The CVE that bumped my dependency for me
Three HIGH advisories deep in a Rust dependency tree, a one-line fix that changed nothing, and eleven minor bumps that were never mine to make.
Tags
28 pages
Rust
Parity means doing the opposite
rust-tool-base needed go-tool-base's control over which commands an AI agent may call. Closing the gap meant doing the opposite of what Go did.
One key, or two?
Launching sigillum, a standalone artefact signing and verification CLI, and the Rust signing problem that made it necessary.
The scaffolder that won't hand you code that doesn't compile
A Rust scaffolder with an AI codegen path that drafts a real command, then refuses to hand it over until it compiles and passes lint.
Which CLI library should you start with?
Choosing a CLI library in Go and Rust. Go is a ladder you climb from the standard library; Rust asks a different question much earlier.
A flag is not a setting
Reviewing a scaffolder turned up a command name that quietly conflated two different things. A flag and a setting are not the same object.
Everyone wants Rust's safety, nobody wants Rust
Refereeing the memory-safety retrofit argument from someone who ships framework code in both Rust and Go, and likes them for different reasons.
Three traps release-plz sets for a Rust workspace
Three traps release-plz sets for a Rust workspace, starting with a default tag template that collides the moment you have more than one crate.
Same config, two answers
Publishing a seventeen-crate Rust workspace to crates.io, and why the same release configuration produced two different answers.
From allow_failure to blocking
Turning three advisory CI jobs into real gates once they were trustworthy enough to block a merge, and how to tell when they are.
