Skip to content

chore(deps): update rust crate uucore to 0.9.0#425

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/uucore-0.x
Open

chore(deps): update rust crate uucore to 0.9.0#425
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/uucore-0.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Oct 25, 2025

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
uucore (source) workspace.dependencies minor 0.2.20.9.0

Release Notes

uutils/coreutils (uucore)

v0.9.0

Compare Source

Rust Coreutils 0.9.0 Release:

We are excited to announce the release of Rust Coreutils 0.9.0 - a release focused on safety and security. This cycle was shaped by a third-party security audit, driving extensive TOCTOU hardening and a sustained, project-wide effort to shrink the amount of unsafe code by removing it outright and migrating low-level syscalls from nix/libc to rustix. On top of that, we landed major zero-copy I/O performance work (splice/tee/pipe), broadened WebAssembly, Cygwin and Windows support, and continued contributing tests and bug reports upstream to GNU coreutils.


GNU Test Suite Compatibility:
Result 0.8.0 0.9.0 Change 0.8.0 to 0.9.0 % Total 0.8.0 % Total 0.9.0 % Change 0.8.0 to 0.9.0
Pass 630 625 -5 94.74% 90.58% -4.16%
Skip 14 8 -6 2.11% 1.16% -0.95%
Fail 21 56 +35 3.16% 8.12% +4.96%
Error 0 1 +1 0% 0.14% +0.14%
Total 665 690 +25 (new tests)

Note: The rise in failing tests is due to the upstream GNU test suite being extended, not to regressions on our side. We updated our GNU reference from 9.10 to 9.11 (PR #​11922), which added 25 new tests (665 → 690). Many of these newly-introduced tests are not yet passing, which accounts for the jump from 21 to 56 failures; no previously-passing functionality regressed, and work is ongoing to address the new tests.


GNU testsuite evolution


Highlights:
  • Security Hardening (Zellic audit)

    • A third-party security audit by Zellic reviewed the codebase; the findings - widely reported as 44 CVEs (see also the Ubuntu update and the corrode write-up Bugs Rust won't catch) - were concentrated in TOCTOU races and filesystem edge cases that Rust's type system does not prevent
    • It's worth noting that many of these CVEs are not memory-safety issues but differences in behavior from GNU coreutils that the audit identified; aligning our semantics with GNU resolves them
    • This release closes many of them: a new TOCTOU-resistant uucore::safe_copy module; TOCTOU fixes in cp, mv, and chmod recursive traversal; rm dot/dotdot path-parsing protection; nohup.out now created with mode 0600; and chroot now resolves all ids before chrooting
  • Reducing unsafe & migrating to rustix

    • A sustained, project-wide push to shrink the unsafe surface: dozens of unsafe removals across utilities, tests, fuzz targets and uucore (get_groups, make_fifo, build.rs, and more)
    • Migration from nix/libc to rustix across id, tr, timeout, sort, wc, tail, cp, who, factor, and core process/IO paths
  • Performance

    • splice()/tee()/pipe() fast paths landed across cat, wc, head, tail, yes, cp, tee, and unexpand (e.g. unexpand +7.5%, faster cp from a pipe on Linux, tee via raw syscalls, yes using the tee syscall)
    • Consolidated in a reworked uucore::pipes / buf_copy
  • GNU Compatibility & Upstream Collaboration

    • Reference bumped to GNU 9.11, which extended the suite with 25 new tests (the reason the failure count went up - see the note above; it is not a regression)
    • We continue to contribute tests and bug reports upstream to GNU coreutils, and our compatibility work keeps surfacing edge cases on both sides
    • New fixes across numfmt, date, tr, cksum, factor, head, stat, and sort
  • numfmt Overhaul

    • Precision handling, rejection of scientific notation, LC_NUMERIC decimal separator, zero-padding for negative numbers, IEC precision cap, large %f values, --to=auto exit code, and multi-byte --suffix width accounting
  • ls Improvements

    • ls -lF symlink target indicators, link-count column no longer inflated per-ACL-file, version-sorting and recursive-mode fixes, independent permissions-column width
    • Refactor letting crate users (e.g. nushell) call ls without writing everything to stdout
  • Cross-platform Reach

    • WASI/wasm support for ln, dd, mktemp, and tty.wasm; Cygwin CI and builds (date, stdbuf); Windows tty (incl. msys2 paths); OpenBSD triage improvements
  • Internationalization

    • numfmt and du now honor LC_NUMERIC for the decimal separator
  • Contributions: This release was made possible by 30 new contributors joining our community


Call to Action:

Try it in your browser - Online Playground powered by WebAssembly
Help us translate - Contribute to Rust Coreutils on Weblate
Sponsor us on GitHub to accelerate development: github.com/sponsors/uutils

What's Changed

cat

chroot

cksum

coreutils

cp

date

dd

df

dirname

du

echo

env

expr

factor

fmt

head

id

install

join

ln

logname

ls

md5sum

mkdir

mknod

mktemp

more

mv

nl

nohup

nproc

numfmt

od

paste

pathchk

pinky

pr

realpath

rm

rmdir

shred

sort

split

stat

stdbuf

stty

sum

sync

tail

tee

timeout

touch

tr

tty

unexpand

uniq

uptime

wc

who

yes

uucore

Security

Code Quality & Cleanup

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot force-pushed the renovate/uucore-0.x branch from fd1700b to 25c0b8f Compare November 10, 2025 18:31
@renovate renovate Bot changed the title chore(deps): update rust crate uucore to 0.3.0 chore(deps): update rust crate uucore to 0.4.0 Nov 10, 2025
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch 2 times, most recently from 2930430 to 67c997e Compare November 11, 2025 08:06
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch 2 times, most recently from 124b928 to 55a2775 Compare December 14, 2025 12:59
@renovate renovate Bot changed the title chore(deps): update rust crate uucore to 0.4.0 chore(deps): update rust crate uucore to 0.5.0 Dec 14, 2025
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch from 55a2775 to 00842dc Compare December 14, 2025 13:34
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch from 00842dc to 806c5ed Compare December 31, 2025 15:39
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch 2 times, most recently from 42864da to 7dba408 Compare February 3, 2026 10:36
@renovate renovate Bot changed the title chore(deps): update rust crate uucore to 0.5.0 chore(deps): update rust crate uucore to 0.6.0 Feb 3, 2026
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch from 7dba408 to c27c0ea Compare February 3, 2026 12:32
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch 2 times, most recently from 8e0bb55 to 80c5674 Compare February 14, 2026 06:16
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch from 80c5674 to b1ec4e6 Compare February 25, 2026 10:58
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch from b1ec4e6 to 1a14011 Compare March 9, 2026 18:14
@renovate renovate Bot changed the title chore(deps): update rust crate uucore to 0.6.0 chore(deps): update rust crate uucore to 0.7.0 Mar 9, 2026
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch 4 times, most recently from a1e3c8a to b3195d7 Compare March 13, 2026 13:17
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch from b3195d7 to f0c15fe Compare March 28, 2026 06:17
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch from f0c15fe to 58943fa Compare April 6, 2026 22:01
@renovate renovate Bot changed the title chore(deps): update rust crate uucore to 0.7.0 chore(deps): update rust crate uucore to 0.8.0 Apr 6, 2026
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch from 58943fa to 748cd74 Compare April 7, 2026 05:19
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch 3 times, most recently from 12014ff to dde4666 Compare May 18, 2026 10:38
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch from dde4666 to d891017 Compare May 31, 2026 01:40
@renovate renovate Bot changed the title chore(deps): update rust crate uucore to 0.8.0 chore(deps): update rust crate uucore to 0.9.0 May 31, 2026
@renovate renovate Bot force-pushed the renovate/uucore-0.x branch from d891017 to 6d7c1aa Compare May 31, 2026 08:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants