Predrag Gruevski

@predr.ag

1877 Followers 375 Following

Querying (Almost) Everything // Frontier Systems @ OpenAI // Author of cargo-semver-checks & Trustfall // https://predr.ag/blog // ex Kensho // MIT alum // https://hachyderm.io/@predrag // not from around here 🇲🇰 // he-him

cargo-semver-checks output where the "function now doc hidden" lint is triggered, warning that the "black_box" function in library/core/src/hint.rs is now #[doc(hidden)] and no longer public API. The run took 6.7s total.
All the Rust Project devs posing for a photo at the end of the All Hands. A huge group of people!
Movie poster in the style of the poster for Project Hail Mary, but titled Project Hail Miri with Ferris looming above a striking green planet.
All this was made possible through the funding provided by the Rust Foundation Fellowship Program, Amazon, Rerun, Accelerant, Astral, Zoo, the generous individuals who support my work via GitHub Sponsors, as well as the Google Summer of Code program where I was a mentor. To everyone who makes what I do possible, thank you 🙏
"Total number of lints" is a fun number to look at, but increasingly just a vanity metric. I believe the community will be best served by us tackling some of our long-standing (and most difficult) challenges, instead of trying to chase exponential lint growth by itself. The challenges include: - making ecosystem-level SemVer studies 50x cheaper by the end of 2027, and completing such a run - completing type-checking lints and cross-crate linting capabilities - officially starting the process of merging `cargo-semver-checks` into cargo Full info here: https://predr.ag/blog/cargo-semver-checks-2025-year-in-review/#the-path-forward-for-2026-and-beyond
Table of contents for the blog post - Goal: Fearless `cargo update` - What we shipped in 2025 - 122 new lints is *a lot* - Discovering a soundness bug in Rust - Doubling the lints without doubling the runtime - Why compiling the same Rust program might succeed or fail depending on the current directory - Resolving the edge cases of `#[do - Conference talks and podcast appearances - What it'll take to eradicate unintended breakage from Rust — RustWeek - The Past, Present, and Future of SemVer in Rust — RustForge - Cursed Rust — A Surprise Talk at RustForge - A Universal Query Engine in Rust — Developer Voices - `cargo-semver-checks` — Open Source Security - The path forward for 2026 and beyond - We've already started down this path - What success will require, and how you can help
Screenshot from the cargo-semver-checks 2024 year in review post featuring a diagram of the number of lints at the end of each calendar year. 2022 ended with 30 lints, 2023 ended with 57, 2024 ended with 120 lints. Link to the post: https://predr.ag/blog/cargo-semver-checks-2024-year-in-review/
GitHub Sponsors email stating: "You sponsored @jyn514! Sponsorship amount: $1000 one time"
fn breaks() -> impl Debug + ?Sized { 123 } // error[E0277]: the size for values of type `impl Debug + ?Sized` cannot be known at compilation time // --> src/lib.rs:3:16 // | // 3 | fn breaks() -> impl Debug + ?Sized { // | ^^^^^^^^^^^^^^^^^^^ doesn't have a size known at compile-time // | // = help: the trait `Sized` is not implemented for `impl Debug + ?Sized` // = note: the return type of a function must have a statically known size async fn works() -> impl Debug + ?Sized { 123 } // no error!
Four plots showing a sudden performance collapse as more cores are added. Different workloads collapse at different points: some around 2 cores, others at 10 or 36. But in all cases, running the workload at the full 48 cores is much slower than taking some cores away.
Ferris is standing alongside a conveyor belt which transports crates off an assembly line. Each crate passes through a cargo-semver-checks scanning station, which applies a "PASS" or "FAIL" sticker to it. It seems like a crate has just failed SemVer checking! Ferris picks it off the conveyor belt, and throws it into a hopper labeled "Revise". This is how all crates being shipped uphold SemVer! All is well.
Screenshot of the cargo-semver-check v0.44.0 release page. It touts 22 new lints, for a total of 200 lints! In celebration, it includes an adorable animation of Ferris standing alongside a conveyor belt which transports crates off an assembly line. Each crate passes through a cargo-semver-checks scanning station, which applies a "PASS" or "FAIL" sticker to it. It seems like a crate has just failed SemVer checking! Ferris picks it off the conveyor belt, and throws it into a hopper labeled "Revise". This is how all crates being shipped uphold SemVer! All is well.
impl<S: Clone> Example<'static, S> { pub fn hello<'a, T, const N: usize>() -> impl for<'n> Fn(&'n i64) -> &'n i64 + use<'a, T, S, N> { |x| x } }
70% of memory safety vulnerabilities have a root cause related to memory safety, across studies done by Microsoft, Google Android, Google Chromium, Mozilla, and a general survey of zero-day vulnerabilities. Mozilla's survey of critical security vulnerabilities shows 94% of them were memory safety related.
Speakers James Blackwood-Sewell PGRX - How Rust reshaped the Postgres ecosystem Adam Chalmers Why Rust for startups Meghan Clark Mixed Reality Network Introspection Stephan Dilly Build a Game with Bevy EncodePanda Rust for the Rest of Us: Your Survival Guide Predrag Gruevski The Past, Present, and Future of SemVer in Rust Adam Harvey Crate security in 2025 Azriel Hoh The Development Experience Is Different With Rust Paul Hummer Other People's Code : Domain Specific wasm Elias Junior Tackling complexity a test at a time Steve Klabnik Rust is (much) more than safety Andrey Konstantinov Reflect Your Rust API into the World Jonas Kruckenberg Panic! At The Disk Oh! David Lattimore Wild build times Laura Bell Main AppSec for developers with deadlines Orhun Parmaksız Becoming a terminal chef with Ratatui, Rust rocks (literally) Jack Purvis From Ruby to Rust: building a live visual performance tool with Rust Anders Rasmussen Make your own own smart watch David Sankel Engineering the Future at Adobe: Why Rust is Key to Our Next Chapter Tom Simpson Designing superconducting magnets for fusion power Jeremy Wells Take your web app offline with Rust and Tauri Mikey Williams Rust in color: embedded LED art Ben Wishovich 🦀 cargo new blog: Shipping a Site with Leptos Ross Younger Land of the long fat pipe: the quest for faster file transfers Mix Irving Peer-2-Peer Data Visualisation
v0.43.0 - In this release - Spotlight: I'm giving a talk at Rust Forge! - Performance improvements - 1 new lint, for a total of 178 This release requires Rust 1.87+ both to install (MSRV) and at runtime. Future releases will require Rust 1.88+. Spotlight: I'm giving a talk at Rust Forge! Rust Forge is a creative new conference organized by Rust in Action author Tim McNamara. It's scheduled for 27-30 August 2025 in Wellington, New Zealand. My talk is titled "The Past, Present, and Future of SemVer in Rust" and I'm extremely excited about it! Here's a short description: At least 1-2 times per week, accidental breaking changes sneak into the new release of some popular Rust package, despite the maintainers' best efforts. Why is this still a problem 10 years after Rust 1.0? What will it take to finally stop such breakage, so we can have fearless cargo update? It's not too late to grab a ticket! I hope to see you there!
GitHub publishing pipeline in a failed state. The commit title is "Release v0.23.2 with support for rustdoc JSON v46." The pipeline has stopped immediately prior to the "Publish to crates.io" stage, having failed the job titled "Check for semver compliance."
Niko, Jack, and Tim giving their talk. The slide reads: Conclusions: - Rust Vision Doc aims to give us insight into the state of Rust - We are happy to have help: come be an interviewer, or talk to Niko or Jack
Shiny cargo-semver-checks sticker: stylized orange Ferris (crab) carefully holding up a crate in its pincers and inspecting it closely.
v0.41.0 release of cargo-semver-checks # In this release - 16 new lints, for a total of 164 - Spotlight: Google Summer of Code - Bugfix: false-positive sealed trait lints This release requires Rust 1.84+ both to install (MSRV) and at runtime. Future releases will require Rust 1.85+. # Spotlight: Google Summer of Code `cargo-semver-checks` is participating in Google Summer of Code, a program aimed at bringing new contributors into open source software development. This is our second year participating in the program under the Rust umbrella. Last summer, @suaviloquence joined us to design and build the ability for users to configure which lints run on their projects, on which SemVer changes, and with what effect such as raising an error vs warning. This is a foundational capability for our project! For example, it allows users to temporarily disable a lint that exhibits buggy behavior in their project, such as a false-positive. The application process for this year's Google Summer of Code concluded two weeks ago, and we're currently in the evaluation process. The selected projects will be announced in early May. We thank everyone who applied for their hard work on their proposals, and wish everyone the best of luck!
pub trait Example { unsafe fn demo(&self) {} } pub struct S; impl Example for S { // This isn't applied to the trait's fn! #[target_feature(enable = "avx2,aes")] unsafe fn demo(&self) {} } pub fn accept_dyn(value: &dyn Example) { // SAFETY: umm ??? // Who knows what #[target_feature] // attributes the trait impl has imposed?! unsafe { value.demo() } }
## In this release - 21 new lints, for a total of 148! - Spotlight: `#[doc(hidden)]` and sealed lints This release requires Rust 1.83+ both to install (MSRV) and at runtime. Future releases will require Rust 1.84+. ## Spotlight: `#[doc(hidden)]` and sealed lints When is "this trait can be implemented" part of the trait's public API? At a high level, the answer is: when writing an `impl` of that trait for our own type doesn't require using any `#[doc(hidden)]` items. But you've been following `cargo-semver-checks` long enough to know the *full answer* is much more complex. And getting the right answer here affects the correctness of a ton of lints! Good news! This `cargo-semver-checks` release ships with a much more sophisticated system for analyzing whether traits can be implemented or are instead "sealed." The new system is more thorough, more nuanced, and faster to boot! Read more about it here: https://predr.ag/blog/when-is-trait-can-be-implemented-public-api/
Screenshot of a Bluesky's "followers" list showing I have exactly 1500 followers now.
An example of a "public API sealed" trait is: pub trait Example { #[doc(hidden)] type X; } Any impl of Example outside of its crate must name the Example::X item, and in doing so refer to non-public-API. Therefore, such an impl is outside the public API of Example, and may suffer breakage outside of major version bumps of Example's crate. Crates can be public-API-sealed in many ways, including: - #[doc(hidden)] (without #[deprecated]) on associated types without a default - #[doc(hidden)] (without #[deprecated]) on associated constants without a default value - #[doc(hidden)] (without #[deprecated]) on associated functions / methods without a default implementation - associated functions / methods taking an "importable but not public API" parameter - associated functions / methods returning an "importable but not public API" type "Importable but not public API" means: - The item has at least one path by which it can be imported from an external crate. That path passes through at least one item that is simultaneously #[doc(hidden)] and not #[deprecated], such as the imported item itself, a module, or a re-export). - The item has no paths by which it can be imported such that no item along that path is #[doc(hidden)] and not #[deprecated].
## In this release - 20 new lints, for a total of 127! - Spotlight: Merging into `cargo` This release requires Rust 1.81+ both to install (MSRV) and at runtime. Future releases will require Rust 1.83+. ## Spotlight: Merging into `cargo` While `cargo-semver-checks` is currently a standalone tool, Rust's `cargo` team plans to eventually make it a built-in part of `cargo` itself. Here's how that would work. When users run `cargo publish` today, `cargo` first runs a series of checks to make sure everything is in order. For example, it ensures that the code repository doesn't include any uncommitted changes, so as not to accidentally publish uncommitted code to crates.io: ``` $ cargo publish Updating crates.io index error: 1 files in the working directory contain changes that were not yet committed into git: src/lib.rs to proceed despite this and include the uncommitted changes, pass the `--allow-dirty` flag ``` `cargo-semver-checks` is planned to become another such pre-publish check, equivalent to running `cargo semver-checks && cargo publish` today. Of course, there are situations where maintainers may prefer to *intentionally* publish breaking changes in a non-major version, such as for a sufficiently critical security fix. The automatic semver-check will be overridable by passing a flag analogous to the `--allow-dirty` flag for uncommitted changes. While we're excited to merge `cargo-semver-checks` into `cargo`, we are proceeding with caution before enabling it by default. We want to ensure "merge day" is a day of celebration for the entire Rust community, instead of causing frustration and further breakage! Good news: you can help us do that! Consider: - Reporting any issues you find, including any suspected false-positives with our lints. - Contributing lints to make `cargo-semver-checks` smarter - Funding the project via GitHub Sponsors
A "Where's Waldo" book cover featuring a large crowd of cartoonish people, with Waldo among them in his red and white striped shirt. He's really hard to notice in the crowd, so he's circled to make him easier to find, solving the puzzle.
A change being applied to a Rust Cargo.toml file. An optional dependency called `mock_instant` ("mock underscore instant") is being removed, and a feature called `mock-instant` ("mock dash instant") is changed to no longer enable the `mock_instant` ("mock underscore instant") feature. The problem is a lot more obvious when I make the spelling explicit, isn't it? :)
Release notes screenshot: In this release: - 12 new lints, for a total of 106! - Bugfix for packages using the "SemVer trick" - Spotlight: Performance via parallelism Spotlight: Performance via parallelism cargo-semver-checks is on a trajectory of doubling its number of lints every year. But more lints mean more code scanning work to be done! And nobody likes slow tools, so we had to parallelize! We began taking a serious look at performance in early 2023. Compared to that point ~almost two years ago: - Lint checking time has reduced by 20%, in wall-clock terms & measured on the exact same hardware. - Yet, we run over 2.5x as many lints in that time! We've aimed to parallelize as much of the execution of the tool as possible, with help from the rayon library. Today, both the lint execution and the rustdoc indexing steps use rayon to distribute the work across all available cores on your system. [It continues...]
Rerun.io logo: a 3D-stylized letter "R" in white on a black background.
Breakage in the Cargo.toml — how Rust package features work (and break) cargo-semver-checks v0.37 can now scan `Cargo.toml` files for breakage! In this post: a primer on Rust package features, and how innocuous-looking changes can break your users.
Rust code that relies on conditional compilation to enable or disable "rayon" parallelization. The structure is: - conditionally include a rayon line - otherwise, include a non-rayon line - then do some stuff they have in common - then again conditionally include a rayon line - or include the non-rayon line otherwise - then more stuff in common.
Slide headline: Across the top 1000 crates, 1 to 2 broken new releases happen per week. Below: This is data from running cargo-semver-checks, and is joint work with Tomasz Nowak, Mieszko Grodzicki, Bartosz Smolarczyk, Michał Staniewski More info: https://predr.ag/blog/semver-violations-are-common-better-tooling-is-the-answer/
A magazine addressed to "Mr. and Mrs. Drag Gruevski". My name is Predrag, not Drag!
Predrag, who is the author of cargo-semver-checks and who mentored Max on this project, was very happy with his contributions that even went beyond his original project scope: He designed and built one of our most-requested features, and produced design prototypes of several more features our users would love. He also observed that writing quality CLI and functional tests was hard, so he overhauled our test system to make better tests easier to make. Future work on cargo-semver-checks will be much easier thanks to the work Max put in this summer. Great work, Max!
cargo-semver-checks v0.36.0 What's changed We're debuting a new "Spotlight" section in the release notes! We'll use it to shine a spotlight at aspects of cargo-semver-checks that don't usually get flashy headlines, even though they play a critical role. In this release: - Spotlight: Supporting many Rust versions at once - 5 new lints (94 total, who will add lint number 100?) - Performance upgrades - Support for comma-separated feature lists This release requires Rust 1.77+ both to install (MSRV) and at runtime. Future releases will require Rust 1.80+.
SemVer accidents are expensive: - Maintainers are scrambling to triage, yank, patch, re-publish. - Users are frustrated: "Why fix something I didn't break?!" - Community-level harm: "Don't update unless you have to" Everyone is worse off, at a huge cost to everyone!
Build bigger in less time: code testing beyond the basics. Three techniques: - invariant testing, represented by engineer Ferris - snapshot testing, represented by defender Ferris - deterministic simulation, represented by magician Ferris
Predrag in the middle of his talk, standing in front of a giant "RustConf 2024, Montreal" banner.
I'm speaking at RustConf 2024, 10-13 September in Montreal. Don't miss my talk: "Putting an End to Accidental SemVer-Breaking Changes" Grab your spot today by registering at rustconf.com
In this release: - 10 new lints - performance upgrades - improved bug reporting UX & test infra This release requires Rust 1.77+ both to install (MSRV) and at runtime. New lints: We can now detect whether a trait is sealed or not, unlocking many new lints! "Is this lint sealed" is a tricky question full of edge cases — check out our deep-dive into this feature to learn more: https://predr.ag/blog/is-this-trait-sealed-or-not-sealed/ - trait_newly_sealed - trait_method_added - trait_method_default_impl_removed - trait_associated_type_added - trait_associated_const_added - trait_associated_type_default_removed - trait_associated_const_default_removed - enum_unit_variant_changed_kind - enum_tuple_variant_changed_kind Additionally, we enabled the trait_no_longer_object_safe lint. It was previously implemented but was disabled while awaiting updated Rust functionality.
The cargo-semver-checks package's Cargo.toml file. The dependencies section states that rustdoc JSON format versions 27, 28, 29, 30, 32, and 33 are all supported.
cargo-semver-checks v0.34.0 In this release: - 3 new lints - support for rustdoc format v33 This release requires Rust 1.77+ both to install (MSRV) and at runtime. It also ensures cargo-semver-checks continues to build correctly on Rust 1.80, addressing both the inference-breaking change and the floating-point miscompilation issues in 1.80.0. New lints: - inherent_method_now_doc_hidden by @orblivion in #821 - union_pub_field_now_doc_hidden by @PedroTurik in #844 - union_must_use_added by @PedroTurik in #845
GitHub conversation. A user reports: "I think it is after this PR not possible to do `cargo install cargo-semver-checks --no-default-features` — it fails to compile. Is that expected? I can't find anything about this in release notes" I reply: Oops! 😅 In retrospect, yes, that's a breaking change. I should have called it out in the release notes! I didn't realize it was breaking and @ggwpez might not have noticed it either. The irony of a breaking change linter having an unexpected breaking change is not lost on me 😅 This is why I want cargo-semver-checks lints that can check manifests: https://rust-lang.github.io/rust-project-goals/2024h2/cargo-semver-checks.html
Conference talk slide describing the project structure of a Rust + Python library for simulating electromagnets. Two repos; publish Rust crate and Python lib separately. Off-the-shelf CI: - Rust: release-plz and cargo-semver-checks (SemVer linting reduces downstream debugging at near-zero cost!) - Python: PyO3/maturin, mixed native project One-line build Downsides are fairly minor (duplicating documentation, split repos) When to push features back from Python to Rust? - NOT "when I will save more time in my current workflow than it takes to rewrite" - Workflows change with performance: "What would you do if it were faster, that isn't being done now?" Prototype in Python/numpy (??? hrs), then rewrite it in Rust (15min - 2hrs), then add bindings back to Python (15-45min to write PyO3 Rust glue, ~15min to write symmetric Python bindings)
v0.33.0 In this release: - lint configuration - a new lint - support for rustdoc format v32 This release requires Rust 1.74+ both to install (MSRV) and at runtime. This is the last release to support Rust 1.74-1.76; future releases will require Rust 1.77+. * Lint configuration Thanks to @suaviloquence's hard work as part of our participation in Google Summer of Code, users can now customize the SemVer (major/minor/patch) and severity (error/warn/allow) levels of cargo-semver-checks lints 🎉 While we've already extensively tested this feature, we know that complex new code often reveals surprises when it first faces the real world. Please kindly report any bugs or reach out in the GSoC project's Zulip if you have questions or concerns. Read more about this new feature on @suaviloquence's blog: https://blog.mcarr.one/
Talk page for my talk: "Trustfall: a foundation for next-gen developer tools" We all love using great developer tools! What's stopping us from having even more great tools at our disposal? How can we do better in the future? Through a series of examples from the cargo-semver-checks SemVer linter, this talk will present the challenges dev tools face: correctness, performance, scope, and long-term maintainability. Without careful engineering, these risks are serious enough to derail any project! Then we’ll show how the Trustfall query engine helps cargo-semver-checks overcome these risks.
About 25-30% of the code is `core` and `alloc`. Other big pieces are `toml_edit` and code related to `serde`. Trustfall and its related components are only a few percent of the final binary.
Toy Story "everywhere" meme, with Buzz Lightyear telling Woody: "Edge cases. Edge cases everywhere."
Build bigger in less time: code testing beyond the basics Modern software projects are huge: hundreds of thousands of lines of code across hundreds of dependencies. How do they avoid falling apart due to an endless stream of bugs? The answer: advanced testing techniques — much more than just clippy, unit tests, and end-to-end CI. Better testing allows us to build bigger in less time, while minimizing bug triage and debugging needs. Let’s dig into some of those advanced techniques and see how they power the projects that we use every day!
Changelog Interviews episode #597 MAJOR.SEMVER.PATCH with Predrag Gruevski & Chris Krycho interviewed by Adam and Jerod
Chart showing Nvidia's market cap as a percentage of total US market cap over the years. It crossed 1% near the end of 2022 and has been growing exponentially ever since.
In this release: - 3 new lints - support for rustdoc format v30 - performance improvements This release requires Rust 1.74+ both to install (MSRV) and at runtime. New lints - pub_static_mut_now_immutable by @arpity22 in #768 - trait_associated_type_now_doc_hidden by @arpity22 in #776 - trait_associated_const_now_doc_hidden by @arpity22 in #779
Email from GitHub reads: You have a new sponsor! Microsoft is now sponsoring you for $3000 one time! A note from your new sponsor: Thanks for maintaining your wonderful open source project(s) - from employees at Microsoft.
Merged GitHub pull request titled: "Add next Rust minor to test matrix" It shows a git diff where the GitHub Actions CI file has an updated toolchain matrix, adding another Rust minor version to the list.
I'm speaking at RustConf 2024 (10-13 Sept, Montreal). Don't miss my talk: Putting an End to Accidental SemVer-Breaking Changes
A screenshot of the cargo-semver-checks README floats next to fasterthanlime as he explains his latest project.
GitHub star history chart showing cargo-semver-checks approaching 1000 stars. Currently sitting at 946 and growing steadily.
The file at `tailscale.com/install.sh`. It's a shell script that starts with a comment: # All the code is wrapped in a main function that gets called at the # bottom of the file, so that a truncated partial download doesn't end # up executing half a script.