Skip to content

uutils-selected 0.9.0#652

Closed
moonfruit wants to merge 1 commit into
mainfrom
bump-uutils-selected-0.9.0
Closed

uutils-selected 0.9.0#652
moonfruit wants to merge 1 commit into
mainfrom
bump-uutils-selected-0.9.0

Conversation

@moonfruit
Copy link
Copy Markdown
Owner

@moonfruit moonfruit commented May 31, 2026

Created with brew bump-formula-pr.

Details

release notes 
### **Rust Coreutils 0.9.0 Release:**

We are excited to announce the release of Rust Coreutils 0.9.0 - a release focused on safety and security. This cycle was shaped by a third-party security audit, driving extensive TOCTOU hardening and a sustained, project-wide effort to shrink the amount of unsafe code by removing it outright and migrating low-level syscalls from nix/libc to rustix. On top of that, we landed major zero-copy I/O performance work (splice/tee/pipe), broadened WebAssembly, Cygwin and Windows support, and continued contributing tests and bug reports upstream to GNU coreutils.




GNU Test Suite Compatibility:






Result
0.8.0
0.9.0
Change 0.8.0 to 0.9.0
% Total 0.8.0
% Total 0.9.0
% Change 0.8.0 to 0.9.0






Pass
630
625
-5
94.74%
90.58%
-4.16%




Skip
14
8
-6
2.11%
1.16%
-0.95%




Fail
21
56
+35
3.16%
8.12%
+4.96%




Error
0
1
+1
0%
0.14%
+0.14%




Total
665
690
+25 (new tests)











Note: The rise in failing tests is due to the upstream GNU test suite being extended, not to regressions on our side. We updated our GNU reference from 9.10 to 9.11 (PR #11922), which added 25 new tests (665 → 690). Many of these newly-introduced tests are not yet passing, which accounts for the jump from 21 to 56 failures; no previously-passing functionality regressed, and work is ongoing to address the new tests.






GNU testsuite evolution




Highlights:


    

  • 

    Security Hardening (Zellic audit)
    

      

    • A third-party security audit by Zellic reviewed the codebase; the findings - widely reported as 44 CVEs (see also the Ubuntu update and the corrode write-up Bugs Rust won't catch) - were concentrated in TOCTOU races and filesystem edge cases that Rust's type system does not prevent
      • 

    • It's worth noting that many of these CVEs are not memory-safety issues but differences in behavior from GNU coreutils that the audit identified; aligning our semantics with GNU resolves them
      • 

    • This release closes many of them: a new TOCTOU-resistant uucore::safe_copy module; TOCTOU fixes in cp, mv, and chmod recursive traversal; rm dot/dotdot path-parsing protection; nohup.out now created with mode 0600; and chroot now resolves all ids before chrooting
      • 

    

    • 

  • 

    Reducing unsafe & migrating to rustix
    

      

    • A sustained, project-wide push to shrink the unsafe surface: dozens of unsafe removals across utilities, tests, fuzz targets and uucore (get_groups, make_fifo, build.rs, and more)
      • 

    • Migration from nix/libc to rustix across id, tr, timeout, sort, wc, tail, cp, who, factor, and core process/IO paths
      • 

    

    • 

  • 

    Performance
    

      

    • splice()/tee()/pipe() fast paths landed across cat, wc, head, tail, yes, cp, tee, and unexpand (e.g. unexpand +7.5%, faster cp from a pipe on Linux, tee via raw syscalls, yes using the tee syscall)
      • 

    • Consolidated in a reworked uucore::pipes / buf_copy
      • 

    

    • 

  • 

    GNU Compatibility & Upstream Collaboration
    

      

    • Reference bumped to GNU 9.11, which extended the suite with 25 new tests (the reason the failure count went up - see the note above; it is not a regression)
      • 

    • We continue to contribute tests and bug reports upstream to GNU coreutils, and our compatibility work keeps surfacing edge cases on both sides
      • 

    • New fixes across numfmt, date, tr, cksum, factor, head, stat, and sort
      • 

    

    • 

  • 

    numfmt Overhaul
    

      

    • Precision handling, rejection of scientific notation, LC_NUMERIC decimal separator, zero-padding for negative numbers, IEC precision cap, large %f values, --to=auto exit code, and multi-byte --suffix width accounting
      • 

    

    • 

  • 

    ls Improvements
    

      

    • ls -lF symlink target indicators, link-count column no longer inflated per-ACL-file, version-sorting and recursive-mode fixes, independent permissions-column width
      • 

    • Refactor letting crate users (e.g. nushell) call ls without writing everything to stdout
      • 

    

    • 

  • 

    Cross-platform Reach
    

      

    • WASI/wasm support for ln, dd, mktemp, and tty.wasm; Cygwin CI and builds (date, stdbuf); Windows tty (incl. msys2 paths); OpenBSD triage improvements
      • 

    

    • 

  • 

    Internationalization
    

      

    • numfmt and du now honor LC_NUMERIC for the decimal separator
      • 

    

    • 

  • 

    Contributions: This release was made possible by 30 new contributors joining our community
    

    • 





Call to Action:


Try it in your browser - Online Playground powered by WebAssembly

Help us translate - Contribute to Rust Coreutils on Weblate

Sponsor us on GitHub to accelerate development: github.com/sponsors/uutils


What's Changed


cat



chroot



cksum



coreutils



cp



date



dd



df



dirname



du



echo



env



expr



factor



fmt



head



id



install



join



ln



logname



ls



md5sum



mkdir



mknod



mktemp



more



mv



nl



nohup



nproc



numfmt



od



paste



pathchk



pinky



pr



realpath



rm



rmdir



shred



sort



split



stat



stdbuf



stty



sum



sync



tail



tee



timeout



touch



tr



tty



unexpand



uniq



uptime



wc



who



yes



uucore



Security

View the full release notes at https://github.com/uutils/coreutils/releases/tag/0.9.0.

@moonfruit moonfruit added the pr-pull Make bottles label May 31, 2026
@github-actions github-actions Bot deleted the bump-uutils-selected-0.9.0 branch May 31, 2026 04:53
@github-actions github-actions Bot closed this in f7caf2f May 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

pr-pull Make bottles

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@moonfruit