logo

lexical-core version 1.0.0 released - Major Security Updates

52 points ialex32_2
View on Reddit ↗

I just published v1.0.0 of lexical-core, a high-performance numeric parsing and writing crate. It's been widely used, and there have been some soundness issues that were discovered so after a long, mental health break from open source work, I went over every line of code, removed unsafe code wherever possible, made safety invariants much stronger, and refactored some code to avoid use of unsafety when possible.

This also includes a few correctness issues in parsing integers (this did not affect floating point numbers).

For example, the number of unsafe functions dropped from 160 to 8 in this release. A huge shoutout to the Rust team, since a lot of the work to keep performance included code changes that would have created prohitively poor performance in previous versions of rustc.

I've also added in contact points for security updates privately email in the hopes of mitigating this in the future. If any well-respected member of the community also would like to have access to both the crates.io repositories and the Github repository as a contingency plan or to review PRs, feel free to reach out to me via email (ahuszagh@gmail.com). No pressure for involvement: just having someone who would be willing to yank crates in case of a major security vulnerability if I'm unavailable would be more than enough.

Anyway, in 1 week I will be yanking every possibly vulnerable crate version published, which because I simply do not have the time to do comprehensive analysis of when unsound code may have been introduced, means every pre-1.0 (v7.0 for lexical, v1.0 for lexical-core) published version.

If you're using lexical, update now and please report any bugs. We have comprehensive testing including fuzzing as part of our PR process, 4 hour+ long UB detection via Miri for significant changes involving unsoundness, and running the test suite via Valgrind.

A few breaking changes were made:

  • There's no longer an unsafe API, at all. Which is fitting.
  • 2 features ("safe" and "nightly", which were no longer relevant) were removed.
  • The MSRV is 1.63.0

Other than that, everything is fully backwards compatible. The full changelog can be found as part of the release.