Rust 1.96.0 release notes: Security & stability update

Rust 1.96.0 shipped on May 28, 2025. This release focuses on stability and security. It includes backend improvements, bug fixes, and two important CVE patches. The rust 1.96.0 release notes also stabilize several APIs like assert_matches! and introduce new Cargo features for git and registry handling.

This maintenance release is recommended for all Rust developers. It fixes two CVEs in Cargo and brings compatibility changes that may affect cross-compilation workflows. Upgrade to keep your toolchain secure and aligned with the latest Rust standards.

What Changed

Stabilized APIs: assert_matches!, debug_assert_matches!, From<T> for AssertUnwindSafe<T>, From<T> for LazyCell<T, F>, From<T> for LazyLock<T, F>, and several new core::range types.
Language: Allow passing expr metavariable to cfg, always coerce never types in tuple expressions, support s390x vector registers in inline assembly, and allow constants of type ManuallyDrop as patterns (fixing a regression from 1.94.0).
Compiler: Enable link relaxation for LoongArch Linux, update riscv64gc-unknown-fuchsia baseline to RVA22 + vector.
Libraries: Support iterating over ranges of NonZero integers, refactor valid-for-read/write definition to exclude null, fix SGX delayed host lookup via ToSocketAddr.
Cargo: Allow a dependency to specify both a git repository and an alternate registry. Added target.'cfg(..)'.rustdocflags support. Fixed CVE-2026-5222 and CVE-2026-5223.
Rustdoc: Deprecation notes now render like other docs (using standard markdown). Separate methods and associated functions in the sidebar.
Compatibility: Fix layout of #[repr(Int)] enums with uninhabited ZSTs, prevent unsize-coercing into Pin<Foo> without Deref, stop passing --allow-undefined on wasm targets, gate accidentally stabilized #![reexport_test_harness_main], error on too-private RPITITs, report uninhabited_static lint in dependencies, distributed builds now include non-split debuginfo for windows-gnu, remove -Csoft-float, update minimum external LLVM to 21, and change c_double to f32 on AVR targets.

Why It Matters

Maintenance release with no specific user-facing features documented. The focus is on stability and security.

Who Should Upgrade

This release is particularly relevant for Rust developers working on cross-compilation (LoongArch, Fuchsia, AVR) or using inline assembly on s390x. Teams managing Cargo registries or depending on CVE-free tooling should update immediately. Anyone using #[repr(Int)] enums or Pin ergonomics will benefit from the bug fixes.

How to Upgrade

Update your Rust toolchain using rustup: rustup update stable.
Verify the new version: rustc --version should return rustc 1.96.0.
Check for any compatibility warnings in your projects, especially if you use wasm targets, AVR, or custom LLVM configurations.
Review the full release notes for breaking changes related to c_double on AVR or import syntax changes.
For Cargo users, ensure your registry configurations handle the new git+registry support if needed.

Usage Examples

assert_matches! macro: Use the newly stabilized macro for concise match-based assertions in tests. Example: assert_matches!(result, Ok(value)).
NonZero range iteration: Iterate over NonZeroU8 from 1 to 255. No need to unwrap or filter zeros manually.
Cargo dual git/registry: Specify both a git repository and an alternate registry in your Cargo.toml. The git version works locally; the registry version is used on publish.
Rustdoc sidebar changes: Methods and associated functions now appear separately, improving navigation in generated docs.
LazyCell / LazyLock: Use From<T> to initialize a LazyCell directly with a value, avoiding the closure overhead.

Breaking Changes

AVR c_double change: On AVR targets, c_double now maps to f32 to match C’s 32-bit double. This may break FFI code that assumed 64-bit doubles.
Import syntax restriction: Using struct S {}; use S::{self as Other}; is no longer allowed because {self} imports require a module parent.
Multiple attribute precedence: For export_name, link_name, and link_section, the first attribute now takes precedence.
Minimum LLVM version: Rust 1.96.0 requires LLVM 21 or newer for building from source.
-Csoft-float removed: This compiler flag is no longer supported.
wasm target changes: rustc no longer passes --allow-undefined on wasm targets by default.