rustc-1.77.2 (wait for the next release)

[Bruce Dubbs]

New point version.

[Xi Ruoyao]

Cargo enabled stripping of debuginfo in release builds by default in Rust 1.77.0. However, due to a pre-existing issue, debuginfo stripping does not behave in the expected way on Windows with the MSVC toolchain.

Rust 1.77.1 therefore disables the new Cargo behavior on Windows for targets that use MSVC. There are no changes for other targets. We plan to eventually re-enable debuginfo stripping in release mode in a later Rust release.

[Xi Ruoyao]

As it's not affecting Linux at all, let's skip this version.

[Xi Ruoyao]

1.77.2:

This release includes a fix for CVE-2024-24576.

Before this release, the Rust standard library did not properly escape arguments when invoking batch files (with the bat and cmd extensions) on Windows using the Command API. An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping.

This vulnerability is CRITICAL if you are invoking batch files on Windows with untrusted arguments. No other platform or use is affected.

[Xi Ruoyao]

Hmm, still not affecting us. Note that BLFS rustc configuration does not support cross-compiling for Windoge targets.