FIND-20260329-010 · 2026-03-29 · Innovation Veille

Rust 1.94.1 patch release — Cargo tar CVE fix + wasm32 thread spawn fix

release MEDIUM

Rust 1.94.1 was released on 2026-03-26. This patch release fixes std::thread::spawn on wasm32-wasip1-threads, removes unstable Windows fs methods, and updates Cargo's tar dependency to 0.4.45 to resolve two CVEs in the tar crate. No breaking changes. Previous known version: 1.94.1 (matches — no action needed, already current).

Source

https://github.com/rust-lang/rust/releases/tag/1.94.1

ODS Impact

ODS backend services (billing-engine, oid, pdf-engine, docstore) are written in Rust. The Cargo tar CVE fix affects dependency resolution and package downloads. No functional change to compiled services. CI/CD Rust toolchain should already be on 1.94.1 or later.

Security Review

License: MIT OR Apache-2.0 | Maintenance: ACTIVE | Risk: LOW | Recommendation: SAFE_TO_USE

Rust 1.94.1 patch release — Cargo tar CVE fix + wasm32 thread spawn fix

Source

ODS Impact

Security Review

Tags