Rust 1.98 Tightens the FFI Boundary and Gives Slice Ranges a First-Class Vocabulary

Rust 1.98.0 is now available, and its most practical theme is sharper boundary checking. The release adds compiler lints for runtime-symbol definitions and stabilizes APIs that let developers describe ranges inside strings and slices without manually reconstructing offsets.

The FFI signal is the more security-relevant change. Rust 1.98 adds the deny-by-default invalid_runtime_symbol_definitions lint and the warn-by-default suspicious_runtime_symbol_definitions lint. The initial checks focus on core runtime symbols such as memcmp, memset, and strlen. That matters for projects using custom linkers, embedded targets, or C-compatible interfaces: a declaration that accidentally collides with a runtime symbol can now become a visible build failure instead of a quiet integration hazard.

There is an important limitation. The release notes say the lints currently cover a specific set of core symbols and are expected to expand in later releases. They should therefore be treated as an early safety net, not as comprehensive FFI analysis. Teams should continue reviewing extern declarations, linker configuration, generated bindings, and platform-specific runtime assumptions.

Rust 1.98 also adds the c_void_returns warning lint. It flags uses of core::ffi::c_void as a return type, a pattern that can conceal an ABI mismatch or an underspecified foreign-function contract. The warning does not prove that every flagged function is wrong, but it gives maintainers a targeted place to inspect C and Rust boundary code.

On the library side, str::substr_range and [T]::subslice_range provide range-oriented accessors for strings and slices. Instead of passing a range and then separately reasoning about its position, code can ask for the corresponding range within the original value. This is useful in parsers, tokenizers, diagnostics, and zero-copy transformations where preserving offsets is as important as extracting a view.

The release also stabilizes str::strip_circumfix and its slice counterpart, making paired-prefix-and-suffix removal explicit. For protocol parsers and structured text handling, that can replace repeated checks for both ends of a value while keeping the operation readable.

The upgrade lesson is straightforward: run Rust 1.98 in CI before changing the minimum supported version. The new lints may expose FFI declarations that deserve a manual audit, while the range APIs can simplify code that currently mixes slicing with offset bookkeeping. Rust’s release notes also document compatibility changes, including stricter behavior around some layouts, imports, transmute checks, and rustfmt discovery. Those changes are narrow, but generated code and platform-specific crates should be tested rather than assumed compatible.

Rust 1.98 is not a wholesale redesign of unsafe interoperability. It is a smaller, more useful shift: the compiler starts naming a class of runtime-symbol mistakes, while the standard library gives low-level code better vocabulary for preserving range relationships. For systems developers, that combination makes boundary code easier to inspect before it reaches production.