When Microsoft's developers and engineers sit down to code, they can now choose to work in Rust, which Redmond has added to its list of canonical languages. “Rust now is a Tier One language at Microsoft, and that just means that it sits among C++, C# and TypeScript as the best supported languages for internal development in the company,” explained Victor Ciura, Microsoft principal engineer for the Rust tooling team, during a keynote talk today at this year’s annual RustConf, being held this week in Montréal. Ciura said Microsoft has “paved a path” of tools and processes that support local Rust development across the entire software development lifecycle. Rust is no stranger at Microsoft and is already present in over 100 Microsoft project repositories. The company has built Oxidizer, a set of crates to build scalable services in Rust, which have been used to build and refine the Microsoft 365 (M365) core services such as Outlook, Word, Excel, OneDrive, and SharePoint. The Copilot tech stack also owes quite a bit to Rust. But the really messy work still lies ahead. Given the recent Windows Patch Tuesday patch deluge, no doubt one of the largest uses for Rust will be shoring up leaky C/C++ Windows code. This is the work Rust was made for. Mozilla developer Graydon Hoare created Rust as a side project in 2006 chiefly as a high-performance language that, unlike C and C++, guarded against memory bugs. Rewriting programs in Rust to improve performance and minimize bugs has since become a common chore for project leaders, who have Rustified everything from databases to package managers, often with the help of AI. New digs Redmond has already done considerable work making Rust comfy on Microsoft Visual C++ (MSVC), its native platform for compiling Windows binaries. Notably, company engineers built rustc_codegen_utc, a custom Rust compiler code-generation backend that wires the rustc compiler directly into MSVC’s internal toolchain for Windows. “Connecting rustc to that backend lets Rust build on the same platform investment, with perfect compatibility out of the box, rather than requiring a parallel implementation of every Windows-specific capability,” wrote Ciura in a blog post that details Redmond's rusty efforts. “The result is a unified code generation platform for Rust and C++ on Windows.” Dangling pointers and foreign code Even with the tight Rust integration, Microsoft engineers will have their work cut out for them. One of the recurring themes of this year’s RustConf is grappling with the dangerous “unsafe” territory that comes when mixing Rust and C++ code. While the Rust compiler can flag memory errors, it typically doesn’t cover pointers into the C++ memory allocations. Still, Redmond running towards Rust is a welcome development. In his 2025 RustConf keynote, Microsoft Azure CTO Mark Russinovich noted that ~70 percent of Windows CVEs are memory issues. “One of the things that I realized a long time ago is that no matter how much we really want to make C and C++ better, we can't make it as good as what Rust starts with," he said. ®
Tailwind CSS may still be open source, but it’s not independent anymore: It’s now a Shopify product. Tailwind Labs CEO Adam Wathan shared news of Shopify’s acquisition of his company in a blog post Thursday. Wathan said that he chose to sell to Shopify because the ecommerce platform was an early adopter of Tailwind CSS, and will serve as an ideal place for his open-source web development platform to “be developed in service of a real product.” “I believe deeply in Shopify's mission to help more people start, run, and grow their own business,” Wathan added. “Tailwind is a very important part of the stack at Shopify, and they're invested in making sure it's actively maintained and continues to improve and adapt for how the ways we build are changing.” For those unfamiliar with Tailwind CSS, it’s an open source framework that simplifies web development by providing utility classes that can be applied directly to elements in HTML documents. Traditional CSS, on the other hand, often involves maintaining separate stylesheets containing rules that are applied to HTML elements. It’s a useful tool, and one that’s installed over 110 million times a week, per Wathan, if you can believe that. But as we've seen several times, the rise of AI is making it hard for the platform's overlords to make ends meet. Wathan said in January that AI coding tools had started eating into Tailwind Labs' bottom line to the degree that he was forced to lay off three employees. He blamed the fact that vibe coding tools have begun to come between his product and potential customers, causing traffic to plummet and income to dry up. So Shopify has come to the rescue to save Tailwind CSS from languishing in maintenance hell like other open source projects. “We're joining Shopify to give Tailwind a stable long-term home where it will be actively maintained for the millions of people who depend on it,” Wathan explained in his blog post. The precise details depend on what type of Tailwind CSS user you are. “Nothing changes with Tailwind CSS or any of our other open-source projects,” Wathan said. “Everything will always be MIT-licensed, and our team will continue to lead and maintain these projects for the community with the support of Shopify.” But users of Tailwind’s premium services might find things changing, as Wathan said his team will no longer be trying to grow the business. That means Tailwind Plus, the company’s paid, UI-based package of templates and other tools, and ui.sh, Tailwind’s package of AI skills designed to help non-coders build user interfaces, are going the way of the dodo. “We're closing sign ups for new customers to focus on Tailwind CSS at Shopify,” Wathan explained. Existing customers who’ve paid for access to those tools and other paid Tailwind Labs offerings will still have access, Wathan stressed. We reached out to get more details on future support for those paid products, and will update this post if we hear back. ®
The popular JavaScript package manager pnpm, already known for its speedy downloads, has further cut installation times by up to 90 percent thanks to a complete rewrite in Rust. Yet the freshly released version 12 of pnpm should not cause consternation while upgrading, its maintainer says. “Upgrading should not feel like a migration. The commands, flags, settings, and lockfile format of pnpm 11 all carry over, and the documentation covers both versions,” wrote Zoltan Kochan, the current lead maintainer of pnpm. In the project’s own benchmarks, pnpm 12 installed a sample uncached package in 5.19 seconds, compared to the 8.22 seconds pnpm 11 required and the 47.7 seconds npm itself required. The project team also built a registry server in Rust, called pnpr, which improves performance even further. In the above test, the installation took only 3.37 seconds with pnpr on the backend. A new Rust core binary, on which work started in April, eliminates a lot of the overhead that comes from routing filesystem work through Node.js. This new version is 65.9 percent Rust and 33.5 percent TypeScript, according to the GitHub stats. “Package installation is dominated by fetching metadata and tarballs, unpacking files, resolving dependency graphs, and linking packages into node_modules, making it a natural target for native code and parallelism,” wrote Sarah Gooding, vice president of communications for security provider Socket, in a blog post. Gooding also noted that the project benchmarked pnpm against Bun and Yarn, but the results were removed due to testing SNAFUs. Nonetheless, she noted the software cut install times by up to 90 percent in some cases. A faster npm Developer Rico Sta. Cruz originally created pnpm in 2016 as a faster alternative to npm (Node Package Manager), JavaScript’s de facto package manager, which devs used to find and download libraries and tools. GitHub acquired the open source npm software and repository in 2020. Npm garnered a reputation for being both sluggish and hungry for disk space, thanks to its generous practice of downloading all needed dependencies onto users’ machines, regardless of whether they were duplicates. Pnpm’s secret sauce is content-addressable storage. If you need a single library for 100 different applications, pnpm downloads it only once, and downloads another copy only if the developer specifies a different version. Like npm, pnpm still draws from the official npm repository, but arguably works better than npm for many. Many devs also like that the lockfile describing the package’s dependency tree was more readable thanks to its use of YAML. The 2025 State of JavaScript survey showed that pnpm was by far the most popular package manager for JavaScript monorepos, a party that also included Nx, Lerna, Yalc, Turborepo and even npm’s built-in Workspaces. About 38 percent (3,840) of 10,251 surveyed developers used the package manager. Rust for JavaScript Rewriting applications in Rust seems to be a favorite activity these days, as the language is known for speedy performance unhampered by garbage collection. In the Web app ecosystem alone, the Bun framework just got an AI-fueled Rust makeover, Tailwind CSS version 4 got a new Rust engine called Oxide, and the Vite framework now speeds along thanks to a Rust-built JavaScript bundler called Rolldown. “It is a bit of [an] indictment on Node for having poor dx” (developer experience), wrote Darcy Clarke, CEO of JavaScript package management platform provider vlt, in an X message, about the Rust rewrite of pnpm. “It was faster to rewrite pnpm in rust than to migrate to esm” (ECMAScript modules), replied pnpm's Kochan, agreeing with Clarke’s sentiment. The software’s GitHub page still points at the last major release, pnpm 11.25, so existing users will have to update to the v12 branch specifically (“pnpm self-update next-12” will get you there). ®
Microsoft is set to launch the next iteration of C# this November. Redmond recently unveiled a preview of C# 15 that introduces tighter restrictions on data types alongside enhanced memory safety protections. Perhaps the most frequently requested feature that arrives with this release is union types. Union types are not new to programming. Python, Scala and TypeScript all recognize the concept. But with C#, “This is how unions should be,” boasted C# lead designer Mads Torgersen in an introductory talk earlier this year. In a nutshell, union types provide a way to categorize different custom data types into a single entity. The union keyword can unite a collection of custom data types (“Dog,” “Cat,” and “Bird”) as a single umbrella type, such as “Pet.” The union keyword gives the compiler a definitive list of “pets,” which can’t be expanded. “Unions enable designs that traditional hierarchies can’t express, composing any combination of existing types into a single, compiler-verified contract,” explained the Microsoft documentation. Upsides for developers include better pattern matching, the ability to write custom functions for union types, protection against rogue data types, stronger abstractions, and less writing of boilerplate error code. In his talk, Torgersen, along with Microsoft principal engineer Dustin Campbell, demonstrated how a union could consolidate two different records for designating the success or failure of an input stream over a network. They presented two separate record types: one indicating success using an integer, the other a standard text error message. By grouping them using the union keyword, they created a single switch expression to parse the results. Without this shortcut, they would have had to add an error message to their switch statement to handle unknown input, create a wrapper (which would have used more memory and probably would have been buggier), or deploy a third-party library to parse the results. While allowable data types are restricted in unions, another new C# 15 feature, closed hierarchies, brings similar control to inherited derived types. The base class uses the closed keyword to limit direct inheritance strictly to derived types defined within the same assembly. Closed hierarchies will block third-party subtypes from being compiled, which would otherwise probably spawn errors. Expanding the danger zone C# is also expanding the scope of defining operations designated by the dev as unsafe. Originally, a code block tagged with "unsafe" just alerted the compiler that it interacts with memory in potentially unsavory ways. Now, the keyword’s scope has been expanded to “inform callers that they have obligations that must be discharged to maintain safety,” wrote Microsoft Product Manager Richard Lander in a blog post earlier this year The expanded scope will give the compiler the ability to flag unsafe operations. The effort follows the lead of Rust and Swift, where the keyword is ruled by “stricter, propagation-oriented semantics,” Lander wrote. Other new C# 15 features include “collection expression arguments,” which allow the developer to pass parameters—such as capacities or comparers—directly to the underlying collection's constructor within the collection expression syntax, using the with keyword. Developers can now declare indexers in an extension block, as well as add labels to break and continue statements for greater control through nested loops. It's noteworthy that C# still persists even as Redmond's priorities have shifted from selling Windows and Office licenses to selling cloud subscriptions and packing its AI Copilot assistant into every corner. Originally created by Anders Hejlsberg, Microsoft first released it in 2002 as an alternative to Java that could run on the company’s then-new .Net platform for Windows. C# would go on to pioneer new capabilities for programming languages, such as the async synchronization capabilities, as well as the LINQ interface for querying databases and other data sources. Fast forward more than 20 years, and Microsoft is still updating the language on the regular. To test C# 15, download a preview of .NET 11. ®
A practical checklist for the Azure DevOps MCP flaw that lets hidden PR comments hijack AI coding agents, plus the configuration changes to make right now.
Login
