candid

• Bug fixes:
  • Bound the allocation when reading a length-prefixed byte field in the type-table header. A byte vector (a future type's payload, or a service method's name) previously reserved its full declared length up front, so a length larger than the remaining input requested a correspondingly large allocation instead of failing on the short read. These fields now grow their buffer incrementally, so an out-of-range or truncated length surfaces as an ordinary parse error. The wire format is unchanged and valid messages decode identically.

2026-07-27

• Bug fixes:
  • Fix decoding a vec of fixed-width primitives into newtype elements (e.g. struct EventIndex(u32)), which failed with a spurious subtyping error since 0.10.27. The bulk decode fast path fed each element through serde's value deserializers, which do not implement deserialize_newtype_struct; they now go through a wrapper that forwards it, as the main deserializer does. Nested newtypes are unwrapped recursively.
  • Fix is_human_readable() reporting true for elements of a vec of fixed-width primitives, also since 0.10.27. The bulk decode fast path inherited serde's default from the same value deserializers, so a Deserialize impl that branches on it took its human-readable path inside a vec while taking the binary path everywhere else, silently decoding to a different value with no error. It now reports false for the whole decoder, as candid is a binary format.

• Breaking changes:

  • Migrated from the deprecated binread crate to its successor binrw. The types in the candid::binary_parser module (Header, PrincipalBytes, Len, BoolValue) now implement binrw::BinRead instead of binread::BinRead, and From<binread::Error> for candid::Error is replaced by From<binrw::Error>.

    Released as a patch rather than a minor bump because the affected surface is limited to those trait impls. binary_parser is an internal wire-format parsing module that is pub only incidentally — it is used nowhere outside candid's own deserializer, and it is now #[doc(hidden)] to say so. Code is affected only if it depends on binread directly and names these impls; the wire format, decoder error messages, byte offsets, type layouts, and all function signatures are unchanged, so the worst case is a compile error rather than a behaviour change.

• Non-breaking changes:

  • Decoding is faster as a side effect of the binrw migration, which drops binread's debug_template codegen: up to 37% fewer instructions on variant-heavy payloads (multi_arg −36.6%, result_variant −10.3%, large_variant −9.5%, subtype_decode −8.0%, double_option −7.0%), with no regressions.
  • Dropped the duplicate syn 1.x dependency tree that binread_derive pinned (along with rustversion).
  • A future unrecognized binrw::Error variant now degrades to a label-less error instead of panicking, since binrw::Error is #[non_exhaustive] and decoding runs on untrusted input.

2026-07-06

• Non-breaking changes:
  • A service reference now decodes where a principal is expected: service <actortype> is a subtype of principal (spec addition: service <: principal, modelled analogously to nat <: int). The subtype checker and the deserializer accept a service reference at type principal; the two share an identical wire encoding, so the coercion is the identity on the reference. The reverse (a principal at a service type) remains rejected.

2026-07-03

• Non-breaking changes:
  • Encode and decode large Nat/Int values in linear time. Values beyond the u64/i64 fast path were previously processed one LEB128/SLEB128 group at a time, shifting the whole bignum on every byte (O(n²) in the encoded length); they now build the value in a single O(n) pass.

• Non-breaking changes:
  • Add pretty::utils::sep_enclose and sep_enclose_space: list/tuple pretty-printing combinators that separate items and enclose them in delimiters, emitting a trailing separator on multi-line layouts.
  • Add TypeEnv::to_sorted_iter() to iterate bindings in a deterministic, key-sorted order.

• Bug fixes:
  • Fix text_fast_path leakage between nested maps: an inner map with non-text keys would fail with a "Type mismatch" error when enclosed in an outer map with text keys

2026-05-20

• Bug fixes:
  • Fix LEB128/SLEB128 fast path silently truncating Nat/Int values near the u64/i64 boundary during decoding
  • Fix Int::decode truncating large magnitudes due to fast-path leakage

• Non-breaking changes:
  • Add subtype_check_all() to collect all subtype errors in one pass (previously stopped at the first)
  • Add Incompatibility type and format_report() for structured, hierarchical error reporting

2026-03-18

• Bug fixes:
  • Fix decoding failure when a trailing argument is a primitive vector

2026-03-16

• Non-breaking changes:
  • Preserve Rust doc comments on exported Candid types, record fields, and variant members when generating .did files via #[derive(CandidType)]

2026-02-27

• Non-breaking changes:
  • Implement DataSize for Principal, enabling Principal as an element type in BoundedVec

2026-02-20

• Non-breaking changes:
  • Add BoundedVec type to candid::types::bounded_vec for bounding a vector by number of elements, total data size, and per-element data size during deserialization

2026-02-10

• Non-breaking changes:
  • Enhance recursion guard
    • Use target_family = "wasm" for platform detection to cover both wasm32 and wasm64; skip recursion check on wasm (sandboxed), use stack-based check on native platforms and a conservative depth limit on other niche platforms
    • Apply recursion guard to all recursive functions on deserialization path: type environment operations (TypeEnv::is_empty, trace_type, rec_find_type, as_func, as_service), value type annotation (IDLValue::annotate_type), subtype checking (subtype_(), equal()), and all deserializer methods (deserialize_option, deserialize_seq, deserialize_map, deserialize_tuple, deserialize_tuple_struct, deserialize_struct, deserialize_enum)
    • Refactor to use RAII guard pattern (RecursionDepth with DepthGuard) for automatic depth management, eliminating manual increment/decrement operations

2026-02-03

• Non-breaking changes:
  • Add max_type_len to DecoderConfig to configure the type table size limit (default: 10,000) during binary parsing.

2026-01-09

• Non-breaking changes:
  • fix: subtyping and coercion rules for optional types
  • fix: coercion of values into nested optional types
  • fix: values of types reserved at any context do not coerce into values of type null
  • fix: missing record fields of type null in the textual format are decoded into a default value

• Non-breaking changes:
  • Fixes a compatibility issue with serde v1.0.220 and later.

2025-09-03

• Non-breaking changes:
  • Implement serde::Serialize and PartialOrd, Ord, Hash for the Reserved type.

2025-08-04

• Non-breaking changes:
  • Fixes a regression in pretty printing when concatenating an empty list of documents

2025-07-29

• Non-breaking changes:
  • Makes the warning message for the special opt subtyping rule more explicit in the candid::types::subtype::subtype and candid::types::subtype::subtype_with_config functions.
  • Added pp_label_raw in pretty::candid module.

• Add a series of decoder functions which provide convenience for ic-cdk macros usage.

2025-01-22

• Add ArgumentEncoder::encode_ref, utils::{write_args, encode_args} that don't consume the value when encoding.

2025-01-15

• Implement CandidType for std::marker::PhantomData.

2024-12-10

• Add IDLBuilder.try_reserve_value_serializer_capacity() to reserve capacity before serializing a large amount of data.

2024-05-03

• Add candid::MotokoResult type. Use motoko_result.into_result() to convert the value into Rust result, and rust_result.into() to get Motoko result.

• Switch HashMap to BTreeMap in serialization and T::ty(). This leads to around 20% perf improvement for serializing complicated types.
• Disable memoization for unrolled types in serialization to save cycle cost. In some cases, type table can get slightly larger, but it's worth the trade off.
• Fix bug in text_size
• Fix decoding cost calculation overflow
• Fix length check in decoding principal type
• Implement CandidType for serde_bytes::ByteArray
• Add pretty::candid::pp_init_args function to pretty print init args

2024-02-27

• Support #[serde(rename = "")] with arbitrary string.
• Fix a performance bug in the type table parsing.
• Allow setting decoding quota for deserialization with the following new functions: candid::decode_args_with_config, candid::utils::decode_args_with_config_debug, candid::decode_one_with_config, candid::Decode!([config]; &bytes, T), candid::Decode!(@Debug [config]; &bytes, T), IDLArgs::from_bytes_with_types_with_config and IDLArgs::from_bytes_with_config. The original decoding method remains to be non-metered.

• Fix parser when converting vec { number } into blob type.

• Fix display IDLValue::Blob to allow "\n\t" in ascii characters.

• Add candid::types::value::try_from_candid_type to convert Rust type to IDLValue.
• Display IDLValue::Blob in ascii character only when the whole blob are ascii characters.

• Implement CandidType for std::cmp::Reverse.
• Rust codegen: add pub for struct fields.
• Fix merge_init_types and instantiate_candid when the main actor refers to a variable.