• Bug fixes:
  • Scope the decode fast paths of a map to their own half of an entry, so a map entry's key and value each decode under their own declared type. deserialize_map derives a big-integer fast path from the map's value type and a text fast path from its key type; each previously stayed active for the whole entry. The big-integer path is now cleared for the duration of the key and restored for the value, the text path is cleared for the duration of the value, and the value's expected and wire types are re-established on every entry. Each half of an entry therefore goes through its own type's entry point, keeping its own encoding (SLEB128 for int, LEB128 for nat) and its own subtype check, for every combination of key and value type — including a value whose type shares an encoding with the key's, such as blob against text. The wire format is unchanged, and entries whose key and value types agree decode identically.
  • Share the undecoded argument queue behind a reference count. The option/backtracking path snapshots the deserializer to restore on a subtype mismatch, which previously copied the whole queue of remaining arguments on every present opt. The queue is only mutated at the top level, so it is now shared rather than copied and the snapshot is a refcount bump. Skipping many present optional arguments is no longer superlinear in the argument count; the decode result is unchanged.

2026-08-14

• Bug fixes:
  • Bound the allocation when reading a length-prefixed byte field in the type-table header. A byte vector (a future type's payload, or a service method's name) previously reserved its full declared length up front, so a length larger than the remaining input requested a correspondingly large allocation instead of failing on the short read. These fields now grow their buffer incrementally, so an out-of-range or truncated length surfaces as an ordinary parse error. The wire format is unchanged and valid messages decode identically.

2026-07-27

• Bug fixes:
  • Fix decoding a vec of fixed-width primitives into newtype elements (e.g. struct EventIndex(u32)), which failed with a spurious subtyping error since 0.10.27. The bulk decode fast path fed each element through serde's value deserializers, which do not implement deserialize_newtype_struct; they now go through a wrapper that forwards it, as the main deserializer does. Nested newtypes are unwrapped recursively.
  • Fix is_human_readable() reporting true for elements of a vec of fixed-width primitives, also since 0.10.27. The bulk decode fast path inherited serde's default from the same value deserializers, so a Deserialize impl that branches on it took its human-readable path inside a vec while taking the binary path everywhere else, silently decoding to a different value with no error. It now reports false for the whole decoder, as candid is a binary format.

• Breaking changes:

  • Migrated from the deprecated binread crate to its successor binrw. The types in the candid::binary_parser module (Header, PrincipalBytes, Len, BoolValue) now implement binrw::BinRead instead of binread::BinRead, and From<binread::Error> for candid::Error is replaced by From<binrw::Error>.

    Released as a patch rather than a minor bump because the affected surface is limited to those trait impls. binary_parser is an internal wire-format parsing module that is pub only incidentally — it is used nowhere outside candid's own deserializer, and it is now #[doc(hidden)] to say so. Code is affected only if it depends on binread directly and names these impls; the wire format, decoder error messages, byte offsets, type layouts, and all function signatures are unchanged, so the worst case is a compile error rather than a behaviour change.

• Non-breaking changes:

  • Decoding is faster as a side effect of the binrw migration, which drops binread's debug_template codegen: up to 37% fewer instructions on variant-heavy payloads (multi_arg −36.6%, result_variant −10.3%, large_variant −9.5%, subtype_decode −8.0%, double_option −7.0%), with no regressions.
  • Dropped the duplicate syn 1.x dependency tree that binread_derive pinned (along with rustversion).
  • A future unrecognized binrw::Error variant now degrades to a label-less error instead of panicking, since binrw::Error is #[non_exhaustive] and decoding runs on untrusted input.

2026-07-06

• Non-breaking changes:
  • A service reference now decodes where a principal is expected: service <actortype> is a subtype of principal (spec addition: service <: principal, modelled analogously to nat <: int). The subtype checker and the deserializer accept a service reference at type principal; the two share an identical wire encoding, so the coercion is the identity on the reference. The reverse (a principal at a service type) remains rejected.

2026-07-03

• Non-breaking changes:
  • Encode and decode large Nat/Int values in linear time. Values beyond the u64/i64 fast path were previously processed one LEB128/SLEB128 group at a time, shifting the whole bignum on every byte (O(n²) in the encoded length); they now build the value in a single O(n) pass.

• Non-breaking changes:
  • Add pretty::utils::sep_enclose and sep_enclose_space: list/tuple pretty-printing combinators that separate items and enclose them in delimiters, emitting a trailing separator on multi-line layouts.
  • Add TypeEnv::to_sorted_iter() to iterate bindings in a deterministic, key-sorted order.

• Bug fixes:
  • Fix text_fast_path leakage between nested maps: an inner map with non-text keys would fail with a "Type mismatch" error when enclosed in an outer map with text keys

2026-05-20

• Bug fixes:
  • Fix LEB128/SLEB128 fast path silently truncating Nat/Int values near the u64/i64 boundary during decoding
  • Fix Int::decode truncating large magnitudes due to fast-path leakage

• Non-breaking changes:
  • Add subtype_check_all() to collect all subtype errors in one pass (previously stopped at the first)
  • Add Incompatibility type and format_report() for structured, hierarchical error reporting

2026-03-18

• Bug fixes:
  • Fix decoding failure when a trailing argument is a primitive vector

2026-03-16

• Non-breaking changes:
  • Preserve Rust doc comments on exported Candid types, record fields, and variant members when generating .did files via #[derive(CandidType)]

2026-02-27

• Non-breaking changes:
  • Implement DataSize for Principal, enabling Principal as an element type in BoundedVec

2026-02-20

• Non-breaking changes:
  • Add BoundedVec type to candid::types::bounded_vec for bounding a vector by number of elements, total data size, and per-element data size during deserialization

2026-02-10

• Non-breaking changes:
  • Enhance recursion guard
    • Use target_family = "wasm" for platform detection to cover both wasm32 and wasm64; skip recursion check on wasm (sandboxed), use stack-based check on native platforms and a conservative depth limit on other niche platforms
    • Apply recursion guard to all recursive functions on deserialization path: type environment operations (TypeEnv::is_empty, trace_type, rec_find_type, as_func, as_service), value type annotation (IDLValue::annotate_type), subtype checking (subtype_(), equal()), and all deserializer methods (deserialize_option, deserialize_seq, deserialize_map, deserialize_tuple, deserialize_tuple_struct, deserialize_struct, deserialize_enum)
    • Refactor to use RAII guard pattern (RecursionDepth with DepthGuard) for automatic depth management, eliminating manual increment/decrement operations

2026-02-03

• Non-breaking changes:
  • Add max_type_len to DecoderConfig to configure the type table size limit (default: 10,000) during binary parsing.

2026-01-09

• Non-breaking changes:
  • fix: subtyping and coercion rules for optional types
  • fix: coercion of values into nested optional types
  • fix: values of types reserved at any context do not coerce into values of type null
  • fix: missing record fields of type null in the textual format are decoded into a default value

• Non-breaking changes:
  • Fixes a compatibility issue with serde v1.0.220 and later.

2025-09-03

• Non-breaking changes:
  • Implement serde::Serialize and PartialOrd, Ord, Hash for the Reserved type.

2025-08-04

• Non-breaking changes:
  • Fixes a regression in pretty printing when concatenating an empty list of documents

2025-07-29

• Non-breaking changes:
  • Makes the warning message for the special opt subtyping rule more explicit in the candid::types::subtype::subtype and candid::types::subtype::subtype_with_config functions.
  • Added pp_label_raw in pretty::candid module.

• Add a series of decoder functions which provide convenience for ic-cdk macros usage.

2025-01-22

• Add ArgumentEncoder::encode_ref, utils::{write_args, encode_args} that don't consume the value when encoding.

2025-01-15

• Implement CandidType for std::marker::PhantomData.

2024-12-10

• Add IDLBuilder.try_reserve_value_serializer_capacity() to reserve capacity before serializing a large amount of data.

2024-05-03

• Add candid::MotokoResult type. Use motoko_result.into_result() to convert the value into Rust result, and rust_result.into() to get Motoko result.

• Switch HashMap to BTreeMap in serialization and T::ty(). This leads to around 20% perf improvement for serializing complicated types.
• Disable memoization for unrolled types in serialization to save cycle cost. In some cases, type table can get slightly larger, but it's worth the trade off.
• Fix bug in text_size
• Fix decoding cost calculation overflow
• Fix length check in decoding principal type
• Implement CandidType for serde_bytes::ByteArray
• Add pretty::candid::pp_init_args function to pretty print init args

2024-02-27

• Support #[serde(rename = "")] with arbitrary string.
• Fix a performance bug in the type table parsing.
• Allow setting decoding quota for deserialization with the following new functions: candid::decode_args_with_config, candid::utils::decode_args_with_config_debug, candid::decode_one_with_config, candid::Decode!([config]; &bytes, T), candid::Decode!(@Debug [config]; &bytes, T), IDLArgs::from_bytes_with_types_with_config and IDLArgs::from_bytes_with_config. The original decoding method remains to be non-metered.

• Fix parser when converting vec { number } into blob type.

• Fix display IDLValue::Blob to allow "\n\t" in ascii characters.

• Add candid::types::value::try_from_candid_type to convert Rust type to IDLValue.
• Display IDLValue::Blob in ascii character only when the whole blob are ascii characters.

• Implement CandidType for std::cmp::Reverse.
• Rust codegen: add pub for struct fields.
• Fix merge_init_types and instantiate_candid when the main actor refers to a variable.