In general, only the most recently released version of nextest is supported at any time.

For more information about nextest's versioning policy, see Stability policy.

Before reporting vulnerabilities, please understand that part of nextest's job is to run arbitrary Rust code, which is often downloaded from the internet. Most of nextest does not form a trust boundary — for example, build archives already run arbitrary code, so a malformed archive doesn't introduce a new attack surface.

Please report vulnerabilities via GitHub. The main point of contact is nextest's primary author, Rain Paharia.

We aim to respond to vulnerability reports within 2-3 business days, and to release patches on weekdays shortly afterwards.