dysl (Oct 24 2026 at 03:06): dysl (Oct 24 2026 at 03:06):Hello,
I submitted a private security advisory about a problem in compile-time built-ins composition, and it was closed with the rationale that the feature isn't tier 1.
Looking at the support/tiers page, I’m struggling to classify it as anything other than embedding API, since no other row seems to match it, at least in my understanding.
I'd appreciate someone with access taking a second look at the classification and would feel more comfortable opening a public issue and PR after that.
Thanks
Alex Crichton (Oct 26 2026 at 15:03):We don't have the most clear documentation about features in the runtime, but when in doubt if something's not explicitly listed tier 1 then it likely isn't. We can't say that every single PR that lands in the main repo which doesn't otherwise have documentation is automatically tier 1, so we have to go the other way and say that unless something is explicitly mentioned at tier 1 then it's considered a lower tier. If you find something we should probably consider tier 1 but isn't explcitly documented as such then that's something we should definitely fix.
dysl (Oct 26 2026 at 15:26):Well, I'm not sure what one would classify them as besides embedding API because they're in the embedding APIs, namely on CodeBuilder.
fitzgen (he/him) (Oct 26 2026 at 15:38):Yeah we definitely should update our documentation to be more clear, but as Alex said we can't make every PR that adds functionality immediately jump to tier 1.
Definitely the right instinct for potential vulnerabilities is to assume it is a vulnerability first, rather than just file a public issue, though, and we appreciate that care for sure.
Last updated: Oct 31 2026 at 23:03 UTC