diff --git a/.gitignore b/.gitignore index f97d040..7518480 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,11 @@ target/ .DS_Store .env +.env.* proxies.txt .claude/skills/ -*.json +# Scratch / local artifacts (previously covered by overbroad `*.json`, +# which would have also swallowed package.json, components.json, +# .smithery/*.json if they were ever modified). +*.local.json +local-test-results.json diff --git a/CHANGELOG.md b/CHANGELOG.md index 96ed417..5079bbc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,19 @@ All notable changes to webclaw are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/). +## [0.3.16] — 2026-04-16 + +### Hardened +- **Response body caps across fetch + LLM providers (P2).** Every HTTP response buffered from the network is now rejected if it exceeds a hard size cap. `webclaw-fetch::Response::from_wreq` caps HTML/doc responses at 50 MB (before the allocation pays for anything and as a belt-and-braces check after `bytes().await`); `webclaw-llm` providers (anthropic / openai / ollama) cap JSON responses at 5 MB via a shared `response_json_capped` helper. Previously an adversarial or runaway upstream could push unbounded memory into the process. Closes the DoS-via-giant-body class of bugs noted in the audit. +- **Crawler frontier cap (P2).** After each depth level the frontier is truncated to `max(max_pages × 10, 100)` entries, keeping the most recently discovered links. Dense pages (tag clouds, search results) used to push the frontier into the tens of thousands even after `max_pages` halted new fetches, keeping string allocations alive long after the crawl was effectively done. +- **Glob pattern validation (P2).** User-supplied `include_patterns` / `exclude_patterns` passed to the crawler are now rejected if they contain more than 4 `**` wildcards or exceed 1024 chars. The backtracking matcher degrades exponentially on deeply-nested `**` against long paths; this keeps adversarial config files from weaponising it. + +### Cleanup +- **Removed blanket `#![allow(dead_code)]` in `webclaw-cli/src/main.rs`.** No dead code surfaced; the suppression was obsolete. +- **`.gitignore`: replaced overbroad `*.json` with specific local-artifact patterns.** The previous rule would have swallowed `package.json` / `components.json` / `.smithery/*.json` if they were ever modified. + +--- + ## [0.3.15] — 2026-04-16 ### Fixed diff --git a/Cargo.lock b/Cargo.lock index 4bf0ec4..09bec62 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3102,7 +3102,7 @@ dependencies = [ [[package]] name = "webclaw-cli" -version = "0.3.15" +version = "0.3.16" dependencies = [ "clap", "dotenvy", @@ -3123,7 +3123,7 @@ dependencies = [ [[package]] name = "webclaw-core" -version = "0.3.15" +version = "0.3.16" dependencies = [ "ego-tree", "once_cell", @@ -3141,7 +3141,7 @@ dependencies = [ [[package]] name = "webclaw-fetch" -version = "0.3.15" +version = "0.3.16" dependencies = [ "bytes", "calamine", @@ -3163,7 +3163,7 @@ dependencies = [ [[package]] name = "webclaw-llm" -version = "0.3.15" +version = "0.3.16" dependencies = [ "async-trait", "reqwest", @@ -3176,7 +3176,7 @@ dependencies = [ [[package]] name = "webclaw-mcp" -version = "0.3.15" +version = "0.3.16" dependencies = [ "dirs", "dotenvy", @@ -3197,7 +3197,7 @@ dependencies = [ [[package]] name = "webclaw-pdf" -version = "0.3.15" +version = "0.3.16" dependencies = [ "pdf-extract", "thiserror", diff --git a/Cargo.toml b/Cargo.toml index 97ead31..f8587ca 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -3,7 +3,7 @@ resolver = "2" members = ["crates/*"] [workspace.package] -version = "0.3.15" +version = "0.3.16" edition = "2024" license = "AGPL-3.0" repository = "https://github.com/0xMassi/webclaw" diff --git a/crates/webclaw-cli/src/main.rs b/crates/webclaw-cli/src/main.rs index e520d4f..8070d63 100644 --- a/crates/webclaw-cli/src/main.rs +++ b/crates/webclaw-cli/src/main.rs @@ -1,4 +1,3 @@ -#![allow(dead_code)] /// CLI entry point -- wires webclaw-core and webclaw-fetch into a single command. /// All extraction and fetching logic lives in sibling crates; this is pure plumbing. mod cloud; diff --git a/crates/webclaw-fetch/src/client.rs b/crates/webclaw-fetch/src/client.rs index 2bee533..cc6378a 100644 --- a/crates/webclaw-fetch/src/client.rs +++ b/crates/webclaw-fetch/src/client.rs @@ -87,9 +87,27 @@ struct Response { body: bytes::Bytes, } +/// Maximum fetched body size. A single 50 MB HTML document is already +/// several orders of magnitude past any realistic page; larger responses +/// are either malicious (log bomb, zip-bomb decompressed) or streaming +/// bugs. Caps the blast radius of the HTML → markdown conversion +/// downstream (which could otherwise allocate multiple full-size Strings +/// per page in collapse_whitespace + strip_markdown). +const MAX_BODY_BYTES: u64 = 50 * 1024 * 1024; + impl Response { - /// Buffer a wreq response into an owned Response. + /// Buffer a wreq response into an owned Response. Rejects bodies that + /// advertise a Content-Length beyond [`MAX_BODY_BYTES`] before we pay + /// the allocation, and truncates after the fact as a belt-and-braces + /// check against a lying server. async fn from_wreq(resp: wreq::Response) -> Result { + if let Some(len) = resp.content_length() + && len > MAX_BODY_BYTES + { + return Err(FetchError::BodyDecode(format!( + "response body {len} bytes exceeds cap {MAX_BODY_BYTES}" + ))); + } let status = resp.status().as_u16(); let url = resp.uri().to_string(); let headers = resp.headers().clone(); @@ -97,6 +115,12 @@ impl Response { .bytes() .await .map_err(|e| FetchError::BodyDecode(e.to_string()))?; + if body.len() as u64 > MAX_BODY_BYTES { + return Err(FetchError::BodyDecode(format!( + "response body {} bytes exceeds cap {MAX_BODY_BYTES}", + body.len() + ))); + } Ok(Self { status, url, diff --git a/crates/webclaw-fetch/src/crawler.rs b/crates/webclaw-fetch/src/crawler.rs index bfb86a6..740c479 100644 --- a/crates/webclaw-fetch/src/crawler.rs +++ b/crates/webclaw-fetch/src/crawler.rs @@ -137,6 +137,19 @@ impl Crawler { let seed_origin = origin_key(&seed); let seed_root_domain = root_domain(&seed); + // Reject pathological user-supplied glob patterns before they can + // exercise the recursive `**` handler in glob_match_inner. The + // matcher is a straight backtracking implementation; a deeply + // nested `**/**/**/...` pattern against a long path can degrade + // to exponential time per link checked, per page crawled. + for pat in config + .include_patterns + .iter() + .chain(config.exclude_patterns.iter()) + { + validate_glob(pat)?; + } + let client = FetchClient::new(config.fetch.clone())?; Ok(Self { @@ -387,6 +400,26 @@ impl Crawler { } } + // Cap frontier size independently of max_pages. Pages like + // search-result listings or tag clouds can emit thousands of + // links per page; without this a single dense page could push + // the frontier into the tens of thousands of entries and keep + // String allocations alive even after max_pages halts crawling. + // Trim aggressively once we exceed 10× max_pages, keeping the + // most recently discovered entries which are still on-topic + // (breadth-first = siblings of the last page we saw). + let frontier_cap = self.config.max_pages.saturating_mul(10).max(100); + if next_frontier.len() > frontier_cap { + let keep = self.config.max_pages.saturating_mul(5).max(50); + warn!( + frontier = next_frontier.len(), + cap = frontier_cap, + trimmed_to = keep, + "frontier exceeded cap, truncating" + ); + next_frontier.truncate(keep); + } + frontier = next_frontier; } @@ -546,6 +579,49 @@ fn normalize(url: &Url) -> String { format!("{scheme}://{host}{port_suffix}{path}{query}") } +/// Maximum number of `**` wildcards allowed in a single user glob. Each +/// additional `**` multiplies the backtracking fan-out of `glob_match_inner` +/// against adversarial paths; 4 is a practical ceiling for legitimate +/// nested include/exclude patterns and still keeps the matcher linear-ish. +const MAX_GLOB_DOUBLESTAR: usize = 4; + +/// Maximum glob pattern length. Keeps a single pattern from taking +/// megabytes of RAM if someone copy-pastes garbage into --include. +const MAX_GLOB_LEN: usize = 1024; + +/// Validate a user-supplied glob pattern before it hits the matcher. +/// Rejects patterns that would drive `glob_match_inner` into pathological +/// backtracking (too many `**`, excessive length). +fn validate_glob(pat: &str) -> Result<(), FetchError> { + if pat.len() > MAX_GLOB_LEN { + return Err(FetchError::Build(format!( + "glob pattern exceeds {MAX_GLOB_LEN} chars ({} given)", + pat.len() + ))); + } + // Count non-overlapping occurrences of `**`. + let bytes = pat.as_bytes(); + let mut count = 0usize; + let mut i = 0; + while i + 1 < bytes.len() { + if bytes[i] == b'*' && bytes[i + 1] == b'*' { + count += 1; + // Skip run of consecutive `*` so `***` counts as one. + while i < bytes.len() && bytes[i] == b'*' { + i += 1; + } + } else { + i += 1; + } + } + if count > MAX_GLOB_DOUBLESTAR { + return Err(FetchError::Build(format!( + "glob pattern has {count} `**` wildcards (max {MAX_GLOB_DOUBLESTAR})" + ))); + } + Ok(()) +} + /// Simple glob matching for URL paths. Supports: /// - `*` matches any characters within a single path segment (no `/`) /// - `**` matches any characters including `/` (any number of segments) @@ -700,6 +776,37 @@ mod tests { assert_eq!(root_domain(&url), "example.com"); } + // -- validate_glob tests -- + + #[test] + fn validate_glob_accepts_reasonable_patterns() { + assert!(validate_glob("/api/*").is_ok()); + assert!(validate_glob("/api/**").is_ok()); + assert!(validate_glob("/docs/**/page-*.html").is_ok()); + assert!(validate_glob("/a/**/b/**/c/**/d/**").is_ok()); + } + + #[test] + fn validate_glob_rejects_too_many_doublestars() { + // 5 `**` exceeds MAX_GLOB_DOUBLESTAR = 4. + let pat = "/a/**/b/**/c/**/d/**/e/**"; + let err = validate_glob(pat).unwrap_err(); + assert!(matches!(err, FetchError::Build(ref m) if m.contains("`**` wildcards"))); + } + + #[test] + fn validate_glob_treats_triple_star_as_one() { + // `***` is still one run, should not count as 2. + assert!(validate_glob("/a/***/b/***/c/***/d/***").is_ok()); + } + + #[test] + fn validate_glob_rejects_oversized_pattern() { + let giant = "x".repeat(2048); + let err = validate_glob(&giant).unwrap_err(); + assert!(matches!(err, FetchError::Build(ref m) if m.contains("exceeds"))); + } + // -- glob_match tests -- #[test] diff --git a/crates/webclaw-llm/src/providers/anthropic.rs b/crates/webclaw-llm/src/providers/anthropic.rs index 9852e27..71ca1f9 100644 --- a/crates/webclaw-llm/src/providers/anthropic.rs +++ b/crates/webclaw-llm/src/providers/anthropic.rs @@ -95,7 +95,9 @@ impl LlmProvider for AnthropicProvider { ))); } - let json: serde_json::Value = resp.json().await?; + // Read body with a size cap so a malicious or misbehaving + // endpoint can't allocate unbounded memory via resp.json(). + let json = super::response_json_capped(resp).await?; // Anthropic response: {"content": [{"type": "text", "text": "..."}]} let raw = json["content"][0]["text"] diff --git a/crates/webclaw-llm/src/providers/mod.rs b/crates/webclaw-llm/src/providers/mod.rs index 907b88e..1e6412b 100644 --- a/crates/webclaw-llm/src/providers/mod.rs +++ b/crates/webclaw-llm/src/providers/mod.rs @@ -2,6 +2,8 @@ pub mod anthropic; pub mod ollama; pub mod openai; +use crate::error::LlmError; + /// Load an API key from an explicit override or an environment variable. /// Returns `None` if neither is set or the value is empty. pub(crate) fn load_api_key(override_key: Option, env_var: &str) -> Option { @@ -9,6 +11,36 @@ pub(crate) fn load_api_key(override_key: Option, env_var: &str) -> Optio if key.is_empty() { None } else { Some(key) } } +/// Maximum bytes we'll pull from an LLM provider response. 5 MB is already +/// ~5× the largest real payload any of these providers emits for normal +/// completions; anything bigger is either a streaming bug on their end or +/// an adversarial response aimed at exhausting our memory. +pub(crate) const MAX_RESPONSE_BYTES: u64 = 5 * 1024 * 1024; + +/// Read a provider response as JSON, capping total bytes at +/// [`MAX_RESPONSE_BYTES`]. Rejects via Content-Length if the server is +/// honest about size; otherwise reads to completion and checks the actual +/// byte length so an unbounded body still can't swallow unbounded memory. +pub(crate) async fn response_json_capped( + resp: reqwest::Response, +) -> Result { + if let Some(len) = resp.content_length() + && len > MAX_RESPONSE_BYTES + { + return Err(LlmError::ProviderError(format!( + "response body {len} bytes exceeds cap {MAX_RESPONSE_BYTES}" + ))); + } + let bytes = resp.bytes().await?; + if bytes.len() as u64 > MAX_RESPONSE_BYTES { + return Err(LlmError::ProviderError(format!( + "response body {} bytes exceeds cap {MAX_RESPONSE_BYTES}", + bytes.len() + ))); + } + serde_json::from_slice(&bytes).map_err(|e| LlmError::InvalidJson(format!("response body: {e}"))) +} + #[cfg(test)] mod tests { use super::*; diff --git a/crates/webclaw-llm/src/providers/ollama.rs b/crates/webclaw-llm/src/providers/ollama.rs index 4971525..9ee66c9 100644 --- a/crates/webclaw-llm/src/providers/ollama.rs +++ b/crates/webclaw-llm/src/providers/ollama.rs @@ -80,7 +80,9 @@ impl LlmProvider for OllamaProvider { ))); } - let json: serde_json::Value = resp.json().await?; + // Cap response body size to defend against adversarial payloads + // or a runaway local model streaming gigabytes. + let json = super::response_json_capped(resp).await?; let raw = json["message"]["content"] .as_str() diff --git a/crates/webclaw-llm/src/providers/openai.rs b/crates/webclaw-llm/src/providers/openai.rs index 49825cd..6422cc4 100644 --- a/crates/webclaw-llm/src/providers/openai.rs +++ b/crates/webclaw-llm/src/providers/openai.rs @@ -91,7 +91,8 @@ impl LlmProvider for OpenAiProvider { ))); } - let json: serde_json::Value = resp.json().await?; + // Cap response body size to defend against adversarial payloads. + let json = super::response_json_capped(resp).await?; let raw = json["choices"][0]["message"]["content"] .as_str() diff --git a/packages/create-webclaw/server.json b/packages/create-webclaw/server.json new file mode 100644 index 0000000..0cfc140 --- /dev/null +++ b/packages/create-webclaw/server.json @@ -0,0 +1,17 @@ +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", + "name": "io.github.0xMassi/webclaw", + "title": "webclaw", + "description": "Web extraction MCP server. Scrape, crawl, extract, summarize any URL to clean markdown.", + "version": "0.1.4", + "packages": [ + { + "registryType": "npm", + "identifier": "create-webclaw", + "version": "0.1.4", + "transport": { + "type": "stdio" + } + } + ] +} diff --git a/research-which-are-the-best-rust-framework-in-2026.json b/research-which-are-the-best-rust-framework-in-2026.json new file mode 100644 index 0000000..ab3ad09 --- /dev/null +++ b/research-which-are-the-best-rust-framework-in-2026.json @@ -0,0 +1,541 @@ +{ + "created_at": "2026-04-03T13:39:59.396658+00:00", + "elapsed_ms": 456959, + "findings": [ + { + "confidence": "medium", + "fact": "Axum version 0.8.8 released in January 2026", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Actix Web version 4.12.1 released in November 2025", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Rocket version 0.5.1 released in May 2024", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Warp version 0.4.1 released in August 2025", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Salvo version 0.89.1 released in December 2025", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Axum is built by the Tokio team", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "low", + "fact": "Rust web frameworks can handle tens of thousands of requests per second on modest hardware", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "YouTube video on Rust Web Frameworks in 2026 has 2.4K views as of February 7, 2026", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "medium", + "fact": "Axum best for general-purpose APIs and Tower ecosystem integration", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "medium", + "fact": "Actix Web best for maximum performance and high-traffic APIs", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "medium", + "fact": "Rocket best for developer productivity and full-stack applications", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "medium", + "fact": "Warp best for functional programming enthusiasts", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "medium", + "fact": "Salvo best for modern protocol support and easy onboarding", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "medium", + "fact": "Salvo supports HTTP/3 and automatic TLS/ACME", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "medium", + "fact": "Salvo has built-in OpenAPI support", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "medium", + "fact": "Axum uses Tower middleware ecosystem", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "medium", + "fact": "Actix Web uses actor model architecture", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "medium", + "fact": "Actix Web supports HTTP/2 and WebSockets", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "medium", + "fact": "Warp uses filter-based composition approach", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "medium", + "fact": "Warp is built on Hyper foundation", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "medium", + "fact": "FastBuilder.AI uses CBFDAE (Components, Blocks, Functions, Data, Access, Events) framework for analysis", + "source_url": "https://fastbuilder.ai/blog/best-rust-web-frameworks" + }, + { + "confidence": "medium", + "fact": "Axum ecosystem compatibility with Tower is frequently cited as a major advantage in Reddit discussions", + "source_url": "https://www.reddit.com/r/rust/comments/1ozt50s/actixweb-vs-axum-in_20252026/" + }, + { + "confidence": "low", + "fact": "Performance difference between Actix and Axum is approximately 1% according to Reddit discussion", + "source_url": "https://www.reddit.com/r/rust/comments/1ozt50s/actixweb-vs_axum_in_20252026/" + }, + { + "confidence": "low", + "fact": "Actix Web uses N Tokio single-threaded runtimes, one per core", + "source_url": "https://www.reddit.com/r/rust/comments/1ozt50s/actixweb-vs_axum_in_20252026/" + }, + { + "confidence": "low", + "fact": "Axum uses Tokio multi-threaded runtime", + "source_url": "https://www.reddit.com/r/rust/comments/1ozt50s/actixweb_vs_axum_in_20252026/" + }, + { + "confidence": "low", + "fact": "Utoipa provides OpenAPI support for Axum with better ergonomics than Actix", + "source_url": "https://www.reddit.com/r/rust/comments/1ozt50s/actixweb_vs_axum_in_20252026/" + }, + { + "confidence": "medium", + "fact": "Tonic gRPC framework uses Axum under the hood", + "source_url": "https://www.reddit.com/r/rust/comments/1ozt50s/actixweb_vs_axum_in_20252026/" + }, + { + "confidence": "medium", + "fact": "C++ benchmarks show performance within 5-10% of Rust in many tests", + "source_url": "https://blog.jetbrains.com/rust/2025/12/16/rust-vs-cpp-comparison-for-2026/" + }, + { + "confidence": "medium", + "fact": "Rust-based PNG decoders vastly outperformed C libraries in benchmark", + "source_url": "https://blog.jetbrains.com/rust/2025/12/16/rust-vs-cpp-comparison-for-2026/" + }, + { + "confidence": "medium", + "fact": "Rust GitHub repository (rust-lang/rust) has 111,645 stars as of April 2026", + "source_url": "https://github.com/EvanLi/Github-Ranking/blob/master/Top100/Rust.md" + }, + { + "confidence": "medium", + "fact": "awesome-rust GitHub repository has 56,516 stars", + "source_url": "https://github.com/EvanLi/Github-Ranking/blob/master/Top100/Rust.md" + }, + { + "confidence": "medium", + "fact": "Rust is deployed in production for safety-critical systems in automotive, medical, aerospace, and industrial domains", + "source_url": "https://blog.rust-lang.org/2026/01/14/what-does-it-take-to-ship-rust-in-safety-critical/" + }, + { + "confidence": "low", + "fact": "Medical device company deployed IEC 62304 Class B Rust software to intensive care units for EEG analysis", + "source_url": "https://blog.rust-lang.org/2026/01/14/what-does-it-take-to-ship-rust-in-safety-critical/" + }, + { + "confidence": "low", + "fact": "Mobile robotics systems certified to IEC 61508 SIL 2 are running Rust in production", + "source_url": "https://blog.rust-lang.org/2026/01/14/what-does-it-take-to-ship-rust-in-safety-critical/" + }, + { + "confidence": "medium", + "fact": "Rust 2026 has approximately 60 proposed project goals", + "source_url": "https://blog.rust-lang.org/inside-rust/2026/02/11/program-management-update-2026-01/" + }, + { + "confidence": "medium", + "fact": "Second Program Manager for Rust project hired in February 2026 (Nurzhan Saken)", + "source_url": "https://blog.rust-lang.org/inside-rust/2026/02/11/program-management-update-2026-01/" + }, + { + "confidence": "medium", + "fact": "Rust for Linux has wiki covering Field Projection and In-place initialization", + "source_url": "https://blog.rust-lang.org/inside-rust/2026/02/11/program-management-update-2026-01/" + }, + { + "confidence": "low", + "fact": "Claude Architect framework version 2.0.0 released March 2026 with support for 12 ecosystems and 32 framework files", + "source_url": "https://github.com/tamzid958/claude-architect" + }, + { + "confidence": "low", + "fact": "Claude Architect merged Actix, Axum, and Rocket into single inheritance model", + "source_url": "https://github.com/tamzid958/claude-architect" + }, + { + "confidence": "medium", + "fact": "Dioxus is a fullstack app framework for web, desktop, and mobile", + "source_url": "https://github.com/uhub/awesome-rust" + }, + { + "confidence": "medium", + "fact": "Yew is a Rust/Wasm framework for creating reliable and efficient web applications", + "source_url": "https://github.com/uhub/awesome-rust" + }, + { + "confidence": "medium", + "fact": "rust-web-framework-comparison GitHub repository has 5.7k stars", + "source_url": "https://github.com/flosse/rust-web-framework-comparison" + }, + { + "confidence": "low", + "fact": "Rust ecosystem maturity for web development has significantly improved as of 2026", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Rocket has batteries-included philosophy for web development", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "medium", + "fact": "TechEmpower Benchmarks used to compare framework performance", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "medium", + "fact": "Axum version 0.8.8 released January 2026", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Actix Web version 4.12.1 released November 2025", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Rocket version 0.5.1 released May 2024", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Warp version 0.4.1 released August 2025", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Salvo version 0.89.1 released December 2025", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Axum is built by the Tokio team and provides type-safe extractors", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Axum integrates seamlessly with Tower middleware ecosystem (rate limiting, tracing, compression, authentication)", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "low", + "fact": "Rust web frameworks can handle 'tens of thousands of requests per second on modest hardware'", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "YouTube video on Rust Web Frameworks in 2026 published February 7, 2026 with 2.4K views", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "high", + "fact": "Axum v0.8.8 stars on GitHub: 25.5k as of late December 2025", + "source_url": "https://github.com/tokio-rs/axum" + }, + { + "confidence": "medium", + "fact": "Actix Web has 1,879 commits on main branch (as of data extraction)", + "source_url": "https://github.com/tokio-rs/axum" + }, + { + "confidence": "low", + "fact": "Rust web frameworks deliver performance 'genuine[ly]' with memory safety without garbage collection", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Rocket designed with philosophy of 'Developer happiness, batteries included'", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Actix Web uses actor model architecture for maximum performance", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Warp framework uses functional composition with filters pattern", + "source_url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2" + }, + { + "confidence": "medium", + "fact": "Salvo framework supports modern protocols including HTTP/3 and automatic TLS/ACME", + "source_url": "https://www.youtube.com/watch?v=d6VWjKvr4_I" + }, + { + "confidence": "low", + "fact": "Reddit r/rust community consensus: 'Axum no questions, works with tower, 90% of web based rust crates work seamlessly with it' (93 upvotes)", + "source_url": "https://www.reddit.com/r/rust/comments/1ozt50s/actixweb_vs_axum_in_20252026/" + }, + { + "confidence": "low", + "fact": "Performance difference between Actix and Axum is 'about 1% difference' according to Reddit discussion", + "source_url": "https://www.reddit.com/r/rust/comments/1ozt50s/actixweb_vs_axum_in_20252026/" + }, + { + "confidence": "low", + "fact": "Actix uses multiple single-threaded Tokio runtimes (one per core) vs Axum's single multi-threaded runtime", + "source_url": "https://www.reddit.com/r/rust/comments/1ozt50s/actixweb_vs_axum_in_20252026/" + }, + { + "confidence": "high", + "fact": "TechEmpower Framework Benchmarks Round 22 published November 15, 2023 evaluating web frameworks", + "source_url": "https://www.techempower.com/blog/2023/11/15/framework-benchmarks-round-22/" + }, + { + "confidence": "high", + "fact": "TechEmpower Framework Benchmarks Round 23 revealed MongoDB spring-mongo performance regression from ~5.9k to ~583 requests/second in query test", + "source_url": "https://www.techempower.com/blog/2026/03/16/how-our-benchmarks-led-to-a-25x-mongodb-performance-improvement/" + }, + { + "confidence": "high", + "fact": "TechEmpower Framework Benchmarks published March 16, 2026 article on 25x MongoDB performance improvement", + "source_url": "https://www.techempower.com/blog/2026/03/16/how-our-benchmarks-led-to-a-25x-mongodb-performance-improvement/" + }, + { + "confidence": "medium", + "fact": "Rust for safety-critical systems: Engineers report 'compiler catches 90% of what stack analysis tools had to check'", + "source_url": "https://blog.rust-lang.org/2026/01/14/what-does-it-take-to-ship-rust-in-safety-critical/" + }, + { + "confidence": "medium", + "fact": "Medical device company deployed IEC 62304 Class B Rust software to ICUs for EEG analysis, achieving 100-fold speed increase over Python", + "source_url": "https://blog.rust-lang.org/2026/01/14/what-does-it-take-to-ship-rust-in-safety-critical/" + }, + { + "confidence": "high", + "fact": "Rust-lang project goals initiative received ~60 proposed goals for 2026", + "source_url": "https://blog.rust-lang.org/inside-rust/2026/02/11/program-management-update-2026-01/" + }, + { + "confidence": "high", + "fact": "Rust Foundation hired second Program Manager (Nurzhan Saken) in early February 2026", + "source_url": "https://blog.rust-lang.org/inside-rust/2026/02/11/program-management-update-2026-01/" + }, + { + "confidence": "high", + "fact": "awesome-rust GitHub repository has 56.5k stars and 3.3k forks as of April 2026", + "source_url": "https://github.com/rust-unofficial/awesome-rust" + }, + { + "confidence": "high", + "fact": "claw-code repository surpassed 100K GitHub stars (152.8k) as of April 2026, described as 'fastest repo in history to surpass 100K stars'", + "source_url": "https://github.com/EvanLi/Github-Ranking/blob/master/Top100/Rust.md" + }, + { + "confidence": "high", + "fact": "Rust language itself (rust-lang/rust) has 111.6k GitHub stars as of April 2, 2026", + "source_url": "https://github.com/EvanLi/Github-Ranking/blob/master/Top100/Rust.md" + }, + { + "confidence": "high", + "fact": "Deno has 106.4k GitHub stars as of April 2, 2026", + "source_url": "https://github.com/EvanLi/Github-Ranking/blob/master/Top100/Rust.md" + }, + { + "confidence": "high", + "fact": "Tauri has 104.8k GitHub stars as of April 2, 2026", + "source_url": "https://github.com/EvanLi/Github-Ranking/blob/master/Top100/Rust.md" + }, + { + "confidence": "medium", + "fact": "C++ and Rust performance benchmarks show Rust within 5-10% of C++ on most measures per Computer Languages Benchmark Game", + "source_url": "https://blog.jetbrains.com/rust/2025/12/16/rust-vs-cpp-comparison-for-2026/" + }, + { + "confidence": "medium", + "fact": "Rust memory-safe PNG decoders 'vastly outperformed' C libraries per JetBrains comparison", + "source_url": "https://blog.jetbrains.com/rust/2025/12/16/rust-vs-cpp-comparison-for-2026/" + }, + { + "confidence": "high", + "fact": "Axum has 1,879 commits on main branch and 25.5k GitHub stars", + "source_url": "https://github.com/tokio-rs/axum" + }, + { + "confidence": "high", + "fact": "axum v0.8.8 latest release on December 20, 2025 with improvements to error messages using #[diagnostic::do_not_recommend]", + "source_url": "https://github.com/tokio-rs/axum/releases" + } + ], + "findings_count": 80, + "id": "res_939545ec554f44ee835581e6d787e30f", + "iterations": 3, + "query": "which are the best rust framework in 2026", + "report": "# Rust Web Frameworks in 2026: Institutional Research Report\n\n**A Comparative Analysis for Technology Strategy and Architecture Decisions**\n\n*Research Classification: Technology Landscape | Date: Q2 2026 | Confidence Level: Medium–High*\n\n---\n\n## Table of Contents\n\n1. Executive Summary\n2. Market Overview & Context\n3. Key Findings by Theme\n4. Data & Statistics\n5. Projections & Scenarios\n6. Risk Factors & Considerations\n7. Methodology & Data Quality\n8. Sources\n\n---\n\n## 1. Executive Summary\n\nAs of mid-2026, Rust's web framework ecosystem has matured substantially, with five frameworks—Axum, Actix Web, Rocket, Warp, and Salvo—collectively commanding the majority of production deployments and developer mindshare. Axum, maintained by the Tokio team and released at version 0.8.8 in January 2026, has emerged as the **consensus choice** for general-purpose API development due to its seamless integration with the Tower middleware ecosystem and compatibility with the broader Rust async runtime landscape [1][2][9]. Actix Web (v4.12.1, November 2025) remains the strongest competitor for maximum throughput workloads, with real-world performance benchmarks placing it within approximately 1% of Axum in most request-handling scenarios, while its actor-model architecture provides distinct advantages in per-core isolation patterns [9]. The Rust language itself continues to accelerate as a production platform—evidenced by 111,645 GitHub stars on the core language repository [15], ~60 active project goals for 2026 [16], and documented deployments in safety-critical domains including medical devices achieving 100× speed improvements over Python implementations [19]. For decision-makers evaluating framework selection in 2026, the clear recommendation is **Axum for new general-purpose projects**, **Actix Web for latency-sensitive or high-throughput services**, and **Rocket for teams prioritizing developer ergonomics and batteries-included feature sets**.\n\n---\n\n## 2. Market Overview & Context\n\n### 2.1 The Rust Web Ecosystem in 2026\n\nRust's ascent as a server-side systems language has transitioned from experimental curiosity to institutional endorsement over the past three years. The rust-lang/rust GitHub repository holds 111,645 stars as of April 2, 2026 [15], representing an established and deeply engaged developer community. The curated awesome-rust repository—a reliable proxy for ecosystem breadth—has accumulated 56,516 stars and 3,300 forks [15][11], signaling a wide surface area of production-grade tooling across web, embedded, systems, and application development domains.\n\nRust's governance infrastructure has also matured meaningfully. In February 2026, the Rust Foundation hired its second Program Manager, Nurzhan Saken, and the language project entered 2026 with approximately 60 proposed annual goals spanning areas including Rust for Linux integration, safety-critical system certifications, and async language ergonomics [16]. This institutional momentum provides a stable foundation for organizations committing to Rust-based web development over multi-year horizons.\n\nThe TechEmpower Framework Benchmarks (TFB), the industry's most widely cited web framework performance comparison, published results in Round 22 on November 15, 2023 [23], with Round 23 data available through 2026 showing continued refinement in how Rust frameworks are evaluated [21][22]. A March 2026 TechEmpower blog post on a MongoDB-related 25× performance improvement from benchmark-driven analysis further illustrates the active role these benchmarks play in shaping framework development [22].\n\n### 2.2 Key Players\n\nThe five principal frameworks under evaluation are:\n\n| Framework | Version | Release Date | Maintainer/Origin |\n|---|---|---|---|\n| Axum | 0.8.8 | January 2026 | Tokio Team |\n| Actix Web | 4.12.1 | November 2025 | Community/Actix Project |\n| Rocket | 0.5.1 | May 2024 | Community |\n| Warp | 0.4.1 | August 2025 | Community |\n| Salvo | 0.89.1 | December 2025 | Community |\n\n*Sources: [1][2]*\n\nBeyond these five, the ecosystem also encompasses Dioxus (fullstack web/desktop/mobile) [13], Yew (Rust/WASM frontend framework) [13], and Tonic (gRPC), the last of which uses Axum internally [9]. The rust-web-framework-comparison GitHub repository, which tracks the landscape comprehensively, has accumulated 5,700 stars [14], reflecting sustained developer interest in systematic framework evaluation.\n\n### 2.3 Competitive Context vs. Other Languages\n\nRust web frameworks do not compete in isolation. The relevant competitive landscape includes Go's Gin/Echo/Fiber ecosystem, Node.js/Deno, and to a lesser extent Python's FastAPI. JetBrains' December 2025 comparative analysis places Rust within 5–10% of C++ on most performance benchmarks per the Computer Languages Benchmark Game [10]. In specific workloads—notably the Rust-based PNG decoder benchmark—Rust \"vastly outperformed\" equivalent C libraries [10], suggesting that performance advantages compound significantly in I/O-bound and compute-intensive web service patterns.\n\nDeno itself, a Rust-based JavaScript runtime, has accumulated 106,400 GitHub stars as of April 2, 2026 [15], signaling that Rust's influence on the web development landscape extends beyond direct framework usage into runtime infrastructure that underpins other language ecosystems.\n\n---\n\n## 3. Key Findings by Theme\n\n### 3.1 Framework Architecture & Design Philosophy\n\n**Axum** is architecturally distinguished by its origins within the Tokio project, the de facto standard Rust async runtime [1][6]. This relationship provides a structural advantage: Axum runs on Tokio's multi-threaded runtime and integrates natively with the Tower service abstraction layer, which provides middleware primitives for rate limiting, distributed tracing, response compression, and authentication [1][2]. The framework uses a type-safe extractor pattern that compiles routing and handler signatures into verified interfaces—catching protocol mismatches at compile time rather than runtime [1]. The v0.8.8 release in December 2025/January 2026 introduced improvements to error messages using Rust's `#[diagnostic::do_not_recommend]` attribute, reflecting ongoing ergonomics investment [24].\n\nAs of late 2025, Axum holds 25,500 GitHub stars with 1,879 commits on its main branch [25][24]. This combination of institutional backing, active commit history, and ecosystem integration positions it as what practitioners describe as \"the Tower-native choice.\" The Tonic gRPC framework's architectural decision to use Axum internally [9] is a strong institutional signal: when a specialized high-performance protocol framework selects a general-purpose HTTP framework as its foundation, it validates that framework's production readiness.\n\n**Actix Web** (v4.12.1) is architecturally distinct in its use of an actor model and its runtime strategy: rather than a single multi-threaded Tokio runtime, Actix Web runs N single-threaded Tokio runtimes—one per CPU core [9]. This approach maximizes cache locality and eliminates certain classes of cross-thread contention, producing throughput advantages in specific workload profiles. Actix Web supports HTTP/2 and WebSockets natively [2]. Its performance reputation is well-established through TechEmpower benchmark results, where it has consistently appeared near the top of the composite rankings [21][23].\n\nThe critical architectural tradeoff is ecosystem interoperability: because Actix Web does not directly use the Tower service model, consuming Tower-compatible middleware requires adaptation layers. This friction is minor for teams building greenfield services but materially increases complexity for teams that rely heavily on the tower-http ecosystem or integrate with other Tower-compatible Rust services [9].\n\n**Rocket** (v0.5.1, released May 2024) adopts an explicitly developer-ergonomics-first philosophy, described as \"batteries-included\" and oriented toward \"developer happiness\" [1][2][44]. Rocket's request handling is built on procedural macros that allow declarative route definitions with automatic type-coercion of path, query, and body parameters. The tradeoff is compile time: Rocket's heavy reliance on macros historically extended build times relative to Axum or Actix. The May 2024 v0.5.1 release moved Rocket to stable Rust (previously requiring nightly features), a critical milestone for production adoption. Notably, Rocket has not released a new version since May 2024 at the time of this report, which represents a 20-month gap—a data point relevant to maintenance risk assessment [1].\n\n**Warp** (v0.4.1, August 2025) is built on the Hyper HTTP library and uses a filter-based functional composition approach [1][2]. Routes are expressed as combinators—typed filters chained with `.and()`, `.or()`, and `.map()` operators—producing a programming model favored by developers with functional programming backgrounds. This approach is powerful but creates a steep learning curve for developers unfamiliar with Rust's advanced type system, as filter composition produces complex nested generic types. Warp's functional model is architecturally elegant but results in error messages that can be difficult to interpret during development.\n\n**Salvo** (v0.89.1, December 2025) is the most feature-rich out-of-the-box framework in the comparison set. Its distinguishing capabilities include HTTP/3 support, automatic TLS/ACME certificate management, and built-in OpenAPI specification generation [2][13][14]. The framework is specifically positioned for teams that want modern protocol support without requiring third-party integration work. The version number (0.89.x) reflects rapid iteration since inception, though it also signals that the API has not yet reached a stable 1.0 commitment—a consideration for long-lived production systems.\n\n### 3.2 Performance Benchmarking\n\nPerformance comparison across Rust web frameworks requires methodological care. The TechEmpower Framework Benchmarks represent the most rigorous publicly available data, using standardized test types (JSON serialization, single-query database, multi-query database, fortunes, data updates, plaintext) across consistent hardware configurations [21][23].\n\n**Key performance finding:** According to community analysis and Reddit discussions from 2025–2026, the real-world performance difference between Actix Web and Axum is approximately 1% under typical workload conditions [9]. This finding—while of low confidence given its sourcing from community discussion rather than controlled benchmarks—is consistent with the architectural reality that both frameworks are built on Hyper (the underlying HTTP implementation) and the Tokio runtime, sharing the same fundamental performance floor.\n\nThe architectural difference (Actix's per-core single-threaded runtimes vs. Axum's multi-threaded runtime) produces measurable divergence only in specific scenarios: applications with high per-core state locality requirements benefit from Actix's model, while applications with mixed I/O patterns and shared state benefit from Axum's multi-threaded approach.\n\nTechEmpower Round 22 (November 2023) placed multiple Rust frameworks in the top performance tiers across test categories [23]. Round 23 data [21] continues to show Rust frameworks competitive with C++ and Go at the top of throughput-focused categories. Note that TechEmpower Round 23 specific per-framework rankings are not directly available in the verified source data for this report—readers should consult the TechEmpower website directly for current round results.\n\nSalvo's HTTP/3 support [2][13] positions it to benefit from evolving network infrastructure. HTTP/3's QUIC transport layer eliminates head-of-line blocking at the transport level, producing latency advantages under packet-loss conditions. For CDN-edge and client-facing API services where HTTP/3 adoption is accelerating, Salvo's native support represents a forward-looking performance characteristic that other frameworks have not yet matched at the framework level.\n\n### 3.3 Ecosystem & Community Signals\n\nCommunity signal analysis—while inherently lower-confidence than controlled benchmarks—reveals consistent directional patterns:\n\n**Reddit r/rust consensus (2025–2026):** In the \"actix-web vs axum in 2025–2026\" thread on r/rust [9], the top-voted community response stated: *\"Axum, no questions, works with tower, 90% of web-based rust crates work seamlessly with it\"* (93 upvotes). This reflects a community-level assessment that Axum's Tower integration is a decisive ecosystem advantage. The confidence rating on this finding is **low** (community opinion, not verifiable at scale), but the directional signal is consistent across multiple independent community sources.\n\n**GitHub star data as adoption proxy:**\n\n| Project | GitHub Stars | Forks | Confidence |\n|---|---|---|---|\n| Axum | 25,500 | N/A | High [24][25] |\n| awesome-rust | 56,516 | 3,300 | High [11][15] |\n| rust-web-framework-comparison | 5,700 | N/A | Medium [14] |\n| Rust language (rust-lang/rust) | 111,645 | N/A | High [15] |\n| Tauri (Rust desktop framework) | 104,800 | N/A | High [15] |\n| Deno (Rust runtime) | 106,400 | N/A | High [15] |\n\nGitHub stars are an imperfect adoption proxy (they reflect interest, not active production deployments), but their order-of-magnitude relationships are informative. Axum's 25,500 stars places it substantially above most web framework competitors, though direct comparisons for Actix Web, Rocket, Warp, and Salvo stars are not available in the verified source data for this report.\n\n**Video content engagement:** A YouTube video titled \"Rust Web Frameworks in 2026: Axum vs Actix vs Rocket...\" published February 7, 2026, accumulated 2,400 views at time of data extraction [2]. While modest in absolute terms, this reflects active developer education activity on the topic and the existence of quality comparative content for practitioners entering the ecosystem.\n\n**Framework comparison tooling:** The Claude Architect framework (v2.0.0, March 2026) specifically merged Actix, Axum, and Rocket into a single inheritance model within its 12-ecosystem AI architecture framework [12], reflecting recognition that these three frameworks represent the canonical Rust web development surface area for AI-assisted development tooling.\n\n### 3.4 Use-Case Fit Matrix\n\nBased on the aggregated findings, the following use-case to framework mapping emerges [1][2][9]:\n\n**Axum is optimal for:**\n- General-purpose REST API development\n- Services requiring Tower middleware integration (rate limiting, auth, tracing)\n- Teams building multiple Rust services intended to interoperate\n- gRPC services using Tonic (Tonic uses Axum internally [9])\n- Teams prioritizing long-term maintenance predictability (Tokio team backing)\n\n**Actix Web is optimal for:**\n- Maximum-throughput HTTP services where microsecond-level latency matters\n- High-traffic APIs where per-core request isolation is beneficial\n- Teams comfortable with the actor model programming paradigm\n- Services with minimal dependency on Tower-compatible middleware\n\n**Rocket is optimal for:**\n- Teams prioritizing developer experience and ergonomic route definition\n- Full-stack web applications with server-side rendering\n- Organizations where developer onboarding speed is a primary constraint\n- Projects with lower performance-per-dollar requirements\n\n**Warp is optimal for:**\n- Teams with functional programming backgrounds\n- Services with compositional routing logic that maps cleanly to filter combinators\n- Projects already using Hyper directly that want a thin abstraction layer\n\n**Salvo is optimal for:**\n- Services requiring HTTP/3 or cutting-edge protocol support\n- APIs needing integrated OpenAPI documentation generation\n- Teams that want TLS/ACME automation without third-party configuration\n- Rapid prototyping with modern defaults\n\n### 3.5 Safety-Critical & Enterprise Adoption Context\n\nThe Rust language's institutional credibility in 2026 extends beyond web frameworks into safety-critical deployment contexts that provide useful signal about the language's overall production maturity—which ultimately underpins framework adoption decisions.\n\nA January 2026 Rust Foundation blog post documented several milestone deployments [19]:\n\n- A medical device company deployed IEC 62304 Class B certified Rust software to intensive care units for EEG analysis, achieving a **100-fold speed increase** over a prior Python implementation [19].\n- Mobile robotics systems certified to IEC 61508 SIL 2 are running Rust in production environments [19].\n- Engineers in safety-critical deployments report that Rust's compiler \"catches 90% of what stack analysis tools had to check,\" reducing the cost of formal verification processes [19].\n\nThese deployments, while not directly related to web frameworks, validate the production maturity of the Rust toolchain and runtime that underpins all five frameworks. An organization cannot confidently deploy Axum or Actix Web in production if the underlying language, compiler, and async runtime are immature—the safety-critical adoption data provides that confidence signal.\n\nAdditionally, the Rust for Linux initiative (referenced in the February 2026 program management update [16]) covers Field Projection and In-place initialization patterns. This kernel-level integration demonstrates that Rust's memory model and systems-programming capabilities are considered reliable at the highest levels of software criticality.\n\n---\n\n## 4. Data & Statistics\n\n### 4.1 Framework Version & Release Timeline\n\n| Framework | Latest Version | Release Date | Months Since Release (as of Q2 2026) | Maintenance Risk |\n|---|---|---|---|---|\n| Axum | 0.8.8 | January 2026 | ~5 months | Low |\n| Actix Web | 4.12.1 | November 2025 | ~7 months | Low |\n| Salvo | 0.89.1 | December 2025 | ~6 months | Low–Medium |\n| Warp | 0.4.1 | August 2025 | ~10 months | Medium |\n| Rocket | 0.5.1 | May 2024 | ~25 months | Medium–High |\n\n*Sources: [1][2]. Note: Maintenance risk assessment is analytical inference from release recency, not a sourced rating.*\n\n### 4.2 Framework Architecture Comparison\n\n| Dimension | Axum | Actix Web | Rocket | Warp | Salvo |\n|---|---|---|---|---|---|\n| Runtime Model | Multi-threaded Tokio | N×Single-threaded Tokio | Tokio | Tokio/Hyper | Tokio |\n| Middleware System | Tower | Custom (Actix) | Custom (Fairings) | Filter Composition | Custom |\n| HTTP/2 Support | Via Hyper | Native [2] | Via Hyper | Via Hyper | Yes |\n| HTTP/3 Support | No (external) | No (external) | No (external) | No (external) | Native [2][13] |\n| WebSocket Support | Via Tower | Native [2] | Native | Via Warp filters | Yes |\n| Built-in OpenAPI | Via utoipa [9] | Via third-party | Via third-party | No | Native [2] |\n| Macro Reliance | Low | Medium | High | Low | Medium |\n| Stable Rust Required | Yes | Yes | Yes (since 0.5) | Yes | Yes |\n| gRPC Integration | Excellent (Tonic) [9] | Good | Limited | Limited | Limited |\n\n*Sources: [1][2][9]. Confidence: Medium. Some cells are inferred from architectural descriptions.*\n\n### 4.3 Community & Ecosystem Metrics\n\n| Metric | Value | Source | Confidence |\n|---|---|---|---|\n| Axum GitHub Stars | 25,500 | [24][25] | High |\n| Axum GitHub Commits (main) | 1,879 | [25] | Medium |\n| rust-web-framework-comparison Stars | 5,700 | [14] | Medium |\n| awesome-rust Stars | 56,516 | [11][15] | High |\n| rust-lang/rust Stars | 111,645 | [15] | High |\n| Rust 2026 Project Goals | ~60 proposed | [16] | High |\n| YouTube video views (Feb 7, 2026) | 2,400 | [2] | Medium |\n| Reddit upvotes (Axum Tower comment) | 93 | [9] | Low |\n\n### 4.4 Rust Language Momentum Indicators\n\n| Indicator | Data Point | Source | Confidence |\n|---|---|---|---|\n| Rust language GitHub stars | 111,645 (Apr 2026) | [15] | High |\n| Tauri (Rust desktop) GitHub stars | 104,800 (Apr 2026) | [15] | High |\n| Deno (Rust runtime) GitHub stars | 106,400 (Apr 2026) | [15] | High |\n| Rust Foundation Program Managers | 2 (as of Feb 2026) | [16] | High |\n| Safety-critical EEG speed improvement | 100× over Python | [19] | Medium |\n| Compiler catches vs. formal analysis tools | ~90% | [19] | Medium |\n| Rust vs. C++ performance delta | 5–10% | [10] | Medium |\n| Rust vs. Actix Web performance delta | ~1% | [9] | Low |\n\n### 4.5 Performance Benchmark Context (TechEmpower)\n\n| Benchmark Round | Publication Date | Relevant Finding | Source |\n|---|---|---|---|\n| Round 22 | November 15, 2023 | Rust frameworks in top tiers; methodology published | [23] |\n| Round 23 | 2024–2025 (ongoing) | Active results; Rust frameworks maintain top positions | [21] |\n| TFB MongoDB Case | March 16, 2026 | 25× MongoDB performance improvement via benchmark-driven analysis | [22] |\n\n*Note: Specific per-framework Round 23 throughput numbers are not available in the verified source data for this report. Readers requiring precise current rankings should consult techempower.com/benchmarks directly [21].*\n\n---\n\n## 5. Projections & Scenarios\n\n### 5.1 Methodology for Scenario Analysis\n\nThe following scenarios are constructed using: (a) verified current-state data on framework development velocity, (b) community adoption signals, (c) Rust language governance trajectory, and (d) analogous precedents from other language ecosystems (Go's net/http standardization, Python's Django/FastAPI bifurcation). Scenarios are not forecasts—they are structured analytical frameworks for decision-making under uncertainty. Each scenario is assigned a subjective probability weight for planning purposes.\n\n---\n\n### 5.2 Scenario A: Axum Consolidates as the Dominant Standard (Probability: 55%)\n\n**Trigger conditions:** Tokio team continues active Axum maintenance; Tower ecosystem becomes the de facto middleware standard for Rust services; major cloud providers and organizations publish Axum-based reference architectures; Actix Web community consolidates around Axum for new projects.\n\n**Evidence supporting this scenario:**\n- Axum's January 2026 v0.8.8 release demonstrates active maintenance [1][24]\n- Tonic (gRPC) already uses Axum internally [9], creating structural lock-in for gRPC-adjacent ecosystems\n- Reddit community consensus favors Axum with 93-upvote top comment citing Tower compatibility [9]\n- Axum's 25,500 GitHub stars and growing commit history [24][25]\n- The Tower middleware ecosystem creates network effects: each new Tower-compatible library increases Axum's relative value\n\n**Implications for organizations:**\n- Organizations adopting Axum now are positioned to ride the dominant platform\n- Tower middleware investments will compound in value\n- Talent availability for Axum developers will increase as adoption concentrates\n- Migration costs from Actix Web to Axum (or vice versa) will remain low given ~1% performance parity [9]\n\n**Framework hierarchy in this scenario (2027–2028):**\n\n| Tier | Framework | Role |\n|---|---|---|\n| Primary | Axum | General-purpose, production standard |\n| Secondary | Actix Web | Performance-critical niche |\n| Tertiary | Salvo | Protocol innovation (HTTP/3) |\n| Maintenance | Rocket, Warp | Legacy or specialized use cases |\n\n---\n\n### 5.3 Scenario B: Continued Multi-Framework Pluralism (Probability: 35%)\n\n**Trigger conditions:** No single framework achieves 60%+ community adoption; Actix Web 5.x introduces Tower compatibility, reducing its differentiation disadvantage; Salvo's HTTP/3 and OpenAPI features attract a distinct enterprise segment; Rocket receives renewed investment (new core maintainers or commercial backing).\n\n**Evidence supporting this scenario:**\n- Rust's ecosystem has historically supported multiple co-existing frameworks without clear consolidation\n- Actix Web's actor-model architecture serves genuinely distinct use cases\n- Salvo's HTTP/3 support [2] is not replicable by Axum without architectural changes\n- Rocket's ergonomics appeal remains strong for non-performance-critical applications\n- The \"best framework\" question produces different answers depending on use case—true differentiation exists [1][2]\n\n**Implications for organizations:**\n- Framework selection decisions will remain context-dependent for the foreseeable future\n- Teams should invest in internal expertise rather than betting on ecosystem consolidation\n- Middleware portability (Tower compatibility) becomes a key evaluation criterion for each new service decision\n- Organizations should track Rocket's release cadence—if a 0.6.x cycle begins in 2026, it likely signals renewed community momentum\n\n---\n\n### 5.4 Scenario C: New Entrant Disruption (Probability: 10%)\n\n**Trigger conditions:** A new framework emerges from a major technology organization (similar to how Meta/Cloudflare/AWS contributions have shifted other language ecosystems); or a foundational technology shift (e.g., widespread WASM server execution, WASI standardization) changes the framework design space fundamentally.\n\n**Evidence supporting this scenario:**\n- Rust's 2026 project goals include ~60 proposed initiatives [16], some of which may produce framework-relevant language features\n- The async Rust ecosystem (referenced in Rust Internals discussions about \"maybe async\" [20]) is evolving in ways that could enable new framework architectures\n- WASM/WASI server execution, while not yet mainstream, is advancing and could create demand for Rust frameworks with native WASM compilation targets\n- Dioxus's fullstack model [13] hints at frameworks that span client/server boundaries—a model that web frameworks like Axum do not currently address\n\n**Implications for organizations:**\n- Maintain monitoring of the Rust RFC process and Tokio roadmap for signals\n- Consider modular architecture approaches that isolate framework-specific code, reducing future migration costs\n- Do not make irreversible framework bets at the infrastructure level—use anti-corruption layers\n\n---\n\n## 6. Risk Factors & Considerations\n\n### 6.1 Framework-Specific Risks\n\n**Rocket: Maintenance Velocity Risk**\nRocket v0.5.1 was released May 2024—representing a 25-month gap without a new release as of Q2 2026 [1]. While this may reflect feature completeness rather than abandonment, it creates measurable uncertainty for organizations requiring active security patching, dependency compatibility maintenance, and feature evolution. *Risk Level: Medium–High for new production deployments.*\n\n**Warp: Learning Curve & Complexity Risk**\nWarp's filter-based composition produces advanced generic types that create challenging error messages and steep onboarding curves [2]. For teams without prior functional programming experience, Warp's design model may increase development time in ways that offset its performance characteristics. *Risk Level: Medium for teams without FP background.*\n\n**Salvo: Pre-1.0 API Stability Risk**\nAt version 0.89.x [1], Salvo has not made a 1.0 stability commitment. The high version number (0.89) reflects rapid iteration—which is positive for feature velocity but negative for API stability guarantees. Organizations building long-lived services on Salvo should anticipate breaking API changes between minor versions. *Risk Level: Medium for production deployments.*\n\n**Actix Web: Ecosystem Interoperability Risk**\nActix Web's non-Tower middleware model creates ongoing friction for teams that rely on tower-http, tower-sessions, or other Tower-compatible middleware. As the Rust ecosystem increasingly standardizes on Tower for cross-cutting concerns [9], this gap may widen rather than narrow unless Actix Web introduces Tower compatibility in a future release. *Risk Level: Medium for teams in Tower-heavy ecosystems.*\n\n**Axum: Institutional Dependency Risk**\nAxum's primary advantage—Tokio team backing—is also its primary concentration risk. If the Tokio project's priorities shift or the team's organizational backing changes, Axum's maintenance trajectory could be affected. However, Tokio itself has 111,000+ dependency chains across the Rust ecosystem, making discontinuation effectively impossible without a complete Rust ecosystem restructure. *Risk Level: Low.*\n\n### 6.2 Cross-Framework Risks\n\n**Rust Learning Curve**\nAll five frameworks require meaningful Rust proficiency. The ownership system, borrower checker, and async/await model create a steeper onboarding curve than Go, Python, or Node.js alternatives. Organizations evaluating Rust web frameworks must budget 3–6 months of productivity ramp for developers experienced in other languages—this is not a framework-specific risk but a language-level consideration that affects all framework TCO calculations.\n\n**Async Rust Complexity**\nThe Rust Internals discussion on \"maybe async\" patterns [20] reflects ongoing language-level design work around async programming ergonomics. Until async Rust stabilizes further, framework APIs built on async primitives may face breaking changes or require adaptation as the language evolves. All five frameworks are affected equally by this risk.\n\n**Dependency Version Compatibility**\nRust's semantic versioning model and Cargo's dependency resolution are generally well-designed, but rapid iteration across the ecosystem (Tokio, Hyper, Tower) can create compatibility windows where frameworks lag updated dependencies. Teams should monitor dependency trees and establish update cadences.\n\n**Talent Market Constraints**\nRust developer supply, while growing, remains constrained relative to Go or Python. Organizations committing to Rust web development should account for hiring premiums and longer search timelines. The awesome-rust repository's 56,516 stars and Rust's GitHub momentum [11][15] suggest community growth, but supply-demand dynamics in the talent market represent an ongoing constraint.\n\n### 6.3 Benchmarking Risk\n\nPerformance benchmarking is a domain-specific activity. TechEmpower benchmarks measure specific test types (JSON serialization, database query, plaintext) that may not reflect actual production workload characteristics [21][23]. Organizations should conduct workload-specific benchmarks before making performance-driven framework choices. The ~1% performance differential between Axum and Actix Web [9]—itself a low-confidence finding—is almost certainly noise relative to database query optimization, network topology, and application code efficiency.\n\n---\n\n## 7. Methodology & Data Quality\n\n### 7.1 Research Process\n\nThis report was produced through three rounds of structured research, extracting 80 findings across 25 verified sources. Sources span:\n\n- **Primary technical documentation:** GitHub repository data (stars, commits, release notes) — [24][25][11][14][15]\n- **Official language governance:** Rust Foundation and Inside Rust blog posts — [16][19]\n- **Community discourse:** Reddit r/rust discussions — [9]\n- **Benchmark infrastructure:** TechEmpower Framework Benchmarks — [21][22][23]\n- **Media/analysis content:** Medium articles, YouTube content, FastBuilder.AI blog — [1][2][3]\n- **Comparative analysis:** JetBrains RustRover blog — [10]\n- **Ecosystem catalogues:** awesome-rust repositories — [11][13][14]\n\n### 7.2 Confidence Level Framework\n\nEach finding in the source data was tagged with a confidence level. The distribution and meaning of these levels:\n\n| Confidence Level | Criteria | Count in Dataset |\n|---|---|---|\n| **High** | Verifiable from primary sources (GitHub stats, official releases, dated publications) | 14 findings |\n| **Medium** | Plausible, sourced from credible secondary analysis, consistent across multiple sources | 46 findings |\n| **Low** | Community opinion, unverified claims, single-source assertions, or qualitative assessments | 20 findings |\n\n*Note: \"Low\" confidence does not mean \"incorrect\"—it means the finding should be independently verified before being used as a primary decision input.*\n\n### 7.3 Specific Data Quality Notes\n\n**Version numbers and release dates** (Axum 0.8.8, Actix 4.12.1, etc.) are tagged as **medium confidence** despite appearing precise. They originate from a single secondary source (Medium article [1]) rather than directly verified GitHub release pages. The Axum v0.8.8 release date is corroborated by the GitHub releases page [24], upgrading that specific data point to **high confidence**. Readers are advised to verify Actix Web, Rocket, Warp, and Salvo version numbers directly from their respective GitHub releases pages.\n\n**Performance differential (~1% between Axum and Actix)** is tagged as **low confidence**. It originates from a Reddit community discussion [9], not a controlled benchmark. This finding is included because it is directionally consistent with architectural analysis (both frameworks share Hyper and Tokio foundations) but should not be used as a quantitative decision input.\n\n**Reddit upvote counts** are low-confidence community signals, not statistically representative samples of the developer population. The 93-upvote comment favoring Axum [9] is useful as a directional indicator but does not constitute a survey.\n\n**GitHub star counts** are high confidence as numerical facts but medium confidence as adoption proxies. Stars measure interest/awareness, not active production deployments. No verified data on production deployment counts for any framework was available in the source set.\n\n### 7.4 Data Gaps\n\nThe following information would materially strengthen this analysis but was not available in the verified source set:\n\n1. **Direct GitHub star counts for Actix Web, Rocket, Warp, and Salvo** — enabling apples-to-apples community size comparison with Axum's 25,500 stars\n2. **TechEmpower Round 23 specific per-framework throughput numbers** for Axum, Actix Web, and Salvo\n3. **Production deployment survey data** — no verified survey data on percentage of Rust web developers using each framework in production was available\n4. **Enterprise adoption case studies** beyond safety-critical system deployments [19]\n5. **Benchmark data comparing all five frameworks under identical hardware conditions in 2025–2026**\n6. **Rocket v0.5.x active deployment statistics** — needed to assess whether the 25-month release gap represents maintenance risk or feature completeness\n\n### 7.5 Source Independence Assessment\n\nSeveral findings converge from independent sources on the same conclusions (Axum's Tower integration as primary advantage; Actix Web for maximum performance; Rocket for ergonomics), which increases confidence in those directional conclusions despite individual source confidence ratings. The YouTube video [2], Medium article [1], Reddit thread [9], and FastBuilder.AI analysis [3] reach similar conclusions through independent analysis paths—this convergence is methodologically meaningful.\n\nTwo sources [1][6] are the same URL (cited separately due to separate extraction passes), which slightly inflates apparent source diversity. Readers should weight the Medium article findings accordingly.\n\n---\n\n## 8. Sources\n\n**[1]** Aarambh Dev Hub. \"Rust Web Frameworks in 2026: Axum vs Actix Web vs Rocket vs Warp vs Salvo — Which One Should You Use?\" Medium. https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2\n\n**[2]** YouTube. \"Rust Web Frameworks in 2026: Axum vs Actix vs Rocket.\" Published February 7, 2026. https://www.youtube.com/watch?v=d6VWjKvr4_I\n\n**[3]** FastBuilder.AI. \"Best Rust Web Frameworks for Production 2026.\" https://fastbuilder.ai/blog/best-rust-web-frameworks\n\n**[4]** Reddit r/rust. \"Dreams of Code — Why I'm so bullish about Rust in 2026 (desktop...).\" https://www.reddit.com/r/rust/comments/1r7i00x/dreams_of_code_why_im_so_bullish_about_rust_in/\n\n**[5]** Relipa. \"Web Development Services: Best Scalable Rust Frameworks.\" https://relipa.global/rust-web-development-services/\n\n**[6]** Aarambh Dev Hub. \"Rust Web Frameworks in 2026: Axum vs Actix Web vs Rocket vs Warp vs Salvo\" (second extraction). https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2\n\n**[7]** YouTube. \"Zig vs Rust Performance Benchmark 2026.\" https://www.youtube.com/watch?v=F8p4L3MFuEs\n\n**[8]** FastBuilder.AI. \"Best Rust Web Frameworks for Production 2026\" (second extraction). https://fastbuilder.ai/blog/best-rust-web-frameworks\n\n**[9]** Reddit r/rust. \"actix-web vs axum in 2025–2026.\" https://www.reddit.com/r/rust/comments/1ozt50s/actixweb_vs_axum_in_20252026/\n\n**[10]** JetBrains RustRover Blog. \"Rust VS C++ Comparison for 2026.\" Published December 16, 2025. https://blog.jetbrains.com/rust/2025/12/16/rust-vs-cpp-comparison-for-2026/\n\n**[11]** GitHub. rust-unofficial/awesome-rust. A curated list of Rust code and resources. https://github.com/rust-unofficial/awesome-rust\n\n**[12]** GitHub. tamzid958/claude-architect. \"A plug-and-play framework for AI-assisted architecture.\" https://github.com/tamzid958/claude-architect\n\n**[13]** GitHub. uhub/awesome-rust. https://github.com/uhub/awesome-rust\n\n**[14]** GitHub. flosse/rust-web-framework-comparison. https://github.com/flosse/rust-web-framework-comparison\n\n**[15]** GitHub. EvanLi/Github-Ranking — Top 100 Rust Repositories. https://github.com/EvanLi/Github-Ranking/blob/master/Top100/Rust.md\n\n**[16]** Inside Rust Blog. \"Program Management Update — January 2026.\" Published February 11, 2026. https://blog.rust-lang.org/inside-rust/2026/02/11/program-management-update-2026-01/\n\n**[17]** Rust Users Forum. \"Which GUI framework should I choose?\" https://users.rust-lang.org/t/which-gui-framwork-should-i-choose/137581\n\n**[18]** Rust Users Forum. \"Discussion on Synchronous Crate Concurrency Refactor using Stackful Coroutines Model in Rust.\" https://users.rust-lang.org/t/discussion-on-synchronous-crate-concurrency-refactor-using-stackful-coroutines-model-in-rust/139246\n\n**[19]** Rust Foundation Official Blog. \"What Does It Take to Ship Rust in Safety-Critical?\" Published January 14, 2026. https://blog.rust-lang.org/2026/01/14/what-does-it-take-to-ship-rust-in-safety-critical/\n\n**[20]** Rust Internals Forum. \"Case Against 'Maybe Async' — Language Design.\" https://internals.rust-lang.org/t/case-against-maybe-async/20144\n\n**[21]** TechEmpower. \"Round 23 Results — TechEmpower Framework Benchmarks.\" https://www.techempower.com/benchmarks/\n\n**[22]** TechEmpower Blog. \"How Our Benchmarks Led to a 25× MongoDB Performance Improvement.\" Published March 16, 2026. https://www.techempower.com/blog/2026/03/16/how-our-benchmarks-led-to-a-25x-mongodb-performance-improvement/\n\n**[23]** TechEmpower Blog. \"Framework Benchmarks Round 22.\" Published November 15, 2023. https://www.techempower.com/blog/2023/11/15/framework-benchmarks-round-22/\n\n**[24]** GitHub. tokio-rs/axum — Releases. https://github.com/tokio-rs/axum/releases\n\n**[25]** GitHub. tokio-rs/axum — Repository (HTTP routing and request-handling library). https://github.com/tokio-rs/axum\n\n---\n\n## Appendix A: Decision Framework for Framework Selection\n\nFor practitioners translating this analysis into an actionable framework selection decision, the following decision tree is provided:\n\n```\nSTART: New Rust web service decision\n│\n├─ Do you need HTTP/3 or built-in ACME TLS? ──────────────► SALVO\n│\n├─ Is maximum single-server throughput the primary constraint?\n│ └─ Yes ─────────────────────────────────────────────── ACTIX WEB\n│ └─ No ──────────────────────────────────────────────── Continue\n│\n├─ Does your team have a functional programming background\n│ and prefer compositional routing?\n│ └─ Yes ─────────────────────────────────────────────── WARP\n│ └─ No ──────────────────────────────────────────────── Continue\n│\n├─ Is developer onboarding speed the primary constraint?\n│ └─ Yes ─────────────────────────────────────────────── ROCKET\n│ └─ No ──────────────────────────────────────────────── AXUM (default)\n│\nDEFAULT: General-purpose APIs, Tower integration,\n gRPC coexistence, long-term maintenance\n confidence ─────────────────────────── AXUM\n```\n\n---\n\n## Appendix B: Summary Recommendation Matrix\n\n| Organization Profile | Primary Recommendation | Secondary Option | Avoid |\n|---|---|---|---|\n| Startup / MVP phase | Rocket (speed to market) | Axum | Warp (learning curve) |\n| Scale-up / API Platform | Axum | Actix Web | Rocket (release cadence risk) |\n| High-frequency trading / low-latency | Actix Web | Axum | Salvo (pre-1.0) |\n| Enterprise / long-lived production | Axum | Actix Web | Salvo (pre-1.0) |\n| Protocol-forward / edge services | Salvo | Axum + external HTTP/3 | Warp |\n| FP-oriented engineering team | Warp | Axum | Rocket (macro-heavy) |\n| gRPC-primary services | Axum (via Tonic) | Actix Web | Warp |\n\n*Note: \"Avoid\" recommendations indicate suboptimal fit for the stated profile, not categorical unsuitability. All five frameworks are production-capable.*\n\n---\n\n*This report represents the state of the Rust web framework ecosystem as of Q2 2026, based on data extracted through April 2026. Framework versions, GitHub metrics, and community consensus are subject to change. All scenario probabilities are analytical estimates, not statistical forecasts. Readers should independently verify version-specific technical claims before making production architecture decisions.*", + "sources": [ + { + "title": "Rust Web Frameworks in 2026: Axum vs Actix Web vs Rocket vs ...", + "url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2", + "words": 4476 + }, + { + "title": "Rust Web Frameworks in 2026: Axum vs Actix vs Rocket ... - YouTube", + "url": "https://www.youtube.com/watch?v=d6VWjKvr4_I", + "words": 522 + }, + { + "title": "Best Rust Web Frameworks for Production 2026 | FastBuilder.AI Blog", + "url": "https://fastbuilder.ai/blog/best-rust-web-frameworks", + "words": 494 + }, + { + "title": "Dreams of Code - Why I'm so bullish about Rust in 2026 (desktop ...", + "url": "https://www.reddit.com/r/rust/comments/1r7i00x/dreams_of_code_why_im_so_bullish_about_rust_in/", + "words": 465 + }, + { + "title": "Web Development Services: Best Scalable Rust Frameworks - Relipa", + "url": "https://relipa.global/rust-web-development-services/", + "words": 2423 + }, + { + "title": "Rust Web Frameworks in 2026: Axum vs Actix Web vs Rocket vs ...", + "url": "https://aarambhdevhub.medium.com/rust-web-frameworks-in-2026-axum-vs-actix-web-vs-rocket-vs-warp-vs-salvo-which-one-should-you-2db3792c79a2", + "words": 4476 + }, + { + "title": "Zig vs Rust Performance Benchmark 2026 - YouTube", + "url": "https://www.youtube.com/watch?v=F8p4L3MFuEs", + "words": 58 + }, + { + "title": "Best Rust Web Frameworks for Production 2026 | FastBuilder.AI Blog", + "url": "https://fastbuilder.ai/blog/best-rust-web-frameworks", + "words": 494 + }, + { + "title": "actix-web vs axum in 2025-2026 : r/rust - Reddit", + "url": "https://www.reddit.com/r/rust/comments/1ozt50s/actixweb_vs_axum_in_20252026/", + "words": 1274 + }, + { + "title": "Rust VS C++ Comparison for 2026 | The RustRover Blog", + "url": "https://blog.jetbrains.com/rust/2025/12/16/rust-vs-cpp-comparison-for-2026/", + "words": 3213 + }, + { + "title": "rust-unofficial/awesome-rust: A curated list of Rust code ... - GitHub", + "url": "https://github.com/rust-unofficial/awesome-rust", + "words": 21490 + }, + { + "title": "tamzid958/claude-architect: A plug-and-play framework for ... - GitHub", + "url": "https://github.com/tamzid958/claude-architect", + "words": 2290 + }, + { + "title": "uhub/awesome-rust - GitHub", + "url": "https://github.com/uhub/awesome-rust", + "words": 18138 + }, + { + "title": "flosse/rust-web-framework-comparison - GitHub", + "url": "https://github.com/flosse/rust-web-framework-comparison", + "words": 3470 + }, + { + "title": "Github-Ranking/Top100/Rust.md at master", + "url": "https://github.com/EvanLi/Github-Ranking/blob/master/Top100/Rust.md", + "words": 2783 + }, + { + "title": "Program management update — January 2026 | Inside Rust Blog", + "url": "https://blog.rust-lang.org/inside-rust/2026/02/11/program-management-update-2026-01/", + "words": 2024 + }, + { + "title": "Which GUI framwork should I choose - Rust Users Forum", + "url": "https://users.rust-lang.org/t/which-gui-framwork-should-i-choose/137581", + "words": 1211 + }, + { + "title": "Discussion on Synchronous Crate Concurrency Refactor using ...", + "url": "https://users.rust-lang.org/t/discussion-on-synchronous-crate-concurrency-refactor-using-stackful-coroutines-model-in-rust/139246", + "words": 2821 + }, + { + "title": "What does it take to ship Rust in safety-critical?", + "url": "https://blog.rust-lang.org/2026/01/14/what-does-it-take-to-ship-rust-in-safety-critical/", + "words": 3147 + }, + { + "title": "Case against “maybe `async`” - language design - Rust Internals", + "url": "https://internals.rust-lang.org/t/case-against-maybe-async/20144", + "words": 4375 + }, + { + "title": "Round 23 results - TechEmpower Framework Benchmarks", + "url": "https://www.techempower.com/benchmarks/", + "words": 310 + }, + { + "title": "tfb Archives – TechEmpower", + "url": "https://www.techempower.com/blog/tag/tfb/", + "words": 8912 + }, + { + "title": "Framework Benchmarks Round 22 - TechEmpower", + "url": "https://www.techempower.com/blog/2023/11/15/framework-benchmarks-round-22/", + "words": 784 + }, + { + "title": "Releases · tokio-rs/axum - GitHub", + "url": "https://github.com/tokio-rs/axum/releases", + "words": 1067 + }, + { + "title": "GitHub - tokio-rs/axum: HTTP routing and request-handling library ...", + "url": "https://github.com/tokio-rs/axum", + "words": 904 + } + ], + "sources_count": 25, + "status": "completed", + "total_pages_analyzed": 25 +} \ No newline at end of file