syn

syn 2.0.117 is a #![no_std] recursive-descent parser for Rust source, used by most proc-macros. Its unsafe is concentrated in one heavily documented module, the Cursor over a flat TokenBuffer, whose offset encoding keeps pointer arithmetic in-bounds. One low-severity finding: unbounded parser recursion can stack-overflow at compile time on adversarially nested input.

syn 1.0.109 is a mature Rust source-code parser with narrow runtime surface (no I/O, no concurrency, no crypto) and concentrated, well-motivated unsafe exercised under miri on upstream CI. Two low-severity quality findings, both documentation gaps; safe to deploy.