v0.9.1

Turbo 0.9.1 — Hardening, Security & Correctness

Nightly Build (20260616)

Automated nightly build from master @ 42436d1.

Version: -nightly.20260616
Commit: 42436d1
Date: 2026-06-16

This is a pre-release build. For stable releases, use brew install ZVN-DEV/turbo/turbo-lang or the latest release.

v0.9.0

v0.9.0 — Batteries-included stdlib: 37 new builtins (67 → 104)

v0.8.2

v0.8.2 — Product Hardening Sprint

Release v0.8.2 with compiler parity, dependency install containment, HTTP CORS default hardening, CI gates, website Next upgrade, stale-copy corrections, and GitHub stable Clippy compatibility.

v0.8.1

v0.8.1 — Hardening Sprint: arena/malloc safety, HTTP hardening, JIT d…

v0.8.0

v0.8.0 — The Safe Core

Safety-focused release closing the highest-severity findings from the
0.7.7 product review.

Security:
- rt_exec no longer shells out (AOT + JIT both hardened).
- AOT linker flags allowlisted against [A-Za-z0-9_.+-]+.

Changed:
- rt_pow is overflow-checked; negative exponents abort.
- read_fd_to_string rebuilt to avoid arena realloc corruption.

Added:
- try_read_file / try_write_file return str ! str.
- hashmap_set_int / hashmap_get_int str→int variant.

See CHANGELOG.md for details.

v0.7.7

Cut v0.7.7

See CHANGELOG for the full list -- headline: LLVM backend reaches
feature parity with Cranelift (struct destructure, if-let, optional
chain), runtime amortized O(1) push with atomic refcount ordering,
recursion-depth DoS guard (E0516), playground hardening, pinned GPG
install key, WASM defer lowering fix, and a purge of
agent/tool-primitive claims from public copy (now documented in
COMPATIBILITY.md as "sidecar, not syntax").

v0.7.6

Cut the next Turbo release with a versioned changelog and compiler bu…

v0.7.5

v0.7.5 — pre-launch hardening

Security: overflow-checked array allocation, thread-local string arena,
Acquire/AcqRel refcount ordering, serde_json replaces hand-rolled parser.

Cleanup: all stale agent/agentic references removed from public content.

Testing: edge-case tests for array bounds, JSON, and string operations.
CI: overflow-checks test job added.

v0.7.4

chore: release v0.7.4 — gold-standard audit

Version bump across all 8 crates, CHANGELOG entry, Homebrew formula
version update. SHA256 hashes in the formula are placeholders — the
release CI will push correct hashes to the homebrew-turbo tap.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>