Releases

Restores recorded Hub deployments across restarts, downloads missing artifacts, and supports cached offline boots. Makes init and update honor manifest source directories and selected lock files. Adds ES256 JWT signing and verification with P-256 keys, stricter algorithm validation, and Temporal workflow replay support. Updates go-lua to v1.6.12, gRPC, and AWS SDK dependencies.

Fixed cloud storage acquisition-denied errors, stale template caching, and offline/dependency lock handling, while preserving Linux AMD64 glibc compatibility.

Hotfix restoring Linux AMD64 compatibility after the ubuntu-latest runner moved to Ubuntu 26.04. Release and nightly builds now use Ubuntu 22.04, and each Linux AMD64 artifact must execute successfully inside a clean Ubuntu 22.04 container before upload. Supersedes withdrawn v0.3.53a; includes its background compile-cache pruning, live policy authority, qualified policy-group resolution, go-lua v1.6.11, and dependency fixes.

Fixes boot stalls caused by synchronous compile-cache pruning. Cleanup runs in the background after 512 successful writes by default, remains configurable through lua.cache.prune_interval, and reports incomplete cache scans. Token validation now honors live policies using Runtime's native groups/policies fields while retaining credential ceilings, and expression policies resolve qualified group names correctly. Includes go-lua v1.6.11 for native string.gsub callbacks, RabbitMQ v1.16.0, and SQS v1.52.5.

Fix derived Lua loggers to use the active invocation context while preserving independent child loggers and caller fields (#1000). Refresh module filesystems across updates, undo and redo; coordinate CLI changes and startup repairs with running runtimes; and wait for filesystem registration before dependent services start (#995). Server startup now exits nonzero when a required boot gate fails (#998). Update go-lua to v1.6.10 and the Go toolchain to 1.27.3, with updated lint tooling (#1001, #999). Add regression coverage for transitive security metadata updates, rollback and offline restart (#980).

Windows limitation: module trees held open by os.Root cannot be replaced until those handles close.

Fix private-module installs after login, token changes, or logout without restarting the runtime. Long-lived Hub clients now read current credentials for each request while keeping credentials off external artifact transfers (#997). Also updates the Temporal API dependency to 1.64.0 (#996).

Wippy Runtime v0.3.50a preserves fractional seconds when SQL timestamps are returned to Lua (#983). PostgreSQL timestamp cursors now round-trip correctly, keeping Session checkpoint history anchored at the intended message. This is the Runtime prerequisite for the pending Session checkpoint-task fixes; those Lua package fixes are released separately.

The Runtime now includes go-lua v1.6.9 (#994), which avoids repeated traversal of shared type graphs and uses iterative walks to prevent stack exhaustion on deeply nested types. Native manifests are finalized before checker namespaces are published (#990).

Completed one-shot startup gates remain satisfied when their dependents restart (#984). HTTP request cleanup drains unread bodies while preserving ownership of hijacked connections (#987). Hub updates now relink unchanged modules after parameter changes, preserve resident manifests during batch updates, and honor declared replacement versions (#986, #988, #991). Filesystem stat results expose OS file identity (#985).

Dependency updates cover AWS S3 manager and SQS, klauspost/compress, Temporal SDK, and Connect RPC. All 22 current-main checks passed before release.

Wippy Runtime v0.3.49a updates go-lua to v1.6.8 with fixes for table traversal after deleting the current key, sparse-table mutations, native Go function keys and comparison metamethods, and repeated state closure. Runtime regression coverage exercises cursor deletion and shared native method identity.

Supervised services now stop before their infrastructure during shutdown, preventing TTY closure from being mistaken for an application exit and losing saved Bee windows.

The release also includes the patched Excelize build for the reported v2.11.0 security advisories, Docker client cancellation and deadline fixes during connection-upgrade handshakes, and AWS, Temporal, Tailscale, Prometheus, Go x/*, and PHP parser dependency updates.

Fixes duplicated OpenAI replies caused by captured locals being closed too early, preserves captures during nested breaks and suspended-task cleanup, and bounds sparse-table allocation with Go-lua v1.6.7. Preserves array/object metadata during payload copying, structured token-validation error kinds and details, and WebSocket JOIN/LEAVE ordering during target handoffs.

For Lua tables with holes, the length operator may select a different valid border; use table.maxn() when the highest numeric key is required. Runtime-managed compile caches refresh automatically; independently precompiled Lua artifacts should be rebuilt with the corrected compiler.

Runtime v0.3.47a improves durable Hub updates, cold restarts, service supervision, SQL readiness, and asynchronous cleanup.

Durable application updates

• Cold restarts restore saved Hub selections and artifact digests against the original deployment baseline, including cached offline restarts.
• Root-batch updates preserve and checkpoint resolved requirement bindings. Version restore retains unchanged runtime-installed modules.
• Missing required settings retain structured, actionable install diagnostics. Environment-backed entries load after their providers.

Reliable service lifecycle

• Supervisor updates run replacement code, report coherent lifecycle state, preserve exponential retry backoff, and support optional restart-intensity limits.
• Startup and shutdown retain ownership of late-starting services and preserve terminal status. Lifecycle actions follow registry transaction completion.
• Boot commands fail promptly when a prerequisite readiness gate fails. SQL resources become routable before their registry entries are accepted.
• Docker startup follows lifecycle cancellation and safely handles shutdown during startup.

Native futures and lower allocation churn

• Native async futures publish their actual outcome after function and retained nested-frame cleanup. Independently spawned actors keep their own lifetimes and resources.
• Cancellation requests remain non-blocking. Callers needing the final outcome await the existing future response before reading the result.
• The completed-call benchmark uses approximately 905 bytes and 19 allocations per call, compared with 937 bytes and 20 allocations previously.
• Failed result delivery releases its sender-owned message and payload references.

Security, workspace development, and runtime correctness

• Token validation resolves live subject authority, and validated HTTP request frames remain writable.
• The owner_safe filesystem policy resolves contained absolute links through the retained root and rejects FIFO targets promptly.
• Rooted applications can opt into local host dependencies with workspace.include_host_dependencies and supply unpublished modules through workspace replacements.
• Module packs have reproducible timestamps. SQL driver failures retain structured error kinds and details.
• Stable go-lua v1.6.5 corrects protected-call upvalue unwinding and coroutine panic diagnostics, and reduces type-name allocation overhead.
• Dependencies include SQLite driver v1.53.0 and LangChainGo v0.1.15.

Known dependency risk

Excelize v2.11.0 retains upstream security advisories affecting malformed or untrusted spreadsheets, including denial-of-service risks. Applications processing untrusted workbooks should account for this risk.

Release artifacts cover Linux amd64/arm64, macOS amd64/arm64, and Windows amd64, with SHA-256 checksums and detached Ed25519 signatures.