v0.2.0-beta

Fairyfly v0.2.0-beta

First beta since v0.1.0-canary (2026-10-06). 35 non-merge commits across
110 files (+10,338 / −1,994): UDP and subprocesses, HTTP proxy support,
direct package sources, a fuzzing/coverage pipeline, and a round of
reliability fixes.

Highlights

UDP sockets

New udp global with POSIX-shaped calls: udp.socket("inet" | "inet6"),
then bind, connect, sendto, recvfrom, send, recv, getsockname,
getpeername, close. sendto/recvfrom are Promise-based; payloads are
binary (Uint8Array / ArrayBuffer); addresses are IP literals only.
Up to 64 sockets per process.

child_process

spawn, exec, and execSync with captured stdout/stderr, exit codes
and signals, cwd / env / maxBuffer / stdio options, and a maximum of
8 concurrent children. POSIX only (macOS/Linux), fully evented on the main
loop — safe alongside http.serve, fetch, and Worker.
process.stats().child now reports spawn/truncation/heap counters.

HTTP proxies for fetch and WebSocket

HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, NO_PROXY (plus lowercase forms)
are read once at startup. http:// uses forward proxying or CONNECT;
https:// and wss:// tunnel through CONNECT with real end-to-end TLS.
Proxy credentials are supported, and NO_PROXY routes to a direct client.
No SOCKS; the proxy URL itself must be http://.

Direct package sources in ff imprint

ff imprint now accepts github:owner/repo[#ref], codeberg:owner/repo[#ref],
forge HTTPS URLs, and direct .tar.gz / .tgz archives. The package
name/version come from the archive's root package.json; ff.lock records
the normalized source, archive URL, and a computed SHA-512 integrity hash,
verified on lock-based reinstalls.

CLI polish

One presentation layer for ff's own messages: TTY- and NO_COLOR-aware
colors, ✓ / → / ✗ status glyphs, aligned help output, and consistent
error text across commands. JS runtime exceptions keep their existing
Error: … rendering.

Response / Request JSON fix

Bodies are now NUL-terminated correctly for QuickJS's JS_ParseJSON in every
path — pool-backed, ArrayBuffer-owned, cloned, and larger than the stack
scratch buffer. Fixes intermittent unexpected data at the end failures
when parsing JSON responses.

Performance & internals

• SIMD header lookup/lowercasing; shared scan width and repeat-mask
  broadcast in the parser hot paths.
• libxev bumped to a maintainer fork fixing kqueue UDP IPv6 address
  truncation.
• semver: guard u32 overflow in wildcard upper bounds.
• Release binaries are DWARF-stripped (smaller downloads); the release
  workflow now fails if debug sections survive.

Testing & tooling

• Deterministic, seed-driven parser fuzzers: zig build fuzz -- <target|smoke> [seed] and make fuzz / make fuzz-one / make fuzz-canary.
  Targets: WS frames, HTTP/1.1 requests + headers (SIMD vs scalar oracle),
  semver, TLS PEM, UTF-8, HTTP/2 session state. The canary target must fail,
  proving failures propagate.
• kcov line coverage via make cov (baseline ~96.8% on the test binary plus
  six fuzzers), a CI fuzz-smoke job, and a nightly fuzz workflow seeded by
  commit SHA.
• Unit tests consolidated under src/unit_tests.zig and registered with
  zig build test.
• FFI test fixture is hermetic: built with zig cc, always rebuilt, and the
  committed macOS dylib is no longer tracked. New make fmt (matches the CI
  tidy job) and make doctor (toolchain diagnostics).

Fixes

• fetch / Response.json(): NUL-terminated bodies (see above).
• UDP: defer slot reuse until cancellation; harden fuzzer argument handling.
• semver wildcard upper-bound overflow.
• Docker: Alpine 3.24, PostgreSQL 18 in docker-compose.yml; release
  workflow fixes (existing releases, simplified matrix).

Docs

17 new pages (29 → 46): udp, child_process, console, crypto,
process, request-response, text-encoding, url, websocket, worker,
performance, architecture, concurrency, event loop, errors, logging, and
compatibility — plus CONTRIBUTING, CODE_OF_CONDUCT, SECURITY, and
SPONSORS.

Install

• Prebuilt: curl -fsSL https://raw.githubusercontent.com/AbdElMajidOuhamane/ff/main/install.sh | sh
• Assets: ff-linux-x86_64, ff-linux-aarch64, ff-macos-aarch64,
  ff-macos-x86_64 (SHA-256 in sha256sums.txt)
• Docker: ghcr.io/abdelmajidouhamane/ff:v0.2.0-beta
• From source: ./scripts/fetch-vendors.sh && make build

Heads-up

• Prebuilt binaries ship without FFI (-Dffi=false) on every platform,
  matching the release/Docker builds. Use a source build if you need
  ffi.dlopen.
• CLI help and status output changed formatting; scripts that parse ff's
  stderr should be re-checked.
• This is a beta: ff upgrade follows GitHub's latest release, so a
  release marked "pre-release" is not picked up automatically.

v0.1.0-canary

What's Changed

• ff quick cnry by @AbdElMajidOuhamane in #1
• Fairyfly canary by @AbdElMajidOuhamane in #2

New Contributors

• @AbdElMajidOuhamane made their first contribution in #1

Full Changelog: https://github.com/AbdElMajidOuhamane/ff/commits/v0.1.0-canary