·
18 commits
to main
since this release
Immutable
release. Only release title and notes can be modified.
A focused follow-up to v0.8.0.
First-party HTTP server
The graph-UI web server has been reimplemented from scratch as a lean in-house module — a refactor that removes the last third-party server library from the binary. The new transport (src/ui/httpd.c) is purpose-built for what the UI actually needs:
- Localhost-only by construction — binds
127.0.0.1exclusively, with platform-correct socket options on every OS. - Strict HTTP/1.1 parsing — hard request caps (16 KB head / 1 MB body), strict CRLF handling, raw path matching, and a per-connection receive deadline.
- Simple by design — one request per connection (
Connection: close); no keep-alive state machine, no chunked encoding.
A new 28-test transport and routing suite covers the parsing edge cases, CORS policy, RPC dispatch, and shutdown behavior. All routes, status codes, and the localhost-only CORS policy behave exactly as before.
Also in this release
- Slimmer grammar set — the
nimgrammar (by far the largest vendored grammar at 66 MB) was dropped; 158 languages remain supported. - Attribution bundle in every archive — release archives now include
THIRD_PARTY_NOTICES.md, a consolidated file with the license texts of all vendored components. Homebrew and AUR installs place it alongside the binary. - Richer SBOM — per-component license and version metadata for everything compiled into the binary.
- Test suite: 5,604 tests (+27 vs v0.8.0).
Update
codebase-memory-mcp updateor grab the binaries below — every asset is signed, checksummed, and attested as usual.
Security Verification
All release binaries scanned with 70+ antivirus engines — 0 detections.
| Binary | SHA-256 | VirusTotal |
|---|---|---|
darwin-amd64 |
6cd48f218bf135a7b831... |
0/72 ✅ |
darwin-arm64 |
595cedd259200424f3d9... |
0/72 ✅ |
linux-amd64 |
58a0e1a968dacd324cde... |
0/72 ✅ |
linux-arm64 |
45d5c33d59d55b998b98... |
0/72 ✅ |
windows-amd64 |
12375e6a39a31f003d77... |
0/72 ✅ |