v3.8.6

3.8.6 (2026-07-10)

Bug Fixes

• add depth limit to json.is_valid to prevent stack overflow on deeply nested input (#2020) (0914ab7)
• add optional host parameter to net.listen() and server.listen() to allow interface-specific binding (#2017) (63e84e6)
• add scope_destroy() to release scope memory at all typechecker call sites (b6a1ac6)
• add type_pool_reset() to free heap strings from type pool on shutdown (f9ef806)
• add typechecker_free() and typetable_free() to release typechecker memory (dce12dc)
• cap HTTP server at 1024 concurrent connections and apply 30s read timeout per connection (#2011) (7d2d30d)
• cap os.exec stdout/stderr collection at 64 MiB per stream to prevent memory exhaustion (#2010) (ae9b26d)
• correct element type parsing for nested bracket types in array initializers (2b61fff)
• free global_init buffer in codegen_destroy() (6b9ea93)
• heap-allocate builtin struct field arrays to prevent free-of-static crash (60e273b)
• initialize ns_func_names fields in codegen_create to prevent garbage free (1ab0464)
• json.encode always quotes map[string:string] values, escape all control chars (#2019) (c490066)
• reject CORS origins containing CR or LF to prevent HTTP header injection (P0101) (#2009) (3188d1d)
• reject https:// URLs in http module with explicit error instead of silent plaintext fallback (#2007) (b25c633)
• repair result-clobbering NULL and dangling stack pointers in typechecker (#2040, #2045) (e74831a)
• report 'unexpected end of interpolation expression' instead of EOF in ${...} sub-parser (#2018) (ef0369d)
• resolve rvalue address-of bug in stdlib codegen (#2053, #2052) (2657125)
• resolve string enum element type in array indexing and iteration (1a0956a)
• resolve wildcard-returned enums as TK_ENUM instead of TK_STRUCT (#2054) (a90e756)
• send HTTP request headers and body separately to remove 8KB body size limit (#2013) (8df4f3e)
• strdup type_array inputs and resolve remaining free-of-non-heap crashes (ca7aa46)
• track and free struct-namespaced function name strings in codegen (480c807)
• use arena allocation for named-arg reorder buffer in tc_resolve_named_args() (58cc8b4)
• use correct C type for integer enum array element access (bb62a4a)
• use lvalue check in addr-of wrapping to preserve mutation semantics (#2053, #2052) (c8becba)

Performance Improvements

• add early-out for equal names in tc_same_enum_type and tc_same_struct_type (#2043) (79d9dc3)
• add parallel index array to find_enum_index to eliminate O(n) scan after bsearch (#2042) (963cbfc)
• cache tc_lookup_using_constant result to avoid double call (#2040) (180d0d7)
• eliminate O(n) inner loop in tc_lookup_using_constant via pre-computed import index (#2041) (ce92138)
• fix several remaining memory leaks in typechecker and codegen (5f513eb)
• replace 202 unconditional stack diagnostic buffers with arena allocation via tc_fmt helper (#2044) (287ec00)
• replace strlen+sprintf heap allocs with snprintf into stack buffer in name-mangling paths (#2045) (1ee7731)