1.6.1

• network.fetch now rejects carriage-return and line-feed characters in the HTTP method and in custom header keys and values, preventing header injection and request smuggling.
• Fixed an out-of-bounds read in vector.archive gzip and deflate decompression that could append uninitialized memory to the output when decompressing inputs larger than 1 GB.
• Fixed a worker thread leaving its mutex locked after an error — including a worker script that fails to load or raises at runtime — which could deadlock a parent waiting on it.
• Fixed running out of memory while growing the call stack being thrown from inside the garbage collector instead of being handled gracefully.
• Fixed a memory leak in the JSON parser when decoding a malformed object key (such as one missing its :).
• Fixed a memory leak in the worker library when a message could not be enqueued under memory pressure.
• Fixed fs.path.join orphaning an internal buffer when a later path component is absolute.
• Fixed a possible capacity overflow when growing a socket's receive buffer.
• Added a NULL guard to the lus_worker_send C API.
• The WASM language server no longer writes debug output to stderr on every document change.

Unstable (02d8c75)

Automated build from commit 02d8c75

Included artifact sets: 5/6 available

⚠️ This is an unstable pre-release build. Use at your own risk.

1.6.0

• Added fromcsv and tocsv to parse CSV files.
• Added VM-intrinsified fastcalls for common standard library functions, reducing call overhead by ~31% (1.46x geometric mean speedup across 57 benchmarks).
  • When the compiler detects a call to a known stdlib function with the expected argument count, it emits OP_FASTCALL instead of OP_CALL. The VM validates at runtime that the function hasn't been replaced and executes the operation inline, falling back to a normal call otherwise.
  • Fastcall emission can be disabled by passing --no-fastcall to lus.
• Added --readonly-env flag that freezes _ENV and all module tables after initialization, enabling fast-dispatch fastcalls that skip runtime validation.
• Added --gc-pause N flag to bound how far the heap may grow past the live set before a new GC cycle starts in incremental mode.
• Added --strip-debug flag that drops debug information from every loaded chunk to save memory (~15% of loaded-code memory on small chunks, more on line-heavy files)
• Regular long strings no longer store a redundant content pointer, saving 8 bytes per long string.
• The string table now grows at a 1.5 load factor instead of 1.0, shrinking its bucket array by up to a third for string-heavy programs.
• for ... in pairs(t)/ipairs(t)/next, t loops over tables now walk the table directly in the VM instead of calling the iterator function each step (pairs ~1.8x, ipairs ~2.3x faster).
• Indexing tables with string variables (t[k]) now takes the same short-string fast path as constant fields, ~15% faster.
• Integer-to-string conversion uses a direct conversion loop instead of snprintf (~20% faster interpolation-heavy code).
• Release binaries for Linux and macOS are now built with profile-guided optimization (tools/pgo-build.sh), 15–45% faster across VM micro-benchmarks than a plain release build.
• The worker library no longer pre-allocates a table from an untrusted declared size while deserializing messages.
• Workers now inherit their parent's pledges (sealed).
• fs permission checks now canonicalize paths and fail closed.
• network:http/network:tcp permission checks now match the URL/host structurally, so a pledge for example.com no longer also permits example.com.net.
• Passing any -P/--pledge permission now seals the pledge store after startup.
• Replaced the short-string hash with a full-content hash.
• Fixed network.tcp.bind not checking network:tcp permission.
• Fixed fs.createdirectory and fs.createlink not checking fs:write permission.
• Fixed fs.type and fs.follow not checking fs:read permission.
• Fixed JSON parser not handling \b, \f, \/, and \uXXXX escape sequences in object keys.
• Fixed msgqueue_push crashing on allocation failure in the worker library.
• Fixed nested catch blocks in the same function corrupting control flow on a subsequent error.
• Fixed catch not closing to-be-closed variables when catching an error, which corrupted state when catching errors raised by standard-library functions that build internal buffers.
• Fixed slice expressions not validating that their bounds are integers.
• Fixed slicing an inline table constructor (e.g. ({1,2,3})[a,b]) producing the wrong result.
• Fixed table.clone(t, true) crashing on deeply nested tables.
• Fixed debug.parse leaving the garbage collector permanently disabled if it ran out of memory while building its result.
• Fixed an intermittent attempt to modify a readonly table error caused by a value collision between the readonly-table flag and the table pre-set hash-node encoding.
• Fixed a buffer overflow in the Windows path canonicalizer on over-long paths.
• Gated the io library (io.open, io.lines, io.input, io.output, io.tmpfile) behind fs:read/fs:write pledges.
• Gated native module loading (package.loadlib and require of C modules) behind the load and fs:read pledges.
• Gated os.getenv behind a new env pledge and os.tmpname behind fs:write.
• Backport upstream Lua 5.5 fixes:
  • lua/lua@3360710
  • lua/lua@b60e2bc
  • lua/lua@10eb89d
  • lua/lua@36d5d2b
  • lua/lua@377cbea
  • lua/lua@51269bd
  • lua/lua@f1bb277
  • lua/lua@efddc23
  • lua/lua@c037162
  • lua/lua@29cf284
  • lua/lua@d0bd25d
  • lua/lua@3228a97
  • lua/lua@4c5d506
  • lua/lua@ae23e72
  • lua/lua@0da6d32
  • lua/lua@36c1f6d
  • lua/lua@53b41d0

table

• Added table.sum to compute the sum of numeric values.
• Added table.mean to compute the arithmetic mean.
• Added table.median to compute the median.
• Added table.stdev to compute the standard deviation.
• Added table.map to apply a function to each element.
• Added table.filter to select elements by predicate.
• Added table.reduce to fold a table into a single value.
• Added table.groupby to group elements by a key function.
• Added table.sortby to sort in-place by a key function.
• Added table.zip to combine tables element-wise into tuples.
• Added table.unzip to split tuples into separate tables.
• Added table.transpose to transpose a 2D matrix.
• Added table.reshape to reshape a 1D array into a matrix.
• Added table.compact (and C API lua_compacttable) to shrink a table's internal storage to fit its current contents.

string

• Added string.split to split a string on a delimiter.
• Added string.join to join table elements with a delimiter.
• Added string.trim to remove leading and trailing characters.
• Added string.ltrim to remove leading characters.
• Added string.rtrim to remove trailing characters.

vector

• Added vector.archive.gzip.compress and vector.archive.gzip.decompress for gzip compression.
• Added vector.archive.deflate.compress and vector.archive.deflate.decompress for raw deflate compression.
• Added vector.archive.zstd.compress and vector.archive.zstd.decompress for Zstandard compression.
• Added vector.archive.brotli.compress and vector.archive.brotli.decompress for Brotli compression.
• Added vector.archive.lz4.compress, vector.archive.lz4.decompress, and vector.archive.lz4.decompress_hc for LZ4 compression.

1.5.1

• Fixed WASM build targeting.

v1.5.0

• Added string interpolation.
• Added runtime attributes for altering local assignments.
• Added error-processing handlers to catch expressions.
• Added initial language server foundation and VSCode extension.
• Enum ordering comparison across different enum roots now raises a runtime error.
• Brought debug.parse to parity with the internal parser.
• Fixed debug.parse serializing linked lists as single nodes instead of arrays.
• Fixed buffer overflow in worker message serialization when arena allocation fails.
• Fixed missing recursion depth limit in worker message deserialization.
• Fixed integer overflow in deser_read bounds check that could allow out-of-bounds reads with large size_t values.
• Fixed negative or huge table counts in worker deserialization being passed to lua_createtable unchecked.
• Fixed missing luaL_checkstack in worker deserialization that could exhaust the Lua stack on deeply nested tables.
• Fixed uninitialized constant slots in enum parsing that could cause a GC crash when luaM_growvector expanded the constants array.
• Fixed race condition in worker receive context signaling that could cause a use-after-free when lib_receive destroys a stack-allocated context while a worker thread is still accessing it.
• Fixed missing bounds checking in bundle index parser.
• adjustlocalvars now validates the register limit before assignment.

1.4.0

• Completed phase-out of function-level protected execution.
  • For software embedding Lus and only making use of the front-facing C APIs like lua_pcall, this should not impact you as the functions have been retrofit with compatibility layers interfacing with the new catch system.
• Added --standalone to generate standalone binaries.
• Added local groups for grouping stack-allocated variables.
• Added vector type and library for buffers.
• Added slices for strings, tables, and vectors.
• Added table.clone(t, deep?) to create copies of tables.
• Added catch[handler] expr syntax to allow expression-level xpcall-like functionality.
• from deconstruction can now be done in if/while assignments.
• Refactored actions workflow.
• Various runtime optimizations:
  • Constant-time O(1) string hashing using sparse ARX algorithm.
  • Aligned string comparison for faster ordering.
  • Alias-aware table loops for improved compiler optimization.
  • O(1) catch handler lookup via activeCatch pointer.
  • Cold path extraction for trap handling and catch error recovery.
  • Arena-aware allocations where performance can be reliably improved.
  • Moved slice logic out of the VM and into its own luaV_slice function.
• Fixed our Windows builder, meaning Windows support has finally returned.
• Fixed race condition in worker.receive that could cause lost wakeups.
• Fixed attribute usage in if-assignments and while-assignments.
• Fixed deeply nested JSON encoding/decoding crashing.

1.3.0

• Added scoped assignments in while loops.
• OpenBSD-inspired pledge mechanism to declare and restrict permissions.
• Added string.transcode for converting between encodings.
• Added network.fetch, network.tcp, and network.udp.
• Added debug.parse to generate ASTs from Lus code.
• Added worker library for concurrency.
• Backport Lua 5.5 RC3 and stable fixes:
  • lua/lua@8164d09
  • lua/lua@104b0fc
  • lua/lua@3d03ae5
  • lua/lua@a5522f0
  • lua/lua@578ae57
  • lua/lua@632a71b
  • lua/lua@962f444
  • lua/lua@45c7ae5
  • lua/lua@5cfc725
  • lua/lua@2a7cf4f

1.2.0

• Added fs library for operating around the file system.
• Removed os.rename in favor of fs.move.
• Removed os.remove in favor of fs.remove.
• Fixed incorrect version strings.
• Fixed H3 test harness not running.
• Fixed catch erroring when parsed as a statement.
• H1 JSON test now includes the RFC8259 dataset.
• H1 JSON test now makes use of fs library.

1.1.0

• Added tojson and fromjson functions for JSON serialization and deserialization.

1.0.0

Note

This changelog denotes differences between Lus and Lua 5.5 RC 2. Lua 5.5 most (in)famously introduces the global assignment statement; it is not a Lus-specific feature.

• Added table deconstruction with from assignment.
• Added scoped assignments in if/elseif conditionals.
• Added catch expression for error handling in expressions.
• Added optional chaining with the ? suffix operator.
• Added first-class enums with the enum keyword.
• Added os.platform function that returns the platform name.
• Added support for WebAssembly builds.
• Added pre-built test suites in four harnesses.
• Removed pcall and xpcall in favor of catch.
• Upgraded the build system from make to meson.