Version History

Version History

Every tagged release of NyxOS, oldest first. The authoritative log is the release table in AGENTS.md at the repository root; this page is the reader-facing summary of it.

Current release: v5.9.86. Latest LTS: v5.9.0-LTS.

See also: Home, Architecture, Building

Reading this page

Versions are grouped into the eras below. Development is deliberately incremental — most releases add exactly one capability and verify it, which is why the patch numbers run so high. Releases whose entry names a bug are usually more interesting than the ones that name a feature.

Foundations — v1.0 to v2.4

A 32-bit kernel finds its feet: VGA text, interrupts, a ramdisk VFS, the first network packets, DOOM, and the first window compositor.

Version	Change
v1.0.0	Base kernel
v1.1.0	Ramdisk VFS + shell commands
v1.2.0	Real networking (RTL8139, ARP, IP, UDP, ICMP/ping)
v2.0.0	Clean slate: removed all hacking/offensive code
v2.0.1	DOOM game integration (VGA mode 13h, doomgeneric, shell command)
v2.1.0	Preemptive multitasking, interrupt-driven I/O, pipe support, diff command
v2.1.1	Full TCP stack, RTL8139 fixes, GUI/window compositor, PC speaker, bitmap font
v2.2.0	GUI auto-boot: NyxOS Desktop launches at startup instead of text shell
v2.3.0	Real EXT2 read support: VFS mount layer, auto-mount at /mnt, ls/cd/cat on ext2
v2.4.0	Sound Blaster 16 DMA/IRQ audio driver (sb16play command, DMA buffer fix, auto-init)

x86_64 and ring 3 — v3.0 to v4.2

The rewrite to long mode: 4-level paging, ELF64, syscall/sysret, a higher-half kernel, NX and SMEP.

Version	Change
v3.0.0	ELF userspace loader, initramfs, per-process paging, ring 3 execution, int 0x80 syscalls
v3.1.0	RTC driver, more syscalls (open/read/close/getpid/sbrk/fsize/exec), libc (printf/malloc/snprintf), initramfs auto-boot, desktop polish (right-click, settings, wallpaper)
v4.0.0	Full x86_64 native (long mode, 4-level paging, syscall/sysret, ELF64, ring 3), clean 32-bit dead code removal, docs corrected
v4.1.0	Higher-half kernel mapping (PML4[256] mirror), user/kernel page-table isolation (user has no identity mapping), CR3 switching in ISR/IRQ/syscall entries, scheduler uses next_cr3
v4.2.0	NX bit (No-Execute) + SMEP (Supervisor Mode Execution Prevention), PAGE_NX added to user stack/heap/data, Local APIC + I/O APIC init, CPUID detection, IST (Interrupt Stack Table) for double fault (#8) and NMI (#2), repo cleanup (README x86_64, .gitignore, AGENTS.md)

Desktop, login and hardening — v5.0 to v5.6

A real GUI application suite, the boot animation and login screen, the syscall-boundary audit, and the first ring-3 programs that actually run.

Version	Change
v5.0.0	Full GUI application suite: Text Editor (file open/save, cursor nav), Image Viewer (test pattern, zoom/pan), Sound Test (PC speaker + SB16 sine/square/sweep). Brighter wallpaper gradient (sky-blue + grass). 8 desktop icons. All placeholders replaced with real apps. No crashes, zero warnings in build
v5.1.0	Stability and bugfix release: TSS struct alignment fix (IST pointers shifted 4 bytes early → triple fault on double fault/NMI), GDT limit correction, APIC/PIC IRQ masking fix (PIC left fully masked when APIC active), switch_to_user_process inline asm operand reversal fix, VGA 8x16 font data corruption fix (marker bytes inserted in each glyph → garbage text in GUI). QEMU display changed to sdl for Windows compatibility
v5.3.0	Login system: boot animation (~5s, NyxOS-themed, 23-step progress bar), credential storage on EXT2 (/etc/passwd), framebuffer login screen with keyboard input, default user nyx/nyx, fallback when no EXT2 disk, login failure → reboot, success → launch desktop
v5.4.0	Audit/hardening pass: fixed clean-build break (sha256.h pulled host <stdint.h>, conflicting with kernel int types); build is warning-free again (0 warnings from ~160 — pointer-truncation casts routed through uintptr_t, keyboard keymap over-initializers trimmed, dead code removed). Security: ring-3 syscall boundary hardened — user pointers validated against the canonical user half, and userspace now gets small integer fds via a translation table instead of raw (forgeable) kernel VFS handles (closed an info-leak + arbitrary-kernel-r/w reachable via exec). Panic handler now prints faulting RIP/CS/ring/error
v5.5.0	Ring-3 userspace now actually runs
v5.6.0	Userspace cleanup + heap bug

Scheduling, networking and SMP — v5.7.x

The preemptive scheduler, job control, the network stack made to actually work end to end, demand paging, copy-on-write, and multi-core bringup.

Version	Change
v5.7.0	Per-fd offsets / streaming file I/O
v5.7.1	Fd-based I/O routes to EXT2 mounts (persistent files)
v5.7.2	Fd-based readdir on EXT2 mounts (file-manager can browse disk)
v5.7.3	Networking works — DHCP completes
v5.7.4	Full network stack: DNS + TCP + HTTP work
v5.7.5	GUI stability fixed — the KERNEL_BASE+3 crash is dead
v5.7.6	Preemptive scheduler + timer live
v5.7.7	Preemptive ring-3 processes
v5.7.8	wait() / job control — foreground & background jobs
v5.7.9	Legacy blocking-exec path removed
v5.7.10	Blocked sleep() + safe kill (timer wait queue)
v5.7.11	Shell job control — jobs + wait
v5.7.12	Priority scheduling (weighted round-robin)
v5.7.13	VFS re-entrancy audit + guard
v5.7.14	Per-process file descriptors
v5.7.15	Idle desktop yields CPU + nice/renice
v5.7.16	File manager: real drag-and-drop into folders
v5.7.17	Networking: loopback + ICMP echo replies + a real ping
v5.7.18	TCP retransmission (RTO) + robust multi-segment receive
v5.7.19	TCP passive open (listen/accept) + in-guest loopback TCP
v5.7.20	NIC-side TCP listen — NyxOS serves HTTP to real clients
v5.7.21	Per-shell CWD + full-path pwd/prompt
v5.7.22	SMP: multi-core bringup verified + exposed (cpus)
v5.7.23	Demand paging + copy-on-write (serviced from the #PF handler)
v5.7.24	GitHub Wiki + clean up
v5.7.25	Real fork() — copy-on-write process clone (the VM capstone)

Userspace comes alive — v5.8.0 to v5.8.49

fork/execve/pipes/signals/mmap, the ring-3 shell, coreutils, /proc and /dev, the shared libc, and the first TUI applications.

Version	Change
v5.8.0	Nyx C language runtime + first .nyx program on NyxOS
v5.8.1	waitpid() — a parent reaps its children from ring 3
v5.8.2	Per-process syscall stacks → waitpid() truly blocks
v5.8.3	Anonymous pipes + blocking read() — real cross-process IPC
v5.8.4	execve() — replace a process image (fork→exec→wait complete)
v5.8.5	dup2() — fd redirection (the shell-pipeline primitive)
v5.8.6	execve() argv passing — programs receive real command-line arguments
v5.8.7	A userspace shell with pipelines — the process-model capstone, zero kernel changes
v5.8.8	Interactive stdin — a live shell you type into
v5.8.9	Lazy sbrk — the demand-paged heap (last VM roadmap item)
v5.8.10	Coreutils (cat/wc/ls) + shell background jobs (&)
v5.8.11	Signals — kill/signal/handlers + Ctrl-C
v5.8.12	mmap/munmap — anonymous demand-zero mappings
v5.8.13	Shell polish — I/O redirection (> >> <) + grep/head/tail
v5.8.14	Shell polish part 2 — cd/pwd/export/$VAR on a per-process CWD
v5.8.15	Userland file tools — mkdir/rm/touch/sort/find (+ a real VFS bug fix)
v5.8.16	Raw tty + shell line editor — arrow-key history and cursor editing (+ a real keyboard-driver bug fix)
v5.8.17	Shell tab completion — commands and paths, zero kernel changes
v5.8.18	File-backed mmap + mprotect
v5.8.19	/dev special files — null/zero/random/urandom, no new syscalls
v5.8.20	6-argument syscalls — mmap gets a real offset
v5.8.21	Userspace ps + kill — process management from ring 3
v5.8.22	/proc filesystem — live kernel state as files (no new syscalls) + real process names
v5.8.23	Userspace top — a live process monitor (+ timed input + terminal clear)
v5.8.24	Foreground jobs no longer freeze the desktop — TUIs run live in the GUI
v5.8.25	edit — a full-screen text editor (terminal cursor addressing + Ctrl keys)
v5.8.26	ANSI colors in the terminal (SGR) — ls --color + a colored editor status bar
v5.8.27	Visual refresh — unified crescent-moon logo (login + nyxfetch) + updated GIFs
v5.8.28	Shared ELF libc — one copy of libc, mapped into every process
v5.8.29	dlopen/dlsym — runtime dynamic loading
v5.8.30	/proc/<pid>/maps — a process's mapped memory regions
v5.8.31	pmap + free — userspace tools over /proc
v5.8.32	env / date / sleep — coreutils + real environment inheritance
v5.8.33	$PATH command resolution — the environment becomes functional
v5.8.34	Terminal scrollback — PgUp/PgDn + mouse wheel + a scrollbar
v5.8.35	More coreutils — cp / mv / uname / whoami / which / clear (+ a real build-system fix)
v5.8.36	Job control — Ctrl-Z stop + jobs/fg/bg with transparent restart
v5.8.37	Shell globbing (*/?) + ~ expansion
v5.8.38	Wallpaper app — a color-picker for the desktop background (purple by default)
v5.8.39	Shell operators — && / || / ; command lists
v5.8.40	Double-buffered compositor — the desktop no longer flickers
v5.8.41	Graphical kernel panic — a visual stop screen instead of a silent freeze
v5.8.42	Shell command substitution $(cmd) (+ two latent kernel bugs it exposed)
v5.8.43	Shell quoting — '...' and "..."
v5.8.44	Ring-3 fault isolation — a crashing program no longer panics the kernel
v5.8.45	Pager — less / more
v5.8.46	Identity map now covers all RAM (was a fixed 64 MB) — fixes the pipeline kernel-panic root cause
v5.8.48	Fix pipeline-corruption root cause #1 — pin the shared-libc master frames un-freeable
v5.8.49	Catchable CPU-exception signals — signal(SIGSEGV/SIGFPE/SIGILL, handler) recovers instead of dying

Sockets, threads and real SMP — v5.8.50 to v5.8.99

BSD sockets from ring 3, poll, alarm, user threads with clone+futex, spinlocks, TLB shootdown, and user processes running on the application processors.

Version	Change
v5.8.50	Panic-screen polish + kernel %x de-doubled
v5.8.51	Network byte order consolidated into htons/htonl/ntohs/ntohl + an IP4_OCTETS display macro (hardening refactor — behavior-preserving)
v5.8.52	Userspace TCP sockets — socket()/connect()/read()/write()/close() wired to the real TCP stack, plus a built-in loopback echo service
v5.8.53	Server-side userspace sockets — bind()/listen()/accept() (a userspace program can now run a TCP server)
v5.8.54	Scheduler fix — a process preempted mid-syscall now resumes on the correct CR3 (a latent crash the busy-polling socket syscalls newly exposed)
v5.8.55	Userspace UDP sockets — socket(SOCK_DGRAM) + sendto()/recvfrom() over the existing udp.c
v5.8.56	nc (netcat) — a userspace tool that bridges stdin/stdout to a TCP or UDP socket, plus a UDP echo service to talk to
v5.8.57	sigsetjmp/siglongjmp — multi-fault recovery (finishes the catchable-signals work from v5.8.49)
v5.8.58	alarm() + SIGALRM — timer-driven signals
v5.8.59	Persistent filesystem — verified end-to-end + polished
v5.8.60	poll() — I/O multiplexing over sockets, pipes, and stdin (the full-duplex / multi-fd primitive)
v5.8.61	nc is now full-duplex (built on v5.8.60's poll())
v5.8.62	The GUI file manager can now browse (and edit) the persistent /mnt ext2 filesystem
v5.8.63	The GUI file manager opens files in the Text Editor (cross-app integration)
v5.8.64	Persistent user accounts on the ext2 disk — useradd survives a reboot; the misleading "EXT2 not available" fallback is fixed
v5.8.65	Account security hardening — random per-user salts, a stronger KDF, a password policy, and login lockout
v5.8.66	Create your own account from the login screen, with a profile picture
v5.8.67	Login fixes — a failed login no longer closes the VM, and the create-account panel no longer overflows
v5.8.68	Login create-panel crash fix — repaint only the active field per keystroke, not the whole panel
v5.8.69	Taskbar user menu — click your badge to change your profile picture or log out (back to the login, no reboot)
v5.8.70	Per-user home directories — the Terminal and File Manager start in /home/<user>
v5.8.71	Starter content for a new home directory
v5.8.72	Minesweeper — a GUI game (new app) + a right-click routing fix
v5.8.73	wget — a userspace HTTP client over the TCP sockets, with its own DNS-over-UDP resolver
v5.8.74	exec forwards argv — userspace tools run with arguments straight from the kernel shell
v5.8.75	The kernel shell auto-execs userspace ELFs — run tools by bare name, no exec prefix
v5.8.76	Tab-completion now includes userspace ELFs
v5.8.77	wget follows redirects + an open command = download-and-read
v5.8.78	Concurrent multi-process sockets: hardening + a repro — the "sockets stay single-process" garble no longer reproduces
v5.8.79	Root-caused the v5.8.78 concurrent-socket "Heisenbug": it was a conn-table capacity limit masked by a Makefile stale-build gap — and fixed the Makefile
v5.8.80	Four POSIX file syscalls — stat/fstat/lseek/getppid (SYS 44–47) — plus two Makefile build-correctness fixes that had been silently shipping stale kernels
v5.8.81	VFS hardening — closed a latent heap OOB and raised the capacity caps
v5.8.82	dup + rename syscalls, and shell-spawned tools now inherit the terminal's cwd
v5.8.83	THE pipeline-corruption Heisenbug — root-caused and FIXED after spanning many increments
v5.8.84	Physical allocator now honors the multiboot2 memory map — the principled generalization of the v5.8.83 firmware-hole fix
v5.8.85	User stacks are now demand-grown with a guard page (was a fixed, pre-committed 64 KB)
v5.8.86	SMEP + SMAP — hardware-enforced ring-0 ↔ user isolation
v5.8.87	Real user threads — clone(CLONE_VM) + futex (SYS 50/51, count 50→52)
v5.8.88	Thread coherence — one heap and one mmap table per thread group (multi-threaded malloc now works)
v5.8.89	Shared fd table per thread group — the thread model is now complete
v5.8.90	SMP stage 1 — the application processors are alive
v5.8.91	SMP stage 2 — real spinlocks, and the syscall path's scratch state goes per-CPU
v5.8.92	SMP stage 3a — the APs run scheduled kernel threads, in parallel with the BSP
v5.8.93	SMP stage 3b — user processes run in ring 3 on the application processors
v5.8.94	TLB shootdown IPIs — the mechanism, proven
v5.8.95	TLB shootdown wired into unmap and mprotect — and a deadlock shape found while auditing
v5.8.96	COW remap shoots down too — and two things that did NOT work, reverted and documented
v5.8.97	get_current_process() was BSP-only — the root cause of both v5.8.96 hangs, found and fixed
v5.8.98	The #GP pinned down to one instruction — but not solved, and said so
v5.8.99	preempt_count is per-CPU (release blocker P0.2) — and a correction to my own priority call

The v5.9.0 audit and LTS — v5.9.0-rc1 to v5.9.0-LTS

A systematic security and correctness audit. Each release closes a specific confirmed finding; v5.9.0-LTS is the long-term-support snapshot.

Version	Change
v5.9.0-rc1	Release blocker P0.3 closed: the last local-only invalidations on paths that REMOVE or REPLACE a mapping
v5.9.0-rc2	Ring-3 → ring-0 arbitrary write closed at its root (3 CRITICAL findings, one fix)
v5.9.0-rc3	Two more CRITICALs closed, from the completion audit of the six areas whose verification had died on a quota limit
v5.9.0-rc4	The missing cld — every interrupt entry path was running with whatever RFLAGS.DF ring 3 left set
v5.9.0-rc5	The mprotect family: fork isolation restored, and the address range bounded (3 HIGH + 1 MEDIUM)
v5.9.0-rc6	Three of the unverified findings checked by hand — all three real, all three fixed
v5.9.0-rc7	Three more HIGHs: framebuffer clipping and the dynamic linker
v5.9.0-rc8	dup() of a mount-backed file was a double free
v5.9.0-rc10	libseg_load — the last confirmed CRITICAL — validated nothing at all
v5.9.0-rc11	Ring-3 flags that survived into the kernel, and the rest of the ELF header validation (1 HIGH + 3 more)
v5.9.0-rc12	The 22-pixel GUI family: one missing term, six places
v5.9.0-rc13+rc14	The editor no longer eats your file, and the file manager stops indexing entries[-1]
v5.9.0-rc15	The ext2 write path, verified by e2fsck instead of by itself
v5.9.0-rc16	A VFS fd IS a node pointer — so the node pool must know who is holding one
v5.9.0-rc17	The three GUI highs — and a fourth found only by actually clicking
v5.9.0-LTS	P0.1 CLOSED — the intermittent ring-3 [fault] was a preemptible CR3-switch→iretq window in the syscall-exit path. LTS release

Polish, DOOM, the browser and TLS — v5.9.1 to v5.9.86

The Nightfall desktop theme, window management, the DOOM port, the games, Selene, the full TLS 1.2 crypto arc, and the image decoders.

Version	Change
v5.9.1	"Nightfall" desktop — a central GUI palette, and the brand purple everywhere the placeholder green used to be
v5.9.2	The palette actually reaches the apps — and the focused window is finally the brand colour
v5.9.3	The window frame joins the focus story
v5.9.4	Desktop icons wrap instead of running off the screen
v5.9.5	No window can be born off-screen
v5.9.6	Window geometry follows the screen — the follow-up v5.9.5 named as its own honest limitation
v5.9.7	Window-management keyboard shortcuts — and they retire v5.9.6's honest gap
v5.9.8	Window snapping — Alt+Left/Right half-tiling, built on v5.9.7's chord layer
v5.9.9	Quarter-tiling — v5.9.8's snap grown from one axis to two
v5.9.10	Window drop shadows — the first depth in the compositor, a fresh visual area after four increments of window management
v5.9.11	Title-bar gradient — the second depth cue, sitting with v5.9.10's shadows
v5.9.12	Rounded window tops — the capstone of the modern-window look (shadow + gradient + rounded corners)
v5.9.13	Taskbar depth — the same gradient treatment carried down from the window chrome to the last flat surface
v5.9.14	Start menu depth + hover — the last flat panel joins the polished chrome
v5.9.15	Context + user menus polished — every menu now shares one look
v5.9.16	Login card — the brand look reaches the first screen the user sees
v5.9.17	Rounded-corner primitives consolidated into fb.c — paying down the debt v5.9.16 flagged
v5.9.18	Windows round on all four corners — the v5.9.12 follow-up, closed with a framebuffer clip region
v5.9.19	README hero screenshot refreshed — the repo's public face finally matches the OS
v5.9.20	Per-CPU IST stacks — first increment of the kernel-internals track (pivot away from the visual arc)
v5.9.21	VFS node-pool spinlock — first increment of the T1 SMP-locking arc
v5.9.22	VFS mount-table spinlock — second increment of the T1 SMP-locking arc
v5.9.23	Keyboard input path locked — third T1 increment, the terminal's line discipline made SMP-safe
v5.9.24	Network stack serialized under one net_lock — the capstone of the T1 arc (after the VFS node pool, mount table, and keyboard input)
v5.9.25	The EXT2 driver locked — the T1 follow-up beyond the planned trio, and the last major non-reentrant subsystem a user process can reach under smpbalance
v5.9.26	EXT2 sector cache — the driver's first cache, write-through so it cannot corrupt the disk
v5.9.27	Partial munmap now splits the VMA — a real "the unmap silently didn't take" bug in the memory manager
v5.9.28	Partial mprotect now splits the VMA too — the companion to v5.9.27, closing the mmap/mprotect precision pair
v5.9.29	Fullscreen framebuffer syscalls — a userspace program can finally put pixels on the screen. First step toward the v5.9.40 DOOM milestone
v5.9.30	Raw key-event path — press AND release for a fullscreen game. Second DOOM-milestone enabler (DG_GetKey), after v5.9.29's video
v5.9.31	The DOOM port begins — the doomgeneric engine recovered from git history, and the platform hooks scoped against the new syscalls
v5.9.32	DOOM userspace build, step one: the whole engine compiles, and the link gap is pinned to 35 symbols
v5.9.33	DOOM links — the whole engine now produces a userspace ELF (448 KB, zero undefined symbols)
v5.9.34	DOOM RUNS — the original 1993 DOOM (shareware), playable on NyxOS. The "but can it run DOOM?" milestone, reached
v5.9.35	DOOM gets a desktop icon — launch the game by clicking, not by knowing the doom command
v5.9.36	The DOOM desktop icon actually launches the game now — v5.9.35 wired the icon but clicking it did nothing
v5.9.37	DOOM runs in a WINDOW now, not fullscreen — you can see the desktop around it
v5.9.38	Title-bar buttons made pixel-consistent — the maximize icon was malformed on every window
v5.9.39	Pong — an in-kernel GUI game, and the compositor's first ANIMATED window
v5.9.40	A "Games" desktop folder gathers Minesweeper, DOOM and Pong — and Pong gets a clickable icon, like DOOM
v5.9.41	Every desktop app icon gets its own identity — a little picture of what it does, not one shared generic square
v5.9.42	Snake — a second in-kernel game, and the Games folder grows to four
v5.9.43	Tetris — the fifth game, and the most mechanically complete one yet
v5.9.44	Selene — the NyxOS web browser fetches and renders the real internet
v5.9.45	Selene grows up — clickable links, keyboard link-navigation, and a Back history
v5.9.46	Auto-DHCP at boot — the network is ready for everything, no manual dhcp
v5.9.47	Selene reads like a page, not a wall of text — headings, paragraphs, lists and rules
v5.9.48	TLS, step 1 — NyxOS speaks TLS with a real https server (ClientHello → ServerHello)
v5.9.49	TLS, step 2 — X25519, the first cryptographic primitive (Curve25519 ECDH), proven against the RFC 7748 vectors
v5.9.50	TLS, step 3 — the TLS 1.2 PRF (P_SHA256), the key-derivation function, proven against RFC 4231 + the canonical PRF vector
v5.9.51	TLS, step 4 — the real ECDHE key agreement: NyxOS and a live https server derive the same session keys
v5.9.52	TLS, step 5 — AES-128-GCM, the record cipher: authenticated encryption that reproduces the NIST vectors byte-for-byte
v5.9.53	TLS, step 6 — the record layer: AES-128-GCM records + the Finished verify_data, framed exactly on the wire
v5.9.54	TLS, step 7 — the handshake COMPLETES: NyxOS establishes a verified, encrypted TLS channel with a real https server
v5.9.55	https, for real — NyxOS fetches and decrypts a live https page over the TLS channel
v5.9.56	Selene opens https sites — the browser speaks TLS
v5.9.57	A real CSPRNG — the TLS ephemeral key and ClientHello random are now unpredictable
v5.9.58	DER/ASN.1 reader — reading an X.509 certificate, step 1 of the TLS trust model
v5.9.59	NIST P-256 (secp256r1) curve arithmetic — the math behind the certificate's signature
v5.9.60	ECDSA-P256 signature verification — the check at the heart of certificate validation
v5.9.61	TLS now cryptographically verifies the server's ServerKeyExchange signature against its certificate
v5.9.62	RSA PKCS#1 v1.5 signature verification — the last crypto primitive for the trust chain
v5.9.63	SHA-512 / SHA-384 — the hash the certificate chain's CA links need
v5.9.64	NIST P-384 (secp384r1) curve arithmetic + ECDSA-P384/SHA-384 verify — the other primitive the CA links need
v5.9.65	TLS certificate-chain verification to a pinned trust anchor — the trust model is closed, TLS is now MITM-resistant (FINALE of the crypto arc)
v5.9.66	Leaf-certificate hostname + validity checks — "verify the peer" is now complete
v5.9.67	Streaming https receive — Selene can now load large pages (back to the browser after the crypto arc)
v5.9.68	HTML forms in Selene — the browser payoff TLS was gating all along (search boxes work)
v5.9.69	POST forms — Selene can submit login-style forms (the complement to GET)
v5.9.70	NIST P-256 (secp256r1) ECDHE key agreement — NyxOS's TLS now reaches the huge set of servers that prefer P-256, not just x25519 ones
v5.9.71	TLS now verifies the RSA-signed ServerKeyExchange too — ECDHE-RSA servers are no longer trusted "unverified"
v5.9.72	TLS certificate enforcement — the trust model can now REFUSE a connection, not just warn (MITM defence goes from "reported" to "blocked")
v5.9.73	A real TLS trust store — strict mode now works across the web, not just SSL.com-rooted sites
v5.9.74	RSA-PSS ServerKeyExchange verification + the SKE signature folded into strict mode — strict TLS is now fully MITM-safe
v5.9.75	Selene: find-in-page (Ctrl+F) — back to the browser after the long TLS arc, with a visible feature
v5.9.76	Selene: <img> placeholders — images stop vanishing; each one renders as a framed box showing its alt text (or filename)
v5.9.77	Selene: <table> column layout — tables stop collapsing into a run-on line and render as aligned, bordered columns
v5.9.78	Selene: tabs — several pages open at once in one window (the browser's biggest UX jump yet)
v5.9.79	ECDSA-P384/SHA-384 ServerKeyExchange verification (0x0503) — the last common SKE signature scheme NyxOS couldn't check
v5.9.80	secp384r1 as an ECDHE group + P-384 ECDHE key agreement — which turns v5.9.79's KAT-only ECDSA-P384 check into a LIVE, end-to-end verification
v5.9.81	DEFLATE / zlib decompression (inflate.c) — the first step toward decoding real images in Selene
v5.9.82	A PNG decoder (png.c) on top of v5.9.81's inflate — NyxOS can now turn PNG bytes into pixels
v5.9.83	Selene draws real images — the payoff of the image arc: <img> PNGs are now fetched, decoded and rendered inline
v5.9.84	Lazy + progressive image loading — an image-heavy page shows its text instantly and only downloads the pictures you can actually see
v5.9.85	BMP image support + a format-agnostic image pipeline — Selene now shows .bmp as well as .png
v5.9.86	GIF support — the third image format, with a real LZW decompressor. Selene now shows PNG, BMP and GIF

See also

• Home - what the current release contains
• Architecture - the system these releases built
• Contributing - the versioning and release conventions

External resources

• Releases - GitHub
• Commit history - GitHub