v1.13.0

Security

• Require Go 1.26.10 and use the module's Go version in CI, parity and release builds; the Docker builder uses the same patched version and the runtime uses Alpine 3.24.3. Public module downloads retain checksum-database verification and the grammar path is selected from the resolved module version. Upgrade pgx to v5.9.2, gRPC to v1.83.2, x/net to v0.60.0 and x/text to v0.42.0, plus their required transitive updates. CI and release qualification now check dependency integrity and reachable vulnerabilities. Release preparation refuses module-file drift instead of tidying the release tree.

Breaking

• Subtraction without spaces. 10-3-2 now evaluates to 5 instead of silently compiling as 10. Numeric, quantity and currency literals keep their sign separate from the subtraction operator. Recompile and audit policies that used adjacent subtraction. Incomplete arithmetic, unsupported unary negation (-value; use (0 - value)) and numeric literals outside float64 range are rejected instead of partially compiling or becoming zero. Compiled bytecode and wire formats are unchanged.
• Arithmetic precedence. *, / and % now bind tighter than + and -. 1 + 2 * 3 now evaluates to 7 instead of 9. Parser integrations must handle the new product_expr CST node for * / %.
• Arithmetic chains group left to right. v1.12.0 grouped many chains of five or more terms from the right. For example, 1000 - 2 - 3 - 4 - 5 evaluated to 1002 instead of 986, 1000 / 2 / 3 / 4 / 5 to 1875 instead of 8.33, and a seven-term sum and difference such as w + i + d + g - l - h - 14600 (values 100000, 1000, 500, 2000, 2500, 3000) to 89400 instead of 83400. Chains of up to four terms were already left to right. Every chain now groups left to right. Long - and / chains change value when recompiled, so audit them along with mixed arithmetic. To keep a former result exactly, add parentheses that state the old grouping.
• Unambiguous remainder. % is reserved for remainder with or without spaces. 7 % 3 now evaluates to 1 instead of being consumed as a percentage quantity. Write percentage quantities as 50 pct, replacing 50 %. Incomplete percent expressions are rejected; strings and comments are unchanged. Rebuild and audit affected policies. Existing bytecode and wire-format versions are unchanged. These source-language changes are separate from v1.12.0.

Verification

Required tests, four fuzz targets, dependency integrity, reachable-vulnerability scanning and the non-root container smoke passed in release preparation CI. The deterministic corpus matched on amd64 v1/v3, native arm64 and WebAssembly in parity. The advisory latest-parser job retains two known golden-test differences; the supported parser pin passes.

Release archives contain arbiter, arbiter-lsp, arbiter-runtime and arbiter-agent. Verify downloads with checksums.txt.