v0.24 (Secure Cadence)

What's Changed

The Secure Cadence milestone is focused on code-hardening and will enable the permissionless deployment of smart contracts on Mainnet. It is an important step in our path to Stable Cadence.

This required some breaking changes. You can read all about these changes and how to update your contracts in this forum post:
Breaking changes coming with Secure Cadence release

While the focus was on securing Cadence, this release is also packed with many new features and improvements!

💥 Breaking Changes

• Zero-pad string representation of addresses by @turbolent in #1214
• Allow importing type and capability values by @dsainati1 in #1202
• Report an error when the parameter list is missing commas by @turbolent in #1073
• Use common super-type for expression type inferring by @SupunS in #1027
• load, copy and borrow cause a force cast by @dsainati1 in #1286
• Taking a reference to an optional value now produces an optionally-typed reference by @dsainati1 in #1303
• Disallow arithmetic, comparison and bitwise operations on number supertypes by @SupunS in #1360
• Add CharacterValue type by @dsainati1 in #1392
• Limit mutation of container-typed fields to the scope of the composite by @dsainati1 in #1267

⭐ Features

• Allow runtime types to be used as a dictionary key by @dsainati1 in #1186
• Add constructor functions for run-time types by @dsainati1 in #1195
• Add new syntax to bind for-in loop indices by @dsainati1 in #1216
• Find least common super-type by @SupunS in #1025
• Infer static type from the value itself for imported arrays/dictionaries by @SupunS in #1049
• Add a clone function to all values by @turbolent in #1229
• Allow scripts to access authorized accounts by @dsainati1 in #1240
• add type(at: Path) function for inspecting the type of objects in storage by @dsainati1 in #1254
• Report a hint for casting an expression of type T to same type T by @SupunS in #1072
• Add an interactive debugger to the command-line runner by @turbolent in #940
• Start development of a new pretty printer for Cadence programs by @turbolent in #1024
• Pretty print statements by @turbolent in #1280
• Pretty print types by @turbolent in #1281
• Add optional resource owner change tracking callback by @turbolent in #1289
• Add array slice function by @turbolent in #1315
• Add indexOf to array by @bjartek in #1352
• Check transfer and use of transferred or destroyed resources at runtime by @turbolent in #1461
• Add a package to run a script against all accounts by @turbolent in #1434
• Memory metering by @turbolent in #1653
• Add a checker option to short-circuit error reporting by @turbolent in #1562

🛠 Improvements

• Add smoke tests cadence values / storage operations by @SupunS in #1185
• Clean up types in cadence package by @turbolent in #1204
• add missing types and conversion functions to cadence package by @dsainati1 in #1224
• Improve container mutation error message by @SupunS in #1228
• Updates Fungible Token tutorial to use a different structure and explanations by @joshuahannan in #1238
• Re-apply "Remove receiver type from function type" by @turbolent in #1272
• Disable existing hints if linting is disabled by @turbolent in #1275
• Remove redundant subtyping check by @dsainati1 in #1285
• Tweak Cadence bench to be more stable by @janezpodhostnik in #1290
• Improve state decoding tool by @turbolent in #1232
• Language Server updates by @MaxStalker in #1295
• Support recursive supertype inferring for containers by @SupunS in #1319
• Add safety checks for go casts in the interpreter by @dsainati1 in #1331
• Ignore dead code by @turbolent in #1345
• Add safety checks for go casts in the parser by @dsainati1 in #1343
• Allows adding new interface conformances during a contract update by @SupunS in #1395
• Refactor type assertions of host function arguments by @turbolent in #1422
• Check use of invalidated resources at runtime by @SupunS in #1464
• Expand interpreter tracing for composite, array and dictionary types by @ramtinms in #1450
• Extend subtyping rule for restricted type by @turbolent in #1486
• Check address length before decoding by @SupunS in #1522
• Add runtime subtype check using static types by @SupunS in #1487
• Improve new static type-based dynamic type checking by @turbolent in #1576
• Remove dynamic types by @turbolent in #1577
• Flowkit version update by @sideninja in #1534
• Adjust formulas for calculating memory usage of arithmetic operations on big integers by @turbolent in #1590
• Don't report errors for invalid types by @turbolent in #1597
• [LS] Crash reporting by @sideninja in #1600
• cadence.Value.Type method back to original param list by @robert-e-davidson3 in #1633
• [LS] Debugging documentation and utility functions by @sideninja in #1601
• Language reference docs improvement by @alilloig in #1627
• Limit number of tokens which can be replayed (reparsed) by @turbolent in #1620
• Improve constant-sized type parsing by @turbolent in #1613
• [LS] NPM release v0.24.0 crash reporting by @sideninja in #1641
• Refactor memory kinds and memory usages by @SupunS in #1667
• Improve error message for invalid public key by @SaveTheRbtz in #1665
• Limit depth of expressions and types by @turbolent in #1664
• Add token limit by @turbolent in #1668
• Fix local token replay limit, add global replay limit by @turbolent in #1663
• Handle and wrap non-error type panics in interpreterRuntime by @SupunS in #1678
• Update fxamacker/cbor and atree to latest versions by @fxamacker in #1682
• Differentiate invalidated resource use errors by @turbolent in #1706
• Optimize ByteSize functions for 7 Value types by @fxamacker in #1299
• Pool lexers to reduce allocations and improve performance by @turbolent in #1610
• Optimize HashInput functions to use scratch buffer provided by onflow/atree by @fxamacker in #1296
• Add more graceful handling for go type assertions in runtime/sema by @dsainati1 in #1318
• Gracefully handle casts during comparison operators by @SupunS in #1330

🐞 Bug Fixes

• Fix smoke tests by @turbolent in #1198
• Fix composite-typed argument passing by @SupunS in #1235
• Gracefully handle invalid restrictions by @turbolent in #1249
• Replace IsSubType check with IsSameTypeKind check where necessary by @SupunS in #1032
• Gracefully handle casts during arithmetic operations by @SupunS in #1306
• Fix resource loss analysis and definite initialization analysis by @turbolent in #1332
• Fix and simplify parser buffering by @SupunS in #1333
• Fix type requirement checking by @SupunS in #1334
• Fix IsContainerType for CompositeType and InterfaceType by @SupunS in #1335
• Fix checking of create before(...) in post condition by @SupunS in #1336
• Fix type requirement checking by @SupunS in #1338
• Fix IsContainerType for CompositeType and InterfaceType by @SupunS in #1339
• Fix references to resource-kinded values by @turbolent in #1344
• Reject invalid access modifiers by @turbolent in #1347
• Fix parsing of 0_ integer literals by @turbolent in #1348
• Update uniseg to latest commit by @turbolent in #1370
• Fix definite field initialization analysis by @SupunS in #1424
• Fix AST walking default-case in switch-statement by @SupunS in #1433
• Update atree by @turbolent in #1421
• Catch potential panics produced by resource owner changed callback by @turbolent in #1445
• Fix CI typo feature-secure-cadence by @robert-e-davidson3 in #1465
• Fix resource field nesting check for enum raw value field by @turbolent in #1459
• do not wrap conditional in ${{}} by @robert-e-davidson3 in #1473
• Fix field initialization: nested intersection should not override outer set by @turbolent in #1524
• Forbid reinitialization of variable, resource-kinded fields by @turbolent in #1527
• Commit storage before getting account storage capacity by @robert-e-davidson3 in #1525
• Nil elements when reslicing by @turbolent in #1547
• Box optional-typed references to non-optional values by @turbolent in #1542
• Reads of missing storage maps should not cause creation by @turbolent in #1557
• Handle missing member when checking mutability of member by @turbolent in #1561
• [LS] Remove caching of checkers for imported programs by @sideninja in #1572
• Properly transfer indexing expression by @turbolent in #1568
• fix double count memory by @robert-e-davidson3 in #1593
• Fix common supertype calculation for optionals by @SupunS in #1594
• Fix erroneous report of resource invalidation when executing a pre-condition by @dsainati1 in #1625
• Revert removal of checker caching / #1572 by @turbolent in #1628
• Track inner values of resource-kinded optionals by @dsainati1 in #1630
• Fix issue with programs cache on contract update by @janezpodhostnik in #1644
• Fix parsing of reference expressions by @turbolent in #1622
• Wrap memory error in FatalError and check for it when parsing by @robert-e-davidson3 in #1660
• Properly support super types in ConformsToStaticType implementations by @turbolent in #1694
• Fix JSON encoding of type values with recursive type by @turbolent in #1705
• Avoid type-checking of the old program during contract updates by @SupunS in #1692

📖 Documentation

• Remove trailing comma in JSON cadence spec by @fee1-dead in #1206
• Fix playground URL for this example by @javiermanzano in #1209
• Fix comment typo by @GuillaumeBAECHLER in #1210
• Fix typo on marketplace design code sample by @javiermanzano in #1207
• Update ownerVault access control keyword by @GuillaumeBAECHLER in #1212
• Fix grammar issue in Hello World tutorial by @NessDan in #1231
• Add line break so images load by @NessDan in #1242
• Change "Object" to plural (typo) by @NessDan in #1241
• Update type inference docs by @SupunS in #1054
• Update 06-marketplace-compose.mdx by @saadtroon in #1265
• Include dependencies in contributing doc, plus gitignore. by @robert-e-davidson3 in #1270
• Update and to are in 03-fungible-tokens.mdx by @Nasir-Ali-Shah in #1271
• Update 06-marketplace-compose.mdx by @saadtroon in #1277
• update typo 0x03 to 0x02 by @Nasir-Ali-Shah in #1278
• Updates NFT tutorial to use latest best practices by @joshuahannan in #1301
• Start of a symbol/operator glossary by @muttoni in #1279
• Move resource owner section to resources page by @turbolent in #1346
• Fixes glossary page by @muttoni in #1350
• Fix links in callouts, linting by @alxflw in #1359
• Update 02-hello-world.mdx by @ObjectPlayer in #1365
• Fix bad links in doc by @kerrywei in #1372
• Update 02-hello-world.mdx by @elpunkt in #1357
• update tutorial links for new playground format by @joshuahannan in #1387
• Object player/1358 fix broken links in cadence document by @ObjectPlayer in #1368
• Update resource name by @brunogonzales in #1390
• Update Hello World tutorial w/ Video Guide by @kimcodeashian in #1401
• Add example of a script to add a key to existing account by @justinbarry in #1403
• Embedding Fungible Token video guide + description by @kimcodeashian in #1414
• Updating Fungible Token video to correct source by @kimcodeashian in #1418
• Fix comments for StorageMap ReadValue and WriteValue by @turbolent in #1439
• Marketplace tutorial improvements by @joshuahannan in #1412
• Capability-based Access Control Document Improvements by @kgebreki in #1519
• Update the crypto doc by @tarakby in #1548
• Add type function to list of functions in AuthAccount documentation by @dsainati1 in #1676
• Best Practices and Anti-Patterns Updates by @joshuahannan in #1471
• Document number supertype changes by @SupunS in #1702
• Update documentation for optional references by @dsainati1 #1700
• Document new short address toString behaviour by @turbolent in #1699
• Fixes typo in tutorial by @walski in #1302
• Update Resource documentation link in 02-hello-world.mdx by @gnujoow in #1298
• Update 02-hello-world.mdx by @gnujoow in #1297
• Update docs/design-patterns backquote paths by @KeisukeYamashita in #1323

Other Changes

• Add smoke test to use only enum (CompositeValue) as dictionary key by @fxamacker in #1201
• Update golangci-lint by @turbolent in #1200
• Add container mutation tests for inserting functions into dictionaries by @turbolent in #1215
• Add benchstat GH action by @janezpodhostnik in #1227
• Add test for casting storage ref to an invalid type by @SupunS in #1243
• Language server: Add test for diagnostics by @turbolent in #1233
• Update LS dependencies by @sideninja in #1163
• Merge v0.20.x changes by @turbolent in #1292
• Fix npm packages by @turbolent in #1293
• Update testify by @turbolent in #1274
• Update to Go 1.16 by @turbolent in #1361
• Export StringAtreeValue from the interpreter by @dsainati1 in #1366
• Panic when testRuntimeInterface methods need hooks but lack them by @robert-e-davidson3 in #1399
• Add tests for linking to already linked paths by @SupunS in #1416
• Add Daniel as code owner by @turbolent in #1436
• Improve bug report issue template by @turbolent in #1440
• use feature branch for cadence->flow-go sync PRs by @robert-e-davidson3 in #1441
• Add test for CharacterValue.HashInput by @robert-e-davidson3 in #1432
• Various regression tests by @robert-e-davidson3 in #1425
• Check capabilities of dependencies by @turbolent in #1476
• Add a custom linter which detects Value composite literals by @turbolent in #1481
• Bump codecov-action from v1 to v2 in ci.yml by @fxamacker in #1492
• Fix lint errors by @SupunS in #1509
• Update copyright by @turbolent in #1529
• Added test to partially ensure HashableValue does not regress by @robert-e-davidson3 in #1431
• Remove release drafter GitHub action by @turbolent in #1551
• Add codecov config by @turbolent in #1553
• Add tests for casting references inside containers by @SupunS in #1581
• Add fast-test option to makefile by @dsainati1 in #1589
• [LS] Update version by @sideninja in #1583
• Disable flow-go sync by @janezpodhostnik in #1645
• Update to Go 1.18 by @turbolent in #1621

New Contributors

We would like to thank all of our new contributors improving Cadence:

• @fee1-dead made their first contribution in #1206
• @javiermanzano made their first contribution in #1209
• @GuillaumeBAECHLER made their first contribution in #1210
• @NessDan made their first contribution in #1231
• @saadtroon made their first contribution in #1265
• @Nasir-Ali-Shah made their first contribution in #1271
• @walski made their first contribution in #1302
• @gnujoow made their first contribution in #1298
• @muttoni made their first contribution in #1279
• @KeisukeYamashita made their first contribution in #1323
• @alxflw made their first contribution in #1359
• @ObjectPlayer made their first contribution in #1365
• @elpunkt made their first contribution in #1357
• @brunogonzales made their first contribution in #1390
• @justinbarry made their first contribution in #1403
• @kgebreki made their first contribution in #1519
• @alilloig made their first contribution in #1627
• @SaveTheRbtz made their first contribution in #1665

Full Changelog: v0.23.0...v0.24.0