v1.5.1 — Security: command injection via torvik.rune

Update promptly

This release fixes a critical security issue. Version 1.5.0 and earlier could
execute arbitrary commands during an ordinary rune build — cloning a repository
and building it was enough. The compiled program never had to be run.

Update Torvik to 1.5.2 as well. Both tools were independently affected.

What was wrong

rune builds the torvc command line by interpolating values read from a
project's torvik.rune. Those values were not validated, so a manifest
containing shell syntax executed arbitrary commands. Affected fields: name,
and under [build], entry, arch, link-script and link-with.

What changed

All manifest values are validated before use. Names, entry symbols and target
triples are restricted to a character allowlist; paths are screened for shell
metacharacters. A rejected value produces a clear message naming the field.

A manifest may also define a custom runner command, which rune run executes
by design. That is not a vulnerability — it is the feature's purpose, and rune
prints the command before running it — but it is a good reason to read an
unfamiliar torvik.rune before running anything from it.

Upgrading

rune installs with Torvik. To install just rune:

Linux

curl -fsSL https://raw.githubusercontent.com/torvik-lang/rune/main/linux/install.sh | sh

Windows (PowerShell)

iwr -useb https://raw.githubusercontent.com/torvik-lang/rune/main/windows/install.ps1 >| iex

Already installed?: rune self-update No manifest changes are required for any project whose values were
already ordinary.

Full details: SECURITY.md, advisory RUNE-2026-001.

rune v1.5.0

Released alongside Torvik v1.5.0 "The Forge".

Run a single file

rune run script.tv
rune run scan.tv report.csv data.csv

Compiles, runs, cleans up — no binary left behind. Anything after the filename reaches the
program through args() / args_get(i). A bare rune run still builds and runs the project
as before.

Build a kernel

A [build] section turns rune into a build tool for freestanding targets:

[project]
name = mykernel
version = 0.1.0

[build]
target = bare
entry = kernel_main
arch = x86_64-unknown-none-elf
link-script = linker.ld
link-with = boot.s
runner = qemu-system-x86_64 -kernel {output}

rune build      # -> build/mykernel.elf
rune run        # builds, then hands the image to the runner

A bare project builds to .elf rather than the host's executable extension — calling a
kernel mykernel.exe would be a lie. rune run doesn't try to execute it either, because
the host can't; it passes the image to whatever runner names, with {output} replaced by
the built path. Leave runner out and rune builds the image and tells you how to add one.

A link-script or link-with named in the manifest but missing is rune's error, reported
before clang ever runs.

Major versions are opt-in

rune update now keeps you on your current major and reports a new one instead of
installing it — while still pulling the newest release within the major you're on:

Heads up: Torvik v2.0.0 is available - a NEW MAJOR (you're on v1.5.0).
  Staying on 1.x, since a major version can break existing code.
  When ready:  rune update v2 --yes
  Silence this notice:  rune update --silence-major

--silence-major quiets that notice until the next major ships. It refuses if there's
nothing to silence, so a version that hasn't been released can't be muted by accident.

The standard library

std has its own repository and version line as of
Torvik v1.5.0. rune installs and updates it, gated the same way:

std = "1.3.0"        # in torvik.rune

A pin is an explicit instruction and is honoured, including across a major. Without one,
rune keeps std inside its current major and surfaces a new one once. To opt in:

rune update --std-major          # check only - reports, installs nothing
rune update --std-major --yes    # install it, and write the pin for you

With --yes, rune writes std = <version> into your manifest so the project and the
toolchain stay aligned. --silence-std-major quiets that notice.

Changed

• std is fetched from torvik-lang/std rather than from the Torvik repository. Installing an
  older Torvik still works exactly as before — those releases carry std in their own tree,
  and git tags are immutable.
• Silencing a major-version notice when there is no new major now refuses with an explanation
  instead of quietly recording nothing.

Internal

rune has its own test suite (dev/tests/run_tests.sh, 19 cases). It previously lived
inside Torvik's suite, which meant a rune regression could only be caught by building the
compiler. They're separate now — and Torvik's suite runs with only torvc installed.

Install

rune ships with Torvik. To install or update it alone:

# Linux
curl -fsSL https://raw.githubusercontent.com/torvik-lang/rune/main/linux/install.sh | sh

# Windows (PowerShell)
iwr -useb https://raw.githubusercontent.com/torvik-lang/rune/main/windows/install.ps1 | iex

Already installed? rune self-update.

rune v1.4.0 — Its own repository

This is the first release of rune from its own repository. rune is the project and
toolchain manager for Torvik — it creates projects, builds and runs them, and keeps your
Torvik installation up to date — and it's written in Torvik itself.

What changed

rune now lives here and versions independently.
Previously rune was released as part of Torvik. From v1.4.0 on it has its own repo, its
own version line, and its own changelog, so it can ship fixes on its own cadence. It still
installs into ~/.torvik alongside torvc and manages Torvik exactly as before.

Independent update checks.
rune update now checks Torvik and rune separately and updates whichever has moved — the
toolchain, rune, or both. rune self-update updates just rune.

Getting rune

You normally get rune automatically when you install Torvik. To install or reinstall just
rune:

# Linux
curl -fsSL https://raw.githubusercontent.com/torvik-lang/rune/main/linux/install.sh | sh
# Windows (PowerShell)
iwr -useb https://raw.githubusercontent.com/torvik-lang/rune/main/windows/install.ps1 | iex

Already have it? rune update (latest Torvik + rune) or rune self-update (just rune).

Commands

rune new <name>     Create a new project
rune init           Initialize a project in the current directory
rune build          Build the current project
rune run            Build and run
rune update [vX]    Update Torvik + rune to the latest, or pin torvc to vX
rune self-update    Update just rune
rune uninstall      Remove the toolchain and rune
rune version        Show rune, language, and std versions

A note on older versions

rune v1.3.0 and earlier were released as part of Torvik — you'll find those binaries in
the matching Torvik release assets (https://github.com/torvik-lang/torvik/releases). If
you're on an older Torvik you already have the rune that shipped with it.

Links

• Changelog: https://github.com/torvik-lang/rune/blob/main/CHANGELOG.md
• Torvik: https://github.com/torvik-lang/torvik