Skip to content

Releases: velyrlabs/velyr

Release list

Velyr v0.1.0-alpha.1

Velyr v0.1.0-alpha.1 Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Oct 00:27
v0.1.0-alpha.1
f4e1692

The first public pre-release of Velyr, a security-first JavaScript and TypeScript runtime written in Rust.

Warning

This is alpha software. APIs, CLI flags and behavior will change, and it is not ready for production.

Install

# Pick your platform from the assets below
TARGET=aarch64-apple-darwin
curl -fLO "https://github.com/velyrlabs/velyr/releases/download/v0.1.0-alpha.1/velyr-$TARGET.tar.gz"
tar -xzf "velyr-$TARGET.tar.gz" && ./velyr --version
Platform Asset
macOS Apple silicon / Intel velyr-aarch64-apple-darwin.tar.gz / velyr-x86_64-apple-darwin.tar.gz
Linux x64 glibc / musl velyr-x86_64-unknown-linux-gnu.tar.gz / velyr-x86_64-unknown-linux-musl.tar.gz
Linux arm64 glibc / musl velyr-aarch64-unknown-linux-gnu.tar.gz / velyr-aarch64-unknown-linux-musl.tar.gz
Windows x64 velyr-x86_64-pc-windows-msvc.zip

Verify

curl -fLO "https://github.com/velyrlabs/velyr/releases/download/v0.1.0-alpha.1/SHA256SUMS"
grep "velyr-$TARGET.tar.gz" SHA256SUMS | shasum -a 256 -c -   # sha256sum -c on Linux
gh attestation verify "velyr-$TARGET.tar.gz" --repo velyrlabs/velyr

Every archive is built by GitHub Actions with cargo auditable, ships with a CycloneDX SBOM (velyr.cdx.json) and a build provenance attestation.

What is in this release

  • ES modules and scripts on V8, with TypeScript and JSX by type stripping.
  • Deny-by-default permissions for files, network, environment, system info and subprocesses; -A reaches loopback but not private networks.
  • Web-standard fetch, streams, Web Crypto and WebSocket.
  • velyr serve with export default { fetch }, optionally on several worker isolates.
  • test, bench, check (project tsc), compile, and dependency management with a velyr.lock lockfile.

Known limitations

  • Node.js compatibility is partial; many npm packages will not run.
  • HTTP throughput is behind Node.js, Deno and Bun. No benchmark claims are made for this release.
  • On Windows, spawning child processes (Velyr.Command, node:child_process) is not supported yet.
  • The Rust-native engine (--engine native) is not included in these binaries.

Report bugs in issues and security problems privately through security advisories.

Loading