This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+3 more
Affected surfaces
ReleasePort's take
Light signalVersion v12.2.8f8451f4.0 introduces platform‑aware package filtering, lockfile version 4 upgrades, peer‑context virtual links, forced‑install flags, and bug fixes for cache cleanup.
Why it matters: These changes make dependency resolution deterministic across OS/CPU/ABI targets, improve lockfile accuracy with ABI data, preserve complex peer‑dependency graphs, enable reliable forced re‑resolution, and resolve prior cache leaks—a critical enhancement for reproducible builds and deployment stability.
Summary
AI summaryPackage installs and dependency resolution are more deterministic with platform‑aware filtering, lockfile upgrades, peer‑context linking, and new forced‑install options.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Adds platform-aware package filtering using OS, CPU, and libc/ABI names. Adds platform-aware package filtering using OS, CPU, and libc/ABI names. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Upgrades `ant.lockb` to lockfile version 4, recording platform ABI data. Upgrades `ant.lockb` to lockfile version 4, recording platform ABI data. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Introduces virtual package links preserving each dependency's peer‑dependency context. Introduces virtual package links preserving each dependency's peer‑dependency context. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Adds `ant install --force` and `ant update --force` to ignore cached metadata and re‑resolve dependencies. Adds `ant install --force` and `ant update --force` to ignore cached metadata and re‑resolve dependencies. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Adds metadata lookup for direct tarball URLs during registry installations. Adds metadata lookup for direct tarball URLs during registry installations. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Automatically sets `npm_config_user_agent=ant/<version>` for package executables launched through Ant. Automatically sets `npm_config_user_agent=ant/<version>` for package executables launched through Ant. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Improves registry‑host caching and warmed‑registry fallback deduplication. Improves registry‑host caching and warmed‑registry fallback deduplication. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Adds multipart package publishing to the registry and ants.land CLI for larger archives. Adds multipart package publishing to the registry and ants.land CLI for larger archives. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Adds `Ant.serve(options)` returning a live server object with hostname, port, URL, stop, requestIP, timeout, upgradeWebSocket, and eventSource. Adds `Ant.serve(options)` returning a live server object with hostname, port, URL, stop, requestIP, timeout, upgradeWebSocket, and eventSource. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Listen failures now include Node‑style details: code, errno, syscall, address, port, or Unix‑socket path. Listen failures now include Node‑style details: code, errno, syscall, address, port, or Unix‑socket path. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Added `dns.promises.resolve()` support for A, AAAA, SRV, and TXT records via c-ares. Added `dns.promises.resolve()` support for A, AAAA, SRV, and TXT records via c-ares. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Made `net.Socket` and `tls.TLSSocket` inherit and initialize as duplex streams. Made `net.Socket` and `tls.TLSSocket` inherit and initialize as duplex streams. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Added `Buffer.prototype.compare()` and `Buffer.prototype.equals()` methods. Added `Buffer.prototype.compare()` and `Buffer.prototype.equals()` methods. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Extended `Buffer.prototype.toString()` with start/end bounds support. Extended `Buffer.prototype.toString()` with start/end bounds support. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Implemented proper `DataView.prototype.buffer`, `byteLength`, and `byteOffset` accessors. Implemented proper `DataView.prototype.buffer`, `byteLength`, and `byteOffset` accessors. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Added Latin‑1 conversion support to base64 and string‑decoder paths. Added Latin‑1 conversion support to base64 and string‑decoder paths. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Added PBKDF2 key import and `SubtleCrypto.deriveBits()` for derived keys in Web Crypto API. Added PBKDF2 key import and `SubtleCrypto.deriveBits()` for derived keys in Web Crypto API. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Added synchronous filesystem operations: `fs.symlinkSync()` and expanded `fs.cpSync()` preserving symlinks, modes, filters, dereference options, and verbatim link targets. Added synchronous filesystem operations: `fs.symlinkSync()` and expanded `fs.cpSync()` preserving symlinks, modes, filters, dereference options, and verbatim link targets. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Feature | Low |
Updated `process`, `process.env`, `process.versions`, `process.features`, and `process.release` to inherit standard object methods like `hasOwnProperty`. Updated `process`, `process.env`, `process.versions`, `process.features`, and `process.release` to inherit standard object methods like `hasOwnProperty`. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Performance | Low |
Reduced per‑byte work in readline key‑sequence processing for faster input handling. Reduced per‑byte work in readline key‑sequence processing for faster input handling. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Performance | Low |
Optimized `Headers` and `Response` initialization while preserving content‑type normalization and constructor behavior. Optimized `Headers` and `Response` initialization while preserving content‑type normalization and constructor behavior. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Performance | Low |
Made pending‑promise garbage‑collector tracking O(1) per VM and added a generational write barrier for closed upvalues. Made pending‑promise garbage‑collector tracking O(1) per VM and added a generational write barrier for closed upvalues. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Fixes cache cleanup and retained‑memory issues in forced installs. Fixes cache cleanup and retained‑memory issues in forced installs. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixed async coroutine state corruption across nested generators, `for await`, and pre‑yield awaits. Fixed async coroutine state corruption across nested generators, `for await`, and pre‑yield awaits. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Ensured returns, throws, breaks, continues, and labeled jumps unwind through all required `finally` blocks in async contexts. Ensured returns, throws, breaks, continues, and labeled jumps unwind through all required `finally` blocks in async contexts. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Medium |
Corrected async returns that previously skipped `finally`, including `Promise.race()` with pending competitors. Corrected async returns that previously skipped `finally`, including `Promise.race()` with pending competitors. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Reworked readline and `process.stdin` to cooperate correctly for keypress events, pause/resume, and piped input handling. Reworked readline and `process.stdin` to cooperate correctly for keypress events, pause/resume, and piped input handling. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Fixed arrow‑key decoding, sequential keypress delivery, stdin pausing, and piped‑input handling in readline. Fixed arrow‑key decoding, sequential keypress delivery, stdin pausing, and piped‑input handling in readline. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Missing CommonJS packages now throw errors with `code: 'MODULE_NOT_FOUND'` from both `require()` and `require.resolve()`. Missing CommonJS packages now throw errors with `code: 'MODULE_NOT_FOUND'` from both `require()` and `require.resolve()`. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
| Bugfix | Low |
Fixed iterator‑result undefined behavior affecting typed arrays, collections, headers, and `Promise.all()`. Fixed iterator‑result undefined behavior affecting typed arrays, collections, headers, and `Promise.all()`. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
Full changelog
Ant 12.2.8f8451f4.0
Package installs and dependency resolution are more deterministic
- Added platform-aware package filtering using npm-compatible operating-system, CPU, and Linux libc/ABI names.
- Upgraded
ant.lockbto lockfile version 4 so platform ABI data is recorded consistently. Invalid or older lockfiles now trigger a fresh resolve and install instead of stopping at an invalid-lockfile error. - Added virtual package links that preserve each dependency's peer-dependency context instead of flattening incompatible peer environments together.
- Improved registry-host caching and warmed-registry fallback deduplication.
- Added
ant install --forceandant update --forceto ignore cached metadata, re-resolve dependencies, and safely replace cached package contents. - Fixed cache cleanup and retained-memory issues in forced installs.
- Added metadata lookup for direct tarball URLs so packages installed from registry tarballs still resolve with their correct package metadata.
- Added automatic
npm_config_user_agent=ant/<version>for package executables launched through Ant. - Improved package trust output by listing blocked lifecycle scripts and the exact
ant trustcommands needed to run them. - Added lifecycle-build counts and clearer progress reporting to install, add, update, trust, and reinstall output.
- Limited add/update summaries to the direct packages requested by the user.
ants.land publishing and tooling improved
- Added multipart package publishing to the registry and ants.land CLI for larger package archives.
- Added tarball hashing and multipart create, part-upload, and completion handling.
Servers and interactive input are easier to use
- Added first-class
Ant.serve(options)for starting a server programmatically instead of relying only on a module default export. Ant.serve()now returns the live server object withhostname,port,url,stop,requestIP,timeout,upgradeWebSocket, andeventSource.- Listen failures now include Node-style
code,errno,syscall,address,port, or Unix-socketpathdetails. - Reworked readline and
process.stdinaround one shared input path so readline, keypress events, pause/resume, and data listeners cooperate correctly. - Fixed arrow-key decoding, sequential keypress delivery, stdin pausing, and piped-input handling.
- Reduced per-byte work in readline key-sequence processing.
Node and web API compatibility expanded
- Added
dns.promises.resolve()support for A, AAAA, SRV, and TXT records through c-ares. - Made
net.Socketandtls.TLSSocketinherit and initialize as duplex streams. - Added
Buffer.prototype.compare()andBuffer.prototype.equals(). - Added start/end bounds support to
Buffer.prototype.toString(). - Added proper
DataView.prototype.buffer,byteLength, andbyteOffsetaccessors. - Added Latin-1 conversion support to base64 and string-decoder paths.
- Added PBKDF2 key import and
SubtleCrypto.deriveBits()support for derived keys. - Added
fs.symlinkSync()and expandedfs.cpSync()to preserve symlinks, file modes, filters, dereference options, and verbatim link targets. - Missing CommonJS packages now throw errors with
code: 'MODULE_NOT_FOUND'from bothrequire()andrequire.resolve(). - Updated
process,process.env,process.versions,process.features, andprocess.releaseto inherit standard object methods such ashasOwnProperty. - Optimized
HeadersandResponseinitialization while preserving content-type normalization and constructor behavior.
JavaScript async execution and control flow are more correct
- Fixed async coroutine state corruption across nested generators,
for await, and awaits that occur before a yield. - Fixed returns, throws, breaks, continues, and labeled jumps so they unwind through every required
finallyblock. - Fixed async returns that previously skipped
finally, includingPromise.race()paths with pending competitors. - Fixed iterator-result undefined behavior affecting typed arrays, collections, headers, and
Promise.all(). - Made pending-promise garbage-collector tracking O(1) and scoped it per VM.
- Added a generational write barrier for closed upvalues so captured values remain live across collections.
- Fixed sloppy-mode
argumentsparameter aliasing, including after async activation materialization. - Fixed JIT-compiled derived constructors dropping the
thisvalue rebound bysuper().
Parser, object-model, and collection correctness improved
- Corrected static class method parsing, computed class elements, and strict class-element compilation.
- Fixed incorrect parsing of unparenthesized
inexpressions. - Fixed strict-mode reclassification for dynamically constructed functions.
- Added non-registered symbols and native functions as valid
WeakMapkeys andWeakSetvalues. - Removed the legacy rope-length cap that could break very large concatenated property strings.
- Improved builtin object construction and prototype consistency.
Silver JIT coverage and performance expanded
- Added JIT support for optimized field reads and optional property/element access.
- Added JIT support for nullish tests and nullish jumps.
- Added JIT support for private-field reads and writes.
- Added JIT support for stack
NIP, prefix/postfix increment, and decrement operations. - Added virtual-stack slot reservation and more precise boxed/numeric slot tracking.
- Fixed stale numeric-slot state after JIT
voidoperations. - Added targeted JIT correctness tests and hit/miss benchmarks for fields, elements, nullish operations, private fields, stack manipulation, and increment/decrement.
- Added dynamic-property, large-AST, React, response-construction, and decimal conversion performance workloads.
- Updated the Darwin ARM64 PGO profile and expanded PGO training with server workloads.
WASI, sandboxing, and embedding moved forward
- Added configurable WASI
preopensinstead of exposing only the current directory. - Fixed Darwin WASI native-call linkage.
- Fixed AArch64 KVM boot-parameter parsing and exception-vector setup.
- Added AArch64 sandbox register dumping for fault diagnosis and disabled unsupported DC ZVA use under KVM.
- Updated libant to compile the platform sandbox backends into the static library.
- Added libant allocator, native-tuning, LTO, and PGO build options.
Build, release, and project infrastructure improved
- Added a reproducible Nix toolchain layer with LLVM 21 on Linux and an Apple-SDK-safe unwrapped Clang setup on macOS.
- Added Cachix-backed Nix builds, system-partitioned vendor caches, stable output hashing, and ccache acceleration.
- Fixed Nix cache trust configuration and prevented unintended linker overrides.
- Fixed the Windows build after the runtime and tooling changes in this release.
- Added a dedicated manifest API route and GitHub workflow that attach release-note URLs without changing artifact provenance.
- Added vouch-managed contribution gating and automated vouch-list maintenance.
Testing coverage grew substantially
- Added a manifest-driven package and runtime test harness with snapshot support.
- Added focused harness groups for server, network, and HTTP benchmarking workloads.
- Added compatibility snapshots for esbuild, Rolldown, React, Preact, tar, djot, Lua, pidtree, and smoke workloads.
- Added regression coverage for
Ant.serve, readline input, platform package resolution, peer-context linking, forced installs, lifecycle trust, multipart publishing, base64, PBKDF2, filesystem symlinks, CommonJS errors, async/finally unwinding, GC upvalues, WeakMap symbols, large ropes, and the expanded JIT surface.
To upgrade to Ant 12.2.8f8451f4.0:
ant upgrade
To install Ant 12.2.8f8451f4.0:
curl -fsSL https://antjs.org/install | bash
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Ant
All releases →Beta — feedback welcome: [email protected]