Skip to content

Ant

v12.2.8f8451f4.0 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 16d CLI & Terminal
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ant antjs engine javascript nodejs npm
+3 more
portable runtime typescript

Affected surfaces

deps

ReleasePort's take

Light signal
editorial:auto 11d

Version v12.2.8f8451f4.0 introduces platform‑aware package filtering, lockfile version 4 upgrades, peer‑context virtual links, forced‑install flags, and bug fixes for cache cleanup.

Why it matters: These changes make dependency resolution deterministic across OS/CPU/ABI targets, improve lockfile accuracy with ABI data, preserve complex peer‑dependency graphs, enable reliable forced re‑resolution, and resolve prior cache leaks—a critical enhancement for reproducible builds and deployment stability.

Summary

AI summary

Package installs and dependency resolution are more deterministic with platform‑aware filtering, lockfile upgrades, peer‑context linking, and new forced‑install options.

Changes in this release

Feature Low

Adds platform-aware package filtering using OS, CPU, and libc/ABI names.

Adds platform-aware package filtering using OS, CPU, and libc/ABI names.

Source: llm_adapter@2026-07-15

Confidence: high

Feature Low

Upgrades `ant.lockb` to lockfile version 4, recording platform ABI data.

Upgrades `ant.lockb` to lockfile version 4, recording platform ABI data.

Source: llm_adapter@2026-07-15

Confidence: high

Feature Low

Introduces virtual package links preserving each dependency's peer‑dependency context.

Introduces virtual package links preserving each dependency's peer‑dependency context.

Source: llm_adapter@2026-07-15

Confidence: high

Feature Low

Adds `ant install --force` and `ant update --force` to ignore cached metadata and re‑resolve dependencies.

Adds `ant install --force` and `ant update --force` to ignore cached metadata and re‑resolve dependencies.

Source: llm_adapter@2026-07-15

Confidence: high

Feature Low

Adds metadata lookup for direct tarball URLs during registry installations.

Adds metadata lookup for direct tarball URLs during registry installations.

Source: llm_adapter@2026-07-15

Confidence: high

Feature Low

Automatically sets `npm_config_user_agent=ant/<version>` for package executables launched through Ant.

Automatically sets `npm_config_user_agent=ant/<version>` for package executables launched through Ant.

Source: llm_adapter@2026-07-15

Confidence: high

Feature Low

Improves registry‑host caching and warmed‑registry fallback deduplication.

Improves registry‑host caching and warmed‑registry fallback deduplication.

Source: llm_adapter@2026-07-15

Confidence: high

Feature Low

Adds multipart package publishing to the registry and ants.land CLI for larger archives.

Adds multipart package publishing to the registry and ants.land CLI for larger archives.

Source: llm_adapter@2026-07-15

Confidence: high

Feature Low

Adds `Ant.serve(options)` returning a live server object with hostname, port, URL, stop, requestIP, timeout, upgradeWebSocket, and eventSource.

Adds `Ant.serve(options)` returning a live server object with hostname, port, URL, stop, requestIP, timeout, upgradeWebSocket, and eventSource.

Source: llm_adapter@2026-07-15

Confidence: high

Feature Low

Listen failures now include Node‑style details: code, errno, syscall, address, port, or Unix‑socket path.

Listen failures now include Node‑style details: code, errno, syscall, address, port, or Unix‑socket path.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Feature Low

Added `dns.promises.resolve()` support for A, AAAA, SRV, and TXT records via c-ares.

Added `dns.promises.resolve()` support for A, AAAA, SRV, and TXT records via c-ares.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Feature Low

Made `net.Socket` and `tls.TLSSocket` inherit and initialize as duplex streams.

Made `net.Socket` and `tls.TLSSocket` inherit and initialize as duplex streams.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Feature Low

Added `Buffer.prototype.compare()` and `Buffer.prototype.equals()` methods.

Added `Buffer.prototype.compare()` and `Buffer.prototype.equals()` methods.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Feature Low

Extended `Buffer.prototype.toString()` with start/end bounds support.

Extended `Buffer.prototype.toString()` with start/end bounds support.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Feature Low

Implemented proper `DataView.prototype.buffer`, `byteLength`, and `byteOffset` accessors.

Implemented proper `DataView.prototype.buffer`, `byteLength`, and `byteOffset` accessors.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Feature Low

Added Latin‑1 conversion support to base64 and string‑decoder paths.

Added Latin‑1 conversion support to base64 and string‑decoder paths.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Feature Low

Added PBKDF2 key import and `SubtleCrypto.deriveBits()` for derived keys in Web Crypto API.

Added PBKDF2 key import and `SubtleCrypto.deriveBits()` for derived keys in Web Crypto API.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Feature Low

Added synchronous filesystem operations: `fs.symlinkSync()` and expanded `fs.cpSync()` preserving symlinks, modes, filters, dereference options, and verbatim link targets.

Added synchronous filesystem operations: `fs.symlinkSync()` and expanded `fs.cpSync()` preserving symlinks, modes, filters, dereference options, and verbatim link targets.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Feature Low

Updated `process`, `process.env`, `process.versions`, `process.features`, and `process.release` to inherit standard object methods like `hasOwnProperty`.

Updated `process`, `process.env`, `process.versions`, `process.features`, and `process.release` to inherit standard object methods like `hasOwnProperty`.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Performance Low

Reduced per‑byte work in readline key‑sequence processing for faster input handling.

Reduced per‑byte work in readline key‑sequence processing for faster input handling.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Performance Low

Optimized `Headers` and `Response` initialization while preserving content‑type normalization and constructor behavior.

Optimized `Headers` and `Response` initialization while preserving content‑type normalization and constructor behavior.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Performance Low

Made pending‑promise garbage‑collector tracking O(1) per VM and added a generational write barrier for closed upvalues.

Made pending‑promise garbage‑collector tracking O(1) per VM and added a generational write barrier for closed upvalues.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Bugfix Medium

Fixes cache cleanup and retained‑memory issues in forced installs.

Fixes cache cleanup and retained‑memory issues in forced installs.

Source: llm_adapter@2026-07-15

Confidence: high

Bugfix Medium

Fixed async coroutine state corruption across nested generators, `for await`, and pre‑yield awaits.

Fixed async coroutine state corruption across nested generators, `for await`, and pre‑yield awaits.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Bugfix Medium

Ensured returns, throws, breaks, continues, and labeled jumps unwind through all required `finally` blocks in async contexts.

Ensured returns, throws, breaks, continues, and labeled jumps unwind through all required `finally` blocks in async contexts.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Bugfix Medium

Corrected async returns that previously skipped `finally`, including `Promise.race()` with pending competitors.

Corrected async returns that previously skipped `finally`, including `Promise.race()` with pending competitors.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Bugfix Low

Reworked readline and `process.stdin` to cooperate correctly for keypress events, pause/resume, and piped input handling.

Reworked readline and `process.stdin` to cooperate correctly for keypress events, pause/resume, and piped input handling.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Bugfix Low

Fixed arrow‑key decoding, sequential keypress delivery, stdin pausing, and piped‑input handling in readline.

Fixed arrow‑key decoding, sequential keypress delivery, stdin pausing, and piped‑input handling in readline.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Bugfix Low

Missing CommonJS packages now throw errors with `code: 'MODULE_NOT_FOUND'` from both `require()` and `require.resolve()`.

Missing CommonJS packages now throw errors with `code: 'MODULE_NOT_FOUND'` from both `require()` and `require.resolve()`.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Bugfix Low

Fixed iterator‑result undefined behavior affecting typed arrays, collections, headers, and `Promise.all()`.

Fixed iterator‑result undefined behavior affecting typed arrays, collections, headers, and `Promise.all()`.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

Full changelog

Ant 12.2.8f8451f4.0

Package installs and dependency resolution are more deterministic

  • Added platform-aware package filtering using npm-compatible operating-system, CPU, and Linux libc/ABI names.
  • Upgraded ant.lockb to lockfile version 4 so platform ABI data is recorded consistently. Invalid or older lockfiles now trigger a fresh resolve and install instead of stopping at an invalid-lockfile error.
  • Added virtual package links that preserve each dependency's peer-dependency context instead of flattening incompatible peer environments together.
  • Improved registry-host caching and warmed-registry fallback deduplication.
  • Added ant install --force and ant update --force to ignore cached metadata, re-resolve dependencies, and safely replace cached package contents.
  • Fixed cache cleanup and retained-memory issues in forced installs.
  • Added metadata lookup for direct tarball URLs so packages installed from registry tarballs still resolve with their correct package metadata.
  • Added automatic npm_config_user_agent=ant/<version> for package executables launched through Ant.
  • Improved package trust output by listing blocked lifecycle scripts and the exact ant trust commands needed to run them.
  • Added lifecycle-build counts and clearer progress reporting to install, add, update, trust, and reinstall output.
  • Limited add/update summaries to the direct packages requested by the user.

ants.land publishing and tooling improved

  • Added multipart package publishing to the registry and ants.land CLI for larger package archives.
  • Added tarball hashing and multipart create, part-upload, and completion handling.

Servers and interactive input are easier to use

  • Added first-class Ant.serve(options) for starting a server programmatically instead of relying only on a module default export.
  • Ant.serve() now returns the live server object with hostname, port, url, stop, requestIP, timeout, upgradeWebSocket, and eventSource.
  • Listen failures now include Node-style code, errno, syscall, address, port, or Unix-socket path details.
  • Reworked readline and process.stdin around one shared input path so readline, keypress events, pause/resume, and data listeners cooperate correctly.
  • Fixed arrow-key decoding, sequential keypress delivery, stdin pausing, and piped-input handling.
  • Reduced per-byte work in readline key-sequence processing.

Node and web API compatibility expanded

  • Added dns.promises.resolve() support for A, AAAA, SRV, and TXT records through c-ares.
  • Made net.Socket and tls.TLSSocket inherit and initialize as duplex streams.
  • Added Buffer.prototype.compare() and Buffer.prototype.equals().
  • Added start/end bounds support to Buffer.prototype.toString().
  • Added proper DataView.prototype.buffer, byteLength, and byteOffset accessors.
  • Added Latin-1 conversion support to base64 and string-decoder paths.
  • Added PBKDF2 key import and SubtleCrypto.deriveBits() support for derived keys.
  • Added fs.symlinkSync() and expanded fs.cpSync() to preserve symlinks, file modes, filters, dereference options, and verbatim link targets.
  • Missing CommonJS packages now throw errors with code: 'MODULE_NOT_FOUND' from both require() and require.resolve().
  • Updated process, process.env, process.versions, process.features, and process.release to inherit standard object methods such as hasOwnProperty.
  • Optimized Headers and Response initialization while preserving content-type normalization and constructor behavior.

JavaScript async execution and control flow are more correct

  • Fixed async coroutine state corruption across nested generators, for await, and awaits that occur before a yield.
  • Fixed returns, throws, breaks, continues, and labeled jumps so they unwind through every required finally block.
  • Fixed async returns that previously skipped finally, including Promise.race() paths with pending competitors.
  • Fixed iterator-result undefined behavior affecting typed arrays, collections, headers, and Promise.all().
  • Made pending-promise garbage-collector tracking O(1) and scoped it per VM.
  • Added a generational write barrier for closed upvalues so captured values remain live across collections.
  • Fixed sloppy-mode arguments parameter aliasing, including after async activation materialization.
  • Fixed JIT-compiled derived constructors dropping the this value rebound by super().

Parser, object-model, and collection correctness improved

  • Corrected static class method parsing, computed class elements, and strict class-element compilation.
  • Fixed incorrect parsing of unparenthesized in expressions.
  • Fixed strict-mode reclassification for dynamically constructed functions.
  • Added non-registered symbols and native functions as valid WeakMap keys and WeakSet values.
  • Removed the legacy rope-length cap that could break very large concatenated property strings.
  • Improved builtin object construction and prototype consistency.

Silver JIT coverage and performance expanded

  • Added JIT support for optimized field reads and optional property/element access.
  • Added JIT support for nullish tests and nullish jumps.
  • Added JIT support for private-field reads and writes.
  • Added JIT support for stack NIP, prefix/postfix increment, and decrement operations.
  • Added virtual-stack slot reservation and more precise boxed/numeric slot tracking.
  • Fixed stale numeric-slot state after JIT void operations.
  • Added targeted JIT correctness tests and hit/miss benchmarks for fields, elements, nullish operations, private fields, stack manipulation, and increment/decrement.
  • Added dynamic-property, large-AST, React, response-construction, and decimal conversion performance workloads.
  • Updated the Darwin ARM64 PGO profile and expanded PGO training with server workloads.

WASI, sandboxing, and embedding moved forward

  • Added configurable WASI preopens instead of exposing only the current directory.
  • Fixed Darwin WASI native-call linkage.
  • Fixed AArch64 KVM boot-parameter parsing and exception-vector setup.
  • Added AArch64 sandbox register dumping for fault diagnosis and disabled unsupported DC ZVA use under KVM.
  • Updated libant to compile the platform sandbox backends into the static library.
  • Added libant allocator, native-tuning, LTO, and PGO build options.

Build, release, and project infrastructure improved

  • Added a reproducible Nix toolchain layer with LLVM 21 on Linux and an Apple-SDK-safe unwrapped Clang setup on macOS.
  • Added Cachix-backed Nix builds, system-partitioned vendor caches, stable output hashing, and ccache acceleration.
  • Fixed Nix cache trust configuration and prevented unintended linker overrides.
  • Fixed the Windows build after the runtime and tooling changes in this release.
  • Added a dedicated manifest API route and GitHub workflow that attach release-note URLs without changing artifact provenance.
  • Added vouch-managed contribution gating and automated vouch-list maintenance.

Testing coverage grew substantially

  • Added a manifest-driven package and runtime test harness with snapshot support.
  • Added focused harness groups for server, network, and HTTP benchmarking workloads.
  • Added compatibility snapshots for esbuild, Rolldown, React, Preact, tar, djot, Lua, pidtree, and smoke workloads.
  • Added regression coverage for Ant.serve, readline input, platform package resolution, peer-context linking, forced installs, lifecycle trust, multipart publishing, base64, PBKDF2, filesystem symlinks, CommonJS errors, async/finally unwinding, GC upvalues, WeakMap symbols, large ropes, and the expanded JIT surface.

To upgrade to Ant 12.2.8f8451f4.0:

ant upgrade

To install Ant 12.2.8f8451f4.0:

curl -fsSL https://antjs.org/install | bash

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Ant

Get notified when new releases ship.

Sign up free

Related context

Related tools

Beta — feedback welcome: [email protected]