This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Affected surfaces
ReleasePort's take
Moderate signalStarting with v0.12.1, linked modules no longer expose their transitive checking dependencies to dependent modules.
Why it matters: Projects must explicitly declare those transitive dependencies; failure triggers build failures in dependency resolution (severity 70).
Summary
AI summaryLinked dependencies no longer expose their transitive checking dependencies to the depending module.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | High |
Projects must directly declare transitive dependencies previously accessible via link=true sources. Projects must directly declare transitive dependencies previously accessible via link=true sources. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Transitive checking dependencies of link=true sources are no longer exposed to depending module. Transitive checking dependencies of link=true sources are no longer exposed to depending module. Source: llm_adapter@2026-07-16 Confidence: high |
— |
Full changelog
Fixed
link = truesource dependencies no longer expose their transitive checking
dependencies to the depending module. Those transitive dependencies are still
passed as link-time inputs, so linked implementations can use their own
dependencies without leaking those names to user code.
Security
- No new ambient capabilities are introduced. The build tool now preserves the
checking boundary for linked dependencies by keeping their implementation
dependencies out of the dependent module's check scope.
Compatibility
- No build-spec changes. Projects that relied on accidentally accessing a
transitive dependency through alink = truedependency must declare that
dependency directly if it is intended to be visible to source code.
Breaking Changes
- Transitive checking dependencies of `link = true` sources are no longer exposed to depending modules; direct declaration required for visibility.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Jo
All releases →Related context
Beta — feedback welcome: [email protected]