This release includes 1 breaking change for platform teams planning a safe upgrade.
Published 1d
Forensics & Incident Response
✓ No known CVEs patched
✓ No known CVEs patched in this version
Summary
AI summaryModule and package names must be ASCII‑only identifiers, rejecting non‑ASCII paths.
Full changelog
Added
- Resource packaging support in
jo.toml, including module-scoped resource
declarations, resource copying for app builds, resource inclusion in package
and release outputs, andresource.ResourcesAPIs for reading bundled
resources from Jo code. (#77) - JavaScript, Python, and Ruby resource-bundle runtime support. (#77)
- Default values for class and union parameters. (#76)
Changed
- Module and package names are validated as ASCII-only identifiers, giving
package and resource paths consistent cross-platform behavior. (#77) py.none,rb.nil,js.null, andjs.undefinednow have typeBottom, so
FFI sentinel values can be used in any expected result position. (#82)
Fixed
- Generated documentation no longer includes the closing
//]marker from doc
comments. (#72) - Resource syncing skips unchanged inputs. (#77)
- Pattern matching now preserves the transformed scrutinee in rescue
expressions. (#80) - SAST output is no longer emitted twice when typing fails. (#79)
Security
- No new ambient capabilities are introduced. Resources must be declared in the
build spec, and resource source/destination paths are validated before they
are copied or bundled. (#77)
Compatibility
- Build specs using non-ASCII module names, package names, or package
dependency names are now rejected. (#77) - Projects can opt into the new
resourcesbuild-spec entries, but existing
projects without resource declarations do not need changes.
Breaking Changes
- Module and package names are validated as ASCII-only identifiers, rejecting build specs that contain non-ASCII characters.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Jo
All releases →Related context
Related tools
Earlier breaking changes
- v0.12.1 Projects must directly declare transitive dependencies previously accessible via link=true sources.
Beta — feedback welcome: [email protected]