Skip to content

Jo

v0.12.2 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Summary

AI summary

Module and package names must be ASCII‑only identifiers, rejecting non‑ASCII paths.

Full changelog

Added

  • Resource packaging support in jo.toml, including module-scoped resource
    declarations, resource copying for app builds, resource inclusion in package
    and release outputs, and resource.Resources APIs for reading bundled
    resources from Jo code. (#77)
  • JavaScript, Python, and Ruby resource-bundle runtime support. (#77)
  • Default values for class and union parameters. (#76)

Changed

  • Module and package names are validated as ASCII-only identifiers, giving
    package and resource paths consistent cross-platform behavior. (#77)
  • py.none, rb.nil, js.null, and js.undefined now have type Bottom, so
    FFI sentinel values can be used in any expected result position. (#82)

Fixed

  • Generated documentation no longer includes the closing //] marker from doc
    comments. (#72)
  • Resource syncing skips unchanged inputs. (#77)
  • Pattern matching now preserves the transformed scrutinee in rescue
    expressions. (#80)
  • SAST output is no longer emitted twice when typing fails. (#79)

Security

  • No new ambient capabilities are introduced. Resources must be declared in the
    build spec, and resource source/destination paths are validated before they
    are copied or bundled. (#77)

Compatibility

  • Build specs using non-ASCII module names, package names, or package
    dependency names are now rejected. (#77)
  • Projects can opt into the new resources build-spec entries, but existing
    projects without resource declarations do not need changes.

Breaking Changes

  • Module and package names are validated as ASCII-only identifiers, rejecting build specs that contain non-ASCII characters.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Jo

Get notified when new releases ship.

Sign up free

Related context

Earlier breaking changes

  • v0.12.1 Projects must directly declare transitive dependencies previously accessible via link=true sources.

Beta — feedback welcome: [email protected]