Forge v0.8.0 — 20 Modules, Security Hardening, VS Code Extension

What's New in v0.8.0

New Stdlib Modules

• os — hostname(), platform(), arch(), pid(), cpus(), homedir()
• path — join(), resolve(), relative(), is_absolute(), dirname(), basename(), extname(), separator

Security

• SSRF protection on by default — HTTP client denies private/loopback IPs unless FORGE_HTTP_ALLOW_PRIVATE=1
• --allow-run permission flag — shell execution requires explicit opt-in

Performance

• Variable-width VM frames — uses max_registers instead of fixed 256 slots
• Unified async runtime — reuses Tokio handle instead of per-call runtime creation
• VM Value is Copy — eliminates 51 unnecessary clone calls in dispatch

Build System

• JIT, PostgreSQL, MySQL are now optional cargo features — all enabled by default
• Trimmed tokio features from "full" to 7 specific features

Bug Fixes

• Fixed JIT memory leak, short-circuit &&/||, string .len char count, JSON escaping
• Eliminated 16 compiler warnings and 3 user-reachable panics

Developer Experience

• VS Code extension enhanced — full TextMate grammar (20 modules, 80+ builtins), 24 code snippets

Stats

• 972 tests passing
• 20 stdlib modules, 250+ functions

Full changelog: https://github.com/humancto/forge-lang/blob/main/CHANGELOG.md

v0.7.1 — Expert Review Fixes

What's Changed

16 fixes from a 5-expert review of the v0.7.0 codebase, targeting safety, correctness, and performance.

Critical Fixes

• Eliminated undefined behavior in VM opcode dispatch — replaced 3 unsafe { transmute } with safe TryFrom<u8> (#22)
• Fixed GC use-after-free risk — added missing root scanning for method tables, static methods, struct defaults, and open upvalues (#23)
• Fixed DAP message corruption — single BufReader<Stdin> prevents buffer desync (#24)
• Fixed deflated coverage — top-level statements now tracked by forge test --coverage (#25)

VM Parity & Correctness

• len() returns Unicode char count, not byte count (#31)
• Object == compares by key-value equality (#32)
• Compiler register overflow now panics cleanly instead of silent u8 wraparound (#37)
• DAP breakpoints keyed by source file (#36)

Performance

• Lazy register allocation: ~1.5MB to ~6KB initial VM memory (#28)
• Cached Arc<Chunk> in dispatch loop (#27)
• debug_assert! on SendableVM jit_cache emptiness (#26)

Benchmarks & Build

• Internal timing for all benchmarks, fair array comparison (#29)
• Rust/Go/Node.js fib(30) benchmarks for cross-language verification (#30)
• AOT/native launchers respect TMPDIR (#33)
• Deduplicated native.rs (-120 lines) (#34)
• Improved coverage executable-line heuristic (#35)

Full Changelog: v0.7.0...v0.7.1

Forge v0.7.0

What's Changed

• feat: forge publish for local registry by @humancto in #16
• feat: VM as default execution engine by @humancto in #17
• feat: cross-file LSP navigation by @humancto in #18
• feat: forge test --coverage by @humancto in #19
• feat: forge build --aot for bytecode-embedded native binaries by @humancto in #20
• feat: Debug Adapter Protocol (DAP) server by @humancto in #21

Full Changelog: v0.6.0...v0.7.0

Forge v0.6.0

What's Changed

• feat: LSP references, deep symbols, smart completions, user hover by @humancto in #7
• feat: LSP type-check diagnostics with line numbers by @humancto in #8
• feat: REPL highlighting + live completion, forge doc/fmt fixes by @humancto in #9
• feat: Phase 2 — package ecosystem improvements by @humancto in #10
• feat: source spans — line-accurate runtime errors (Phase 1.5) by @humancto in #11
• feat: Phase 3 — VM stdlib parity (47 new builtins + 4 modules) by @humancto in #12
• feat: JIT expansion — logical ops, 8-arg dispatch, tests by @humancto in #13
• feat: VM spawn/await async support (Phase 3.1) by @humancto in #14
• feat: schedule/watch blocks in VM (Phase 3.5) by @humancto in #15

Full Changelog: v0.5.0...v0.6.0

Forge v0.5.0

What's Changed

• Production-readiness hardening: HTTP/JWT/PG/VM/FS + 69 tests by @humancto in #4
• Phase 0 cleanup: JWT key-confusion defence, http options, roadmap by @humancto in #5
• Release v0.5.0 by @humancto in #6

Full Changelog: v0.4.3...v0.5.0

Forge v0.4.3

What's Changed

• Fix/audit jan 2026 by @humancto in #3

Full Changelog: v0.4.2...v0.4.3

Forge v0.4.2

v0.4.2 — Quality Pass

Six critical fixes that improve correctness, error reporting, and developer trust.

Fixes

1. REPL version strings — Dynamic version from Cargo.toml instead of hardcoded v0.3.0. Expanded tab-completion builtins (~28 → ~100). Updated help to list all 17+ modules.

2. HTML script stripping — crawl() now properly removes <script> and <style> content instead of leaking JavaScript/CSS into crawled text.

3. CSV RFC 4180 parser — Handles quoted fields with commas ("Smith, John",42), escaped quotes ("He said ""hello"""), and CRLF line endings.

4. push/pop mutation — push(arr, x) and pop(arr) now mutate let mut arrays in-place. Immutable arrays still return new copies (correct behavior preserved).

5. Mutable closure capture — make_counter() pattern now works correctly. Closures share mutable state via Arc<Mutex<HashMap>> instead of copy-on-write Arc<HashMap>.

6. Runtime error source locations — Runtime errors now display the offending source line with ariadne-powered error formatting. SpannedStmt wrapper tracks line numbers through execution.

Test Coverage

• 626 Rust tests + 631 Forge tests = 1,257 total (all passing)
• New tests/v042_fixes_test.fg with 31 targeted tests for all fixes
• New unit tests in csv.rs (12 tests) and http.rs (10 tests)

Install

# Homebrew
brew upgrade forge

# Cargo
cargo install forge-lang

# From source
git clone https://github.com/humancto/forge-lang && cd forge-lang && cargo install --path .

v0.4.1 — Hardened

What's New in v0.4.1

Parameterized SQL Queries (all DB modules)

All three database modules now support parameterized queries to prevent SQL injection:

• SQLite (db): db.query("SELECT * FROM users WHERE age > ?", [21])
• PostgreSQL (pg): pg.query("SELECT * FROM users WHERE age > $1", [21])
• MySQL (mysql): mysql.query(conn, "SELECT * FROM users WHERE age > ?", [21])

PostgreSQL TLS Support

pg.connect() now supports SSL/TLS connections via rustls — connect securely to cloud-hosted PostgreSQL instances.

CORS Security

HTTP servers now default to restrictive CORS. Opt in to permissive CORS with @server(cors: "permissive").

Interpreter Refactor

• call_builtin() extracted from interpreter/mod.rs to interpreter/builtins.rs
• call_native() extracted from vm/machine.rs to vm/builtins.rs
• Improved maintainability with no behavior changes

Bug Fixes

• split() with empty delimiter now correctly splits into characters
• 5 language bugs fixed (BUG-001 through BUG-005)
• 4 additional safety/correctness fixes

Testing

• 577 Rust tests (up from 528)
• 442 Forge tests (comprehensive new test suites added)
• 18 example files, all passing

HTTP Benchmark Examples

New bench_server.fg and bench_client.fg examples. Forge achieves ~28,000 req/sec on localhost — on par with raw Rust/Axum and 10x faster than Python/Flask.

v0.4.0 — Swiss Army Knife

What's New

JWT Authentication Module (jwt)

Stateless JSON Web Token support with 4 functions:

• jwt.sign(claims, secret, options?) — Create signed tokens (HS256/384/512, RS256, ES256)
• jwt.verify(token, secret) — Verify signature + expiration, return decoded claims
• jwt.decode(token) — Decode without verification (for debugging)
• jwt.valid(token, secret) — Boolean validity check (never throws)

Options: expires (duration strings like "1h", "7d"), issuer, audience, subject, algorithm, not_before.

MySQL/MariaDB Module (mysql)

Full MySQL support with connection pooling and parameterized queries:

• mysql.connect(url) or mysql.connect(host, user, pass, db) — Connect and get connection ID
• mysql.query(conn, sql, params?) — SELECT with parameterized ? placeholders
• mysql.execute(conn, sql, params?) — INSERT/UPDATE/DELETE, returns affected rows
• mysql.close(conn) — Close connection pool

Supports multiple simultaneous connections, automatic TLS via rustls, and safe parameterized queries.

By the Numbers

• 21 stdlib modules (up from 19)
• 280+ built-in functions (up from 270+)
• 528 Rust tests passing
• 862 total tests (Rust + Forge)

Full Changelog

• Added jsonwebtoken v9 crate for JWT support
• Added mysql_async v0.34 crate with rustls-tls for MySQL
• New language spec pages for jwt and mysql modules
• New book chapters (Ch. 32: JWT, Ch. 33: MySQL)
• Updated README, CLAUDE.md, and all documentation
• Rebuilt PDF book

Forge v0.3.3

Full Changelog: v0.3.2...v0.3.3