[Lorenzobattistela]

• bend --publish sends only files inside the entry's directory: a
  ../ climb, a symlink out of it or a LICENSE that links out is refused
  before mining, with no hub request (Security: bend --publish reads and uploads files outside the project directory via climbing foreign imports #1836, PR fix(cli): keep published files inside the entry directory #1838 by oxura).
• File.open(path, "x") creates a new file and fails with EEXIST if
  the path exists, in one step (File.open: a "x" mode that creates a file and fails if it exists #1821, PR File.open takes "x": create a new file, fail if the path exists (#1821) #1824).
• Non-UTF-8 arguments: IO.args_bytes gives each argument's bytes, and
  File.open_bytes opens a path given as bytes (IO.args turns non-UTF-8 arguments into U+FFFD, so a program can't open a file it was given #1798, PR A non-UTF-8 argument reaches the program as bytes and opens its file (#1798) #1799 by
  viridale).
• Process.run runs through one worker on Bun and Node, so it no
  longer ends the run on Node, and a child that leaves stdin unread no
  longer hangs it (Process.run ends the run on the Node host instead of running the program #1468, PR Run Process.run through one worker on Bun and Node #1831 by oxura).
• Metal: the lane spill of 2.0.38 is gone (PR Remove the Metal lane spill (#1439): bend -o of a ! program built 17% slower #1809): it made
  bend -o of a ! program build 17% slower. A full lane fails with
  ERR_DEEP again, as in 2.0.37.
• Fixes:
  • The GPU build sees a closure in a later instance of the same datatype
    (ty_holds skips a closure in a later instance of the same datatype #1513, PR ty_holds opens a datatype once with DUMMY for its value arguments (#1513) #1542).
  • C: a read-only walk borrows its list when a sum type puts a word where
    another constructor has a box (A read-only walk owns its list when a sum type puts an unboxed field where another constructor has a boxed one #1805, PR A read-only walk borrows its list when a word shares a slot with a box (#1805) #1806 by viridale); a memory
    fault ends the program by its signal (SIGSEGV, SIGBUS), not exit 1,
    after flushing output (PR Keep native memory faults as fatal signals #1828 by oxura).
  • IO.get_env refuses a name with a =, which read part of another
    variable on C and Node (IO.get_env with a "=" in the name reads part of another variable on the C lane and Node #1794, PR fix(io): get_env rejects a name with a "=" #1795 by orezraey).
• CLI: bend -o never overwrites an input through a hard link or with
  the GPU archive <out>.gpu (PRs fix(cli): reject hard-linked input files as outputs #1797 by sebastian-griego and fix(cli): prevent GPU archives from overwriting inputs #1826 by
  toprameen); a $CC that is not a usable clang 14+ ends the build with
  its reason, instead of a silent plain-clang build (bend -o: a $CC that is not a runnable clang is skipped silently, and the build uses plain clang #1802, PR bend -o: a $CC that is not a usable clang ends the build, instead of a silent plain-clang build (#1802) #1804 by
  Yi-111-a).
• Tools: the formatter keeps body columns after (, ;, tuple commas
  and in nested lambdas, and keeps a generic's > apart from a following
  = (PRs fix(formatter): preserve nested lambda body columns #1803 by toprameen, fix(lsp): preserve grouped semicolon body alignment #1811, fix(lsp): preserve body alignment after opening parentheses #1816, fix(lsp): preserve body alignment after tuple commas #1833, fix(lsp): preserve generic closers before assignment #1839 by vicmcorrea).
• Docs: BendTT proves adequacy, a checked law holds at each closed
  instance (PR BendTT: adequacy, a checked law holds at each closed instance #1627 by ScottMoore0); the guide and BendRT say a hot type
  counts the fields of every node, shared or not (One + on a List<&2, U32> seals every List cell a native build makes, List<&1, U32> ones included: a loop that shares nothing runs 2x slower #1559, PRs docs(guide): clarify reference counts on unshared fields #1812 by
  vicmcorrea and BendRT: a hot type counts the fields of every node, shared or not #1813), and BendRT matches the runtime on the corpus, JS
  requests and the CUDA cube (BendRT paper: the CPU corpus size and the JS request path differ from comp.ts; a question about the CUDA cube #1822, PR BendRT: the corpus grows from 8 GB, JS requests return, CUDA sizes the cube (#1822) #1823).

🤖 Generated with Claude Code