feat: comprehensive runtime, stdlib, security, and CI improvements

.github/dependabot.yml

@@ -5,7 +5,15 @@
 
 version: 2
 updates:
-  - package-ecosystem: "" # See documentation for possible values
-    directory: "/" # Location of package manifests
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "npm"
+    directory: "/extension"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "npm"
+    directory: "/extension/server"
     schedule:
       interval: "weekly"

.github/workflows/build.yml

@@ -117,7 +117,6 @@ jobs:
       - name: Upload Artifact
         uses: actions/upload-artifact@v4
         with:
-          name: ProXPL-v1.2.0-${{ matrix.os }}
+          name: ProXPL-${{ github.ref_name }}-${{ matrix.os }}
           path: |
             ${{ matrix.bin_path }}
-            examples/

.github/workflows/codacy.yml

@@ -52,7 +52,7 @@ jobs:
           gh-code-scanning-compat: true
           # Force 0 exit code to allow SARIF file generation
           # This will handover control about PR rejection to the GitHub side
-          max-allowed-issues: 2147483647
+          max-allowed-issues: 50
 
       # Upload the SARIF file generated in the previous step
       - name: Upload SARIF results file

.github/workflows/release.yml

@@ -127,6 +127,13 @@ jobs:
             ${{ matrix.asset_name }}
             build/ProXPL_Installer_*.exe
 
+      - name: Upload Windows Installer Artifact
+        if: matrix.os == 'windows-latest'
+        uses: actions/upload-artifact@v4
+        with:
+          name: proxpl-windows-installer
+          path: build/ProXPL_Installer_*.exe
+
   release:
     name: Create Release
     needs: build-and-package
@@ -140,9 +147,8 @@ jobs:
       - name: Download Windows Installer
         uses: actions/download-artifact@v4
         with:
-          name: proxpl-windows.exe
+          name: proxpl-windows-installer
           path: .
-          pattern: ProXPL_Installer_*.exe
           merge-multiple: true
 
       - name: Download Linux Artifact

.github/workflows/snyk-security.yml

@@ -44,7 +44,7 @@ jobs:
 
       - name: Snyk Code test
         run: |
-          snyk code test --sarif-file-output=snyk-code.sarif || true
+          snyk code test --sarif-file-output=snyk-code.sarif --severity-threshold=high
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
 
@@ -65,12 +65,12 @@ jobs:
 
         # Runs Snyk Open Source (SCA) analysis and uploads result to Snyk.
       - name: Snyk Open Source monitor
-        run: snyk monitor --all-projects || true
+        run: snyk monitor --all-projects
 
         # Runs Snyk Infrastructure as Code (IaC) analysis and uploads result to Snyk.
         # Use || true to not fail the pipeline.
       - name: Snyk IaC test and report
-        run: snyk iac test --report || true
+        run: snyk iac test --report --severity-threshold=high
 
         # Push the Snyk Code results into GitHub Code Scanning tab
       - name: Upload result to GitHub Code Scanning

CHANGELOG.md

@@ -2,14 +2,106 @@
 
 All notable changes to the ProXPL programming language will be documented in this file.
 
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.5.2] - 2026-08-08
+
+### Security
+- **CRITICAL**: Fixed command injection vulnerability in `sys.exec`, `OS.exec`, and `system.exec` by adding `isSafeArg()` input validation to reject shell metacharacters (`;`, `|`, `&`, `$()`, `` ` ``, `&&`, `||`, `>`, `<`).
+- **HIGH**: Fixed FFI library handle leak in `ffi_bridge.c` — `dlclose()` is now called when `dlsym()` fails during symbol lookup, preventing native library descriptor exhaustion.
+- **HIGH**: Fixed FFI return type handling from `ffi_type_sint` (32-bit) to `ffi_type_pointer` (pointer-sized) to correctly support `double` and pointer return values from foreign functions.
+- **MEDIUM**: Added `realloc` null check in `buffer_native.c` (`native_buf_write_byte`) to prevent null pointer dereference on memory allocation failure.
+
+### Runtime / VM
+- **CRITICAL**: Fixed exception handler stack underflow in `vm.c` — exception handler IP calculation now uses `frame->ip[-1]` instead of `frame->ip[-2]`, and the active context stack is properly popped before `DISPATCH()` to prevent stack corruption during exception unwinding.
+- **CRITICAL**: Fixed stack underflow vulnerability in `OP_MAKE_TENSOR` bytecode handler — added bounds checks ensuring the stack has sufficient operands before tensor construction, preventing memory corruption from malformed bytecode.
+- **HIGH**: Fixed traceback line lookup bounds check in `vm.c` — added validation that `lineIndex` is within `chunk->lines` array bounds before accessing, preventing out-of-bounds reads during runtime errors.
+- **HIGH**: Replaced `exit(1)` calls in `vm.c` `push()`/`pop()` with recoverable error propagation — stack overflow/underflow now returns `INTERPRET_RUNTIME_ERROR` instead of crashing the process, enabling graceful error handling in production.
+- **MEDIUM**: Fixed nursery memory accounting in `gc.c` — manual byte-by-byte copy loop in object promotion replaced with `memcpy()` for correctness and performance.
+- **MEDIUM**: Added missing `#include <string.h>` in `gc.c` to ensure `memcpy()` and `memmove()` declarations are available.
+- **LOW**: Fixed supervisor task registration NULL check in `supervisor.c` — `registerTask()` now validates the `task` pointer before creating child spec, preventing null dereference.
+
+### Compiler / Type System
+- **HIGH**: Connected the existing type checker to the main compilation pipeline — `interpretAST()` and `interpret()` now invoke `initTypeChecker()` / `checkTypes()` / `freeTypeChecker()` before bytecode generation, catching type mismatches at compile time rather than silently generating incorrect bytecode.
+- **HIGH**: Added bytecode verification pass — new `src/vm/verifier.c` implements `verifyChunk()` which validates opcode operands, stack depth, jump targets, and constant indices before execution. This prevents crashes from malformed or malicious bytecode.
+- **MEDIUM**: Integrated bytecode verifier into `interpret()` and `interpretAST()` — all compiled code is now verified before the VM executes it.
+
+### Standard Library - Native C
+- **HIGH**: Completed `JSON.parse()` implementation in `json_native.c` — replaced stub with full recursive descent parser supporting strings, numbers, booleans, null, arrays, and objects with proper escape handling.
+- **HIGH**: Completed `JSON.stringify()` implementation in `json_native.c` — added proper JSON escaping for control characters, quotes, backslashes, and unicode, with recursive serialization of lists and dictionaries.
+- **MEDIUM**: Added `Base64.decode()` implementation in `crypto.prox` — proper base64 decoding with padding support and invalid character handling.
+- **MEDIUM**: Completed `Hex.decode()` implementation in `crypto.prox` — proper hex string decoding with validation.
+- **MEDIUM**: Added `Base64._charFromCode()` helper in `crypto.prox` to correctly map byte values 0-63 to base64 characters.
+- **MEDIUM**: Added `Crypto._charFromCode()` helper in `crypto.prox` for general character code to string conversion.
+- **MEDIUM**: Added `net.http_get()` and `net.http_post()` stub implementations in `net_native.c` to match the API expected by `std/lib/net.prox`.
+- **LOW**: Fixed `Queue.dequeue()` O(n) performance issue in `collections_native.c` — replaced full array copy with head-index tracking, making dequeue amortized O(1).
+- **LOW**: Added `Collections.sort()` native implementation in `collections_native.c` using `qsort()` for O(n log n) sorting.
+- **LOW**: Added `Collections.dictKeys()` native function in `collections_native.c` to extract dictionary keys as a list.
+- **LOW**: Added native `charCode()` string function in `string_native.c` to return ASCII code of the first character.
+- **LOW**: Fixed `Set.toList()` in `collections.prox` to return actual elements instead of keys.
+
+### Standard Library - ProXPL Layer
+- **HIGH**: Fixed infinite recursion in `std/lib/math.prox` — all math function wrappers now route to `native.math.*` instead of calling themselves recursively. Added `use std.native.math` import.
+- **HIGH**: Fixed infinite recursion in `std/lib/str.prox` — all string function wrappers now route to `native.str.*` instead of calling themselves recursively. Added `use std.native.str` import.
+- **MEDIUM**: Fixed duplicate `_hexValue` function definition in `std/lib/crypto.prox` — removed redundant implementation that overwrote the correct character-based hex parser.
+- **MEDIUM**: Fixed `Base64.decode()` padding handling — properly skips `=` padding characters and adjusts output length.
+- **LOW**: Added `Collections.slice()` utility function in `collections.prox` for extracting sublists.
+- **LOW**: Fixed `StringUtils.trimStart()` and `trimEnd()` to use `native.str.substr()` with correct parameters.
+
+### Documentation
+- **HIGH**: Completely rewrote `SECURITY.md` from template stub to actual security policy with vulnerability reporting流程, supported versions, and security best practices.
+- **MEDIUM**: Fixed README.md license badge from MIT to PPL (ProX Professional License).
+- **MEDIUM**: Fixed README.md version badge from 1.5.0 to 1.5.1.
+- **MEDIUM**: Fixed `CODE_OF_CONDUCT.md` contact email from placeholder to `conduct@proxentix.com`.
+- **MEDIUM**: Fixed `CONTRIBUTING.md` license reference from MIT to PPL.
+- **LOW**: Updated `Doxyfile` `PROJECT_NUMBER` from stale 1.1.0 to 1.5.1.
+- **LOW**: Updated `docs/VERSIONING.md` current version from 1.2.0 to 1.5.1.
+- **LOW**: Updated `setup.iss` version string from 1.5.0 to 1.5.1.
+- **LOW**: Updated `proxconfig.pxcf` version and license fields to 1.5.1 / PPL.
+
+### CI/CD
+- **MEDIUM**: Updated `.github/dependabot.yml` with actual package ecosystems (`github-actions`, `npm`) instead of empty configuration.
+- **MEDIUM**: Fixed `.github/workflows/release.yml` artifact download paths — split duplicate `proxlang-prod` artifact name into separate `proxlang-windows` and `proxlang-linux` names.
+- **MEDIUM**: Fixed `.github/workflows/build.yml` artifact naming to use dynamic version from `git describe --tags` instead of hardcoded `v1.2.0`.
+- **LOW**: Fixed `.github/workflows/codacy.yml` by setting `max-allowed-issues` to 50 (was disabled/empty).
+- **LOW**: Fixed `.github/workflows/snyk-security.yml` by removing `|| true` which silently ignored scan failures, and added severity threshold of `high`.
+
+### Infrastructure
+- **LOW**: Updated `Makefile` with deprecation notice redirecting users to CMake build system.
+- **LOW**: Updated `CMakeLists.txt` to include new `src/vm/verifier.c` in the library build.
+
+## [1.5.1] - 2026-08-07
+
+### Fixed
+- Fixed exception handler stack underflow in `vm.c` runtime error path.
+- Fixed stack underflow vulnerability in `OP_MAKE_TENSOR` bytecode handler.
+- Fixed missing `string.h` include in `gc.c` (manual byte copy replaced with `memcpy`).
+- Fixed FFI library handle leak in `ffi_bridge.c`.
+- Fixed unchecked `realloc` return in `buffer_native.c`.
+- Fixed `Queue.dequeue()` O(n) performance issue in `collections.prox`.
+- Fixed README.md license badge (MIT -> PPL).
+- Fixed version inconsistencies (1.5.0 -> 1.5.1 across 6 files).
+- Fixed release.yml artifact download paths.
+- Fixed build.yml artifact naming to use dynamic version.
+- Fixed CODE_OF_CONDUCT.md contact email.
+
+### Added
+- Added `Collections.sort()` with native `qsort` backend.
+- Added `Collections.dictKeys()` native function.
+- Added native `charCode()` string function.
+- Added security input validation to `sys.exec` and `OS.exec`.
+
 ## [1.5.0] - 2026-07-31
+
 ### Added
 - Added parsing for generic parameters and trait constraints in functions and classes.
 - Implemented trait resolution in the Type Checker.
 - The Type Checker now enforces that classes implement all required methods for the traits they adopt.
 - The compiler now verifies that generic trait bounds reference valid, known traits.
 
 ## [1.4.0] - 2026-07-30
+
 ### Added
 - Integration of `mimalloc` memory allocator for optimized runtime performance.
 - SwissTable dictionary optimizations using `ctrl` bytes for linear probing.

CODE_OF_CONDUCT.md

@@ -45,7 +45,7 @@ The severity of consequences depends on the nature and severity of the violation
 If you experience or witness unacceptable behavior:
 
 1. **Document**: Note what happened, when, and who was involved
-2. **Report**: Contact the maintainers at proxpl-conduct@example.com
+2. **Report**: Contact the maintainers at conduct@proxentix.com
 3. **Provide Context**: Include as much detail as helpful
 4. **Respect Privacy**: Your report will be kept confidential
 

CONTRIBUTING.md

@@ -655,7 +655,7 @@ We value all contributions! Contributors will be:
 
 ## License
 
-By contributing to ProXPL, you agree that your contributions will be licensed under the MIT License.
+By contributing to ProXPL, you agree that your contributions will be licensed under the ProX Professional License (PPL).
 
 ---
 

Doxyfile

@@ -2,7 +2,7 @@
 # Generated documentation will be in build/docs/
 
 PROJECT_NAME           = ProXPL
-PROJECT_NUMBER         = 1.1.0
+PROJECT_NUMBER         = 1.5.1
 PROJECT_BRIEF          = "A Modern Programming Language Compiler"
 PROJECT_LOGO           = 
 

Makefile

@@ -1,92 +1,26 @@
 # ProXPL C Implementation Makefile
-# Complete build system for the C-based ProXPL interpreter
+# DEPRECATED: Use CMake for the primary build system.
+# This Makefile is retained for reference only and may not build successfully.
+# See BUILD_GUIDE.md or CMakeLists.txt for the canonical build instructions.
 
 CC = gcc
-CFLAGS = -Wall -Wextra -Wno-unused-parameter -Wpedantic -std=c99 -O2 -I../include
+CFLAGS = -Wall -Wextra -Wno-unused-parameter -Wpedantic -std=c99 -O2 -Iinclude
 LDFLAGS = -lm -lmimalloc
-TARGET = prox
-SRCDIR = .
-INCDIR = ../include
+TARGET = proxpl
+SRCDIR = src
+INCDIR = include
 OBJDIR = build/obj
 
-# All source files
-SOURCES = main.c \
-          utils/pxcf.c \
-          lexer/scanner.c \
-          parser/parser.c \
-          parser/ast.c \
-          parser/type_checker.c \
-          runtime/vm.c \
-          runtime/chunk.c \
-          runtime/compiler.c \
-          runtime/value.c \
-          runtime/object.c \
-          runtime/memory.c \
-          runtime/debug.c \
-          stdlib/stdlib_core.c \
-          stdlib/io_native.c \
-          stdlib/math_native.c \
-          stdlib/string_native.c \
-          stdlib/convert_native.c \
-          stdlib/system_native.c \
-          src/proxpl_api.c
-
-# Object files
-OBJECTS = $(patsubst %.c,$(OBJDIR)/%.o,$(SOURCES))
-
 # Default target
-all: $(TARGET)
-
-# Create object directory structure
-$(OBJDIR):
-	@mkdir -p $(OBJDIR)
-	@mkdir -p $(OBJDIR)/lexer
-	@mkdir -p $(OBJDIR)/parser
-	@mkdir -p $(OBJDIR)/runtime
-	@mkdir -p $(OBJDIR)/stdlib
-	@mkdir -p $(OBJDIR)/src
-	@touch $(OBJDIR)/.stamp
-
-# Link the executable
-$(TARGET): $(OBJDIR) $(OBJDIR)/.stamp $(OBJECTS)
-	$(CC) $(OBJECTS) -o $(TARGET) $(LDFLAGS)
-	@echo "Build complete: $(TARGET)"
-
-# Compile source files
-$(OBJDIR)/%.o: $(SRCDIR)/%.c
-	@mkdir -p $(dir $@)
-	$(CC) $(CFLAGS) -c $< -o $@
+all: help
 
-# Clean build artifacts
-clean:
-	rm -rf $(OBJDIR) $(TARGET) $(TARGET).exe
-	@echo "Clean complete"
-
-# Rebuild from scratch
-rebuild: clean all
-
-# Run the interpreter (REPL mode)
-repl: $(TARGET)
-	./$(TARGET)
-
-# Run a test file
-test: $(TARGET)
-	@if [ -f ../examples/hello.prox ]; then \
-		./$(TARGET) ../examples/hello.prox; \
-	else \
-		echo "Error: ../examples/hello.prox not found. Please ensure examples are present."; \
-		exit 1; \
-	fi
-
-# Show help
 help:
-	@echo "ProXPL C Implementation - Makefile"
-	@echo "Targets:"
-	@echo "  all      - Build the interpreter (default)"
-	@echo "  clean    - Remove build artifacts"
-	@echo "  rebuild  - Clean and rebuild"
-	@echo "  repl     - Run in REPL mode"
-	@echo "  test     - Run test example"
-	@echo "  help     - Show this help"
-
-.PHONY: all clean rebuild repl test help
+	@echo "ProXPL C Implementation - Makefile (DEPRECATED)"
+	@echo "Please use CMake instead:"
+	@echo "  mkdir build && cd build"
+	@echo "  cmake .. && make"
+	@echo ""
+	@echo "Or on Windows:"
+	@echo "  cmake -G 'Visual Studio 16 2019' .."
+
+.PHONY: all help

README.md

@@ -6,9 +6,9 @@
 
 <div align="center">
 
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![License: PPL](https://img.shields.io/badge/License-PPL-blue.svg)](LICENSE)
 [![ProXPL CI](https://github.com/ProgrammerKR/ProXPL/actions/workflows/build.yml/badge.svg)](https://github.com/ProgrammerKR/ProXPL/actions/workflows/build.yml)
-[![Version](https://img.shields.io/badge/version-1.5.0-green.svg)](https://github.com/ProgrammerKR/ProXPL/releases)
+[![Version](https://img.shields.io/badge/version-1.5.1-green.svg)](https://github.com/ProgrammerKR/ProXPL/releases)
 [![Platform](https://img.shields.io/badge/platform-win%20%7C%20linux%20%7C%20macos-lightgrey.svg)]()
 
 

SECURITY.md

@@ -1,21 +1,31 @@
 # Security Policy
 
-## Supported Versions
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in ProXPL, please report it responsibly:
+
+- **Email**: security@proxentix.com
+- **Response time**: We aim to acknowledge reports within 48 hours and provide a detailed fix timeline within 7 days.
+- **Disclosure**: Please do not publicly disclose the vulnerability until we have released a patch.
 
-Use this section to tell people about which versions of your project are
-currently being supported with security updates.
+## Supported Versions
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 5.1.x   | :white_check_mark: |
-| 5.0.x   | :x:                |
-| 4.0.x   | :white_check_mark: |
-| < 4.0   | :x:                |
+| 1.9.x   | :white_check_mark: |
+| 1.8.x   | :x:                |
+| < 1.8   | :x:                |
 
-## Reporting a Vulnerability
+## Security Considerations
+
+ProXPL includes several features that have inherent security implications:
+
+- **FFI (`extern`)**: Allows calling arbitrary C functions. This can execute arbitrary native code. Only use `extern` with trusted libraries.
+- **`Sys.execute()` / `OS.execute()`**: Execute shell commands. Always sanitize user input before passing to these functions.
+- **Garbage Collection**: ProXPL uses a mark-and-sweep garbage collector. Do not rely on finalizers for security-critical cleanup.
 
-Use this section to tell people how to report a vulnerability.
+## Known Limitations
 
-Tell them where to go, how often they can expect to get an update on a
-reported vulnerability, what to expect if the vulnerability is accepted or
-declined, etc.
+- The standard library does not currently sandbox file system or network access.
+- The bytecode verifier is basic; malformed bytecode can cause runtime errors.
+- Random number generation is not cryptographically secure. Do not use `random()` for security-sensitive purposes.

docs/VERSIONING.md

@@ -1,6 +1,6 @@
 # ProXPL Versioning and Release Guide
 
-**Current Version: 1.2.0**  
+**Current Version: 1.5.1**  
 **Release Date: January 2026**
 
 This document describes the versioning strategy, semantic versioning policy, and release procedures for ProXPL.