Release v0.0.50

[queil]

No description provided.

[strix-security]

Strix Security Review

Warning

This pull request has 7 commits after the last Strix review (05719ec). Strix has not reviewed these changes.
Automatic review on push is off for this repository. To review the latest changes, tag @strix-security in a comment, or turn on re-review on push.

No security issues found.

Review summary

Reviewed all 20 changed files in this release PR, focusing on the new exec process-replacement feature (Proc.fs P/Invoke execvp/setenv, the Builtins reifier wiring, Parser desugar/refusal, and Check diverging-statement handling), the new Path.home/XDG directory helpers, the #history REPL directive, the newTempDir cleanup warning, and the inference open-map refactor in Infer.fs.

The exec primitive was examined end-to-end: the program name, arguments, environment keys/values, and working directory are all validated for NUL bytes, arguments are passed as an argv array to execvp (no shell interpolation, so no command-injection surface), the argv array is correctly null-terminated, and environment changes are applied via setenv to be inherited by the replacement image. The Path.home/XDG helpers read environment variables but return typed string values that are never expanded in argv, so they introduce no injection path. The REPL #history directive and the inference/parse/checker changes are analysis- or display-only and reach no dangerous sink with attacker-controlled input.

A targeted semgrep security pass over the changed source files reported zero findings. No candidate vulnerability rose to the level of requiring an independent validation pass.

_{Updated for 05719ec.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}