# Releases > Every release, newest first. Releases are signed. Source: https://kern-lang.eu/releases Every release, newest first. Releases are signed. v1.2.0 ## Egress control, descriptor ownership, security hardening The second minor release. 2,241 tests, 435 stdlib modules. [Read the release notes ](https://kern-lang.eu/releases/1.2.0) ## All releases 1. v1.1.2 ### [Pool-mode liveness, cooperative Mutex, mbedTLS ABI fix](https://kern-lang.eu/releases/1.1.2) Patch release. 2. v1.1.1 ### [Concurrent HTTP fix, boxed union layout, release pipeline](https://kern-lang.eu/releases/1.1.1) Patch release fixing three adopter-reported v1.1.0 regressions. 3. v1.1.0 ### [Editions, package management, Go-parity stdlib breadth](https://kern-lang.eu/releases/1.1.0) The first feature release on the 1.0 line. 4. v1.0.3 ### [Security hardening, in-kernel virtio, formatter and go-parity stdlib](https://kern-lang.eu/releases/1.0.3) A security release on the 1.0 line. 5. v1.0.2 ### [Stdlib restructured into packages, containers hardened, control plane HA](https://kern-lang.eu/releases/1.0.2) 38 commits on the 1.0 line (v1.0.1 was a one-day patch carrying E0331, the trait-bound fix and the shared macOS container VM). 6. v1.0.0 ### [The release line is stable, releases are signed, and the clock became a capability](https://kern-lang.eu/releases/1.0.0) And the clock became a capability. Oct 3, 2026 7. v1.0.0-rc3 ### [The full rc2 security scan closed, the installer builds from source, and the runtime stopped leaking](https://kern-lang.eu/releases/1.0.0-rc3) rc3 closes every finding from the rc2 security scan (H-1 through H-9, M-1 through M-15) and adds three CI gates that did not exist… 8. v1.0.0-rc2 ### [Static file serving and safe long-lived state](https://kern-lang.eu/releases/1.0.0-rc2) Reproducible across two machines. Jul 14, 2026 9. v1.0.0-rc1 ### [A 1.0-grade implementation on the road to verifiable trust](https://kern-lang.eu/releases/1.0.0-rc1) Jun 23, 2026 10. v0.9.0-rc3 ### [SQL checked against your schema at compile time (E0311)](https://kern-lang.eu/releases/0.9.0-rc3) The engine moves inside the language. May 16, 2026 11. v0.9.0-rc2 ### [Injection prevention as a syntactic category](https://kern-lang.eu/releases/0.9.0-rc2) The OWASP injection family is eliminated at the level of the grammar, not patched at runtime. 12. v0.9.0-rc1 ### [The stability candidate](https://kern-lang.eu/releases/0.9.0-rc1) Generics, async, Secure\, native containers. May 6, 2026 13. v0.6.0 ### [Decimal, LLM resilience, durable event log](https://kern-lang.eu/releases/0.6.0) And a BSI TR-02102-2 TLS audit. Apr 25, 2026 ## The engineering log Newest first. This is the full record behind the claims on the home page, including the audits that found our own bugs. Findings are named rather than hidden, and corrected when they turn out to be wrong. 1. On main since rc2 ### [Nine typechecker holes closed, three machine-checked proofs, and a cloud control plane](https://kern-lang.eu/releases/typechecker-holes-and-machine-checked-proofs) A parallel bug hunt found nine expression positions where the typechecker never called check\_expr at all. 2. ### [SMP guests, scoped Cap\, generational GC, and a fail-closed security sweep](https://kern-lang.eu/releases/smp-guests-scoped-fs-generational-gc) Four threads of work landed in the same week. 3. ### [The control plane a sovereign cloud needs, written as pure functions](https://kern-lang.eu/releases/sovereign-cloud-control-plane) Four modules landed that turn kern from a language you deploy onto a cloud into one you can build a cloud out of, and they share a design decision… 4. ### [A multi-tenant microVM platform written in Kern, from KVM up](https://kern-lang.eu/releases/multi-tenant-microvm-platform) The isolation story went from a proof of concept to a multi-tenant platform in one wave. 5. ### [The docs are a contract, so they get audited like code, and one audit found an auth bypass](https://kern-lang.eu/releases/docs-audited-like-code) An adopter put it plainly: the documentation is what actually gets read, so a document promising a capability the code does not deliver is a false… 6. ### [The compiler got about three times faster, and the collections about four](https://kern-lang.eu/releases/faster-compiler-and-collections) Compile throughput was profiled end to end and three root causes fell out, each fixed without a rewrite. 7. ### [A toolchain an agent can drive, and MCP with injection safety at compile time](https://kern-lang.eu/releases/agent-toolchain-and-mcp-injection-safety) Kern is now addressable by code-generating models as a first-class consumer. 8. ### [BLE and a complete BLE Mesh stack, in pure Kern, verified on hardware](https://kern-lang.eu/releases/ble-mesh-in-pure-kern) Kern reaches the device tier without a C dependency. 9. ### [Post-quantum crypto, workload identity, and the Go 1.25 gap closed](https://kern-lang.eu/releases/post-quantum-crypto-workload-identity) The standard library grew from 303 modules to 354, and from 2,219 public functions to 2,982, in three deliberate directions. 10. ### [Coverage measured by name, and what it found was failing open](https://kern-lang.eu/releases/coverage-measured-by-name) Test coverage was being measured the flattering way. 11. ### [A resource ceiling on every remote input, and compliance that actually persists](https://kern-lang.eu/releases/resource-ceilings-and-compliance) A sustained hardening wave gave the runtime a ceiling wherever a remote peer chooses the cost. 12. ### [The trust roadmap moved from claims to gates](https://kern-lang.eu/releases/trust-roadmap-gates) The July trust push turned the “real but manually verified” caveats into blocking CI jobs. 13. ### [Three taint tags, race detection and overflow checks in the type system](https://kern-lang.eu/releases/taint-tags-races-overflow) Secret is now a first-class compile-time taint tag alongside PersonalData\ (E0302) and Untrusted\ (E0303): a secret reaching any sink that does… 14. ### [TLS on every transport, cap-gated mail, real-time SIEM](https://kern-lang.eu/releases/tls-on-every-transport) The data-confidentiality track is complete: all five network transports now do TLS. 15. ### [The language-security audit, solved at the root](https://kern-lang.eu/releases/language-security-audit) Five independent audits of the language itself were folded into one ranked register (docs/design/language-security-hardening-2026-08.md), which… 16. ### [The type system is the seccomp profile](https://kern-lang.eu/releases/type-system-is-the-seccomp-profile) Every Kern binary now seals itself, before user code runs, to a seccomp-BPF filter that permits only the syscalls its capability set grants, and… 17. ### [Object-capability mesh and forensic record-replay](https://kern-lang.eu/releases/object-capability-mesh-and-record-replay) A Kern service's identity on the network is now the SHA-256 of its own reproducible binary: kern\_attest\_self\_hash() measures the running executable… 18. ### [Rootless containers and managed TLS](https://kern-lang.eu/releases/rootless-containers-and-managed-tls) The container engine's full mode (host bridge, veth pairs, NAT, inter-container networking) now runs for a non-root launcher: install-caps.sh grants… 19. Containerisation milestone ### [Linux boots on Kern's hypervisor](https://kern-lang.eu/releases/linux-boots-on-the-hypervisor) The container engine now extends beyond Linux namespaces. 20. Hardening milestone ### [Capability-secure core (compile error E0404)](https://kern-lang.eu/releases/capability-secure-core) All authority-bearing entry points: network, filesystem, process, FFI, environment access: now require explicit Cap\ capabilities. 21. Generics + async ### [Landed on a stable ABI](https://kern-lang.eu/releases/generics-and-async-on-a-stable-abi) Selective monomorphization for stdlib hot paths: List\, Map\, Result\, Option\, Decimal: emitted as linkonce\_odr typed wrappers so… 22. Also shipped ### [Kern-pkg, cloud KMS, chain-hashed audit](https://kern-lang.eu/releases/kern-pkg-cloud-kms-audit-log) init / build / run / test / add / remove / verify / install / publish / search / update with manifest \[dependencies\] / \[dev-dependencies\] parsing.