# kern 1.2.0

> Egress control, descriptor ownership, security hardening. The second minor release. 2,241 tests, 435 stdlib modules.

Source: https://kern-lang.eu/releases/1.2.0

Egress control, descriptor ownership, security hardening

The second minor release2,241 tests435 stdlib modules

## Release notes

### Strict egress mode

`KERN_NET_POLICY=strict` with a `KERN_NET_ALLOW` list means deny-all by default. Every dial, DNS lookup and UDP send to an unlisted destination is refused with a SIEM event. Becomes the default in 1.3.0.

### Descriptor ownership (A38)

Every API that hands out a file descriptor now hands out a handle that names the open it came from. A close wakes blocked operations and the last one to finish performs the close; a handle used after close fails even once the number is reused. Eliminates the class of bug where closing a descriptor on one thread lets another thread's I/O land on a different connection.

### Protocol-client ownership (A46)

MQTT, gRPC, NATS, SSH and WebSocket clients are now owned records. A close wakes a call blocked on the connection; a call on a closed value fails cleanly.

### Shared list safety (A35)

Slot stores are now release-ordered, reader loads acquire, writers take the container lock, and sorts/shuffle/clear are locked.

### Cap\<Recon>

Port probes and banner grabs need their own capability; `Cap<Net>` for scanning is deprecated (W0004, E0422 under edition 2027).

### UDP/NTP/mDNS/libpq egress

Now go through the allowlist and the SSRF screen; cloud metadata and link-local addresses are refused at default SSRF level.

### KERN\_NET\_ALLOW hardened

No more truncation at 1024 bytes, no port misparse, malformed list refuses all traffic.

### macOS VM proxy fix

A guest could redirect published-port traffic to another VM on the same host.

### Async fixes

Async file/DNS calls inside routines returned wrong results; multiple multi-worker correctness fixes.

### Cloud plane

Rescue mode (UR-102), power\_cycle, per-instance events, cloud-init user\_data for VMs (UR-108), volume resize in place (UR-110), container hostname best-effort (UR-109).

### HTTP client deadline

Total deadline across connect, TLS, writes, reads, redirects and retries (default 120s).

### Fuzz

Python parser fuzzers ported to Kern-native.

### By the numbers

2,241 tests (1,669 conformance + 85 compat + 487 negative). 435 stdlib modules (310 core + 125 in 10 packages), 4,878 pub fns. 62K-line compiler, 74K C runtime (46,006-line audited TCB). 14 fuzz targets (8 C libFuzzer + 6 Kern-language).

Strict egress mode

`$ export KERN_NET_POLICY=strict`

Upgrade with the same install command. Releases are signed.

[Get started ](https://kern-lang.eu/get-started)