ICL 1.23.9 Release Notes

Summary

Hardens the local browser interface against two low-severity issues and
rolls up the JavaScript dependency upgrades (dockview, mermaid,
vega-lite) prepared after 1.23.8.

Security

• Fixed a path-traversal weakness in the browser's static asset serving.
  The /assets/ and /speedscope/ routes are not token-gated and passed
  the request path into the filesystem-fallback lookup without
  validation, so a crafted percent-encoded request (e.g.
  /assets/..%2f..%2f..%2fetc%2fpasswd) could escape the assets
  directory and read files readable by the ICL user when an on-disk
  assets directory was present. Filenames containing .. components or
  absolute paths are now rejected before any lookup.
• Fixed the WebSocket origin check to match the loopback host exactly.
  It previously used a substring match, so a spoofed origin such as
  http://127.0.0.1.evil.com was accepted. The host is now parsed and
  compared against the loopback allow-list.

Both issues are reachable only on the loopback interface and behind the
random port and per-session token, so real-world exposure is limited.

Dependencies

• Update dockview from 5.2.0 to 7.0.2. In v7 upstream renamed the
  framework-agnostic core package from dockview-core to dockview,
  which changes the browser global from window['dockview-core'] to
  window.dockview; all dockview APIs used by ICL are unchanged.
• Update mermaid from 11.14.0 to 11.16.0.
• Update vega-lite from 6.4.2 to 6.4.3.

Breaking Changes

None.

ICL 1.23.8 Release Notes

Summary

Restores package changes (in-package, ,cd) at the REPL, adds
pass-through of arguments after -- to the inferior Lisp, and rolls up
the fixes previously prepared for 1.23.7.

New Features

• Arguments following -- on the ICL command line are now passed
  through to the inferior Lisp, allowing scripts and options to be
  forwarded to the backend.

Bug Fixes

• Fixed in-package, (setf *package* ...), and the ,cd command
  having no lasting effect at the REPL. The interactive debugger eval
  path bound *package* to COMMON-LISP-USER around both the read and
  the evaluation of each form, so any package change was discarded
  before the next form was read.
• Fixed REPL crash (package-lock-violation on COMMON-LISP) when
  typing " inside a form with a dotted package name like
  zr.strings:parse-f64. The pathname context checker was using
  intern on the :cl package instead of find-symbol, which
  triggered SBCL's package lock when the extracted function name
  wasn't a known CL symbol.
• Hardened form-complete-p to catch all errors from
  read-from-string, not just reader-error. This prevents
  package-lock violations and other unexpected conditions from
  crashing the editor on Enter.
• Fixed escaped character tracking in find-string-start where
  (incf i) inside (loop for i ...) had no effect.
• ros install atgreen/icl now fails with a clear, actionable message
  when run without a prior ocicl install, instead of an obscure
  error.

Breaking Changes

None.

ICL 1.23.6 Release Notes

Summary

Fixes input handling for terminals using the Kitty keyboard protocol
and corrects escape tracking in paredit string detection.

Bug Fixes

• Fixed characters like " being silently dropped in terminals that
  use the Kitty keyboard protocol (kitty, foot, ghostty, WezTerm,
  etc.). ICL now properly decodes printable characters, modifier
  combinations, and special keys sent as ESC[N;Mu sequences.
• Fixed the Shift+Enter modifier check for the Kitty protocol, which
  was testing the wrong bit due to the protocol's 1 + flags
  encoding.
• Fixed in-string-p and count-unmatched-delimiters where escaped
  characters inside strings were not being skipped correctly, causing
  incorrect string state tracking in paredit mode.

Breaking Changes

None.

ICL 1.23.5 Release Notes

Summary

Fixes for DEB and RPM repository deployment and package signing.

Bug Fixes

• Fixed DEB package build failure caused by missing dpkg-sig package.
• Fixed APT repository deployment to GitHub Pages so that
  apt package index and GPG keyring URLs are now available.
• Fixed RPM and DEB repository builds to run as part of the release
  workflow instead of as separate workflows.
• SPDX SBOM is now installed at /usr/share/sbom/ in both RPM and DEB
  packages.

Breaking Changes

None.

ICL 1.23.2 Release Notes

Summary

Fix RPM signing in release pipeline.

Bug Fixes

• Install rpm-sign package in Fedora build container so rpmsign is available.
• RPM packages are now GPG-signed with the icl signing key.

Breaking Changes

None.

ICL 1.23.0 Release Notes

Summary

Update cl-selfupdate dependency.

Dependencies

• Update cl-selfupdate to 20260412-ee7dcdc.

Breaking Changes

None.

ICL 1.20.8 Release Notes

Summary

Add Ctrl-C interrupt support for the browser REPL and fix premature submission of incomplete forms.

Bug Fixes

• Fix REPL submitting incomplete forms when a reader error (e.g. unknown package prefix) occurs. Previously, any reader error was treated as a complete form, causing unbalanced expressions to be submitted immediately on Enter instead of allowing multiline continuation. Now checks parenthesis balance on reader errors.

New Features

• Add Ctrl-C support in the browser REPL to interrupt running evaluations. Pressing Ctrl-C while code is executing sends an :emacs-interrupt message via the Slynk protocol to break into the running computation on the backend.

Breaking Changes

None.

ICL 1.20.7 Release Notes

Summary

Fix premature submission of incomplete forms when input contains unknown package symbols.

Bug Fixes

• Fix REPL submitting incomplete forms when a reader error (e.g. unknown package prefix) occurs. Previously, any reader error in form-complete-p / input-complete-p was treated as a complete form, causing unbalanced expressions like (pkg:symbol () to be submitted immediately on Enter instead of allowing multiline continuation. Now checks parenthesis balance on reader errors so incomplete forms correctly continue to the next line.

Breaking Changes

None.

ICL 1.20.6 Release Notes

Summary

Update bundled JavaScript libraries and fix a cached image creation bug.

Changes

• Update dockview-core from 4.13.1 to 5.0.0. This major version bump adds header positioning support; all APIs used by ICL are unchanged.
• Update mermaid from 11.12.2 to 11.12.3 (patch release).
• Fix SLYNK package reader error during cached image creation. The generated eval code contained a literal slynk:create-server symbol that the reader couldn't resolve before Slynk was loaded.

Breaking Changes

None.

ICL 1.20.5 Release Notes

Summary

Bugfix release fixing a startup failure when the user's .sbclrc does not load ASDF.

Bug Fixes

• Fix UIOP package error during cached image creation when .sbclrc doesn't load ASDF. The generated Lisp code contained a literal uiop:getcwd symbol that the reader couldn't resolve before ASDF was loaded. Split (require :asdf) into a separate --eval so ASDF packages exist before the image creation code is read.

Breaking Changes

None.