Gleam 1.18.0

Gleam 1.18.0 has been released — a bug-fix release that addresses several issues in the compiler, JavaScript target, Hex package verification, and developer tooling.

Bug Fixes

• Bit array segments — Fixed a bug where the compiler would generate invalid code when using constant strings in bit array segments.
• Float encoding (JavaScript target) — Fixed a bug where floats whose fraction rounded up would be encoded as half their value in 16-bit bit array segments on the JavaScript target.
• Float rounding (JavaScript target) — Fixed a bug where floats exactly halfway between two 16-bit floats would be rounded away from zero rather than to even in bit array segments on the JavaScript target.
• Zero-size segments — Fixed a bug where a bit array segment with a size of zero would add a zero byte to the bit array on the JavaScript target, instead of contributing nothing.
• Project scaffolding — Fixed a bug in gleam new where the incorrect verb form would be used when single or multiple conflicting files existed in the target directory.
• TOML v1.1 support — Fixed a bug where some commands would fail if gleam.toml uses TOML v1.1 syntax.
• Constructor renaming — Fixed a bug where renaming constructors referenced in constants resulted in incorrect code.
• Hex security — Fixed a bug where the checksum used to verify a downloaded Hex package tarball and the package\'s requirements were taken from the Hex API response rather than the verified registry metadata, so the registry signature did not guard them.

Impact & Upgrade Notes

While this is primarily a maintenance release centered on bug fixes, the Hex security fix is particularly noteworthy for anyone publishing or consuming packages via Hex. The registry signature now properly guards the checksum verification process.

Users targeting JavaScript should find Gleam 1.18.0 produces more reliable bit array code, especially around float encoding edge cases.

Upgrade via your preferred package manager or download from the official Gleam website.