SafeC Blog

SafeC 1.0.0-beta-7 released

2026-10-27T00:00:00Z

SafeC 1.0.0-beta-7 was released on 2026-10-27. It is a pre-release: the language and std are still moving quickly.

It is the largest release so far: pull requests #51 through #88, everything merged since 1.0.0-beta-6. What's coming next tracked it as it landed and has the longer write-up of each area; the changelog lists every change down to individual signatures.

Install this exact release:

bash

curl -fsSL https://raw.githubusercontent.com/safec-org/SafeC/main/install.sh | bash -s -- --version=v1.0.0-beta-7

powershell

& ([scriptblock]::Create((irm https://raw.githubusercontent.com/safec-org/SafeC/main/install.ps1))) -Version v1.0.0-beta-7

Highlights

A web stack (#57): std/http is a keep-alive server with a router and middleware, static files, cookies, multipart forms, server-sent events and WebSocket, plus a URL client that follows redirects and decodes gzip; std/encoding/url and std/encoding/deflate come with it, and std/wasm has full DOM and browser-API interop.
HTTPS (#66): std/tls uses the operating system's TLS (OpenSSL, SChannel, Secure Transport) with a SafeC TLS 1.3 fallback, and std/http speaks https:// and wss://.
Async (#61): std/async brings Rust's Future / Poll / Waker model as goto state machines, with timers, combinators, channels, a no-heap LocalExecutor, a multi-threaded ThreadPool and async TCP.
A GUI toolkit (#63, #65): std/gui has an anti-aliased vector canvas with TrueType text, a widget toolkit and multi-window GuiApp, on X11, Wayland, Win32, Cocoa and the web, with GL ES, Metal and D3D11 presenters.
Audio and MIDI (#59): std/audio is one callback API over ALSA, JACK, Core Audio, WASAPI and Web Audio, with MIDI on every platform.
safeguard doc and safeguard publish (#69): a rustdoc-style API reference for any package (std's is at /api/), and library publishing with CI, release archives and Pages docs.
scc (#70): a SafeC compiler written in SafeC that emits WebAssembly and reproduces itself byte for byte. It runs the Playground in your browser.
safeguard packages (#51, #55): C, C++ and Objective-C packages and dependencies, library headers, Windows DLLs and app bundles; a build links only the std modules a project uses, with their system libraries.
ML on Vulkan and WebGPU (#54): std/ml tensor devices for SPIR-V (Vulkan) and WebGPU, beside CUDA, ROCm and Metal.
Prebuilt std in sections (#56): releases ship std compiled per platform, one archive per section, chosen with install.sh --std=... / install.ps1 -Std ...; the release binaries run on macOS 11 and glibc 2.25 or newer.
Versions you can check: safec --version and the new safeguard --version both print 1.0.0-beta-7 (#85).
Fixes: variadic calls promote bool / char / short to int; safety-check gaps around const &T field writes, -> escapes and container element references are closed; every container now drops its elements; Typedef** x locals parse; the lifetime analysis treats const &R T as a reference to const and ends expression temporaries at their full expression; and Windows and macOS CI are green (#52, #53, #64, #68, #71–#75, #78, #79, #82–#84).
Compiler and safeguard fixes (#86, #87): __VA_ARGS__ expands to every argument; #line works; atomic_cas with "release" / "acq_rel" is valid; including a libc header twice is a no-op; safeguard links libm on Linux; a file with many BST<..., struct> inserts compiles in a fraction of a second instead of tens; warnings are printed again when a file comes from the incremental cache.

Breaking changes

Every breaking change below is reported by the compiler at each affected line — a wrong argument count or type, an ownership error with a note at the declaration, or a missing header. Nothing changes behaviour silently except where the changelog says so.

std's API takes slices, not void* or pointer + length pairs (#76, #80, #81). Buffers are []T / []const T, callback contexts are typed ?&T stored as ?&Erased, and no void* is left anywhere in std. Allocators hand out ?&heap unsigned char; audio and MIDI callback contexts must be Send + Sync.
Compiler-enforced Drop, Send and Sync (#77). A value of a Drop type must be dropped or moved exactly once on every path; spawn, channels and thread pools accept only data that is safe to share or move.
Containers own their elements (#83). clear(), drop() and overwriting a key drop the values; don't free them yourself first.
std headers are <std/...> only (#83). safeguard no longer puts std/ itself on the include path, so a bare <math.h> is the C library's and #include <io.h> must become #include <std/io.h>.

Migrating

Buffers: pass slices — f.read(buf[..]), w.write(buf[0..n]), sha256(bytes, digest[..]), str_copy(dst[..], src); safe_memcpy now counts elements. See Types: slices, read-only and optional slices.
Ownership: add defer v.drop(); after creating a value of a Drop type (or release it on every path), and move data into threads with thread_spawn or share it through Mutex<T>. See Ownership & Drop and Thread Safety.
Containers: drop the container alone — remove any m.foreach(free_value) before m.drop(). See Collections: containers own their elements.
Includes: replace #include <io.h> / "prelude.h" with #include <std/io.h> / <std/prelude.h>. See Including std in Standard Library Modules.
Custom allocators and hashers: switch alloc / dealloc to ?&heap unsigned char, and a user Hasher to the slice signatures.

The full before/after table and two runnable examples are in What's coming next: Migrating; the changelog's Breaking changes section lists every changed signature, module by module.

Upgrading

Re-run the installer to upgrade an existing install in place (it installs the newest release, pre-releases included; pass the version to pin this one):

bash

curl -fsSL https://raw.githubusercontent.com/safec-org/SafeC/main/install.sh | bash -s -- --version=v1.0.0-beta-7

powershell

& ([scriptblock]::Create((irm https://raw.githubusercontent.com/safec-org/SafeC/main/install.ps1))) -Version v1.0.0-beta-7

Keep your std sections with --std=... / -Std ..., or add one later with --std=+<section>; see Install for every option. Then check what you have:

bash

safec --version       # safec 1.0.0-beta-7
safeguard --version   # safeguard 1.0.0-beta-7

Rebuild your projects from clean (safeguard clean && safeguard build) so nothing compiled against the old std is linked in.

Known issues

This is known in 1.0.0-beta-7:

GPU backends are compile-tested only. The CUDA, ROCm, Metal, Vulkan and WebGPU paths in std/ml and std/gui's GPU presenters compile in CI on every platform, but this release has not been run on GPU hardware.

If you hit something else, please open an issue.

Pull requests

safeguard: library headers, Windows DLLs, C/C++/Objective-C packages and dependencies, app bundles (#51)
compiler: const &R T is a reference to const; dataflow analysis for heap/arena lifetimes (#52)
compiler: expression temporaries die at the end of their full expression (lifetime analysis false positive) (#53)
ml: Vulkan (SPIR-V) and WebGPU tensor devices (#54)
safeguard: link only the std modules a project uses, with their system libraries; OS-seeded rng; prebuilt std in releases; README (#55)
std prebuilt in sections; std always optimized; releases for macOS 11 and glibc 2.25; llvm-nm on Linux CI (#56)
std web: URL/query/forms, deflate+gzip, keep-alive server, router, static files, cookies, multipart, SSE, WS client, browser DOM APIs (#57)
std: dir/path, CommonMark+GFM markdown, YAML flow, wasm runtime allocator; scx fixes; lexer escape fix (#58)
std/audio: real-time audio + MIDI I/O (ALSA, JACK, Core Audio/MIDI, WASAPI/WinMM, WebAudio/Web MIDI, dummy) (#59)
std/async: Rust-style futures/executors over goto state machines; goto scope checks in the compiler (#61)
README: restore the Async/Await row lost in #57's merge (#62)
std/gui: AA vector canvas + TrueType text, multi-window GuiApp, full widget toolkit (#63)
Fix main's Windows CI: generic COMDATs after ABI lowering; full-size WSADATA (#64)
std/gui: Wayland, web (<canvas>/WebGL/DOM) backends and GPU presenters (GL ES, Metal, D3D11) (#65)
HTTPS/TLS: std/tls with OS backends (OpenSSL, SChannel, SecureTransport) and a SafeC TLS 1.3 fallback; https/wss in std/http (#66)
README: restore the GUI platforms sentence lost in #66's merge (#67)
Fix main's macOS/Windows CI: std_modules check counts linkonce generic instances as linker-merged (#68)
safeguard doc (rustdoc-like, built with SafeC's web std) and safeguard publish (git + CI for GitHub/GitLab/Gitea/Forgejo) (#69)
selfhost: scc, a SafeC compiler in SafeC emitting WebAssembly — bootstraps, powers the web playground (#70)
compiler: promote bool/char/short to int in variadic calls (printf("%d", !x) printed 254) (#71)
Close safety gaps: const-ref field writes, ->/call-root escapes, container element references (#72)
Fix method calls through by-reference call results; MemoryFlow false positive with StrMap in recursion (#73)
compiler: check atomic_cas arguments against the pointee type (#74)
Fix main CI on every platform (package.sh, glibc 2.43 headers, macOS/Windows doc and test fixes) (#75)
std: no void* and no pointer + length pairs in the public API (slices and typed erasure) (#76)
Compiler-enforced Drop and thread safety (Send/Sync, spawn rules, Mutex guards) (#77)
compiler/examples/stdlib_complete.sc: port to the slice API (#78)
Fix main's macOS/Windows CI: ABI-lowered functions keep their place; mutex test pinned to Linux (#79)
std/audio without void*: typed backends, slices, typed FFI; Send+Sync audio/MIDI callback contexts (#80)
std: no void* anywhere — typed memory layer, ML autograd/GPU, GUI, TLS, OS bindings; api_lint enforces it (#81)
Parser: Typedef** x local declarations; nested prefix operators (**pp, - -x) (#82)
Fix bugs found by the docs audit: containers drop their elements, Reactor::drop, WsConn::closed, <math.h> in safeguard, playground time functions (#83)
selfhost: fail loudly when a string literal overflows g_tmp (#84)
Release 1.0.0-beta-7 (#85)
Fix 13 compiler and safeguard bugs: BST compile time, libc headers included twice, libm, __VA_ARGS__, #line, atomic_cas orderings, must_use on prototypes (#86)
safec: keep warnings on incremental-cache hits (#87)
Release: smoke test accepts a versioned clang; #86 and #87 in the beta-7 changelog (#88)

The release on GitHub · Changelog

A new home for SafeC

2026-10-26T00:00:00Z

The SafeC documentation started life as a VitePress site: a sidebar of reference pages and not much else. It has grown into the website a language needs. Here is what's new — and what stayed exactly where it was.

What's new

A landing page that says what SafeC is in one screen, with a runnable example, the bugs SafeC rejects at compile time side by side with the C that compiles them, and a tour of the standard library.
Learn gathers the Book, the guide, the language reference, the standard library, examples and benchmarks in one hub.
Install has per-platform instructions with copy buttons, the requirements (clang 21+) and every installer option.
Tools covers safeguard, sc-lsp with VS Code, Neovim and Emacs setups, and safec itself.
Community explains where development happens and how to report bugs and contribute.
The Playground edits SafeC in the browser with highlighting and line numbers, loads every runnable example from the Book, and shares programs as links. Every SafeC program on the site that the playground can build now has a Run in Playground link.
This blog, with tags, an Atom feed and an RSS feed. Release notes are generated from SafeC's release history and its CHANGELOG.md at build time, and the changelog shows what has been merged but not yet released.
A fresh design: light and dark themes, a layout that works on phones, keyboard navigation and a search that covers the docs and the blog.

What didn't change

Every existing URL still works — /guide/introduction, /reference/types, /stdlib/http and all the rest are where they were, in English and in Korean. New short URLs like /docs/ and /download are static redirect pages, since GitHub Pages has no server-side redirects.

Built with SafeC

The site is generated by a SafeC program in site/ of the docs repository, using only the standard library: std/serial/markdown parses CommonMark with GitHub's extensions, std/serial/yaml reads the configuration and frontmatter, scx templates (SafeC's JSX-style markup) lay out the pages, and the dev server is std/http. The interactive parts — the theme switch, search, tabs, copy buttons and the playground's editor — are a SafeC module compiled to WebAssembly on std/wasm's DOM bindings, with a few lines of JavaScript to load it. There is no JavaScript framework, and every page works without scripts.

What's next

The playground's Run button was waiting on a self-hosted SafeC compiler built to WebAssembly. Update: it has landed — Run now compiles and runs programs in the browser with scc (What's coming next). Versioned docs are planned too: the version selector in the docs sidebar lists the releases already.

Found a broken link or a page that could be clearer? Open an issue or send a pull request — the Community page explains how.

What's coming next: everything merged since 1.0.0-beta-6

2026-10-26T00:00:00Z

Shipped in 1.0.0-beta-7. Everything below was released on 2026-10-27 as SafeC 1.0.0-beta-7, together with #82–#88. The release notes have the install and upgrade instructions, a short migration list and the known issues; this post stays as the record of the cycle.

SafeC's main branch had moved a long way since 1.0.0-beta-6. This post was the running log of what the next release would contain: the pull requests merged since then, #56 through #81, grouped by area. Two of them are breaking changes that the compiler reports at every affected call site; the migration guide at the end shows how to update code.

SafeC's CHANGELOG.md, which this site renders as the changelog, records the later changes — safeguard doc and publish, scc, the slice API and the ownership checks — under 1.0.0-beta-7 (they were under Unreleased while this post was written), down to individual signatures. The first half of this cycle — the web stack, async, the GUI toolkit, audio and HTTPS — has a longer write-up in This cycle in SafeC.

At a glance

Area	What changed	Pull requests
Web stack	`std/http` server, router, WebSocket, SSE; URL and DEFLATE codecs; DOM interop for wasm	#57
Async	Rust-style futures as `goto` state machines, executors, async TCP	#61
GUI	Vector canvas, widgets, multiple windows; X11, Wayland, Win32, Cocoa and the web; GPU presenters	#63, #65
Audio & MIDI	One callback API over ALSA, JACK, Core Audio, WASAPI, Web Audio	#59
HTTPS	`std/tls`: the OS's TLS, with a SafeC TLS 1.3 fallback	#66
safeguard doc & publish	rustdoc-style API reference; library publishing with CI	#69
scc & the playground	A SafeC compiler written in SafeC, compiling to WebAssembly	#70
Slices, not `void` — breaking*	std's public API takes slices and typed erasure; no `void*` left anywhere in std	#76, #80, #81
Drop, Send and Sync — breaking	Compiler-checked ownership and thread safety	#77
Fixes	Codegen, safety-check gaps, Windows and macOS CI	#64, #68, #71–#75, #78, #79, #82, #83

Releases also now ship std prebuilt per platform, one archive per section (core, collections, gui, …), selected with install.sh --std=... / install.ps1 -Std ... (#56), and this website is now built by a SafeC program (#58).

A web stack

std/http (#57) is now a stack for real services: structured headers, a keep-alive HttpServer with chunked transfer coding, a Router with middleware and route patterns, static files, cookies, multipart forms, server-sent events and WebSocket upgrades, and a URL client that follows redirects and decodes gzip. It brought std/encoding's URL (RFC 3986) and DEFLATE / zlib / gzip codecs. On the browser side, std/wasm gained DOM and browser-API interop — events, timers, fetch, storage, history — with its JavaScript glue shipped in std. examples/fullstack_demo puts a Router server and a SafeC-to-wasm client together.

Async: futures as `goto` state machines

std/async (#61) brings Rust's Future / Poll / Waker / Context model to SafeC as a library, with no language coroutines: the ASYNC_BEGIN / AWAIT / ASYNC_RETURN macros turn a struct with a poll method into a resumable state machine over goto, keeping every local that lives across an await in the struct. On top come timers, join / select / timeout combinators, channels, Mutex, Semaphore, Notify, cancellation, a no-heap LocalExecutor that also runs on bare metal and wasm32, a multi-threaded ThreadPool, and an IoDriver + Runtime with async TCP on the epoll, kqueue and WSAPoll reactor.

A GUI toolkit

std/gui became a toolkit in #63: an anti-aliased vector canvas with TrueType text, a retained widget toolkit with layout and theming, and GuiApp for multi-window applications, all on a GuiBackend interface over the X11, Win32 and Cocoa window layers. #65 added more platforms: Wayland (chosen at run time on Linux), a WebAssembly backend that draws into a <canvas> or through WebGL with DOM interop and IME text input, and GPU presenters over OpenGL ES (EGL), Metal and Direct3D 11. safeguard bundle --target wasm32 packages a GUI app as a web page.

Audio and MIDI

std/audio (#59) is one callback-based API for audio streams and MIDI ports, with format conversion. Audio runs on ALSA, JACK, Core Audio, WASAPI, Web Audio and a dummy device for tests; MIDI on the ALSA sequencer, JACK, Core MIDI, WinMM and Web MIDI.

HTTPS

std/tls (#66) uses the operating system's TLS where there is one — OpenSSL (loaded at run time), SChannel, SecureTransport — and falls back to a TLS 1.3 client and server written in SafeC, with X.509 path validation against the system's trust roots. std/crypto grew X25519, P-256 / P-384 ECDH and ECDSA, RSA (PKCS#1 v1.5 and PSS), HKDF and ChaCha20 for it. http_fetch and friends speak https://, WsConn speaks wss://, and HttpServer serves HTTPS with a TlsServerConfig.

`safeguard doc` and `safeguard publish`

safeguard doc (#69) generates a package's API reference, like rustdoc: a page per item with highlighted declarations, Markdown doc comments with intra-doc links ([Vec::push]) and examples, a module per header, source pages, client-side search (SafeC compiled to wasm32), light and dark themes, and a link check of the result. --serve serves it, --std documents std itself — that is how this site's std API reference is built. Underneath is the new safec --emit-doc-json, which dumps the declarations and their doc comments as JSON from the real front end.

safeguard publish prepares a library's git repository for publishing: README / LICENSE / metadata checks, --bump for semver, and generated CI (GitHub Actions by default; GitLab CI, Gitea or Forgejo with --ci=) that tests on Linux, macOS and Windows and, on a tag, attaches prebuilt static and shared libraries to a release and deploys the docs to Pages. It is a dry run unless you pass --write. Package.toml gained repository, homepage, documentation, readme, keywords and a [publish] table, and safeguard build --crate-type staticlib|cdylib|bin overrides [build] crate_type.

scc and the online playground

scc (#70) is a SafeC compiler written in SafeC, in SafeC's new selfhost/ directory. It compiles SafeC straight to a WebAssembly binary with no LLVM and no linker, through its own lexer, preprocessor, parser, semantic analysis (with safec's safety checks and diagnostics) and wasm backend. It builds with the C++ safec, natively and as WebAssembly, and it compiles itself: selfhost/bootstrap.sh checks that the self-compiled compiler reproduces itself byte for byte. A differential test harness compiles the Book, the reference programs and a corpus with both compilers and compares the results, in a new selfhost CI job — it is what found the variadic promotion bug below.

scc is what powers this site's Playground: its Run button now compiles and runs your program entirely in the browser, in a Web Worker with time and memory limits. scc accepts the subset of the language listed in selfhost/SUBSET.md and does not run the ownership and thread-safety checks; for those and the full std, build locally.

Breaking: std's API without `void*` or pointer + length pairs

#76 removed every void*, raw T* buffer and (pointer, length) pair from std's public declarations:

Buffers are slices. []T is a buffer the function writes, []const T one it only reads. A slice carries its length and indexing it is bounds-checked; a fixed-size argument (a key, a nonce, a digest) is checked on entry and panics if it is too short, instead of being read or written past. std::str_bytes("text") gives a string's bytes as a []const char, accepted wherever []const unsigned char is expected.
Type erasure is typed. Where std stores callbacks with different context types side by side — executors, wakers, timers, widgets, the VFS, audio and MIDI callbacks, HTTP handlers, DOM listeners, thread entry points — the slot is a ?&Erased (std/erased.h) filled only by generic methods that take a matching fn(?&T) / ?&T. Opaque handles are typed structs too.
The language grew to match: read-only slices []const T, optional slices ?[]T and nullable function references ?fn R(Args), slice-returning functions and slice fields, range-checked re-slicing (a[i..j] traps when i > j or j > len outside unsafe), and byte slices that interconvert across char, signed char and unsigned char. Casting a slice to a pointer is now an error: use s.ptr.
New in std: Erased, S24 (a packed 24-bit audio sample, so 24-bit buffers are []S24), struct TimeFields, Vec::from_slice / as_slice, String::from_bytes / push_bytes / as_bytes, and over([]T) constructors for StaticVec, StaticMap, RingBuffer, LFQueue and the allocators.

#80 and #81 finished the job inside std: the audio, GUI, ML, TLS and OS backends bind their C, Objective-C, CUDA, HIP, Metal, Vulkan and WebGPU APIs through typed handles and byte pointers, audio and MIDI callback contexts must be Send + Sync, allocators hand out ?&heap unsigned char, and malloc_defer takes its type from the declaration. No void* is left anywhere in std, and a lint in SafeC's test suite fails the build if one reappears, or if a raw pointer reappears in a public std declaration.

Breaking: compiler-enforced Drop, Send and Sync

#77 makes resource ownership and thread safety compile-time checks. See Ownership & Drop and Thread Safety for the full rules.

Drop. A type with a void drop() method, or one holding such a value, must be dropped or moved exactly once on every path — return, break, continue, goto, match, defer, loops. Leaks, use after drop or move, double drops, overwriting a live value, and moving out of borrowed memory are compile errors. The check is per generic instantiation and inserts nothing into the generated code.
consume methods (int close() consume;) destroy their receiver like drop(); drop(x) is drop glue for any type; std::replace and std::swap live in std/ownership.h; forget(x) is allowed only in unsafe. A reference a method returns into its receiver (Vec::at(), MutexGuard::get()) borrows from it.
Send / Sync are derived from each type's structure, overridable with unsafe impl Send; / impl !Send;, and usable as generic bounds. spawn takes only Sync static data, spawn_scoped lends a local until it is joined, and chan_send moves a Send value.
New in std/thread.h: thread_spawn / SpawnedThread<T, R> (moves its argument into the thread; join() returns the result), Mutex<T> / MutexGuard<T> (the value is reachable only through the guard, which unlocks in drop()) and RwLock<T>; std/atomic.h has AtomicInt and AtomicLong.
std's owning types — collections, File, sockets, TLS, HTTP, threads, sync primitives, GUI, audio, async, ML containers — implement Drop; free() / close() / destroy() stay as consume aliases. ThreadPool::spawn, Chan<T>, AsyncChannel<T> and Oneshot<T> require Send values, GUI windows are !Send, and dropping an unfinished AsyncTask panics instead of leaving its executor polling freed memory.

Turning the checks on across std found real bugs, now fixed: leaks, double frees and use-after-frees in TLS error paths, the GUI SVG renderer, widget and PNG loaders, static-file and router helpers, Audio::open, LLM and LoRA paths in std/ml, and safec-doc's link checker.

Notable fixes

Variadic calls promote bool, char and short to int, as C requires: printf("%d", !x) used to print 254 (#71).
Safety-check gaps closed (#72): writing a field through a const &T is rejected; the &stack / &arena escape check follows ->; an element reference from Vec::at, HashMap or StrMap held across a push or a rehashing insert is reported. Mutation through a reference-returning call chain (v.at(i).field.push(x)) now reaches the real field instead of a temporary copy.
Method calls on a field of a by-reference call result act on the referent, and a false positive with StrMap in recursive functions is gone (#73); atomic_cas arguments are checked against the pointee type (#74).
C header import skips 128-bit float and _Complex declarations, so newer glibc headers import; safeguard test runs the test's .exe on Windows (#75). In a library package, safeguard test links the library into each test.
Windows and macOS: a generic function keeps its COMDAT through ABI lowering, std/sched passes WSAStartup a correctly sized WSADATA, the WSAPoll reactor no longer reads its watch list after dispatch (#64); ABI-lowered functions keep their place in the module (#79); the std module check accepts generic instances repeated across sections on Mach-O and COFF (#68).
Parser: a local declared with a typedef name and two or more * (Foo_t** x = pp;) is a declaration, and prefix operators nest (**pp, -*p, - -x), in safec and scc alike (#82).
Found by the website audit (#83): every container now drops its elements on clear() / drop() and when a key is overwritten, as Vec does (BTree, StaticVec and StaticMap, which have no drop(), are clear()ed) — see Collections; Reactor has a drop(), and close_() frees its tables and is idempotent; WsConn::closed() is the value to accept() into, and a closed connection never touches fd 0; safeguard reaches std only as <std/...>, so a bare #include <math.h> is the C library's (breaking for #include <io.h>: write <std/io.h>); and std/time works in the playground.

Migrating

Both breaking changes fail loudly: every affected call is a compile error (a wrong argument count or type, or an ownership error with a note at the declaration), and nothing changes behaviour silently except where the changelog says so. The common edits:

Before	After
`f.read(buf, n)`, `w.write(buf, n)`	`f.read(buf[..])`, `w.write(buf[0..n])`
`sha256(data, len, digest)`	`sha256(bytes, digest[..])` with `bytes` a slice, e.g. `buf[0..len]` or `std::str_bytes(s)`
`str_copy(dst, src, size)`	`str_copy(dst[..], src)` — returns 1 if it fit, 0 if truncated, always NUL-terminates
`safe_memcpy(dst, src, bytes)`	`safe_memcpy(dst[..], src[..])` — counts elements, copies `min` of the two lengths
`time_gmtime(t, fields)` (9-int array)	`struct TimeFields tm = time_gmtime(t);`
`Vec::from_arr(p, n)`	`Vec::from_slice(a[..])`
`String::from_n(p, n)` / `push_n`	`String::from_bytes(s)` / `push_bytes(s)`
`sys_bsearch(...)` returning `?&T`	returns the index as `?unsigned long`
`void*` callback context	a typed `?&T`, stored as `?&Erased` by std's generic methods
a custom allocator's `?&heap void alloc(size, align)` / `dealloc(?&heap void)`	`?&heap unsigned char` in both (std's allocators and `heap_alloc` hand out bytes; `alloc_t` / `dealloc_t` are unchanged)
`(T*)slice`	`slice.ptr`
a value with `free()` / `close()` that is never released on some path	`defer v.drop();` right after creating it, or release it on every path
`thread_create(&tid, work, ctx)` sharing a pointer	`thread_spawn(fn, value)` moving the data in, or `Mutex<T>` / `spawn_scoped` for shared data

A typical ownership error, and its fix:

int sum_positive([]const int xs) {
    struct Vec<int> v = std::Vec::new();
    for (unsigned long i = 0UL; i < xs.len; i = i + 1UL) {
        if (xs[i] < 0) { return -1; }   // error: value of Drop type 'Vec<int>' leaks when the
        v.push(xs[i]);                  //   function returns: 'v' is never dropped;
    }                                   //   call v.drop() or add 'defer v.drop()'
    // ...
    v.drop();
    return 0;
}

Adding defer v.drop(); after the declaration (and removing the final v.drop()) releases v on every path.

The slice forms, in a program the Playground can run — a read-only slice parameter, a bounded str_copy and an element-wise safe_memcpy:

#include <std/str.h>
#include <std/mem.h>
extern int printf(const char* fmt, ...);

long sum([]const int xs) {           // a read-only slice: the length comes with it
    long s = 0L;
    for (unsigned long i = 0UL; i < xs.len; i = i + 1UL) { s = s + (long)xs[i]; }
    return s;
}

int main() {
    char name[8];
    int fit = std::str_copy(name[..], "truncated!");   // bounded by the slice
    printf("fit=%d name=%s\n", fit, name);

    int src[4] = {1, 2, 3, 4};
    int dst[3];
    unsigned long n = std::safe_memcpy(dst[..], src[..]);   // elements, not bytes
    printf("copied=%lu sum=%ld\n", n, sum(dst[..]));
    return 0;
}

Run in Playground

It prints fit=0 name=truncat (the copy was truncated to the 8-byte buffer, NUL included) and copied=3 sum=6. The same with crypto and a thread that owns its data — this one needs the full std, so build it locally with safeguard run:

#include <std/crypto/sha256.h>
#include <std/str.h>
#include <std/thread.h>
#include <std/collections/vec.h>
extern int printf(const char* fmt, ...);

int count(struct Vec<int> v) {
    int n = (int)v.len;
    v.drop();                       // the thread owns v and must drop it
    return n;
}

int main() {
    unsigned char digest[32];
    std::sha256(std::str_bytes("abc"), digest[..]);   // was sha256(data, len, digest)

    struct Vec<int> v = std::Vec::new();
    v.push(1); v.push(2);
    struct SpawnedThread<struct Vec<int>, int> t = std::thread_spawn(count, v);
    // v.push(3);                   // error: use of 'v' after it was moved
    int len = t.join();             // join() consumes t and returns count's result

    printf("digest[0]=0x%02x len=%d\n", (unsigned)digest[0], len);
    return 0;
}

It prints digest[0]=0xba len=2; uncommenting v.push(3) is the compile error use of 'v' after it was moved, with a note pointing at the thread_spawn call.

Where to look while migrating:

Types: slices, read-only slices and optional slices
Ownership & Drop — the rule, every error, consume methods, forget
Thread Safety — Send and Sync, thread_spawn, Mutex<T>
The std pages for the modules you use: mem, str, io, collections, crypto, thread, async, audio, dsp, http, and the std API reference
The changelog's Breaking changes list, module by module

Try it

All of this shipped in 1.0.0-beta-7: install it, or try the language in the Playground. If something you depend on broke in a way the compiler didn't explain, please open an issue.

This cycle in SafeC: async, audio, a web stack, a GUI toolkit and HTTPS

2026-10-25T00:00:00Z

Shipped in 1.0.0-beta-7 on 2026-10-27.

The weeks since 1.0.0-beta-6 went into the standard library: a program that serves HTTP, opens a window, plays audio and awaits futures can now be written with nothing but std. Everything below is merged on main (pull requests #56–#67) and will ship in the next release (the changelog starts with #69; What's coming next covers everything since beta-6).

std/async: futures without language coroutines

std/async (#61) brings Rust's Future / Poll / Waker / Context model to SafeC as a library. A future is a struct with a poll method; the ASYNC_BEGIN / AWAIT / ASYNC_RETURN macros turn it into a resumable state machine over goto, with every local that lives across an await stored in the struct.

On top of that: timers, join / select / timeout combinators, channels, Mutex, Semaphore, Notify and cancellation, a deterministic no-heap single-threaded LocalExecutor that also runs on bare metal and wasm32, a multi-threaded ThreadPool, a host block_on, and an IoDriver + Runtime with async TCP on the epoll, kqueue and WSAPoll reactor. The compiler learned the goto rules this depends on — duplicate labels, jumps over declarations, labels after return — and safeguard gained [build] compat_preprocessor for packages built on the macros. See examples/async_demo.

std/audio: real-time audio and MIDI

std/audio (#59) is one callback-based API for audio streams and MIDI ports with format conversion. Audio backends: ALSA, JACK, Core Audio, WASAPI, Web Audio and a dummy device for tests; MIDI: the ALSA sequencer, JACK, Core MIDI, WinMM and Web MIDI, over a MIDI core with message types, a parser and a lock-free queue. Runtime tests cover the dummy backend, ALSA's null and file PCMs, a JACK loopback and MIDI, with a Windows check under Wine; examples/audio_demo lists devices, plays a sine and monitors MIDI. Along the way safeguard learned _macos and _wasm platform-variant std sources.

A web stack

#57 rebuilt std/http into a stack for real services: structured headers and request/response helpers, a keep-alive HttpServer with chunked transfer coding, a Router with middleware and route patterns, static files, cookies, multipart forms, server-sent events and WebSocket upgrades, plus a URL client that follows redirects and decodes gzip. It came with std/encoding/url (RFC 3986 parsing and resolution, query parameters, form encoding) and std/encoding/deflate (DEFLATE, zlib and gzip, CRC-32 and Adler-32).

On the browser side, std/wasm grew full DOM and browser-API interop — events, timers, fetch, storage, history — with its JavaScript glue shipped in std and tested under Node. examples/fullstack_demo puts both halves together: a Router server and a SafeC-to-wasm client.

std/gui: a GUI toolkit

#63 turned std/gui into a toolkit: an anti-aliased vector canvas with TrueType font loading, kerning and text layout (GUI Graphics); a retained widget toolkit with layout and theming; and GuiApp for multi-window applications, all over a GuiBackend interface beneath a portable window layer. Canvas tests compare against a golden image, the widget tests run on a headless backend, and two-window GuiApp tests run on X11 (under Xvfb) and Win32 (under Wine). Try examples/gui_hello and examples/gui_gallery, which shows every widget.

#65 then took the toolkit to more platforms: a Wayland backend (chosen at run time on Linux), a WebAssembly backend that draws into a <canvas> or through WebGL with windows inside the page, IME text input and DOM interop, and GPU presenters over OpenGL ES (EGL), Metal and Direct3D 11. safeguard bundle --target wasm32 packages a GUI app as a runnable web page.

Prebuilt std, in sections

Releases now ship the standard library prebuilt for each platform as one archive per section — std's top-level directories, like core, collections, gui or ml (#56). safeguard links the sections a project uses instead of compiling them, and install.sh --std=... / install.ps1 -Std ... choose which to install. std is now always compiled optimized, in debug builds too, and the release binaries target macOS 11 and glibc 2.25 (Debian 10, Ubuntu 18.04, RHEL 8 and later).

The docs, built with SafeC

The documentation site you're reading is now generated by a SafeC program instead of VitePress. That work added the std pieces a static-site generator needs (#58): std/dir and std/path with whole-file File::read_to_string / write_bytes, a CommonMark + GFM Markdown parser with containers, heading ids and render hooks, YAML flow collections and block scalars, html_unescape / html_strip_tags, a wasm runtime with a reusing size-class allocator over memory.grow, and fixes to scx templates. The compiler now lexes C's \a \b \f \v \e escapes. The new website builds on all of it.

Windows fixes

#64 made Windows CI green again: the compiler keeps a generic function's COMDAT when the ABI pass rebuilds it, std/sched passes WSAStartup a real 408-byte WSADATA, and the WSAPoll reactor no longer indexes its watch list after dispatching. A smaller compiler fix from #63: an f-suffixed floating literal is a float.

HTTPS

The last piece landed as this post was being written: #66 adds std/tls, with the operating system's TLS where there is one — OpenSSL (loaded at run time), SChannel and SecureTransport — and a TLS 1.3 engine written in SafeC (client and server) as the fallback, with X.509 parsing, certificate path validation and the system's trust roots. std/crypto grew what that needs: X25519, P-256 / P-384 ECDH and ECDSA, RSA PKCS#1 v1.5 and PSS, HKDF and ChaCha20. With it, std/http speaks https:// in http_fetch and friends and in the SSE client, WsConn speaks wss://, and HttpServer serves HTTPS with a TlsServerConfig.

Try it

Everything above is on main. Until the next release, build from source, or install 1.0.0-beta-6 and follow the changelog.

SafeC 1.0.0-beta-6 released

2026-10-22T00:00:00Z

SafeC 1.0.0-beta-6 was released on 2026-10-22. It is a pre-release: the language and std are still moving quickly.

Install this exact release:

bash

curl -fsSL https://raw.githubusercontent.com/safec-org/SafeC/main/install.sh | bash -s -- --version=v1.0.0-beta-6

powershell

& ([scriptblock]::Create((irm https://raw.githubusercontent.com/safec-org/SafeC/main/install.ps1))) -Version v1.0.0-beta-6

Pull requests

cuDNN convolution / U-Net and cuFFT transforms on the CUDA backend (#3)
perf(cuda): close the H200 gaps vs PyTorch (cuDNN graph API, pinned transfers) + fp16/bf16 buffers (#4)
fix: std::alloc size class 33 read past the cache tables (#5)
perf: CPU SIMD/threads for std/dsp and std/ml; float DSP; vendor BLAS (#6)
perf(std): slab allocator, quarantine byte budget, faster Vec/HashMap, half-spectrum rFFT, arena FeatureMaps (#7)
feat(std/ml): flash and linear attention on ROCm (#9)
perf(std/ml): MPS bf16 decode/flash/linear attention, faster RMSNorm and GEMV (#8)
feat(cuda): flash and linear attention (cuDNN SDPA, tensor-core kernels) (#11)
perf(cuda): faster head-dim-128 linear and fp32 flash attention (#12)
fix(std): panic/log print through stderr_compat.h (#10)
perf(std/ml): MPS flash attention on simdgroup matrices, chunk-parallel linear attention, CUDA/ROCm-compatible API (#13)
perf(std/ml): ROCm attention on matrix cores (MFMA) (#14)
perf(std/ml): 8-simdgroup MPS flash attention threadgroups where they win (#15)
safeguard: honor $SAFEC and key the std archive cache on the compiler (#16)
perf(std/dsp): Accelerate vDSP for FIR on Apple; fix fft.sc linking on macOS (#17)
feat(std/ml): ROCm decode ops (half GEMV, RMSNorm, GELU); gpu_mps links off Apple (#18)
feat(std/ml): CPU half_gemv; tensor_blas/tensor_vdsp link on every platform (#19)
std/ml CUDA: decode ops from the Gemma 4 engine (half GEMV, RMSNorm, GELU, split-KV attention) (#20)
perf(std/ml): Apple Silicon half_gemv, half_gemv_batch, P-core pool (#21)
fix(std/sched): wait out connect() in the http and websocket clients (macOS) (#22)
std/http: bound connect and handshake time in HTTP/WebSocket clients (#23)
std/ml: residual/pooling, Mamba SSM, training stack, generative models, RL, LoRA/QLoRA (#24)
fix(std): panic/log print through stderr_compat.h (#26)
std/ml: trainable convnets; fp16/bf16 mixed precision on CPU, ROCm and CUDA (#27)
std/ml CUDA: faster mixed-precision ops and 16-bit convolutions (#28)
std: faster CPU training (sgemm packs once per call, vectorized optimizer) (#29)
feat(safeguard): prebuilt and local library dependencies; fix [[dependencies]] parsing (#31)
std/ml: device-resident training on ROCm (nn_rocm.h) (#30)
std/ml nn_rocm: MIOpen convolutions, fused passes, fp16/bf16 training (#32)
std: audit outside std/ml — bug fixes, convention fixes, broader tests (#33)
std/ml: one training interface over CPU and ROCm (traits), backend picked at build time (#34)
std/ml: operations on stateful types are methods (#35)
std: AES-GCM TLS records, real MMU formats, chip-generic HAL, verified GUI backends (#36)
Trait composition and bounded generic structs; std/ml models as composed traits (#37)
std/ml: autograd as methods (Tensor::backward / zero_grad, Autograd state) (#38)
feat(compiler): static methods, keyword method names, return-type inference (#39)
feat(compiler): methods with their own type parameters (#40)
std/ml: static-method constructors; single-tensor ops as methods (#41)
compiler: static calls through a type parameter; generic functions as values (#42)
std/ml: generic DenseTensor; HalfTensor/BF16Tensor with autograd (#44)
std: methods, static constructors and composed traits (#45)
fix(compiler): struct-body declarations, trait method shapes, newtype if const, pointer inference (#43)
ml/mps: typed MpsBuf, GPU Mlp training, const-pointer global and dispatch fixes (#46)
ml: train on ROCm, CUDA and Metal through tensor devices; fp16/bf16, SparseTensor (#47)
ml: trainable attention and transformers on tensor devices; fused attention kernels (#48)
ml/device_cuda: cuDNN graph plans for device convolutions; first H200 run (#49)
ml/device: every kernel on the Metal GPU from the shared kernel source; macOS link fix (#50)

The release on GitHub · Changelog

SafeC 1.0.0-beta-5 released

2026-10-20T00:00:00Z

SafeC 1.0.0-beta-5 was released on 2026-10-20. It is a pre-release: the language and std are still moving quickly.

Install this exact release:

bash

curl -fsSL https://raw.githubusercontent.com/safec-org/SafeC/main/install.sh | bash -s -- --version=v1.0.0-beta-5

powershell

& ([scriptblock]::Create((irm https://raw.githubusercontent.com/safec-org/SafeC/main/install.ps1))) -Version v1.0.0-beta-5

The release on GitHub · Changelog

SafeC 1.0.0-beta-4 released

2026-10-20T00:00:00Z

SafeC 1.0.0-beta-4 was released on 2026-10-20. It is a pre-release: the language and std are still moving quickly.

Install this exact release:

bash

curl -fsSL https://raw.githubusercontent.com/safec-org/SafeC/main/install.sh | bash -s -- --version=v1.0.0-beta-4

powershell

& ([scriptblock]::Create((irm https://raw.githubusercontent.com/safec-org/SafeC/main/install.ps1))) -Version v1.0.0-beta-4

Pull requests

Honor volatile on variables, fields and pointee types (#1)
Target arch macros + WebAssembly targets (wasm32/wasm64) (#2)

The release on GitHub · Changelog

SafeC Blog

SafeC 1.0.0-beta-7 released

Highlights #

Breaking changes #

Migrating #

Upgrading #

Known issues #

Pull requests #

A new home for SafeC

What's new #

What didn't change #

Built with SafeC #

What's next #

What's coming next: everything merged since 1.0.0-beta-6

At a glance #

A web stack #

Async: futures as goto state machines #

A GUI toolkit #

Audio and MIDI #

HTTPS #

safeguard doc and safeguard publish #

scc and the online playground #

Breaking: std's API without void* or pointer + length pairs #

Breaking: compiler-enforced Drop, Send and Sync #

Notable fixes #

Migrating #

Try it #

This cycle in SafeC: async, audio, a web stack, a GUI toolkit and HTTPS

std/async: futures without language coroutines #

std/audio: real-time audio and MIDI #

A web stack #

std/gui: a GUI toolkit #

Prebuilt std, in sections #

The docs, built with SafeC #

Windows fixes #

HTTPS #

Try it #

SafeC 1.0.0-beta-6 released

Pull requests #

SafeC 1.0.0-beta-5 released

SafeC 1.0.0-beta-4 released

Pull requests #

Highlights

Breaking changes

Migrating

Upgrading

Known issues

Pull requests

What's new

What didn't change

Built with SafeC

What's next

At a glance

A web stack

Async: futures as `goto` state machines

A GUI toolkit

Audio and MIDI

HTTPS

`safeguard doc` and `safeguard publish`

scc and the online playground

Breaking: std's API without `void*` or pointer + length pairs

Breaking: compiler-enforced Drop, Send and Sync

Notable fixes

Migrating

Try it

std/async: futures without language coroutines

std/audio: real-time audio and MIDI

A web stack

std/gui: a GUI toolkit

Prebuilt std, in sections

The docs, built with SafeC

Windows fixes

HTTPS

Try it

Pull requests

Pull requests