Releases

Lingua v1.6.2

Stable channel · published October 20, 2026

Windows

Desktop app

Choose this for the graphical editor and console. Native execution also needs the runtime for your language.

Terminal tool (CLI)

For terminal commands, without a graphical editor. Running code needs its language runtime, including Node.js 24.x for JavaScript and TypeScript.

Not code-signed yet, so Windows shows a "Windows protected your PC" screen on first run. Choose More info, then Run anyway. The checksum below is how you verify the file is the one we published.

Verify your download

Download SHA256SUMS.txt alongside your binary, then run:

shasum -a 256 -c SHA256SUMS.txt

macOS and Linux ship with shasum. On Windows use certutil -hashfile <file> SHA256 and compare against the listing.

What's new in v1.6.2

  • A desktop or web build that cannot verify your license token, such as an older version opened after a signing-key rotation or a stale cached web app, no longer deletes it. The license shows as rejected with its reason, grants nothing in that build, and is back on the next launch of a build that trusts it. The same holds when the license server does not recognize the token or its signature. Privacy & Trust now lists each rejection.
  • Development and locally packaged desktop builds keep their data in separate Lingua Dev and Lingua Local folders, so they can no longer change the installed app's license, consent or approvals, and they no longer take over lingua:// links.

Full changelog →

Older releases (5)
  • v1.6.1

    Oct 15, 2026
    • Lua string.format with a zero %g precision, such as %.0g, now formats like standard Lua instead of failing the run with a meaningless error.
    • lingua capsule verify and the regression-suite export name the engine mismatch for Python, Go and web Ruby recordings. A real recording with per-line results or a failed run used to report a generic incomplete baseline instead.
    • Desktop HTTP, SSE and WebSocket requests honor Stop and their timeout while the host name is still resolving, instead of waiting on a DNS lookup that never answers. A WebSocket header named __proto__ is now sent like any other header.
    • Python print with several arguments shows strings in the console as print does, without repr quotes (sum = 55, not 'sum =' 55). Strings inside lists and other containers keep their quotes.

    Read v1.6.1 notes →

  • v1.6.0

    Oct 13, 2026
    • Capsule Workspace imports recompute attached-file SHA-256 hashes locally and distinguish matching, mismatched, and unverified text without executing code.
    • Manual notebook project documents. Open, Save and Save As preserve .linguanb v1 cells and output evidence; capability-backed writes detect changed files and retain unsaved edits.
    • Explicit current-file Capsule verification and bounded serial suite v1 with strict per-case verdicts, unchanged baselines, in-root target validation and inert project-target export/inspection.
    • Run Capsules support strict CLI verification. The new verify command rejects drift and incomplete evidence with nonzero exits, treats Python, Go and web Ruby recordings as inconclusive because their app engine differs from the CLI, while validate stays inert and replay keeps its original exit contract.

    Read v1.6.0 notes →

  • v1.5.1

    Sep 24, 2026
    • Selected code can travel with a safe reference. Copy reference and Copy with context are Free editor and modified-diff actions that require an explicit selection, use a relative file name, and never copy hidden content or an absolute path.
    • A Run Capsule can move from the app to the CLI. Export the latest run as JSON in Free, inspect it, validate it without execution, then explicitly replay trusted source to compare status and output. A deterministic example and English/Spanish walkthrough document the boundary.
    • Runtime availability is explained where actions are chosen. Menus, the command palette, and Settings distinguish browser limitations, license gates, and missing local Node, Go, Rust, Deno, Bun, or Ruby installations instead of treating payment as an installation step.
    • Dead-code checks now cover every independently locked package. CI analyzes the root app, website, license Worker and update Worker with explicit package boundaries, proves each boundary with a temporary negative fixture, and runs for stacked pull requests as well as pull requests targeting main.

    Read v1.5.1 notes →

  • v1.5.0

    Sep 17, 2026
    • The desktop app's local MCP server no longer ships a vulnerable request parser. hono moves to 4.13.7, clearing three advisories: toSSG() writing files outside its output directory, unbounded dot-notation nesting in parseBody() exhausting memory, and query parameters read after the URL fragment. The license service picks up the same fix.
    • The desktop app now runs on Electron 44. The upgrade brings the matching Chromium security fixes. The main process's bundled HTTP client moves to undici 8 and its WebSocket client to ws 8.21.3, both still covered by the bundled-dependency audit gate.
    • The first TypeScript run is faster. The TypeScript toolchain now warms up while you type in a TypeScript tab, so the first run no longer waits for it. The first run measured about a third faster, and a real session gives the warm-up more time than the benchmark did.
    • Running a JavaScript notebook cell no longer downloads the TypeScript compiler. Notebook cells previously pulled about 0.9 MB of compiler on their first run, whatever their language; TypeScript cells now transpile with esbuild instead.

    Read v1.5.0 notes →

  • v1.4.1

    Aug 31, 2026
    • The Windows desktop installer is back in the release payload. Version 1.4.0 published without a Windows build, so Windows installs and auto-updates stayed on 1.3.0. This release restores the NSIS installer and its update manifest with no other changes.

    Read v1.4.1 notes →