MAX Nightly 26.6.0.dev2026091105 (Mojo 1.1.0.dev2026091105) Released

Nightly
1

:astronaut: A new nightly version has been released! :astronaut:

See the quickstart guide for installation instructions: Quickstart | MAX

MAX changelog updates:

  • Hardened decoding of client-supplied images. Image.open is now restricted
    to an explicit format allowlist (PNG, JPEG, WEBP, GIF, BMP, PPM, TIFF, TGA,
    and AVIF where the platform provides it), shrinking the native-decoder attack
    surface and keeping image bytes away from decoders such as EPS/Ghostscript.
  • Media memory is now governed by a single knob, MAX_SERVE_MAX_MEDIA_BYTES
    (default 100 MiB). The fetched size of all resolved media (http(s)://,
    data:, and file:// images and videos) for a request is bounded in
    aggregate by it, rather than each item being capped independently. No single
    image may decode to more than it either. That decoded size is estimated
    from the image header and rejected before the pixel buffer is allocated,
    which is what catches a decompression bomb (a small on-the-wire image that
    expands to hundreds of MB). This replaces both the former per-item
    MAX_SERVE_MAX_BYTES server cap and a separate decoded-pixel limit. It is
    deliberately separate from MAX_SERVE_MAX_REQUEST_BYTES, which bounds only
    the request body. A small body can name URLs the server then fetches, so
    raising one limit should not silently widen the other.

Mojo changelog updates:

  • [docs] Cut over Mojo 1.1 changelog for release branch cut.
  • [stdlib] Move simd to std/simd.mojo
  • [stdlib] Rename CStringSlice to CStringSpan
  • [Mojo][stdlib] Add an @inline(value) decorator

Raw MAX diff: https://github.com/modular/modular/compare/48d33430b478f47fea76c0bb01b5246fa26989e1...da4f8b76ac0f51091f927e4a9b6f0b17f40b11e6)>
Current Mojo changelog: https://github.com/modular/modular/blob/main/Mojo/docs/site/nightly-changelog.md