Linux static binaries compiled 2026-07-22. Copy, chmod +x, run. Zero dependencies.
Wacatac.B!ml. This is a known false positive: its ML heuristic misfires on statically compiled Go binaries and UPX-compressed executables. It has been reported to Microsoft for review. All other major antivirus engines report these files as clean — see the VirusTotal links below for full scan results.
Reliability release: a source-level audit (adversarially verified) and a
field-reported outage drove a large batch of concurrency, lifecycle, and
untrusted-input fixes. None change configured behaviour — they remove crashes,
hangs, leaks, and silent data loss.
Stale-listener self-heal. A worker's unix server: socket could reach a
state where it showed LISTEN but refused every fresh connection, with
apm list still green and only restart --force recovering it. The listener
lifecycle is now serialised on a per-worker mutex, socket-file unlink is
ownership-checked (APM no longer lets Go's unlink-on-close delete a socket a
newer listener bound), and a watchdog probes every unix listener every 10s and
rebinds a wedged one in place — children untouched — emitting a server_rebind
event. Watch-triggered restart bursts are coalesced so a flurry of saves no
longer churns through dozens of back-to-back restart cycles.
Deadlocks removed. Two daemon-wide hangs that presented as "green but
serves nothing": the child-exit handler joined its stdout reader while holding
the same mutex that reader's IPC dispatch needs, and a circular depends_on
held a worker's mutex across its dependency wait. Both are fixed.
Lifecycle and leak fixes. Single-owner connection accounting (no more
negative activeConns breaking drain); rolling restarts no longer abandon an
unrelated sibling that crashes mid-cycle; sync.Once teardown for statsd and
vanguard (no double-close panic); health-probe, GUI syscollector, inotify-fd,
and apm log goroutine/fd leaks closed; IPC cleanup scoped to the exiting
child (was wiping every in-flight request), request/stream ids namespaced per
child, and child-supplied timeouts clamped.
Untrusted-input hardening. Bounds on HTTP body/headers (plus a body-read
deadline), WebSocket fragmented messages, the child 0x05 stdout frame length,
and the local-command / mesh / GUI WebSocket buffers — each was an unbounded
allocation from a length field. The stderr reader no longer dies on long lines,
and a slow client gets a clean truncated transfer instead of a silently
corrupted stream. ban_path now also matches the percent-decoded target.
Config / saveconf / convert. apm reload <file> only stops workers owned
by that file (no longer sweeps other files' or ad-hoc workers); saveconf
serialises every reloadable field, preserves sibling worker blocks, and
round-trips quoted values; apm_network reloads apply; apm convert emits a
recognised memory_limit and no longer mangles date layouts; the config parser
no longer hangs on a trailing unterminated quote.