Gleam 1.18.0 Adds Record-Field Navigation, Boosting JavaScript Performance

Q: What hidden security threat lurked in Gleam before the 1.18.0 update patched its dependency resolution?

The hidden threat was a man-in-the-middle supply-chain vulnerability in Gleam’s Hex dependency resolution, tracked as CVE-2026-59247. Before 1.18.0, Gleam correctly used signature-verified Hex repository metadata to resolve package versions, but then made a second request to the unsigned Hex API and wrote checksum and dependency-name data from that unsigned response into `manifest.toml`. That created a trust gap: the API response was not covered by Hex’s repository signature. An attacker able to intercept TLS with a certificate trusted by the Gleam process — for example through a TLS-inspecting proxy or a custom CA added to the trust store — could alter both the API release response and the downloaded tarball. By forging a matching checksum in the unsigned metadata, the attacker could make Gleam accept and extract malicious package contents without access to Hex’s signing key. The practical impact was loss of integrity for downloaded dependencies. The main risk applied when a project was resolving or updating Hex dependencies, such as when the manifest was missing, dependencies changed, or versions were updated. Builds using an unchanged, known-good `manifest.toml` remained protected because tarballs were still checked against the pinned checksum already in the manifest. In short, the danger was not a language-server bug but a dependency-authenticity flaw that could let forged packages slip into builds before 1.18.0 fixed it.

1 articles · Updated · InfoWorld · Aug 3

Version 1.18.0, released July 29, gives the Gleam language server full record-field support, adding go-to-definition, find-references and rename across declarations, updates and cross-module accesses.
Three language-server upgrades drive the release: record-field tooling, renaming for type variables, and module renaming that updates references when a Gleam file is renamed in an editor.
JavaScript targets also get a compiler optimization that reuses a single value for equivalent data structures instead of rebuilding instances, which creator Louis Pilfold said testing showed improves performance.
The release also adds a code action to generate missing type definitions, expands pattern-match-on-value to function-call results, and lets Git dependencies specify a repository subdirectory path.