Clojure Deref (Mar 8, 2024)

Last week CVE-2024-22871 detailed in GHSA-vr64-r9qj-h27f was filed. I’ve added the relevant info to the latter link so read there for the details. The important takeaway here is that you should never read serialized objects from an untrusted source (usually this is via ObjectInputStream.readObject() if you’re grepping your source code). There are an open-ended number of ways an attacker can craft malicious objects using a variety of languages and libraries.

Today we released Clojure 1.11.2 and 1.12.0-alpha9 with a fix for the specific problem identified in that service advisory - the change is small (converting some infinite loop cases to throw instead). Along with this, there is a new version of the Clojure CLI that defaults to Clojure 1.11.2, and new versions of some contrib libraries.

We have been working hard on the last remaining feature pieces for Clojure 1.12. Due to some useful feedback on prior alphas, we found an issue with the new class array syntax (e.g. String*) - while this is an invalid class name in Java, it (and literally any name) are valid class names in the JVM, and in particular, Clojure deftype is an example way that you can create such a class. We considered a wide range of options but we have settled on an alternate syntax, with array classes ending in ::N (where N is the dimension). :: is not valid in Java class names, and not (until now) valid in Clojure symbol names, so there is no chance of conflict with this syntax.

With method values, we heard all of your feedback regarding reflective support for uniform method symbols. I think we’ve found some interesting new angles on this that will allow us to support reflection in many cases, which I will save for another post. For those interested specifically in avoiding reflection, we will address that more directly in a future release. And finally, we are zero-ing in final work for implicit function conversion. All of this work is past the planning and deep into implementation, and it should start to land soon.

Finally, this is not really Clojure core work but a result of some LLM explorations at Nubank, but I’ve submitted a patch to the MultiPL-E LLM coding benchmark to add support for Clojure. We’re starting to use this ourselves in evaluating Clojure capabilities of different models, and hopefully others can get use out of it as well.

New releases and tools this week: