Fix nightly compatibility and prepare 0.28.1

.github/workflows/ci.yml

@@ -62,7 +62,7 @@ jobs:
       - uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-11-06-34f137a
+          nightly-tag: nightly-2026-11-13-03dce41
       - name: Install Rust toolchain
         run: |
           rustup toolchain install "${{ needs.rust-version.outputs.version }}" --profile minimal --target x86_64-unknown-linux-musl --component llvm-tools-preview
@@ -116,7 +116,7 @@ jobs:
       - uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-11-06-34f137a
+          nightly-tag: nightly-2026-11-13-03dce41
       - name: Install Rust toolchain
         shell: bash
         run: |
@@ -164,7 +164,7 @@ jobs:
       - uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-11-06-34f137a
+          nightly-tag: nightly-2026-11-13-03dce41
       - name: Install Rust toolchain
         shell: bash
         run: |

.github/workflows/deploy-docs.yml

@@ -40,7 +40,7 @@ jobs:
         uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-11-06-34f137a
+          nightly-tag: nightly-2026-11-13-03dce41
 
       - name: Restore released docs
         env:

.github/workflows/release.yml

@@ -126,7 +126,7 @@ jobs:
         uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-11-06-34f137a
+          nightly-tag: nightly-2026-11-13-03dce41
 
       - name: Install Zig
         uses: mlugg/setup-zig@8d6198c65fb0feaa111df26e6b467fea8345e46f
@@ -235,7 +235,7 @@ jobs:
         uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-11-06-34f137a
+          nightly-tag: nightly-2026-11-13-03dce41
 
       - name: Install Rust
         shell: bash
@@ -280,7 +280,7 @@ jobs:
         uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-11-06-34f137a
+          nightly-tag: nightly-2026-11-13-03dce41
 
       - name: Create docs staging tree
         run: mkdir -p docs-site
@@ -453,7 +453,7 @@ jobs:
         uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427 # ratchet:roc-lang/setup-roc@v0.3.0
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-11-06-34f137a
+          nightly-tag: nightly-2026-11-13-03dce41
 
       - name: Download release metadata
         uses: actions/download-artifact@v8

.github/workflows/pie-compatibility.yml → .github/workflows/static-runtime.yml

@@ -1,6 +1,4 @@
-# TODO for the release after 0.28.0: pin a Roc nightly containing #12949,
-# remove this workflow, and retire the fixed-address musl startup patch.
-name: Static runtime compatibility
+name: Static runtime validation
 on:
   pull_request:
   workflow_dispatch:
@@ -13,7 +11,6 @@ jobs:
       fail-fast: false
       matrix:
         target: [x64musl, arm64musl, x64mac, arm64mac, x64win]
-        compiler: [pinned, pie]
         include:
           - {target: x64musl, os: ubuntu-24.04}
           - {target: arm64musl, os: ubuntu-24.04-arm}
@@ -23,36 +20,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v7
-      - uses: mlugg/setup-zig@8d6198c65fb0feaa111df26e6b467fea8345e46f
-        if: matrix.compiler == 'pie'
-        with:
-          version: 0.17.1
       - uses: roc-lang/setup-roc@cbe782d6f165b89c87d99f50a59ac4f5f73b4427
-        if: matrix.compiler == 'pinned'
         with:
           version: nightly-new-compiler
-          nightly-tag: nightly-2026-11-06-34f137a
-      - uses: actions/checkout@v7
-        if: matrix.compiler == 'pie'
-        with:
-          repository: roc-lang/roc
-          ref: c080bd1bc565531389f74444d3736d1bfb8e5352
-          path: target/roc-pie
-      - uses: actions/cache@v5
-        if: matrix.compiler == 'pie'
-        id: compiler-cache
-        with:
-          path: target/roc-pie/zig-out/bin
-          key: roc-pie-${{ runner.os }}-${{ runner.arch }}-c080bd1bc565531389f74444d3736d1bfb8e5352-zig-0.17.1-strip
-      - name: Build the pinned PIE compiler
-        if: matrix.compiler == 'pie' && steps.compiler-cache.outputs.cache-hit != 'true'
-        shell: bash
-        working-directory: target/roc-pie
-        run: zig build roc -Doptimize=ReleaseFast -Dstrip -j2
-      - name: Select the PIE compiler
-        shell: bash
-        if: matrix.compiler == 'pie'
-        run: echo "ROC=$GITHUB_WORKSPACE/target/roc-pie/zig-out/bin/roc${{ runner.os == 'Windows' && '.exe' || '' }}" >> "$GITHUB_ENV"
+          nightly-tag: nightly-2026-11-13-03dce41
       - uses: mlugg/setup-zig@8d6198c65fb0feaa111df26e6b467fea8345e46f
         with:
           version: 0.17.0
@@ -82,7 +53,7 @@ jobs:
           dist/dev-compat/tcp-server > target/dev-tcp-server.log
           "$compiler" build tests/resource-lifetimes/resource-lifetime.roc --opt=dev --target="$TARGET" --output=dist/dev-compat/resources
           dist/dev-compat/resources
-          python3 scripts/check_static_executables.py dist/dev-compat --format ${{ matrix.compiler }}
+          python3 scripts/check_static_executables.py dist/dev-compat --format pie
       - name: Verify executable format
         if: endsWith(matrix.target, 'musl')
-        run: python3 scripts/check_static_executables.py dist/example-binaries/${{ matrix.target }} --format ${{ matrix.compiler }}
+        run: python3 scripts/check_static_executables.py dist/example-binaries/${{ matrix.target }} --format pie

CONTRIBUTING.md

@@ -138,9 +138,9 @@ and run `python3 scripts/pin_linker_inputs.py /path/to/linker-inputs.lock.json`,
 then regenerate third-party notices and commit the lock and text metadata.
 Generated target objects and libraries must stay outside Git.
 
-Linux startup supports fixed-address executables from the pinned Roc nightly
-and static PIE from the compiler's ASLR change. The compatibility workflow tests
-both compilers against the same pinned runtime release. Linux Rust and C host
+The pinned Roc nightly emits static PIE on Linux. The Static runtime validation
+workflow checks randomized loading, development-backend callbacks, and native
+execution against the pinned runtime release. Linux Rust and C host
 code is built as PIC. The producer also validates startup with stored function
 pointers, thread-local data, and threads on both Linux architectures.
 

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "roc_host"
-version = "0.28.0"
+version = "0.28.1"
 authors = ["The Roc Contributors"]
 edition = "2021"
 rust-version = "1.97"

docs/releases/0.28.1.md

@@ -0,0 +1,35 @@
+# basic-cli 0.28.1
+
+```roc
+app [main!] { pf: platform "{{PLATFORM_URL}}" }
+```
+
+Use Roc **`nightly-2026-11-13-03dce41`** or later. CI, release builds, and the
+Nix development shell now use this nightly.
+
+## Fixes
+
+- `Cmd` and `Path` check without duplicate-definition warnings on the new
+  nightly ([#556](https://github.com/roc-lang/basic-cli/issues/556)).
+  `Cmd.Command` remains opaque and keeps all its builder and execution methods;
+  the `Cmd.call!`, `capture!`, `run!`, and `spawn!` convenience functions keep
+  their existing signatures.
+- The pinned compiler includes the Windows unwind-table fix in
+  [roc#12996](https://github.com/roc-lang/roc/pull/12996). This resolves the
+  compile-time failures of quoted `Locale` and `Path` values reported in
+  [#555](https://github.com/roc-lang/basic-cli/issues/555). Applications using
+  0.27.0 or 0.28.0 also benefit from upgrading the compiler; their literals do
+  not need changing.
+- The platform header now explicitly types `main!` arguments as `List(OsStr)`,
+  matching the native arguments supplied by the launcher
+  ([#554](https://github.com/roc-lang/basic-cli/pull/554)).
+
+Source validation now checks the platform with `--no-cache` on Linux and
+Windows, so dependency warnings and compile-time literal failures fail CI.
+Linux runtime checks use the official nightly and verify static PIE loading
+and development-backend callbacks.
+
+---
+
+- [API documentation](https://roc-lang.github.io/basic-cli/0.28.1/)
+- [Full changelog since 0.28.0](https://github.com/roc-lang/basic-cli/compare/0.28.0...0.28.1)

flake.nix

@@ -6,7 +6,7 @@
     # nixos-unstable no longer supports Intel macOS.
     nixpkgs-x86-darwin.url = "github:NixOS/nixpkgs/nixpkgs-26.05-darwin";
     roc-overlay = {
-      url = "github:roc-lang/roc-overlay/57a4b47c16545bf87a7d6b7e4480e7100fe74dc2";
+      url = "github:roc-lang/roc-overlay/67491987eb6ef2423d9a6e5901f6a8e439d8566c";
       inputs.nixpkgs.follows = "nixpkgs";
       inputs.nixpkgs-darwin.follows = "nixpkgs-x86-darwin";
     };
@@ -56,16 +56,35 @@
           inherit system;
           overlays = [
             roc-overlay.overlays.default
+            # Until roc-overlay records the November 13 nightly.
+            (import ./nix/roc-nightly.nix)
             rust-overlay.overlays.default
           ];
         };
       releaseFor = system: import ./nix/release.nix { pkgs = pkgsFor system; };
+      # Keep in sync with the nightly pinned in .github/workflows.
+      developmentCompilerFor = system: (pkgsFor system).rocpkgs."nightly-2026-11-13-03dce41";
     in
     {
       formatter = forAllSystems (system: (pkgsFor system).nixfmt);
 
       packages = forAllSystems (system: (releaseFor system).packages);
-      checks = forAllSystems (system: (releaseFor system).checks);
+      checks = forAllSystems (
+        system:
+        let
+          pkgs = pkgsFor system;
+          compiler = developmentCompilerFor system;
+        in
+        (releaseFor system).checks
+        // {
+          development-compiler = pkgs.runCommand "basic-cli-development-compiler" {
+            nativeBuildInputs = [ compiler ];
+          } ''
+            test "$(roc version)" = "Roc compiler version ${compiler.version}"
+            touch "$out"
+          '';
+        }
+      );
 
       devShells = forAllSystems (
         system:
@@ -78,8 +97,7 @@
         {
           default = pkgs.mkShell {
             packages = [
-              # Keep in sync with the nightly pinned in .github/workflows.
-              pkgs.rocpkgs."nightly-2026-11-06-34f137a"
+              (developmentCompilerFor system)
               pkgs.python3
               rustToolchain
               pkgs.simple-http-server

native/linker-inputs/README.md

@@ -26,9 +26,13 @@ python3 scripts/linker_inputs.py build --target x64musl --directory dist/linker-
 Publication requires each target to have passed validation on its native OS and
 architecture. The workflow publishes only after all three producers succeed.
 
-## Removal in the release after 0.28.0
+## Fixed-address compatibility removal
 
-Move the Roc pin to a nightly containing roc-lang/roc#12949, remove the temporary
-Static runtime compatibility workflow and the fixed-address startup patch in
-the producer, then publish and pin new linker inputs using unpatched `rcrt1.o`.
-Update the producer's fixed-address checks and documentation with that change.
+0.28.1 moves the Roc pin past roc-lang/roc#12949. Static runtime validation now
+uses that official nightly for static PIE, development-backend callbacks, and
+native execution. The pinned linker inputs still include the fixed-address
+startup compatibility patch; it is harmless for PIE and does not need rebuilding
+for this source compatibility patch release.
+
+At the next linker-input update, remove the fixed-address startup patch and its
+producer checks, then publish and pin new inputs using unpatched `rcrt1.o`.

nix/roc-nightly-sources.json

@@ -0,0 +1,18 @@
+{
+  "x86_64-linux": {
+    "url": "https://github.com/roc-lang/nightlies/releases/download/nightly-2026-11-13-03dce41/roc_nightly-linux_x86_64-2026-11-13-03dce41.tar.gz",
+    "hash": "sha256-GlL8PRRm/IUeajPCg4+xJFRGS8WjwLyV7ceEqg5CXlI="
+  },
+  "aarch64-linux": {
+    "url": "https://github.com/roc-lang/nightlies/releases/download/nightly-2026-11-13-03dce41/roc_nightly-linux_arm64-2026-11-13-03dce41.tar.gz",
+    "hash": "sha256-nb/NzPo2ecel+PTij7dLtOcUZRQAyXiQHGCYSCl2Nmw="
+  },
+  "aarch64-darwin": {
+    "url": "https://github.com/roc-lang/nightlies/releases/download/nightly-2026-11-13-03dce41/roc_nightly-macos_apple_silicon-2026-11-13-03dce41.tar.gz",
+    "hash": "sha256-SXzKhKYwHht0HAb7ZK5uAYZszwu6moGX/ckcnvPHAXE="
+  },
+  "x86_64-darwin": {
+    "url": "https://github.com/roc-lang/nightlies/releases/download/nightly-2026-11-13-03dce41/roc_nightly-macos_x86_64-2026-11-13-03dce41.tar.gz",
+    "hash": "sha256-Vu3fny503mZGCvHITqqUoHQ8kJ4RLqR1UjQwRBxSLIA="
+  }
+}

nix/roc-nightly.nix

@@ -0,0 +1,23 @@
+# Temporary supplement until roc-overlay records this nightly. Reuse its
+# installation and wrapping recipe, with the official archives and digests.
+final: prev:
+let
+  source = (builtins.fromJSON (builtins.readFile ./roc-nightly-sources.json)).${prev.stdenv.hostPlatform.system};
+  tag = builtins.elemAt (prev.lib.splitString "/" source.url) 7;
+in
+{
+  rocpkgs = prev.rocpkgs // {
+    ${tag} = prev.rocpkgs.default.overrideAttrs (old: {
+      version = tag;
+      src = final.fetchurl source;
+      passthru = old.passthru // {
+        inherit tag source;
+        compilerVersion = tag;
+        compilerCommit = "03dce412cc30ec237e4829b633f98549d01faf14";
+      };
+      meta = old.meta // {
+        changelog = "https://github.com/roc-lang/nightlies/releases/tag/${tag}";
+      };
+    });
+  };
+}