@endo/pass-style@2.0.1

Patch Changes

• #3343 c0f60b4 Thanks @boneskull! - Version bump for latest dist-tag only. This is the same version as v1.8.2.

@endo/evasive-transform@2.3.1

Patch Changes

• #3344 cafd9fc Thanks @boneskull! - Bump for release only.

ses@2.3.0

Minor Changes

• #3308 4da9a99 Thanks @kriskowal! - Drop the immutable-ArrayBuffer pseudo-prototype.

  Emulated immutable ArrayBuffers produced by @endo/immutable-arraybuffer now inherit directly from ArrayBuffer.prototype rather than from an intermediate prototype. Object.getPrototypeOf(immuAB) === ArrayBuffer.prototype for both emulated immutable and genuine buffers; the brand check is the new immutable accessor on ArrayBuffer.prototype installed by the shim.

  The [Symbol.toStringTag] slot is preserved as an own property on each emulated immutable buffer (not on the shared prototype), so Object.prototype.toString.call(immuAB) continues to return '[object ImmutableArrayBuffer]' (as in master) while genuine ArrayBuffers continue to read as '[object ArrayBuffer]'. This keeps concordance (and any other downstream consumer that sniffs the toStringTag to decide whether the value is a genuine exotic) from misrouting an emulated immutable through Node's Buffer.from, which throws because the emulated immutable is not an exotic object.

  @endo/immutable-arraybuffer is now a side-effect-only package: its sole public export is ./shim.js. The index.js and the package's . entry are removed; the previously exported names (isBufferImmutable, sliceBufferToImmutable, optTransferBufferToImmutable) are no longer reachable from outside the package. Callers detect immutability via the ArrayBuffer.prototype.immutable accessor (or Object.prototype.toString.call(buffer) === '[object ImmutableArrayBuffer]' when the shim has not been loaded) and convert via buffer.sliceToImmutable(...) and buffer.transferToImmutable(...) on the prototype. The break is a major bump for the @endo/immutable-arraybuffer package.

  @endo/bytes's to-immutable.js imports @endo/immutable-arraybuffer/shim.js (triggering the shim install) and calls buffer.sliceToImmutable(...) on ArrayBuffer.prototype instead of the previously exported sliceBufferToImmutable free function.

  The shim's install policy is now detect-then-skip rather than warn-and-overwrite: the Immutable ArrayBuffer proposal has reached stage 3, so any prior installation (native or previously loaded shim) wins. If 'sliceToImmutable' in ArrayBuffer.prototype is already true when the shim loads, the shim does nothing.

  ses drops the %ImmutableArrayBufferPrototype% permits entry, which no longer has a referent. The three permits lines inside %ArrayBufferPrototype% that declare the shim-installed methods (transferToImmutable, sliceToImmutable, immutable) stay as-is.

  @endo/pass-style's byteArray brand check no longer routes through an intermediate prototype; it consults the immutable accessor on ArrayBuffer.prototype directly. The check also tolerates the [Symbol.toStringTag] own-property on emulated immutable buffers and verifies that its value is a non-enumerable data property with a string value.

• #3322 eeefaa0 Thanks @kriskowal! - Permit TextEncoder and TextDecoder as universal intrinsics.

  TextEncoder and TextDecoder are pure transformations between string and Uint8Array with no static side channels, so they are now permitted on every compartment (start compartment and every compartment created after lockdown, identity-equal). Their prototypes are frozen alongside the other tamed primordials. On hosts that do not provide them (XS), lockdown proceeds without them and compartments observe their absence as before.

  Code that monkey-patches TextEncoder.prototype or TextDecoder.prototype after lockdown() will now throw, because the prototypes are frozen. Such mutations must happen before lockdown, the same rule that already applies to every other intrinsic.

• #3220 d47d74f Thanks @boneskull! - Exposes __noNamespaceBox__ getter on Compartment.

• #3316 71cbdb9 Thanks @boneskull! - makeError() now allows a code?: string option, which sets a code property on the resulting Error, if so desired.

Patch Changes

• #3306 a85b212 Thanks @gibson042! - - consoleTaming: 'safe' prevents Node.js console logging from invoking custom inspect methods

• #3307 c69eb03 Thanks @gibson042! - The console format specifier %c is for consuming a CSS style string and applying that style to the rendering of the remaining arguments. Node.js and browsers both parse %c the same way and have it consume one argument.

  • Browsers actually make use of the CSS, leading to security problems (e.g., https://issues.chromium.org/40056332 ).
  • Node.js ignores the %c and its corresponding argument, which is allowed by the WHATWG Console specification.

  To avoid the CSS security problems on all platforms, under the defaut consoleTaming: 'safe', we now sanitize out the %c and corresponding argument, emulating the allowed current Node.js behavior on all platforms. This fixes this CSS vulnerability while maintaining compatibility with the specification. We also treat unknown specifiers in a future-proof manner.

• #3309 bfa149b Thanks @boneskull! - makeError now narrows type of return instance when errConstructor provided.

• Updated dependencies [4da9a99]:

  • @endo/immutable-arraybuffer@2.0.0

@endo/patterns@2.1.0

Minor Changes

• #3287 d54fad3 Thanks @boneskull! - Bump version for publishing only.

Patch Changes

• Updated dependencies [4da9a99]:
  • @endo/pass-style@1.8.2

@endo/pass-style@1.8.2

Patch Changes

• #3308 4da9a99 Thanks @kriskowal! - Drop the immutable-ArrayBuffer pseudo-prototype.

  Emulated immutable ArrayBuffers produced by @endo/immutable-arraybuffer now inherit directly from ArrayBuffer.prototype rather than from an intermediate prototype. Object.getPrototypeOf(immuAB) === ArrayBuffer.prototype for both emulated immutable and genuine buffers; the brand check is the new immutable accessor on ArrayBuffer.prototype installed by the shim.

  The [Symbol.toStringTag] slot is preserved as an own property on each emulated immutable buffer (not on the shared prototype), so Object.prototype.toString.call(immuAB) continues to return '[object ImmutableArrayBuffer]' (as in master) while genuine ArrayBuffers continue to read as '[object ArrayBuffer]'. This keeps concordance (and any other downstream consumer that sniffs the toStringTag to decide whether the value is a genuine exotic) from misrouting an emulated immutable through Node's Buffer.from, which throws because the emulated immutable is not an exotic object.

  @endo/immutable-arraybuffer is now a side-effect-only package: its sole public export is ./shim.js. The index.js and the package's . entry are removed; the previously exported names (isBufferImmutable, sliceBufferToImmutable, optTransferBufferToImmutable) are no longer reachable from outside the package. Callers detect immutability via the ArrayBuffer.prototype.immutable accessor (or Object.prototype.toString.call(buffer) === '[object ImmutableArrayBuffer]' when the shim has not been loaded) and convert via buffer.sliceToImmutable(...) and buffer.transferToImmutable(...) on the prototype. The break is a major bump for the @endo/immutable-arraybuffer package.

  @endo/bytes's to-immutable.js imports @endo/immutable-arraybuffer/shim.js (triggering the shim install) and calls buffer.sliceToImmutable(...) on ArrayBuffer.prototype instead of the previously exported sliceBufferToImmutable free function.

  The shim's install policy is now detect-then-skip rather than warn-and-overwrite: the Immutable ArrayBuffer proposal has reached stage 3, so any prior installation (native or previously loaded shim) wins. If 'sliceToImmutable' in ArrayBuffer.prototype is already true when the shim loads, the shim does nothing.

  ses drops the %ImmutableArrayBufferPrototype% permits entry, which no longer has a referent. The three permits lines inside %ArrayBufferPrototype% that declare the shim-installed methods (transferToImmutable, sliceToImmutable, immutable) stay as-is.

  @endo/pass-style's byteArray brand check no longer routes through an intermediate prototype; it consults the immutable accessor on ArrayBuffer.prototype directly. The check also tolerates the [Symbol.toStringTag] own-property on emulated immutable buffers and verifies that its value is a non-enumerable data property with a string value.

@endo/parser-pipeline@0.1.0

Minor Changes

• #3158 1fa6c22 Thanks @boneskull! - Introduces @endo/parser-pipeline, a new package that eliminates redundant Babel AST parsing when multiple consumers need to analyze or transform the same JavaScript module source.

  The core problem: tools built on @endo/compartment-mapper (such as LavaMoat) have historically parsed each module two or three times — once for import/export analysis, once for evasive transforms, and once for policy-relevant globals analysis. This package composes those passes into a single parse-traverse-generate cycle.

  createParsers(config?) is the primary entry point. It accepts a single flat configuration object that combines pipeline options (visitorFactories, per-language mjs/cjs overrides, lifecycle hooks) with worker-pool options (workerScript, workerData, maxWorkers, idleTimeout). It returns { sync, async } parser maps that are drop-in replacements for parserForLanguage in @endo/compartment-mapper. The module-source analysis step is handled implicitly by the pipeline; consumers only supply user-defined visitor factories.

  Each entry in visitorFactories is a VisitorPassFactory: a function called once per module that returns a VisitorPass — an object with a required visitor and an optional done() method. Read-only "analyzer" passes and mutating "transform" passes are unified under this single type. Passes run in array order between the implicit module-source analyzer (first) and the implicit module-source transform (last). Each pass's done() fires immediately after its own traversal, so later passes see any AST mutations made by earlier ones. Passes that omit done contribute undefined to their visitorResults slot. Source maps are generated whenever the consumer provides a sourceMapHook, since the implicit module-source transform always rewrites the AST.

  Async-only consumers (e.g. policy generation) need only supply the worker/pool options and lifecycle hooks — they do not need to pass factory configs that only run inside the worker.

  runPipelineInWorker(port, config) powers the async path. It accepts the same pre-merge PipelineConfig shape as createParsers, performing the merge internally. Consumer-provided worker scripts call this to listen for parse tasks dispatched by the worker pool, run the full pipeline in a worker thread, and post results back. The worker pool (WorkerParserPool) manages spawning, queuing, idle timeouts, and unref'd workers so the process can exit cleanly once all in-flight dispatches settle.

Patch Changes

• Updated dependencies [e054d1a, 4da9a99, 34da8b4, be222ee, eeefaa0, 73e03aa, d47d74f, a85b212, 8906393, c69eb03, dfdfa08, 71cbdb9, bfa149b]:
  • @endo/compartment-mapper@2.4.0
  • ses@2.3.0
  • @endo/module-source@1.5.0

@endo/module-source@1.5.0

Minor Changes

• #3220 8906393 Thanks @boneskull! - Exposes AST-based parser for CJS, as well as an analyzeCjs function from the analyzer.js subpath export.

• #3218 dfdfa08 Thanks @boneskull! - Fixes the type of SourceMapHook and introduces proper .ts type sources checked by tsc. Types that were previously inlined as JSDoc typedefs (SourceMapHook, SourceMapHookDetails, SourceMapObject, ModuleSourceOptions, TransformSourceParams) are now defined in src/types/module-source.ts and re-exported from the package root via a new src/external.types.d.ts entry.

  Adds a ./analyzer.js subpath export with analyzeModule(options?). The returned context object exposes analyzePass and transformPass (plain { visitor } objects) and a buildRecord() function. This is the primitive that @endo/parser-pipeline uses to drive module analysis; it is also used internally by the ModuleSource constructor, so the exported API is not specific to the pipeline.

  Removes the PluginFactory abstraction and visitorFromPlugin helper: Babel plugins now return plain { visitor } objects directly, with @babel/types imported at module scope.

Patch Changes

• Updated dependencies [4da9a99, eeefaa0, d47d74f, a85b212, c69eb03, 71cbdb9, bfa149b]:
  • ses@2.3.0

@endo/immutable-arraybuffer@2.0.0

Major Changes

• #3308 4da9a99 Thanks @kriskowal! - Drop the immutable-ArrayBuffer pseudo-prototype.

  Emulated immutable ArrayBuffers produced by @endo/immutable-arraybuffer now inherit directly from ArrayBuffer.prototype rather than from an intermediate prototype. Object.getPrototypeOf(immuAB) === ArrayBuffer.prototype for both emulated immutable and genuine buffers; the brand check is the new immutable accessor on ArrayBuffer.prototype installed by the shim.

  The [Symbol.toStringTag] slot is preserved as an own property on each emulated immutable buffer (not on the shared prototype), so Object.prototype.toString.call(immuAB) continues to return '[object ImmutableArrayBuffer]' (as in master) while genuine ArrayBuffers continue to read as '[object ArrayBuffer]'. This keeps concordance (and any other downstream consumer that sniffs the toStringTag to decide whether the value is a genuine exotic) from misrouting an emulated immutable through Node's Buffer.from, which throws because the emulated immutable is not an exotic object.

  @endo/immutable-arraybuffer is now a side-effect-only package: its sole public export is ./shim.js. The index.js and the package's . entry are removed; the previously exported names (isBufferImmutable, sliceBufferToImmutable, optTransferBufferToImmutable) are no longer reachable from outside the package. Callers detect immutability via the ArrayBuffer.prototype.immutable accessor (or Object.prototype.toString.call(buffer) === '[object ImmutableArrayBuffer]' when the shim has not been loaded) and convert via buffer.sliceToImmutable(...) and buffer.transferToImmutable(...) on the prototype. The break is a major bump for the @endo/immutable-arraybuffer package.

  @endo/bytes's to-immutable.js imports @endo/immutable-arraybuffer/shim.js (triggering the shim install) and calls buffer.sliceToImmutable(...) on ArrayBuffer.prototype instead of the previously exported sliceBufferToImmutable free function.

  The shim's install policy is now detect-then-skip rather than warn-and-overwrite: the Immutable ArrayBuffer proposal has reached stage 3, so any prior installation (native or previously loaded shim) wins. If 'sliceToImmutable' in ArrayBuffer.prototype is already true when the shim loads, the shim does nothing.

  ses drops the %ImmutableArrayBufferPrototype% permits entry, which no longer has a referent. The three permits lines inside %ArrayBufferPrototype% that declare the shim-installed methods (transferToImmutable, sliceToImmutable, immutable) stay as-is.

  @endo/pass-style's byteArray brand check no longer routes through an intermediate prototype; it consults the immutable accessor on ArrayBuffer.prototype directly. The check also tolerates the [Symbol.toStringTag] own-property on emulated immutable buffers and verifies that its value is a non-enumerable data property with a string value.

@endo/eslint-plugin@3.0.0

Major Changes

• #3319 e352f0f Thanks @boneskull! - Breaking: Backwards compatibility with legacy ESLint config files is provided on a best-effort basis, given ESLint's deprecation of rules and third-party replacements. Recommended rules from ESLint 9+ have also been configured.

  Breaking: Minimum supported Node.js version is now v22.12.0.

  Breaking: @jessie.js/eslint-plugin is no longer a dependency of @endo/eslint-plugin. This removes a cyclic dependency (@jessie.js/eslint-plugin depends on @endo/eslint-plugin, and vice versa).

  • eslint-plugin-unicorn is no longer a peer dependency of @endo/eslint-plugin and can be safely removed from your devDependencies (unless you consume it directly, of course).
  • The flat/recommended config no longer registers the @jessie.js plugin, applies @jessie.js/safe-await-separator, or installs the use-jessie processor. The legacy recommended and internal configs likewise no longer extend plugin:@jessie.js/recommended or set the @jessie.js/use-jessie processor. See "Migration" below for more details.
  • New rules have been added from @eslint/js' recommended configuration, including no-assign-to-exported-let-var-or-function and no-harden-pattern-maker, which may or may not already be handled by your existing configuration.

  Migration: Consumers that rely on the rules and processor provided by @jessie.js/eslint-plugin must install @jessie.js/eslint-plugin manually and wire it up alongside @endo/eslint-plugin:

  import jessie from '@jessie.js/eslint-plugin';
  import endo from '@endo/eslint-plugin';
  
  export default [
    ...endo.configs['flat/recommended'],
    ...jessie.configs['flat/recommended'],
    { processor: jessie.processors['use-jessie'] },
  ];

  Furthermore, the new rules will need to be addressed as appropriate for your project.

• #3325 ac72fca Thanks @boneskull! - Certain tags are no longer allowed by our jsdoc/check-tag-names rule configuration, including @code.

  The new rules jsdoc/reject-any-type and jsdoc/ts-no-empty-object-type have been disabled.

Patch Changes

• #3305 6d6160d Thanks @turadg! - Republish with resolved dependency versions. The 2.6.0 manifest on npm shipped catalog: protocol specifiers for eslint-plugin-import and typescript, which npm cannot resolve; the publish toolchain now resolves the catalog: protocol to concrete version ranges at pack time. Fixes #3304.

@endo/compartment-mapper@2.4.0

Minor Changes

• #3221 e054d1a Thanks @boneskull! - Expose findUnknownCanonicalNames() from new export @endo/compartment-mapper/policy.js.

• #3338 34da8b4 Thanks @boneskull! - Added support for dynamic import() of absolute paths (POSIX/Win32). Added support for absolute Win32 paths to dynamic require().

  Dynamic import() of absolute paths in a POSIX environment requires a ReadPowers object containing an isAbsolute function (IsAbsoluteFn). A pathToFileURL function (PathToFileURLFn) is strongly recommended.

  For absolute path support in a Windows environment (for both dynamic import() and require()), a ReadPowers object must supply isAbsolute and pathToFileURL.

  Dynamic require() support for absolute paths retains the current baseline ReadPowers object requirements; see README.md for details.

• #3220 be222ee Thanks @boneskull! - Expose Babel-based CJS parser, parse-cjs-babel. Expose shared functionality for wrapping CJS functors with __dirname, __filename, etc. Add support for dynamic import() (parse-cjs-babel only). Fix incorrect typings of PackageDataHook's parameter.

Patch Changes

• #3247 73e03aa Thanks @boneskull! - Fixes CompartmentDescriptor so that it is generic on the PackagePolicy; externally-defined ParseFns can now refer to the specific contents of a custom PackagePolicy present in a CompartmentDescriptor.

  Introduces ParseSourceMapHook; differentiated from @endo/module-source's SourceMapHook.

  Fixes type of PolicyItem; eliminates confusion between void (no extra union members) and any (SomePackagePolicy).

• Updated dependencies [4da9a99, eeefaa0, d47d74f, a85b212, 8906393, c69eb03, dfdfa08, 71cbdb9, bfa149b]:

  • ses@2.3.0
  • @endo/module-source@1.5.0