Release v2.15.1

Release type: stable
Release line: 2.15.x
Branch: release/2.15.x

[2.15.1] - 2026-07-26

Introduced a computed member guard transform in @enclave-vm/ast to secure dynamic computed member accesses.
Implemented a resource exhaustion rule to prevent security vulnerabilities stemming from resource abuse.
Added a recursion backstop for secure proxies to improve sandbox security.

Enhanced secure proxy caching mechanism by separating host-owned and realm-owned value handling.
Updated the in-VM secure-proxy membranes with a maximum recursion depth to ensure security even with deep recursive structures.

Comprehensive updates to secure proxies ensure that potential prototype-chain and function-constructor hazards are effectively blocked.
Improved reporting mechanism for sandbox escape attempts and access to dangerous properties, providing finer control over security policies.
Fixed a critical sandbox escape (GHSA-r2vf-x7cg-3g52) in @enclave-vm/core. A .bind chain could inflate the secure-proxy recursion depth past its cap, which failed open and returned a raw (unwrapped) host reference whose prototype chain reaches the host Function constructor; separately, a computed property key laundered through a variable (e.g. String.fromCharCode(...)) evaded static detection. The in-VM membranes now fail closed, and both a static rule and a runtime computed-key guard sanitize dynamically-built property keys.

Thanks to @zolbooo for responsibly reporting this vulnerability.