v0.5.5

Security: binary chunks and the translator

• A corrupted binary chunk could stall the VM inside a single instruction, out of reach of any count hook. The loader now verifies registers, constants, upvalues, prototypes and jump targets (src/lverify.js) and refuses a bad chunk with malformed (...). JavaScript errors raised while reading a chunk become a load error instead of a silent status -1. A binary chunk remains trusted input; sandbox: true still refuses them all.
• lua2js warnings can be unsafe when the translation reaches the JavaScript environment (eval, Function, globalThis...) or a prototype (__proto__, constructor). A __proto__ key in a table constructor is now an own property. The Lua ↔ JavaScript page refuses to run such a translation.

Documentation

• The security page explains why untrusted game scripts get an exchange mode instead of fengari-interop, and replays 1,500 corrupted binary chunks on upstream Fengari 0.1.5 (72 JavaScript exceptions cross pcall) and on the Pyroeis sandbox (none).

Full details in CHANGES.md.

🤖 Generated with Claude Code