v2.0.0

Maintenance release that makes the package build and run on current Node.js.

Changed

• Migrated the binding from NAN to Node-API (node-addon-api). NAN tracks V8's unstable C++ API and no longer compiles on current Node — the build failed inside nan.h itself. Node-API is ABI-stable, so a build keeps working across future Node major versions.
• Vendored Lua 5.1.5 and LuaFileSystem 1.8.0, compiled into the addon. The prebuilt libraries are gone. The package now builds on Linux, macOS and Windows, on x64 and ARM64, with no system Lua to install.
• LuaJIT replaced by stock Lua 5.1.5. Only Windows ever linked LuaJIT; macOS already shipped stock Lua 5.1.5. In exchange, Apple Silicon and ARM64 Linux build at all, which they previously could not.
• require('lfs') now works on every platform. It was a Windows-only prebuilt DLL loaded via an LUA_CPATH hack; LuaFileSystem is now compiled in and registered through package.preload.
• Node.js 18 or newer is required.

Fixed

Each of these changes observable behaviour, hence the major version.

• SetField pushed its key argument as the value, so every assignment wrote the field name into the field. It also failed to resolve a relative stack index before pushing, which put Lua into an unprotected error and aborted the process.
• LoadFile and LoadString were bound to the DoFile/DoString handlers, so they executed the chunk instead of only compiling it.
• Lua booleans converted to the numbers 1 and 0 rather than true and false.
• Push truncated numbers through lua_pushinteger, turning 3.5 into 3.
• AddPackagePath appended to package.path without a separator, corrupting the last entry so require usually failed, and interpolated the path into generated Lua source.
• Table conversion used a hardcoded relative stack index and only worked when the table was on top of the stack.
• get_str allocated on every string argument and never freed it.
• Six sprintf calls formatted arbitrary-length Lua error messages into a fixed 1024-byte stack buffer.
• ~LuaState never called lua_close, leaking the interpreter; calling Close twice was a use-after-free. Close is now idempotent and later use of a closed state throws.
• SetField and GetField reject non-table targets instead of letting Lua abort the process.
• Registered callbacks are looked up through a closure upvalue rather than a global singleton, so separate LuaState instances no longer clash.

Added

• Test suite covering the public API, with regression tests pinning each fix above.
• CI across Linux, macOS and Windows on Node 20, 22 and 24.

Upgrading: see the breaking changes table in the README.