Slice (Nexus-JS) v0.10.1

Slice (Nexus-JS) v0.10.1

Highlights

• Modular Host Bindings Architecture (src/bindings/): Split the monolithic host_bindings.rs into 14 focused domain modules (core, helpers, crypto, fs, http_and_fetch, kv_and_sandbox, wintertc_and_buffer, websocket, workers_and_sockets, wasm, child_process, deterministic_and_os, intrinsics).
• Zero-Copy TypedArray & DataView Fast Paths (boa_engine + helpers.rs): Added direct native downcast methods (TypedArray::with_bytes, TypedArray::with_bytes_mut, TypedArray::fast_byte_length, DataView::with_bytes) eliminating JS property lookups and intermediate Vec<u8> allocations across WebCrypto, node:crypto, TextEncoder/TextDecoder, Buffer, zlib, sockets, and WebAssembly (6.1x faster crypto.getRandomValues, 2.0x faster TextEncoder.encodeInto, 1.9x faster createHash/createHmac).
• Streaming JSON.parse via DeserializeSeed (serde_json): Eliminated intermediate serde_json::Value DOM trees during JSON.parse, delivering a 27% speedup on JSON transformation pipelines (195.89 us vs 269.67 us).
• 5-Ring Security & OCap Hardening:
  • Enforced VFS symlink target resolution and OCap read/write verification across all node:fs operations (SEC-01).
  • Enforced isolate memory ceilings (BOA_KV_MEM_BUDGET) on VFS writes, console.log, and crypto.randomBytes (SEC-02).
  • Bounded zlib decompression streams to the active isolate memory ceiling and metered CPU fuel (SEC-03).
  • Extended Egress DLP scanning to HTTP response headers and Content-Type (SEC-04).
  • Verified FsRead OCap on subprocess cwd and sanitized dynamic linker/shell environment variables (LD_PRELOAD, DYLD_*, BASH_ENV) in node:child_process (SEC-05).