Skip to content

v2.4.0

Latest
Latest

Choose a tag to compare

View all tags
@sunnylqm sunnylqm released this 02 Aug 15:21
v2.4.0
bd6516f
This commit was signed with the committer’s verified signature.
sunnylqm Sunny Luo
SSH Key Fingerprint: YvgEN//aCN45+tCn7lmXL72uTB0I4p154UAO3vb6zXA
Verified
Learn about vigilant mode.

Safety hardening

  • Transactional file outputs: all file-based diff/patch APIs (and the hdp CLI) write to an exclusively-created temp file and atomically rename it over the destination only after verification succeeds. Failures remove the temp file and never touch an existing destination. In-place operation (output path == input path, including hard-link/symlink aliases) is now safe and supported.
  • Patch resource limits: patch(), patchStream(), patchSingleStream() accept { maxOutputBytes, maxWorkingMemoryBytes } and enforce finite defaults (2 GiB in-memory / 16 GiB file output, 256 MiB working memory). Corrupt or malicious patch headers are rejected before any allocation or output-file creation.
  • Async input ownership: async diff()/patch() copy their buffer inputs before queueing; mutating, transferring, or detaching the source buffers after the call can no longer corrupt results.
  • DataView inputs are now accepted; windowSize values above Number.MAX_SAFE_INTEGER are rejected (previously undefined behavior).
  • Prebuild load errors are preserved as err.cause when the fallback loader also fails.

CI / packaging

  • Per-platform smoke test of the packed npm tarball (loads from prebuilds/ only).
  • Linux prebuilds are rejected if they require glibc symbols above 2.34 (the baseline since v2.3.0; compatible with Ubuntu 22.04 / Debian 12 / RHEL 9).
  • Full test suite now also runs on Node 14.17 (the declared engines floor).
  • README platform list corrected to the actually published targets: darwin-arm64, linux-x64, linux-arm64.

Dependencies

Updated to latest: node-gyp-build 4.8.4, node-addon-api 8.9.1, node-gyp 13.0.1, prebuildify 6.0.1, @types/bun 1.3.14.

Assets 2
Loading