Commits

Branch selector

 main

User selector

All users

All time

Commit History

Commits on Apr 30, 2026

• fix: update pull request branch from master to main in workflow configuration

  patriksimek

  committed
  647d7dd

  Copy full SHA for 647d7dd

• style: update ESLint configurations and remove unnecessary disable comments

  patriksimek

  committed
  9429c8d

  Copy full SHA for 9429c8d

• docs: add CHANGELOG.md for v3.10.6

  Show description for 72f5921
  patriksimek

  committed
  72f5921

  Copy full SHA for 72f5921

• fix(GHSA-cp6g-6699-wx9c): realpath candidate paths before require.root prefix check

  Show description for b53a591
  patriksimek

  committed
  b53a591

  Copy full SHA for b53a591

Commits on Apr 29, 2026

• docs(ATTACKS): refresh Categories 4, 9, 12, 19, 21, 22 for v3.10.6

  Show description for cf0c2dd
  patriksimek

  committed
  cf0c2dd

  Copy full SHA for cf0c2dd

• test: GHSA-6785 timeout bumps + GHSA-v27g Path A test gating

  Show description for 26b8a7a
  patriksimek

  committed
  26b8a7a

  Copy full SHA for 26b8a7a

• fix: deny wasi via NodeVM allowlist

  Show description for 2d8c585
  patriksimek

  committed
  2d8c585

  Copy full SHA for 2d8c585

• fix: setup-sandbox defense-in-depth (mpf8 symmetry + v37h L3 + bridge wiring)

  Show description for b57ac2d
  patriksimek

  committed
  b57ac2d

  Copy full SHA for b57ac2d

• fix: defense-in-depth bridge hardening

  Show description for 1035da6
  patriksimek

  committed
  1035da6

  Copy full SHA for 1035da6

• docs(README): document bufferAllocLimit + add Hardening recommendations

  Show description for d3270cf
  patriksimek

  committed
  d3270cf

  Copy full SHA for d3270cf

• test(infra): legacy-test-runner supports this.skip() and Promise-returning tests

  Show description for fedf68e
  patriksimek

  committed
  fedf68e

  Copy full SHA for fedf68e

• test(GHSA-hw58-p9xv-2mjh): pin async-fn host-process abort residual

  Show description for 69fe949
  patriksimek

  committed
  69fe949

  Copy full SHA for 69fe949

• fix: deny trace_events host-process abort DoS via NodeVM allowlist

  Show description for b3728f3
  patriksimek

  committed
  b3728f3

  Copy full SHA for b3728f3

• fix(GHSA-v27g-jcqj-v8rw): close Path A residual + redact getEvalOrigin

  Show description for 0a394d3
  patriksimek

  committed
  0a394d3

  Copy full SHA for 0a394d3

• fix(GHSA-wp5r-2gw5-m7q7): close unicode-escape identifier bypass

  Show description for 9f04848
  patriksimek

  committed
  9f04848

  Copy full SHA for 9f04848

• test(GHSA-qcp4-v2jj-fjx8): add the missing regression tests

  Show description for b8ebb4f
  patriksimek

  committed
  b8ebb4f

  Copy full SHA for b8ebb4f

• fix(GHSA-6785-pvv7-mvg7): forward bufferAllocLimit from NodeVM to VM super()

  Show description for b99ad81
  patriksimek

  committed
  b99ad81

  Copy full SHA for b99ad81

Commits on Apr 28, 2026

• test: extend Node-version gating to cover Node 8/10/12/16

  Show description for de7b94d
  patriksimek

  committed
  de7b94d

  Copy full SHA for de7b94d

• test: gate Node-version-dependent GHSA PoCs with it.cond

  Show description for 4e8a2f5
  patriksimek

  committed
  4e8a2f5

  Copy full SHA for 4e8a2f5

• chore: bump version to 3.10.6, renumber ATTACKS categories

  Show description for b2867a6
  patriksimek

  committed
  b2867a6

  Copy full SHA for b2867a6

• test: discover GHSA regression suites under test/ghsa/

  Show description for 74f1752
  patriksimek

  committed
  74f1752

  Copy full SHA for 74f1752

• fix(GHSA-wp5r-2gw5-m7q7): extend transformer fast-path regex with `with` and INTERNAL_STATE_NAME

  Show description for 6f8f704
  patriksimek

  committed
  6f8f704

  Copy full SHA for 6f8f704

• fix(GHSA-v27g-jcqj-v8rw): redact host frame info on CallSite wrapper

  Show description for e5d8635
  patriksimek

  committed
  e5d8635

  Copy full SHA for e5d8635

• fix(GHSA-mpf8-4hx2-7cjg): wrap host Promise.then onFulfilled value via from() not ensureThis

  Show description for 4bef390
  patriksimek

  committed
  4bef390

  Copy full SHA for 4bef390

• docs(GHSA-6785-pvv7-mvg7): align ATTACKS.md narrative with default=Infinity

  Show description for b8d7a71
  patriksimek

  committed
  b8d7a71

  Copy full SHA for b8d7a71

• fix(GHSA-6785-pvv7-mvg7): cap Buffer.alloc family with bufferAllocLimit option

  Show description for 77ab500
  patriksimek

  committed
  77ab500

  Copy full SHA for 77ab500

• fix(GHSA-hw58-p9xv-2mjh): catch + swallow sandbox Promise executor rejections

  Show description for 6bbfbb3
  patriksimek

  committed
  6bbfbb3

  Copy full SHA for 6bbfbb3

• fix(GHSA-947f-4v7f-x2v8): deny host-passthrough builtins from NodeVM allowlist

  Show description for cc15af4
  patriksimek

  committed
  cc15af4

  Copy full SHA for cc15af4

• fix(GHSA-vwrp-x96c-mhwq): block host intrinsic prototype pollution via bridge write traps

  Show description for a17d5cc
  patriksimek

  committed
  a17d5cc

  Copy full SHA for a17d5cc

• test(GHSA-55hx-c926-fr95): add 4 variant attack patterns

  Show description for 792e16d
  patriksimek

  committed
  792e16d

  Copy full SHA for 792e16d

• fix(GHSA-55hx-c926-fr95): structural sanitization at host-Promise boundary

  Show description for 4cb82cc
  patriksimek

  committed
  4cb82cc

  Copy full SHA for 4cb82cc

• test(GHSA-55hx-c926-fr95): structural leak repro — exposed-async-fn host-promise rejection

  Show description for 119fd0a
  patriksimek

  committed
  119fd0a

  Copy full SHA for 119fd0a

• fix(GHSA-55hx-c926-fr95): extend handleException to recurse into AggregateError.errors[]

  Show description for d715dd8
  patriksimek

  committed
  d715dd8

  Copy full SHA for d715dd8

• test(GHSA-47x8-96vw-5wg6): add 7 variant attack patterns + Category 21 doc

  Show description for 4a9168b
  patriksimek

  committed
  4a9168b

  Copy full SHA for 4a9168b

• fix(GHSA-47x8-96vw-5wg6): structural identity collapse for host built-in intrinsics

  Show description for 261da20
  patriksimek

  committed
  261da20

  Copy full SHA for 261da20