Skip to content

v2.11.1 - #3

Merged
figulusproject merged 9 commits into
mainfrom
v/2.11.1
Aug 3, 2026
Merged

v2.11.1#3
figulusproject merged 9 commits into
mainfrom
v/2.11.1

Conversation

@figulusproject

Copy link
Copy Markdown
Owner

Added

  • setWasmModuleOptions({ locateFile }) in the browser entry point, letting bundlers/apps override
    where the WASM backend fetches cld.web.wasm from when it isn't served at the default relative
    path.

Fixed

  • Browser entry point's metadata.json import now uses the with { type: 'json' } attribute
    required by Node's ESM loader.

Security

  • Added a CodeQL Advanced workflow (codeql.yml) analyzing the actions, c-cpp, and
    javascript-typescript languages on push/PR to main and weekly on a schedule.
  • Added a security.yml workflow running npm audit --audit-level=high against the package's
    npm dependencies on push/PR to main and weekly on a schedule, separate from the CodeQL
    workflow above.
  • Restricted the default GITHUB_TOKEN permissions to contents: read on the ci.yml and
    security.yml workflows.

… cld.web.wasm from:

- wasm/browser-entry.js: export setWasmModuleOptions({ locateFile }), stored module-level and passed to createCldModule() -- Emscripten's own glue already checks Module["locateFile"] before falling back to its bundled-relative-URL default, so this is purely additive
- index.d.ts: types for the new export
- README.md: document the override for bundlers that serve cld.web.wasm from a non-default path
- fix browser-entry.js's metadata.json import to use the `with { type: 'json' }` attribute Node's ESM loader requires -- without it the real browser entry point couldn't be loaded via plain Node import() at all, which is what made it impossible to test
- test/runner-wasm-browser.js: confirms the override is actually honored, not just accepted -- spawns the real browser-entry.js in a child process with no override (fails, since the default WASM URL resolves to a file:// URL that Node's fetch() can't handle) and again with locateFile pointed at a local HTTP server serving the real wasm binary (succeeds with a correct detection), so success in the second case can only come from the override taking effect
- package.json: add the new test to npm test
- add a fork changelog  with entries for 2.11.0 and unreleased changes
- add read-only permissions to ci and security workflows
- rename branches from `master` to `main` in security workflow
@figulusproject
figulusproject merged commit b47a959 into main Aug 3, 2026
26 checks passed
@figulusproject
figulusproject deleted the v/2.11.1 branch August 3, 2026 13:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant