@componentor/fs 3.0.13 → 3.0.15

package/README.md

@@ -570,6 +570,19 @@ Make sure `opfsSync` is enabled (it's `true` by default). Files are mirrored to
 
 ## Changelog
 
+### v3.0.15 (2026)
+
+**Fixes:**
+- Add bounds validation to `decodeRequest` — rejects truncated SAB payloads instead of reading out-of-bounds
+- Wrap `decodeRequest` in try/catch in both VFS and OPFS leader loop handlers — corrupt buffers return `status: -1` instead of crashing the leader loop
+- Guard `readPayload` against zero/negative/overflow chunk lengths from stale SAB data
+
+### v3.0.14 (2026)
+
+**Fixes:**
+- Fix `PATH_USED` not persisted after `write()` without flush flag — `commitPending()` now runs unconditionally after every write, preventing "path out of bounds" corruption on reload
+- Repair inode scanner uses the full allocated path table region instead of `PATH_USED` from the superblock — recovers files even when the superblock counter was stale
+
 ### v3.0.13 (2026)
 
 **Fixes:**

package/dist/index.js

@@ -2809,8 +2809,8 @@ var VFSEngine = class {
       tData = tAlloc;
       tInode = tAlloc;
     }
+    this.commitPending();
     if (flags & 1) {
-      this.commitPending();
       this.handle.flush();
     }
     const tFlush = this.debug ? performance.now() : 0;