@componentor/fs 3.0.14 → 3.0.16

package/README.md

@@ -570,6 +570,18 @@ Make sure `opfsSync` is enabled (it's `true` by default). Files are mirrored to
 
 ## Changelog
 
+### v3.0.16 (2026)
+
+**Fixes:**
+- Add 10s timeout to main-thread spin-wait — prevents infinite busy loop if SharedWorker is dead or unresponsive
+
+### v3.0.15 (2026)
+
+**Fixes:**
+- Add bounds validation to `decodeRequest` — rejects truncated SAB payloads instead of reading out-of-bounds
+- Wrap `decodeRequest` in try/catch in both VFS and OPFS leader loop handlers — corrupt buffers return `status: -1` instead of crashing the leader loop
+- Guard `readPayload` against zero/negative/overflow chunk lengths from stale SAB data
+
 ### v3.0.14 (2026)
 
 **Fixes:**

package/dist/index.js

@@ -1277,11 +1277,18 @@ var DEFAULT_SAB_SIZE = 2 * 1024 * 1024;
 var instanceRegistry = /* @__PURE__ */ new Map();
 var HEADER_SIZE = SAB_OFFSETS.HEADER_SIZE;
 var _canAtomicsWait = typeof globalThis.WorkerGlobalScope !== "undefined";
+var SPIN_TIMEOUT_MS = 1e4;
 function spinWait(arr, index, value) {
   if (_canAtomicsWait) {
     Atomics.wait(arr, index, value);
   } else {
+    const start = performance.now();
     while (Atomics.load(arr, index) === value) {
+      if (performance.now() - start > SPIN_TIMEOUT_MS) {
+        throw new Error(
+          `VFS sync operation timed out after ${SPIN_TIMEOUT_MS / 1e3}s \u2014 SharedWorker may be unresponsive`
+        );
+      }
     }
   }
 }