@marcuspuchalla/nachos 0.1.3 → 0.2.0

package/CHANGELOG.md

@@ -5,6 +5,81 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0] - 2026-06-14 - RFC 8949 audit remediation
+
+Resolves the findings of the June 2026 RFC 8949 conformance & security audit.
+All fixes verified empirically against the build and locked in by
+`src/__tests__/audit-fixes.test.ts`.
+
+### Fixed
+
+#### Security
+- **(H1) Source-map parse path stack overflow** - `decodeWithSourceMap()` now
+  enforces `maxTagDepth` (RUSTSEC-2019-0025). Deeply nested tags previously
+  overflowed the call stack with an uncatchable `RangeError`; they now raise a
+  clean `Error`, matching `decode()`.
+- **(M2) Encoder depth bypass via tags** - `maxDepth` is now tracked across the
+  tagged-value boundary, so deeply nested `{tag,value}` chains can no longer
+  bypass the limit and overflow the stack.
+- **(L3) `readUint` precision** - refuses values above `MAX_SAFE_INTEGER`
+  instead of silently losing precision; callers must use `readBigUint`.
+
+#### Correctness / Conformance
+- **(H2) Map key ordering is now explicit** - canonical mode defaults to
+  **length-first** ordering (Cardano CIP-21 / RFC 7049 §3.9) and accepts a new
+  `mapKeyOrder: 'length-first' | 'bytewise'` option. `'bytewise'` selects
+  RFC 8949 §4.2.1 core deterministic ordering. Applies to both encoding and
+  `validateCanonical` decoding.
+- **(M1) Trailing-data well-formedness** - new `allowTrailingData` option
+  (default `true`; auto-`false` in `strict` mode) makes `decode()` reject
+  bytes left over after the top-level item. Use `parseSequence` for multiple items.
+- **(M4) Shortest-form tag numbers** - `validateCanonical` now rejects
+  non-shortest tag number encodings (e.g. `d80100` instead of `c100`).
+- **(M5) Float16 subnormal encoding** - `canBeFloat16` lower bound corrected
+  from 2⁻¹⁴ (min normal) to 2⁻²⁴ (min subnormal). The encoder no longer emits
+  float32 for representable subnormals, so its output again passes its own
+  canonical validator.
+
+#### Behavior
+- **(M3) Duplicate map keys** - default `dupMapKeyMode` changed from `'allow'`
+  to `'warn'` so duplicates are never silently collapsed in the `Map` view.
+  Byte-perfect round-trips are still preserved via `ALL_ENTRIES_SYMBOL`.
+
+### Performance
+- **(L1) Source-map sequences** - `parseSequenceWithSourceMap` uses a zero-copy
+  `subarray` view per item instead of re-hex-encoding the buffer tail (O(N²) → O(N)).
+
+### Added
+- `MapKeyOrder` type, `mapKeyOrder` option (parser + encoder), `allowTrailingData`
+  option, and `compareBytesLexicographic` / `compareMapKeys` utilities.
+- Diagnostic notation (L5) now renders `CborByteString`/`CborTextString` wrappers,
+  unassigned simple values (`simple(N)`), and auto-detects indefinite-length
+  arrays/maps/strings.
+- 24 new audit-regression tests.
+
+## [0.1.4] - 2026-02-22
+
+### Fixed
+
+#### Security
+- **Duplicate map key bypass** - Semantic comparison now used for duplicate detection; different encodings of the same integer key (e.g. `0x01`, `0x1801`, `0x190001`) are correctly identified as duplicates (RFC 8949 Section 5.6)
+- **maxParseTime bypass** - Timeout is now enforced in standard `decode()`/`parse()` path, not only in `decodeWithSourceMap()`
+- **bytesWritten double-counting** - Removed broken value-copy tracking from `EncodeContext`; `maxOutputSize` is now checked once at root level after encoding completes
+
+#### Correctness
+- **Tag 4/5 integer validation** - `Number.isInteger()` check added to reject floats in exponent/mantissa positions (RFC 8949 requirement)
+- **Float16 IEEE 754 rounding** - Replaced truncating `>> 42` shift with guard/round/sticky round-half-to-even; also fixed 32-bit truncation bug that corrupted most float16 mantissas
+- **Exponential source-map re-parsing** - `validateTagSemantics` and `decodePlutusConstructor` now called directly on already-parsed values instead of re-parsing the entire tag subtree (O(D²) → O(D))
+
+### Performance
+- **Eliminated O(N²) parsing** - `parseItem` and `parseSequence` no longer slice and hex-encode the full remaining buffer on each element; all types now use buffer+offset native dispatch
+- **Map canonical sort** - Keys pre-encoded once before sort instead of re-encoded O(N log N) times inside comparator
+
+### Added
+- **Uint8Array input support** - `decode()`, `decodeWithSourceMap()`, `parseSequence()`, and `CborDecoder` class methods now accept `Uint8Array` directly, skipping hex conversion entirely
+- **Buffer-native parser exports** - `parseIntegerFromBuffer`, `parseFromBuffer` (float), `parseTagFromBuffer`, `validateTagSemantics`, `decodePlutusConstructor` exported for advanced use
+- 115 new tests
+
 ## [0.1.3] - 2026-02-09
 
 ### Fixed