@photostructure/fs-metadata 0.9.0 → 1.0.0

package/CHANGELOG.md

@@ -14,6 +14,15 @@ Fixed for any bug fixes.
 Security in case of vulnerabilities.
 -->
 
+## 1.0.0 - 2026-02-23
+
+### Security
+
+- Windows: add `/NXCOMPAT` (DEP) and `/HIGHENTROPYVA` (x64 high-entropy ASLR) linker flags
+- Windows: add `WarningLevel: 4` as structured MSBuild property on x64 and ARM64 targets (avoids `/W` flag ordering conflicts with node-gyp defaults)
+- Linux/macOS: add `-D_FORTIFY_SOURCE=2` and `-Wformat-security` compiler flags
+- Linux x64: add `-fcf-protection=full` (Intel CET); Linux ARM64: add `-mbranch-protection=standard` (PAC+BTI)
+
 ## 0.9.0 - 2025-12-28
 
 ### Added

package/README.md

@@ -1,4 +1,4 @@
-![PhotoStructure fs-metadata logo](https://raw.githubusercontent.com/photostructure/fs-metadata/main/doc/logo.svg)
+<img src="https://raw.githubusercontent.com/photostructure/fs-metadata/main/doc/logo.svg" alt="PhotoStructure fs-metadata logo" width="200">
 
 Cross-platform native Node.js module for filesystem metadata, mount points, and volume information. Built for and supported by [PhotoStructure](https://photostructure.com).
 
@@ -7,7 +7,7 @@ Cross-platform native Node.js module for filesystem metadata, mount points, and
 [![Node-API v9 Badge](https://raw.githubusercontent.com/nodejs/abi-stable-node/refs/heads/doc/assets/Node-API%20v9%20Badge.svg)](https://nodejs.org/dist/latest/docs/api/n-api.html#node-api-version-matrix)
 [![View on GitHub](https://img.shields.io/badge/View%20on-GitHub-blue)](https://github.com/photostructure/fs-metadata)
 
-## Quick Start
+## Quick start
 
 ```bash
 npm install @photostructure/fs-metadata
@@ -28,14 +28,14 @@ const metadata = await getVolumeMetadata("/");
 console.log(metadata);
 ```
 
-## Key Features
+## Features
 
-- **Volume Management**: List mount points, get volume metadata, space usage
-- **Hidden Files**: Get/set hidden attributes, recursive checks, cross-platform support
+- **Volume management**: List mount points, get volume metadata, space usage
+- **Hidden files**: Get/set hidden attributes, recursive checks, cross-platform support
 - **Performance**: Non-blocking async operations with timeout protection
-- **TypeScript**: Full type definitions with ESM and CommonJS support
+- **TypeScript**: Type definitions with ESM and CommonJS support
 
-## Supported Platforms
+## Supported platforms
 
 | Platform      | Architecture | Node.js | OS Version                |
 | ------------- | ------------ | ------- | ------------------------- |

package/binding.gyp

@@ -32,14 +32,32 @@
             ],
             "cflags": [
               "-fPIC",
-              "-fstack-protector-strong"
+              "-fstack-protector-strong",
+              "-D_FORTIFY_SOURCE=2",
+              "-Wformat-security"
             ],
             "cflags_cc": [
               "-fexceptions",
               "-fPIC",
-              "-fstack-protector-strong"
+              "-fstack-protector-strong",
+              "-D_FORTIFY_SOURCE=2",
+              "-Wformat-security"
             ],
             "conditions": [
+              [
+                "target_arch=='x64'",
+                {
+                  "cflags": ["-fcf-protection=full"],
+                  "cflags_cc": ["-fcf-protection=full"]
+                }
+              ],
+              [
+                "target_arch=='arm64'",
+                {
+                  "cflags": ["-mbranch-protection=standard"],
+                  "cflags_cc": ["-mbranch-protection=standard"]
+                }
+              ],
               [
                 "enable_gio=='true'",
                 {
@@ -88,6 +106,7 @@
                   ],
                   "msvs_settings": {
                     "VCCLCompilerTool": {
+                      "WarningLevel": 4,
                       "AdditionalOptions": [
                         "/Qspectre",
                         "/guard:cf",
@@ -101,6 +120,8 @@
                       "AdditionalOptions": [
                         "/guard:cf",
                         "/DYNAMICBASE",
+                        "/HIGHENTROPYVA",
+                        "/NXCOMPAT",
                         "/CETCOMPAT"
                       ]
                     }
@@ -118,6 +139,7 @@
                   ],
                   "msvs_settings": {
                     "VCCLCompilerTool": {
+                      "WarningLevel": 4,
                       "AdditionalOptions": [
                         "/guard:cf",     # Control Flow Guard (supported on ARM64)
                         "/ZH:SHA_256",   # SHA-256 hash algorithm for checksums
@@ -133,38 +155,14 @@
                     "VCLinkerTool": {
                       "AdditionalOptions": [
                         "/guard:cf",      # Control Flow Guard at link time
-                        "/DYNAMICBASE"    # ASLR (Address Space Layout Randomization)
-                        # NOTE: /CETCOMPAT omitted - Intel CET is x64-specific
+                        "/DYNAMICBASE",   # ASLR (Address Space Layout Randomization)
+                        "/NXCOMPAT"       # DEP (Data Execution Prevention)
+                        # NOTE: /HIGHENTROPYVA and /CETCOMPAT are x64-specific
                         #       ARM64 has equivalent hardware security features
                       ]
                     }
                   }
                 }
-              ],
-              [
-                "target_arch=='ia32'",
-                {
-                  "defines": [
-                    "_M_IX86"
-                  ],
-                  "msvs_settings": {
-                    "VCCLCompilerTool": {
-                      "AdditionalOptions": [
-                        "/guard:cf",
-                        "/ZH:SHA_256",
-                        "/sdl"
-                      ],
-                      "ExceptionHandling": 1,
-                      "RuntimeTypeInfo": "true"
-                    },
-                    "VCLinkerTool": {
-                      "AdditionalOptions": [
-                        "/guard:cf",
-                        "/DYNAMICBASE"
-                      ]
-                    }
-                  }
-                }
               ]
             ]
           }
@@ -183,17 +181,23 @@
               "CLANG_CXX_LIBRARY": "libc++",
               "MACOSX_DEPLOYMENT_TARGET": "10.15",
               "OTHER_CFLAGS": [
-                "-fstack-protector-strong"
+                "-fstack-protector-strong",
+                "-D_FORTIFY_SOURCE=2",
+                "-Wformat-security"
               ]
             },
             "cflags": [
               "-fexceptions",
               "-fPIC",
-              "-fstack-protector-strong"
+              "-fstack-protector-strong",
+              "-D_FORTIFY_SOURCE=2",
+              "-Wformat-security"
             ],
             "cflags_cc": [
               "-fexceptions",
-              "-fstack-protector-strong"
+              "-fstack-protector-strong",
+              "-D_FORTIFY_SOURCE=2",
+              "-Wformat-security"
             ],
             "link_settings": {
               "libraries": [

package/claude.sh

@@ -12,7 +12,10 @@ claude --append-system-prompt "$(
 # MANDATORY GUIDELINES
 - **Study your CLAUDE.md** - Every conversation begins by studying CLAUDE.md
 - **Always Start By Reading** - You must study the referenced codebase and related documentation before making any change. NEVER assume APIs or implementation details.
-- **Assume Concurrent Edits** - STOP if build errors aren't from your changes
+- **Assume Concurrent Edits** - if you encounter a compilation error that you don't think you caused, **STOP immediately**, do not try to fix it blindly, **describe the error** to the user clearly, and **use AskUserQuestion** with these options:
+   - "Build is now fixed, continue"
+   - "Please fix the build and then continue"
+
 - **Validate your work** - Does your code compile? Can we clean up compilation warnings? Do the related tests pass?
 - **Don't use git checkout to undo changes** - Instead, re-apply your diff in reverse. You have to assume that the git tree was not clean when you made edits.
 - **Ask questions** - If anything is nebulous or unclear, it is IMPERATIVE that you ask clarifying questions to maximize velocity and avoid spurious work.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@photostructure/fs-metadata",
-  "version": "0.9.0",
+  "version": "1.0.0",
   "description": "Cross-platform native filesystem metadata retrieval for Node.js",
   "homepage": "https://photostructure.github.io/fs-metadata/",
   "types": "./dist/index.d.ts",
@@ -96,29 +96,29 @@
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
-    "@types/node": "^25.0.3",
+    "@types/node": "^25.3.0",
     "@types/semver": "^7.7.1",
     "cross-env": "^10.1.0",
     "del-cli": "^7.0.0",
     "eslint": "9.39.1",
-    "eslint-plugin-regexp": "^2.10.0",
-    "eslint-plugin-security": "^3.0.1",
-    "globals": "^16.5.0",
+    "eslint-plugin-regexp": "^3.0.0",
+    "eslint-plugin-security": "^4.0.0",
+    "globals": "^17.3.0",
     "jest": "^30.2.0",
     "jest-environment-node": "^30.2.0",
     "jest-extended": "^7.0.0",
-    "node-gyp": "^12.1.0",
-    "npm-check-updates": "^19.2.0",
+    "node-gyp": "^12.2.0",
+    "npm-check-updates": "^19.4.1",
     "npm-run-all2": "8.0.4",
     "prebuildify": "^6.0.1",
-    "prettier": "^3.7.4",
+    "prettier": "^3.8.1",
     "prettier-plugin-organize-imports": "4.3.0",
-    "terser": "^5.44.1",
+    "terser": "^5.46.0",
     "ts-jest": "^29.4.6",
     "tsup": "^8.5.1",
     "tsx": "^4.21.0",
-    "typedoc": "^0.28.15",
+    "typedoc": "^0.28.17",
     "typescript": "^5.9.3",
-    "typescript-eslint": "^8.50.1"
+    "typescript-eslint": "^8.56.1"
   }
 }