@sythos/js_barcode_universal 1.5.9 → 1.5.11

package/README.md

@@ -112,8 +112,8 @@ The `unpkg` and `jsdelivr` fields point at the IIFE bundle, so a CDN needs no in
 
 ```html
 <script src="https://unpkg.com/@sythos/js_barcode_universal"></script>
-<script src="https://unpkg.com/@sythos/js_barcode_universal@1.5.9"></script>
-<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.5.9"></script>
+<script src="https://unpkg.com/@sythos/js_barcode_universal@1.5.11"></script>
+<script src="https://cdn.jsdelivr.net/npm/@sythos/js_barcode_universal@1.5.11"></script>
 ```
 
 Pin the version for anything you ship; the unpinned form resolves to `latest` and will move under
@@ -656,6 +656,55 @@ and reports which backend actually drew.
 
 ---
 
+## Security automation
+
+The repository is covered by GitHub's configured [CodeQL default setup](https://github.com/Sythos/JS_Barcode_Universal/security/code-scanning)
+for JavaScript and TypeScript code-scanning analysis. GitHub manages the analysis schedule and
+the security-events upload; this avoids running a duplicate advanced workflow alongside the
+repository-level default setup.
+
+[Dependabot](.github/dependabot.yml) checks the development TypeScript toolchain and GitHub Actions
+references weekly. Updates are repository-development controls only; the published SDK remains
+zero-dependency at runtime.
+
+These security workflows report findings and propose maintenance updates. They do not replace
+review of barcode conformance, licensing, patent status or release attestations.
+
+The image I/O boundary treats camera and file rasters as untrusted input. It validates finite
+positive dimensions, bounds allocations to 16,777,216 pixels, accepts only byte-valued channels,
+and snapshots greyscale buffers before decoding. Malformed or oversized rasters are rejected
+before detector work begins.
+
+---
+
+## Build provenance and artifact attestations
+
+The package publication workflow in [`.github/workflows/npm-publish.yml`](.github/workflows/npm-publish.yml)
+uses npm provenance when publishing to the public npm registry. npm provenance and GitHub Artifact
+Attestations are related but separate records:
+
+- **npm provenance** is issued by npm for a package publication and links the published package to
+  its source repository and trusted build workflow;
+- **GitHub Artifact Attestations** bind a build artifact, its digest and its build context to the
+  GitHub Actions workflow that produced it. They can be verified independently of the npm registry.
+
+The release-specific attestation workflow is expected at
+[`.github/workflows/release.yml`](.github/workflows/release.yml). Release assets must be verified
+against this repository and their exact local file contents:
+
+```sh
+gh attestation verify path/to/release-asset.tgz -R Sythos/JS_Barcode_Universal
+```
+
+The same command can be used for any other attested release asset by replacing the path. An
+attestation confirms build provenance; it is not an ISO barcode-conformance certificate, a patent
+clearance, or a guarantee that the implementation is vulnerability-free.
+
+Release automation validates the package version against the selected Git tag; it does not invent
+or increment versions by itself. The current release is `1.5.11`.
+
+---
+
 ## Licence
 
 MIT © 2026 Sythos (https://www.sythos.net). Every source file carries the header.

package/bundle/sythos-barcode.esm.js

@@ -1,5 +1,5 @@
 /*!
- * Sythos Barcode Suite v1.5.9
+ * Sythos Barcode Suite v1.5.11
  *
  * MIT License
  *
@@ -312,6 +312,41 @@ __modules["js/image/luminance.js"] = function (__require, __exports) {
  * @module image/luminance
  */
 const { NotFoundError } = __require("js/core/errors.js");
+// Camera and file inputs are untrusted. Keep allocations bounded before any
+// raster is copied into the decoder pipeline.
+const MAX_IMAGE_DIMENSION = 16384;
+const MAX_IMAGE_PIXELS = 16777216;
+function validateDimensions(width, height) {
+    if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+        || width < 1 || height < 1
+        || width > MAX_IMAGE_DIMENSION || height > MAX_IMAGE_DIMENSION) {
+        throw new NotFoundError(`Image dimensions must be positive safe integers no larger than ${MAX_IMAGE_DIMENSION}`);
+    }
+    const pixels = width * height;
+    if (pixels > MAX_IMAGE_PIXELS) {
+        throw new NotFoundError(`Image contains too many pixels: ${pixels} (maximum ${MAX_IMAGE_PIXELS})`);
+    }
+    return pixels;
+}
+function isByteArray(data) {
+    return data instanceof Uint8Array || data instanceof Uint8ClampedArray;
+}
+function validateByteData(data, expected, label) {
+    if (!isByteArray(data) && !Array.isArray(data)) {
+        throw new NotFoundError(`${label} must be a Uint8Array, Uint8ClampedArray, or number[]`);
+    }
+    if (!Number.isSafeInteger(data.length) || data.length < expected) {
+        throw new NotFoundError(`${label} is shorter than the required ${expected} bytes`);
+    }
+    if (Array.isArray(data)) {
+        for (let i = 0; i < expected; i++) {
+            const value = data[i];
+            if (!Number.isInteger(value) || value < 0 || value > 255) {
+                throw new NotFoundError(`${label} contains a non-byte value at index ${i}`);
+            }
+        }
+    }
+}
 /**
  * @typedef {object} ImageLike
  * @property {Uint8ClampedArray | Uint8Array | number[]} data RGBA, 4 bytes per pixel.
@@ -325,6 +360,10 @@ class LuminanceSource {
      * @param {number} height
      */
     constructor(grey, width, height) {
+        const pixels = validateDimensions(width, height);
+        if (!isByteArray(grey) || grey.length < pixels) {
+            throw new NotFoundError(`Greyscale buffer is shorter than the required ${pixels} bytes`);
+        }
         this.grey = grey;
         this.width = width;
         this.height = height;
@@ -340,15 +379,14 @@ class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromImageData(image) {
-        const { data, width, height } = image;
-        if (!data || !width || !height) {
-            throw new NotFoundError('Image must be { data, width, height } with RGBA data');
+        if (!image || typeof image !== 'object') {
+            throw new NotFoundError('Image must be an object with RGBA data');
         }
-        if (data.length < width * height * 4) {
-            throw new NotFoundError(`Image data too short: ${data.length} bytes for ${width}x${height} RGBA ` +
-                `(expected ${width * height * 4})`);
-        }
-        const grey = new Uint8Array(width * height);
+        const { data, width, height } = image;
+        const pixels = validateDimensions(width, height);
+        const expected = pixels * 4;
+        validateByteData(data, expected, 'Image data');
+        const grey = new Uint8Array(pixels);
         for (let i = 0, p = 0; i < grey.length; i++, p += 4) {
             const a = data[p + 3];
             let r = data[p], g = data[p + 1], b = data[p + 2];
@@ -373,10 +411,11 @@ class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromGrey(grey, width, height) {
-        if (grey.length < width * height) {
-            throw new NotFoundError('Greyscale buffer shorter than width * height');
-        }
-        return new LuminanceSource(grey, width, height);
+        const pixels = validateDimensions(width, height);
+        validateByteData(grey, pixels, 'Greyscale buffer');
+        // Snapshot caller-owned data so later mutations cannot alter a decode in progress.
+        const copy = Uint8Array.from(Array.isArray(grey) ? grey.slice(0, pixels) : grey.subarray(0, pixels));
+        return new LuminanceSource(copy, width, height);
     }
     /**
      * @param {number} x @param {number} y
@@ -391,6 +430,9 @@ class LuminanceSource {
      * @returns {Uint8Array}
      */
     getRow(y, out) {
+        if (!Number.isSafeInteger(y) || y < 0 || y >= this.height) {
+            throw new RangeError(`LuminanceSource row is outside the image: ${y}`);
+        }
         const row = out && out.length >= this.width ? out : new Uint8Array(this.width);
         row.set(this.grey.subarray(y * this.width, (y + 1) * this.width));
         return row;
@@ -17554,7 +17596,7 @@ function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-const VERSION = '1.5.9';
+const VERSION = '1.5.11';
 
 __exports.listFormats = listFormats;
 __exports.encode = encode;

package/bundle/sythos-barcode.js

@@ -1,5 +1,5 @@
 /*!
- * Sythos Barcode Suite v1.5.9
+ * Sythos Barcode Suite v1.5.11
  *
  * MIT License
  *
@@ -313,6 +313,41 @@ __modules["js/image/luminance.js"] = function (__require, __exports) {
  * @module image/luminance
  */
 const { NotFoundError } = __require("js/core/errors.js");
+// Camera and file inputs are untrusted. Keep allocations bounded before any
+// raster is copied into the decoder pipeline.
+const MAX_IMAGE_DIMENSION = 16384;
+const MAX_IMAGE_PIXELS = 16777216;
+function validateDimensions(width, height) {
+    if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+        || width < 1 || height < 1
+        || width > MAX_IMAGE_DIMENSION || height > MAX_IMAGE_DIMENSION) {
+        throw new NotFoundError(`Image dimensions must be positive safe integers no larger than ${MAX_IMAGE_DIMENSION}`);
+    }
+    const pixels = width * height;
+    if (pixels > MAX_IMAGE_PIXELS) {
+        throw new NotFoundError(`Image contains too many pixels: ${pixels} (maximum ${MAX_IMAGE_PIXELS})`);
+    }
+    return pixels;
+}
+function isByteArray(data) {
+    return data instanceof Uint8Array || data instanceof Uint8ClampedArray;
+}
+function validateByteData(data, expected, label) {
+    if (!isByteArray(data) && !Array.isArray(data)) {
+        throw new NotFoundError(`${label} must be a Uint8Array, Uint8ClampedArray, or number[]`);
+    }
+    if (!Number.isSafeInteger(data.length) || data.length < expected) {
+        throw new NotFoundError(`${label} is shorter than the required ${expected} bytes`);
+    }
+    if (Array.isArray(data)) {
+        for (let i = 0; i < expected; i++) {
+            const value = data[i];
+            if (!Number.isInteger(value) || value < 0 || value > 255) {
+                throw new NotFoundError(`${label} contains a non-byte value at index ${i}`);
+            }
+        }
+    }
+}
 /**
  * @typedef {object} ImageLike
  * @property {Uint8ClampedArray | Uint8Array | number[]} data RGBA, 4 bytes per pixel.
@@ -326,6 +361,10 @@ class LuminanceSource {
      * @param {number} height
      */
     constructor(grey, width, height) {
+        const pixels = validateDimensions(width, height);
+        if (!isByteArray(grey) || grey.length < pixels) {
+            throw new NotFoundError(`Greyscale buffer is shorter than the required ${pixels} bytes`);
+        }
         this.grey = grey;
         this.width = width;
         this.height = height;
@@ -341,15 +380,14 @@ class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromImageData(image) {
-        const { data, width, height } = image;
-        if (!data || !width || !height) {
-            throw new NotFoundError('Image must be { data, width, height } with RGBA data');
+        if (!image || typeof image !== 'object') {
+            throw new NotFoundError('Image must be an object with RGBA data');
         }
-        if (data.length < width * height * 4) {
-            throw new NotFoundError(`Image data too short: ${data.length} bytes for ${width}x${height} RGBA ` +
-                `(expected ${width * height * 4})`);
-        }
-        const grey = new Uint8Array(width * height);
+        const { data, width, height } = image;
+        const pixels = validateDimensions(width, height);
+        const expected = pixels * 4;
+        validateByteData(data, expected, 'Image data');
+        const grey = new Uint8Array(pixels);
         for (let i = 0, p = 0; i < grey.length; i++, p += 4) {
             const a = data[p + 3];
             let r = data[p], g = data[p + 1], b = data[p + 2];
@@ -374,10 +412,11 @@ class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromGrey(grey, width, height) {
-        if (grey.length < width * height) {
-            throw new NotFoundError('Greyscale buffer shorter than width * height');
-        }
-        return new LuminanceSource(grey, width, height);
+        const pixels = validateDimensions(width, height);
+        validateByteData(grey, pixels, 'Greyscale buffer');
+        // Snapshot caller-owned data so later mutations cannot alter a decode in progress.
+        const copy = Uint8Array.from(Array.isArray(grey) ? grey.slice(0, pixels) : grey.subarray(0, pixels));
+        return new LuminanceSource(copy, width, height);
     }
     /**
      * @param {number} x @param {number} y
@@ -392,6 +431,9 @@ class LuminanceSource {
      * @returns {Uint8Array}
      */
     getRow(y, out) {
+        if (!Number.isSafeInteger(y) || y < 0 || y >= this.height) {
+            throw new RangeError(`LuminanceSource row is outside the image: ${y}`);
+        }
         const row = out && out.length >= this.width ? out : new Uint8Array(this.width);
         row.set(this.grey.subarray(y * this.width, (y + 1) * this.width));
         return row;
@@ -17555,7 +17597,7 @@ function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-const VERSION = '1.5.9';
+const VERSION = '1.5.11';
 
 __exports.listFormats = listFormats;
 __exports.encode = encode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sythos/js_barcode_universal",
-  "version": "1.5.9",
+  "version": "1.5.11",
   "description": "Read and write barcodes in JavaScript and TypeScript with zero runtime dependencies. TypeScript sources compile to the JavaScript runtime and bundles. QR Code, Micro QR, rMQR, FrameQR Code, Aztec Code and Rune, PDF417 variants, GS1 DataBar Omnidirectional/Truncated, EAN supplements and one-dimensional formats.",
   "author": {
     "name": "Sythos",

package/src/index.d.ts

@@ -360,4 +360,4 @@ export declare function decodeStrict(image: {
     height: number;
 }, options?: object): DecodeResult;
 /** Library version, matching package.json. */
-export declare const VERSION = "1.5.9";
+export declare const VERSION = "1.5.11";

package/src/index.js

@@ -779,4 +779,4 @@ export function decodeStrict(image, options) {
     return results[0];
 }
 /** Library version, matching package.json. */
-export const VERSION = '1.5.9';
+export const VERSION = '1.5.11';

package/src/js/image/luminance.js

@@ -39,6 +39,41 @@
  * @module image/luminance
  */
 import { NotFoundError } from '../core/errors.js';
+// Camera and file inputs are untrusted. Keep allocations bounded before any
+// raster is copied into the decoder pipeline.
+const MAX_IMAGE_DIMENSION = 16384;
+const MAX_IMAGE_PIXELS = 16777216;
+function validateDimensions(width, height) {
+    if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+        || width < 1 || height < 1
+        || width > MAX_IMAGE_DIMENSION || height > MAX_IMAGE_DIMENSION) {
+        throw new NotFoundError(`Image dimensions must be positive safe integers no larger than ${MAX_IMAGE_DIMENSION}`);
+    }
+    const pixels = width * height;
+    if (pixels > MAX_IMAGE_PIXELS) {
+        throw new NotFoundError(`Image contains too many pixels: ${pixels} (maximum ${MAX_IMAGE_PIXELS})`);
+    }
+    return pixels;
+}
+function isByteArray(data) {
+    return data instanceof Uint8Array || data instanceof Uint8ClampedArray;
+}
+function validateByteData(data, expected, label) {
+    if (!isByteArray(data) && !Array.isArray(data)) {
+        throw new NotFoundError(`${label} must be a Uint8Array, Uint8ClampedArray, or number[]`);
+    }
+    if (!Number.isSafeInteger(data.length) || data.length < expected) {
+        throw new NotFoundError(`${label} is shorter than the required ${expected} bytes`);
+    }
+    if (Array.isArray(data)) {
+        for (let i = 0; i < expected; i++) {
+            const value = data[i];
+            if (!Number.isInteger(value) || value < 0 || value > 255) {
+                throw new NotFoundError(`${label} contains a non-byte value at index ${i}`);
+            }
+        }
+    }
+}
 /**
  * @typedef {object} ImageLike
  * @property {Uint8ClampedArray | Uint8Array | number[]} data RGBA, 4 bytes per pixel.
@@ -52,6 +87,10 @@ export class LuminanceSource {
      * @param {number} height
      */
     constructor(grey, width, height) {
+        const pixels = validateDimensions(width, height);
+        if (!isByteArray(grey) || grey.length < pixels) {
+            throw new NotFoundError(`Greyscale buffer is shorter than the required ${pixels} bytes`);
+        }
         this.grey = grey;
         this.width = width;
         this.height = height;
@@ -67,15 +106,14 @@ export class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromImageData(image) {
-        const { data, width, height } = image;
-        if (!data || !width || !height) {
-            throw new NotFoundError('Image must be { data, width, height } with RGBA data');
-        }
-        if (data.length < width * height * 4) {
-            throw new NotFoundError(`Image data too short: ${data.length} bytes for ${width}x${height} RGBA ` +
-                `(expected ${width * height * 4})`);
+        if (!image || typeof image !== 'object') {
+            throw new NotFoundError('Image must be an object with RGBA data');
         }
-        const grey = new Uint8Array(width * height);
+        const { data, width, height } = image;
+        const pixels = validateDimensions(width, height);
+        const expected = pixels * 4;
+        validateByteData(data, expected, 'Image data');
+        const grey = new Uint8Array(pixels);
         for (let i = 0, p = 0; i < grey.length; i++, p += 4) {
             const a = data[p + 3];
             let r = data[p], g = data[p + 1], b = data[p + 2];
@@ -100,10 +138,11 @@ export class LuminanceSource {
      * @returns {LuminanceSource}
      */
     static fromGrey(grey, width, height) {
-        if (grey.length < width * height) {
-            throw new NotFoundError('Greyscale buffer shorter than width * height');
-        }
-        return new LuminanceSource(grey, width, height);
+        const pixels = validateDimensions(width, height);
+        validateByteData(grey, pixels, 'Greyscale buffer');
+        // Snapshot caller-owned data so later mutations cannot alter a decode in progress.
+        const copy = Uint8Array.from(Array.isArray(grey) ? grey.slice(0, pixels) : grey.subarray(0, pixels));
+        return new LuminanceSource(copy, width, height);
     }
     /**
      * @param {number} x @param {number} y
@@ -118,6 +157,9 @@ export class LuminanceSource {
      * @returns {Uint8Array}
      */
     getRow(y, out) {
+        if (!Number.isSafeInteger(y) || y < 0 || y >= this.height) {
+            throw new RangeError(`LuminanceSource row is outside the image: ${y}`);
+        }
         const row = out && out.length >= this.width ? out : new Uint8Array(this.width);
         row.set(this.grey.subarray(y * this.width, (y + 1) * this.width));
         return row;

package/src/ts/image/luminance.ts

@@ -42,6 +42,49 @@
 
 import { NotFoundError } from '../core/errors.js';
 
+// Camera and file inputs are untrusted. Keep allocations bounded before any
+// raster is copied into the decoder pipeline.
+const MAX_IMAGE_DIMENSION = 16_384;
+const MAX_IMAGE_PIXELS = 16_777_216;
+
+function validateDimensions(width, height) {
+  if (!Number.isSafeInteger(width) || !Number.isSafeInteger(height)
+    || width < 1 || height < 1
+    || width > MAX_IMAGE_DIMENSION || height > MAX_IMAGE_DIMENSION) {
+    throw new NotFoundError(
+      `Image dimensions must be positive safe integers no larger than ${MAX_IMAGE_DIMENSION}`
+    );
+  }
+  const pixels = width * height;
+  if (pixels > MAX_IMAGE_PIXELS) {
+    throw new NotFoundError(
+      `Image contains too many pixels: ${pixels} (maximum ${MAX_IMAGE_PIXELS})`
+    );
+  }
+  return pixels;
+}
+
+function isByteArray(data) {
+  return data instanceof Uint8Array || data instanceof Uint8ClampedArray;
+}
+
+function validateByteData(data, expected, label) {
+  if (!isByteArray(data) && !Array.isArray(data)) {
+    throw new NotFoundError(`${label} must be a Uint8Array, Uint8ClampedArray, or number[]`);
+  }
+  if (!Number.isSafeInteger(data.length) || data.length < expected) {
+    throw new NotFoundError(`${label} is shorter than the required ${expected} bytes`);
+  }
+  if (Array.isArray(data)) {
+    for (let i = 0; i < expected; i++) {
+      const value = data[i];
+      if (!Number.isInteger(value) || value < 0 || value > 255) {
+        throw new NotFoundError(`${label} contains a non-byte value at index ${i}`);
+      }
+    }
+  }
+}
+
 /**
  * @typedef {object} ImageLike
  * @property {Uint8ClampedArray | Uint8Array | number[]} data RGBA, 4 bytes per pixel.
@@ -56,6 +99,10 @@ export class LuminanceSource {
    * @param {number} height
    */
   constructor(grey, width, height) {
+    const pixels = validateDimensions(width, height);
+    if (!isByteArray(grey) || grey.length < pixels) {
+      throw new NotFoundError(`Greyscale buffer is shorter than the required ${pixels} bytes`);
+    }
     this.grey = grey;
     this.width = width;
     this.height = height;
@@ -72,18 +119,15 @@ export class LuminanceSource {
    * @returns {LuminanceSource}
    */
   static fromImageData(image) {
-    const { data, width, height } = image;
-    if (!data || !width || !height) {
-      throw new NotFoundError('Image must be { data, width, height } with RGBA data');
-    }
-    if (data.length < width * height * 4) {
-      throw new NotFoundError(
-        `Image data too short: ${data.length} bytes for ${width}x${height} RGBA ` +
-        `(expected ${width * height * 4})`
-      );
+    if (!image || typeof image !== 'object') {
+      throw new NotFoundError('Image must be an object with RGBA data');
     }
+    const { data, width, height } = image;
+    const pixels = validateDimensions(width, height);
+    const expected = pixels * 4;
+    validateByteData(data, expected, 'Image data');
 
-    const grey = new Uint8Array(width * height);
+    const grey = new Uint8Array(pixels);
     for (let i = 0, p = 0; i < grey.length; i++, p += 4) {
       const a = data[p + 3];
       let r = data[p], g = data[p + 1], b = data[p + 2];
@@ -109,10 +153,11 @@ export class LuminanceSource {
    * @returns {LuminanceSource}
    */
   static fromGrey(grey, width, height) {
-    if (grey.length < width * height) {
-      throw new NotFoundError('Greyscale buffer shorter than width * height');
-    }
-    return new LuminanceSource(grey, width, height);
+    const pixels = validateDimensions(width, height);
+    validateByteData(grey, pixels, 'Greyscale buffer');
+    // Snapshot caller-owned data so later mutations cannot alter a decode in progress.
+    const copy = Uint8Array.from(Array.isArray(grey) ? grey.slice(0, pixels) : grey.subarray(0, pixels));
+    return new LuminanceSource(copy, width, height);
   }
 
   /**
@@ -129,6 +174,9 @@ export class LuminanceSource {
    * @returns {Uint8Array}
    */
   getRow(y, out) {
+    if (!Number.isSafeInteger(y) || y < 0 || y >= this.height) {
+      throw new RangeError(`LuminanceSource row is outside the image: ${y}`);
+    }
     const row = out && out.length >= this.width ? out : new Uint8Array(this.width);
     row.set(this.grey.subarray(y * this.width, (y + 1) * this.width));
     return row;

package/src/ts/index.d.ts

@@ -360,4 +360,4 @@ export declare function decodeStrict(image: {
     height: number;
 }, options?: object): DecodeResult;
 /** Library version, matching package.json. */
-export declare const VERSION = "1.5.9";
+export declare const VERSION = "1.5.11";

package/src/ts/index.ts

@@ -787,4 +787,4 @@ export function decodeStrict(image, options) {
 }
 
 /** Library version, matching package.json. */
-export const VERSION = '1.5.9';
+export const VERSION = '1.5.11';