@zudojs/serialization 1.0.0 → 1.0.1

package/README.md

@@ -81,7 +81,9 @@ RPC peer or a request body.
   is plain `JSON.parse`, where `__proto__` survives as an inert own property and
   never reaches the prototype — but do not spread or deep-merge such an object
   into another without screening its keys.
-- **Input is size-bounded** by `maxSize`, and depth-bounded by `maxDepth`.
+- **Input is size-bounded** by `maxSize`, and depth-bounded by `maxDepth`. On
+  the `preserveTypes` path the depth limit defaults to 128; on the fast path it
+  is enforced whenever you set it, per call or as an instance default.
 - **An unrecognised `$type` tag is treated as ordinary data**, so a peer cannot
   stop the consumer with `{"$type":"anything"}` and your own records may carry a
   `$type` field. Pass `strict: true` to make an unknown tag an error instead.

package/dist/serializerJson/jsonSerializer.core.js

@@ -49,6 +49,13 @@ export class JSONSerializer {
             this.assertOutputSize(json, maxSize);
             return json;
         }
+        // The fast path stays a bare `JSON.stringify` by default, but a depth
+        // limit the caller asked for must still be enforced: `maxDepth` used to
+        // be read only when `preserveTypes` was on, so a per-call or per-instance
+        // limit was silently ignored on the path most callers use.
+        if (opts.maxDepth !== undefined) {
+            assertDepthWithinLimit(value, maxDepth);
+        }
         const json = opts.pretty
             ? JSON.stringify(value, null, opts.indent ?? 2)
             : JSON.stringify(value);
@@ -71,6 +78,11 @@ export class JSONSerializer {
             assertDepthWithinLimit(parsed, maxDepth);
             return this.restoreValue(parsed, 0, maxDepth, opts);
         }
+        // Same contract on the fast path: an explicit `maxDepth` bounds input
+        // that arrives from the wire, whether or not types are being restored.
+        if (opts.maxDepth !== undefined) {
+            assertDepthWithinLimit(parsed, opts.maxDepth);
+        }
         return parsed;
     }
     transformValue(value, depth, maxDepth, options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/serialization",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Data translation layer with JSON serializer, type transformers, envelopes, and registry for Zudojs applications.",
   "type": "module",
   "main": "./dist/index.js",
@@ -19,16 +19,20 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@zudojs/constants": "1.0.0",
-    "@zudojs/errors": "1.0.0",
+    "@zudojs/constants": "1.0.1",
+    "@zudojs/errors": "1.0.1",
     "@zudojs/types": "1.0.0",
-    "@zudojs/validation": "1.0.0"
+    "@zudojs/validation": "1.0.1"
   },
   "devDependencies": {
     "typescript": "7.0.2",
     "vitest": "^4.1.11"
   },
   "license": "MIT",
+  "author": {
+    "name": "Oluwayemi Oyinlola",
+    "url": "https://github.com/oyinlola-tech"
+  },
   "keywords": [
     "zudojs",
     "serialization",