ata-validator 1.7.2 → 1.7.4

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 1.7.4 - 2026-08-26
+
+### Fixed
+
+- `validate()` read past the end of the document the caller handed it. simdjson wants padding after a document so its SIMD loads can run off the end, and the library was claiming that padding on buffers it does not own, on the grounds that a buffer not ending near a page boundary has readable bytes after it. That does not fault, which is why it went unnoticed, but the bytes belong to somebody else: under AddressSanitizer it reports as a heap-buffer-overflow inside simdjson, so anyone fuzzing or sanitizing an application built on ata saw a memory error with no way to tell it was deliberate. Through the Node binding the read landed in V8's heap. The document is now copied into a padded buffer, reused per thread, before it is parsed. The buffer APIs already did this and were never affected. Found by the fuzz targets in `fuzz/`, which were in the repository but had never been run; all three now survive millions of executions clean.
+
+### Changed
+
+- Rejecting a document through the buffer APIs no longer costs more than accepting one. The On-Demand plan answers first, and a `false` from it used to be ambiguous: it could mean the document failed a constraint, or that the plan could not decide. The caller had to assume the second, so it re-created the padded view, parsed the whole document again into a DOM, tried the generated plan, and then walked the tree. A rejected document was therefore parsed twice and walked up to three times. The plan now reports whether it stopped because the document failed a constraint or because it could not be read, and only the second falls through. simdjson's `INCORRECT_TYPE` is a constraint failure rather than a read failure, which is the distinction that makes this work: a property holding a string where the schema wants an integer surfaces as a read error from `get<int64>`, not as a type mismatch. On a 62 KB array of a thousand objects with one bad element: 316 µs to 11 µs when the bad element is first, 315 µs to 40 µs when it is last, and rejecting is now never dearer than accepting. `tests/test_buffer_path_parity.js` holds the buffer path to the same answers as `validate()` across all 3359 suite cases, and still reports zero disagreements.
+
+## 1.7.3 - 2026-08-26
+
+### Added
+
+- A prebuilt native engine for Intel macOS again, `@ata-validator/native-darwin-x64`. The target was dropped in 0.13.4 because GitHub's x64 macOS runners had stopped being reliably available; `macos-15-intel` brought them back, so the matrix is now seven targets: darwin arm64 and x64, linux x64 and arm64 on both glibc and musl, and win32 x64. Intel Macs went to the pure-JS engine in the meantime, which validates identically but leaves the buffer APIs unavailable, so this only changes speed and reach, not answers.
+
 ## 1.7.2 - 2026-08-24
 
 ### Fixed

package/README.md

@@ -561,11 +561,28 @@ npm test
 npm run test:suite
 ```
 
+## Project
+
+- [CONTRIBUTING.md](CONTRIBUTING.md) explains how to build the project and what a
+  pull request needs before it can be merged.
+- [GOVERNANCE.md](GOVERNANCE.md) says who decides what, which changes the project
+  will not accept and why, how releases are cut, and how someone becomes a
+  maintainer. It states the bus factor plainly rather than leaving you to find
+  it out.
+- [SECURITY.md](SECURITY.md) is where vulnerabilities go. Not the issue tracker.
+- [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) applies everywhere the project is
+  discussed.
+
 ## License
 
 MIT
 
-## Authors
+## Contributors
+
+[@mertcanaltin](https://github.com/mertcanaltin) ·
+[@SukeshP1995](https://github.com/SukeshP1995) ·
+[@lemire](https://github.com/lemire) ·
+[@armagandalkiran](https://github.com/armagandalkiran) ·
+[@pnodet](https://github.com/pnodet)
 
-[Mert Can Altin](https://github.com/mertcanaltin)
-[Daniel Lemire](https://github.com/lemire)
+Missing from this list after landing a patch? Send a pull request.

package/lib/native-load.js

@@ -14,7 +14,10 @@
 const VERSION = require('./version');
 
 function nativePackageName(platform, arch, isMusl) {
-  if (platform === 'darwin') return arch === 'arm64' ? '@ata-validator/native-darwin-arm64' : null;
+  if (platform === 'darwin') {
+    if (arch !== 'x64' && arch !== 'arm64') return null;
+    return `@ata-validator/native-darwin-${arch}`;
+  }
   if (platform === 'win32') return arch === 'x64' ? '@ata-validator/native-win32-x64' : null;
   if (platform === 'linux') {
     if (arch !== 'x64' && arch !== 'arm64') return null;

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.7.2';
+module.exports = '1.7.4';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.7.2",
+  "version": "1.7.4",
   "description": "JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.",
   "main": "index.js",
   "module": "index.mjs",
@@ -112,12 +112,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.7.2",
-    "@ata-validator/native-linux-x64-gnu": "1.7.2",
-    "@ata-validator/native-linux-arm64-gnu": "1.7.2",
-    "@ata-validator/native-linux-x64-musl": "1.7.2",
-    "@ata-validator/native-linux-arm64-musl": "1.7.2",
-    "@ata-validator/native-win32-x64": "1.7.2"
+    "@ata-validator/native-darwin-arm64": "1.7.4",
+    "@ata-validator/native-darwin-x64": "1.7.4",
+    "@ata-validator/native-linux-x64-gnu": "1.7.4",
+    "@ata-validator/native-linux-arm64-gnu": "1.7.4",
+    "@ata-validator/native-linux-x64-musl": "1.7.4",
+    "@ata-validator/native-linux-arm64-musl": "1.7.4",
+    "@ata-validator/native-win32-x64": "1.7.4"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"