ata-validator 1.7.3 → 1.7.4

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 1.7.4 - 2026-08-26
+
+### Fixed
+
+- `validate()` read past the end of the document the caller handed it. simdjson wants padding after a document so its SIMD loads can run off the end, and the library was claiming that padding on buffers it does not own, on the grounds that a buffer not ending near a page boundary has readable bytes after it. That does not fault, which is why it went unnoticed, but the bytes belong to somebody else: under AddressSanitizer it reports as a heap-buffer-overflow inside simdjson, so anyone fuzzing or sanitizing an application built on ata saw a memory error with no way to tell it was deliberate. Through the Node binding the read landed in V8's heap. The document is now copied into a padded buffer, reused per thread, before it is parsed. The buffer APIs already did this and were never affected. Found by the fuzz targets in `fuzz/`, which were in the repository but had never been run; all three now survive millions of executions clean.
+
+### Changed
+
+- Rejecting a document through the buffer APIs no longer costs more than accepting one. The On-Demand plan answers first, and a `false` from it used to be ambiguous: it could mean the document failed a constraint, or that the plan could not decide. The caller had to assume the second, so it re-created the padded view, parsed the whole document again into a DOM, tried the generated plan, and then walked the tree. A rejected document was therefore parsed twice and walked up to three times. The plan now reports whether it stopped because the document failed a constraint or because it could not be read, and only the second falls through. simdjson's `INCORRECT_TYPE` is a constraint failure rather than a read failure, which is the distinction that makes this work: a property holding a string where the schema wants an integer surfaces as a read error from `get<int64>`, not as a type mismatch. On a 62 KB array of a thousand objects with one bad element: 316 µs to 11 µs when the bad element is first, 315 µs to 40 µs when it is last, and rejecting is now never dearer than accepting. `tests/test_buffer_path_parity.js` holds the buffer path to the same answers as `validate()` across all 3359 suite cases, and still reports zero disagreements.
+
 ## 1.7.3 - 2026-08-26
 
 ### Added

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.7.3';
+module.exports = '1.7.4';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.7.3",
+  "version": "1.7.4",
   "description": "JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.",
   "main": "index.js",
   "module": "index.mjs",
@@ -112,13 +112,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.7.3",
-    "@ata-validator/native-darwin-x64": "1.7.3",
-    "@ata-validator/native-linux-x64-gnu": "1.7.3",
-    "@ata-validator/native-linux-arm64-gnu": "1.7.3",
-    "@ata-validator/native-linux-x64-musl": "1.7.3",
-    "@ata-validator/native-linux-arm64-musl": "1.7.3",
-    "@ata-validator/native-win32-x64": "1.7.3"
+    "@ata-validator/native-darwin-arm64": "1.7.4",
+    "@ata-validator/native-darwin-x64": "1.7.4",
+    "@ata-validator/native-linux-x64-gnu": "1.7.4",
+    "@ata-validator/native-linux-arm64-gnu": "1.7.4",
+    "@ata-validator/native-linux-x64-musl": "1.7.4",
+    "@ata-validator/native-linux-arm64-musl": "1.7.4",
+    "@ata-validator/native-win32-x64": "1.7.4"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"