smbls 3.14.854 → 3.14.856

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # smbls
 
+## 3.14.856
+
+### Patch Changes
+
+- A payload key can no longer write to a prototype, a shared library reaches a consumer as copies, and a server render takes back its own library entries (merge programme 2026-10-25, lane F1).
+
+  - Security: `deepDestringifyFunctions` and `destringifyGlobalScope` (`@symbo.ls/utils`, and so the `smbls` bundle) and the renderer's own reviver (`@symbo.ls/mermaid` `deepDestringifyFunctions`, `stripFunctionStrings`) skip the keys `__proto__`, `constructor` and `prototype`. Before, a served page payload with a `__proto__` key wrote its object into `Object.prototype` (every object of the process then carried its keys, the next server render in the same process too), and a revived global scope inherited from an object the payload chose. The library merge (`deepDefaults` and its copies) skips the same keys.
+  - A library's `polyglot.translations` fill a consumer that has translations of its own, language by language and key by key: the app's key wins, an app with `polyglot.fetch` keeps its own maps, and a flat dotted library key never shadows a nested app value. `@symbo.ls/sync` puts the library keys back after a livesync snapshot or op.
+  - The merge hands a consumer copies of a library's design system and bags, never the library's objects, so one consumer's boot can no longer write into a library payload that other consumers share. A cycle in a library value is kept, not followed. Every `smbls` boot starts from its own default containers.
+  - `@symbo.ls/brender`: a render takes back only the `__SMBLS_PKGS__` entries its own libraries added; the process keeps one package registry and its framework entries.
+
+## 3.14.855
+
+### Patch Changes
+
+- 0c1947e: Font-face scans read a rule's type before its text. `declaredFaces` (inside `applyFontFaces` / `prepareDesignSystem`) and `removeServerStyles` (the takeover of a pre-rendered page) serialised `cssText` of every CSS rule on the page before they checked for `CSSRule.FONT_FACE_RULE`. Now only `@font-face` rules are serialised. The faces found and the styles removed are the same.
+
 ## 3.14.854
 
 ### Patch Changes