Version Packages

CHANGELOG.md

@@ -1,5 +1,11 @@
 # quickjs-wasi
 
+## 3.2.1
+
+### Patch Changes
+
+- [`8780703`](https://github.com/vercel-labs/quickjs-wasi/commit/87807033b30003f4c4820c9230a0c87968d4a82e) Thanks [@VikashLoomba](https://github.com/VikashLoomba)! - Fill enumeration result arrays with DefineProperty semantics (`JS_DefinePropertyValueUint32`) instead of `[[Set]]` (`JS_SetPropertyUint32`) in `qjs_get_own_property_names`, `qjs_get_own_property_names_all`, and `qjs_get_own_property_keys`. A guest that polluted `Array.prototype` with an index accessor could previously swallow keys at that index and have its setter executed inside the binary's fill loop — guest code running during nominally trap-free enumeration. The Define-based fill never walks the prototype chain, so pollution can neither observe nor corrupt enumeration, and every result index is an own data property (indexed readback cannot reach an inherited accessor either). Also removes a dead, never-wired byte-at-a-time UTF-16 handler in the encoding extension whose FIXME case (code unit following an unmatched lead surrogate) is handled correctly by the live `decode_utf16` path.
+
 ## 3.2.0
 
 ### Minor Changes

package.json

@@ -1,6 +1,6 @@
 {
   "name": "quickjs-wasi",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "packageManager": "pnpm@10.30.3",
   "description": "Snapshotable JavaScript runtime via WebAssembly. QuickJS-NG compiled to WASM with snapshot/restore support.",
   "type": "module",

src/version.ts

@@ -1,2 +1,2 @@
 // Auto-synced with package.json version. Do not edit manually.
-export const VERSION = "3.2.0";
+export const VERSION = "3.2.1";