Changelog

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^7.2.1 to ^7.2.2

16.5.1 (2025-08-25)

Bug Fixes

• deps: update dependency ses to v1.14.0 (#1746) (3e4b834)

16.5.0 (2025-06-24)

Features

• core: relax scuttling by skipping intrinsics (#1645) (5040521)
• node: add support in scuttling (#1627) (587644f)

Bug Fixes

• add Node.js v24.0.0 to supported engines (ad9cdcd)
• deps: update babel monorepo (afc9fe5)
• deps: update babel monorepo to v7.27.3 (#1672) (72cb642)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^8.0.7 to ^8.0.8

16.4.0 (2025-05-01)

Features

• core: add "redefine" global policy value to schema (09d78ba), closes #1583
• core: support untrusted entrypoints (36018de)

Bug Fixes

• core,webpack: remove deprecated lockdown options (efec539), closes #1578
• core: block circular global object endowments (#1505) (6745a0e)
• deps: update babel monorepo to v7.26.10 (#1561) (2757717)
• deps: update babel monorepo to v7.27.0 (#1589) (efd83d7)
• deps: update definitelytyped (#1574) (6c2d54e)
• deps: update dependency json-stable-stringify to v1.3.0 (#1613) (f9314d1)
• deps: update dependency ses to v1.12.0 [security] (#1605) (881ae86)
• upgrade ses to v1.11.0 (a12dae1)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^8.0.6 to ^8.0.7

16.3.2 (2025-03-11)

Bug Fixes

• deps: update babel monorepo to v7.26.7 (#1524) (7285fdf)
• deps: update babel monorepo to v7.26.9 (6a9dc73)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^8.0.5 to ^8.0.6

16.3.1 (2025-01-28)

Bug Fixes

• deps: update babel monorepo to v7.26.5 (#1501) (4e1e19d)
• deps: update dependency ses to v1.10.0 (#1422) (b6f0589)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^8.0.4 to ^8.0.5

16.3.0 (2025-01-15)

Features

• webpack: policy debugging capabilities and tighter tests (20b12ad)

Bug Fixes

• core: ignore global Function in policy (55f8c7b)

16.2.2 (2024-12-09)

Bug Fixes

• 2 bugs manifested in walking content from policy-overrides (#1471) (7599146)

16.2.1 (2024-12-05)

Bug Fixes

• make policy ordering consistntly manifest itself in json files produced (a149a7d)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^8.0.3 to ^8.0.4

16.2.0 (2024-12-04)

Features

• core: policy sorting cli for cleaner sort order migration (#1467) (b2cf7c3)
• core: second param to mergePolicy is now explicitly optional (f2302aa)
• core: sort policy in a diff-friendly way (#1350) - sort order remains unchanged even if path to dependency changed. (4af8ad7)

Bug Fixes

• core: fix broken references, type checking for mergePolicy.js (b08adef)
• core: move ses to production dependencies (27c0e8b)
• core: update vendored lockdown.umd.js (41a2d54)
• deps: update babel monorepo (e6f4e70)
• deps: update babel monorepo to v7.25.9 (6d9d5a3)
• deps: update dependency ses to v1.9.0 (75cae74)
• deps: update dependency type-fest to v4.30.0 (6528665)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^8.0.2 to ^8.0.3

16.1.0 (2024-10-11)

Features

• core: export endowmentsToolkit from the root (4abfade)

Bug Fixes

• deps: update babel monorepo to v7.25.7 (1ee84bf)
• deps: update babel monorepo to v7.25.8 (1dcb35e)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^8.0.1 to ^8.0.2

16.0.1 (2024-09-11)

Bug Fixes

• deps: update babel monorepo to v7.25.4 (6b59ee5)
• deps: update babel monorepo to v7.25.6 (6a42125)
• deps: update dependency ses to v1.7.0 (#1262) (0209007)
• deps: update dependency ses to v1.8.0 (7e5bece)
• deps: update dependency type-fest to v4.25.0 (a5c8d3e)
• deps: update dependency type-fest to v4.26.0 (f4051f9)
• deps: update dependency type-fest to v4.26.1 (6172f93)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^8.0.0 to ^8.0.1

16.0.0 (2024-08-15)

⚠ BREAKING CHANGES

• node: remove support for Node.js v16
• browserify: remove support for Node.js v16
• perf: remove support for Node.js v16
• tofu: remove support for Node.js v16
• webpack: remove support for Node.js v16
• core: remove support for Node.js v16

Features

• core: make makeMinimalViewOfRef usage in builtin attenuation consistent with globals for negative policy overrides, moving implementation to endowmentsToolkit as a side-effect desireable for webpack plugin (c0c91fc)
• global store with attenuation support (#1158) (f7175a6)

Bug Fixes

• deps: update babel monorepo (0880e2e)
• deps: update babel monorepo (d9d40b4)
• deps: update babel monorepo (b6aa714)
• deps: update dependency type-fest to v4.23.0 (d04e1f3)
• deps: update dependency type-fest to v4.24.0 (c735909)

Miscellaneous Chores

• browserify: remove support for Node.js v16 (6ca05ba)
• core: remove support for Node.js v16 (6ca05ba)
• node: remove support for Node.js v16 (6ca05ba)
• perf: remove support for Node.js v16 (6ca05ba)
• tofu: remove support for Node.js v16 (6ca05ba)
• webpack: remove support for Node.js v16 (6ca05ba)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^7.3.0 to ^8.0.0

15.4.0 (2024-07-11)

Features

• core: nodejs 22 support (8722914)

Bug Fixes

• core: udpate lockdown.umd.js (236bb91)
• deps: update babel monorepo to v7.24.5 (7e466bd)
• deps: update babel monorepo to v7.24.6 (f6d450f)
• deps: update dependency ses to v1.5.0 (9b871f7)
• deps: update dependency type-fest to v4.14.0 (1321a58)
• deps: update dependency type-fest to v4.15.0 (c48f8e3)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^7.2.3 to ^7.3.0

15.3.0 (2024-03-26)

Features

• core: add external package name fallback function to options in generatePolicy, use it in webpack (8a3a0a6)

Bug Fixes

• core: remove circular ref to ambient.ts (b370419)
• core: update LavamoatModuleRecord to use default initializer args (ff3991c)
• core: update vendored lockdown.umd.js (6a062e6)
• deps: update dependency type-fest to v4.10.3 (95c0ae3)
• deps: update dependency type-fest to v4.12.0 (29d157c)
• deps: update dependency type-fest to v4.13.1 (ec89820)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^7.2.2 to ^7.2.3

15.2.0 (2024-02-29)

Features

• core: ESM support in policy generation (60dc4fa)
• core: return attempted path when parsing JSON of policy fails (ea7f3d4)
• core: turn off localeTaming in ses lockdown by default (e37582f)
• webpack: policy loading, generation and overrides put together (1bf3702)

Bug Fixes

• core/test: platform-agnostic line separator (0a898a3)
• core: detect ESM/CJS imports properly (c2c37e2)
• core: export types from generatePolicy (b999545)
• webpack: fix typescript complaints (fc41eda)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^7.2.0 to ^7.2.1

15.1.2 (2024-02-07)

Bug Fixes

• core: update LavamoatModuleRecord (152534d)
• deps: update dependency @babel/types to v7.23.9 (c2f91e9)
• deps: update dependency json-stable-stringify to v1.1.1 (7d28e79)
• deps: update dependency type-fest to v4.10.0 (9f2cf3c)
• deps: update dependency type-fest to v4.10.1 (36567e7)
• deps: update dependency type-fest to v4.10.2 (1580ed9)
• deps: update dependency type-fest to v4.9.0 (70e9ffd)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^7.1.0 to ^7.2.0

15.1.1 (2024-01-18)

Bug Fixes

• core: update SES to v1.1.0 in core (29ad47d)

15.1.0 (2024-01-18)

Features

• core: ship some types (#732) (d5de381)

Bug Fixes

• core: add better types to policy loading and merging functions (db799d1)
• core: update LavaMoatPolicy types (d9292ca)
• deps: pin dependencies (4006c1f)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^7.0.0 to ^7.1.0

15.0.0 (2023-10-18)

⚠ BREAKING CHANGES

• The minimum supported Node.js version is now v16.20.0.

Features

• core: add overrideTaming: 'severe' for improved developer experience under lavamoat (#730) (20e4f76)
• node20 (ef3a0da)

Bug Fixes

• drop Node.js v14 (#729) (10c667b)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^6.2.1 to ^7.0.0

14.4.1 (2023-09-14)

Bug Fixes

• core,perf: bump ses to 0.18.7 and reenable lib:ses script (986fc1f)
• core,perf: bump ses to 0.18.8 (d7a3b4d)
• normalize all package versions (0800c11)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^6.0.3 to ^6.2.1

14.2.3 (2023-09-13)

Bug Fixes

• core,perf: bump ses to 0.18.8 (d7a3b4d)

14.2.2 (2023-09-08)

Bug Fixes

• core,perf: bump ses to 0.18.7 and reenable lib:ses script (986fc1f)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • lavamoat-tofu bumped from ^6.0.2 to ^6.0.3