v2.2.0: security and correctness fixes, modern tooling (Node >=8 preserved) #19

Merged

corneliusio merged 8 commits from release/v2.2.0 into master

2026-08-24 21:25:08 +00:00

corneliusio commented

2026-08-24 21:15:42 +00:00

(Migrated from github.com)

Summary

Minor release. Every change preserves the existing Node >=8 runtime contract (verified by a dependency-free smoke test that CI runs on Node 8 and 12).

Runtime fixes (`index.js`)

Prototype pollution fixed — checksum state lives in null-prototype records, so __proto__ namespace/filename keys are inert (regression-tested; the old code demonstrably polluted Object.prototype)
Binary-safe hashing — contents are hashed as a Buffer; distinct binary files no longer collapse to one checksum via lossy UTF-8 decoding
Dynamic namespace functions run for every file (previously only the first file in a stream)
Cache state keyed per resolved checksum file — different files are isolated; instances sharing one file merge their writes (the documented multi-task pattern)
Atomic writes (temp + rename), structural validation of parsed cache JSON, forward-slash cache keys with read-time migration of legacy Windows keys, hash/namespace errors wrapped in PluginError, duplicate isStream() guard removed, NODE_ENV=test behavior branch removed

Tooling

ava 0.25 (36 known advisories in its tree) replaced with node:test; gulp 5 added as a devDependency for a real pipeline integration test — full tree now audits clean
yarn -> pnpm; Travis -> GitHub Actions (SHA-pinned actions; test matrix Node 20/22/24 on ubuntu + windows; publish on version tags via npm OIDC trusted publishing, gated on the Node 8/12 smoke test)

Tests: 8 -> 23

Includes: cross-process persistence round trip, disk-load of pre-existing caches, real gulp.src -> once -> gulp.dest pipeline, pollution regression, binary distinctness, shared-file merging, and error paths (streamed/null contents, throwing namespace fn, unwritable cache file).

Note for release notes: the undocumented NODE_ENV=test empty-chunk behavior was removed as a bug fix.

Before tagging: configure this repo + release.yml as a trusted publisher for gulp-once on npmjs.com. Pushing the v2.2.0 tag publishes.

## Summary Minor release. Every change preserves the existing Node >=8 runtime contract (verified by a dependency-free smoke test that CI runs on Node 8 and 12). ### Runtime fixes (`index.js`) - **Prototype pollution fixed** — checksum state lives in null-prototype records, so `__proto__` namespace/filename keys are inert (regression-tested; the old code demonstrably polluted `Object.prototype`) - **Binary-safe hashing** — contents are hashed as a Buffer; distinct binary files no longer collapse to one checksum via lossy UTF-8 decoding - **Dynamic namespace functions run for every file** (previously only the first file in a stream) - **Cache state keyed per resolved checksum file** — different files are isolated; instances sharing one file merge their writes (the documented multi-task pattern) - Atomic writes (temp + rename), structural validation of parsed cache JSON, forward-slash cache keys with read-time migration of legacy Windows keys, hash/namespace errors wrapped in `PluginError`, duplicate `isStream()` guard removed, `NODE_ENV=test` behavior branch removed ### Tooling - ava 0.25 (36 known advisories in its tree) replaced with `node:test`; gulp 5 added as a devDependency for a real pipeline integration test — full tree now audits clean - yarn -> pnpm; Travis -> GitHub Actions (SHA-pinned actions; test matrix Node 20/22/24 on ubuntu + windows; publish on version tags via npm OIDC trusted publishing, gated on the Node 8/12 smoke test) ### Tests: 8 -> 23 Includes: cross-process persistence round trip, disk-load of pre-existing caches, real `gulp.src -> once -> gulp.dest` pipeline, pollution regression, binary distinctness, shared-file merging, and error paths (streamed/null contents, throwing namespace fn, unwritable cache file). > Note for release notes: the undocumented `NODE_ENV=test` empty-chunk behavior was removed as a bug fix. > > Before tagging: configure this repo + `release.yml` as a trusted publisher for `gulp-once` on npmjs.com. Pushing the `v2.2.0` tag publishes.