@php-wasm/universal - npm Package Compare versions

Comparing version 3.1.5 to 3.1.8

lib/api.d.ts

@@ -22,1 +22,18 @@ import { releaseProxy, type NodeEndpoint as NodeWorker, type Remote, type IsomorphicMessagePort, type ProxyMethods } from './comlink-sync';
 export declare function exposeSyncAPI<Methods>(apiMethods: Methods, port: IsomorphicMessagePort): Promise<[() => void, (e: Error) => void, Methods]>;
+/**
+ * Bridges a ReadableStream to a MessagePort by reading chunks and posting
+ * messages to the port. Used as a fallback when transferable streams are not
+ * supported (e.g., Safari).
+ *
+ * Protocol of the returned MessagePort:
+ *
+ *   { t: 'chunk', b: ArrayBuffer } – next binary chunk
+ *   { t: 'close' }                 – end of stream
+ *   { t: 'error', m: string }      – terminal error
+ */
+export declare function streamToPort(stream: ReadableStream<Uint8Array>): MessagePort;
+/**
+ * Reconstructs a ReadableStream from a MessagePort using the inverse of the
+ * streamToPort protocol. Each message enqueues data, closes, or errors.
+ */
+export declare function portToStream(port: MessagePort): ReadableStream<Uint8Array>;

lib/php-response.d.ts

@@ -41,3 +41,3 @@ export interface PHPResponseData {
     readonly exitCode: Promise<number>;
-    private parsedHeaders;
+    private cachedParsedHeaders;
     private cachedStdoutBytes;
@@ -44,0 +44,0 @@ private cachedStderrText;

lib/proxy-file-system.d.ts

@@ -12,2 +12,6 @@ import type { PHP } from './php';
  *
+ * Mounts are registered via php.mount() so they survive runtime rotation.
+ * When the replica's WASM module is hot-swapped, hotSwapPHPRuntime()
+ * re-applies these mount handlers on the fresh module.
+ *
  * @param sourceOfTruth - The PHP instance containing the original files
@@ -17,3 +21,3 @@ * @param replica - The PHP instance that will access files through PROXYFS
  */
-export declare function proxyFileSystem(sourceOfTruth: PHP, replica: PHP, paths: string[]): void;
+export declare function proxyFileSystem(sourceOfTruth: PHP, replica: PHP, paths: string[]): Promise<void>;
 /**
@@ -20,0 +24,0 @@ * Answers whether the given path is to a shared filesystem.

package.json

 {
   "name": "@php-wasm/universal",
-  "version": "3.1.5",
+  "version": "3.1.8",
   "description": "PHP.wasm – emscripten bindings for PHP",
@@ -40,3 +40,3 @@ "repository": {
   "license": "GPL-2.0-or-later",
-  "gitHead": "e10df5885055e97c87ce88fe5e9d8d4ac3e700da",
+  "gitHead": "ba6a9509c9db4e0b7af6f155cf31162a6b659b5f",
   "engines": {
@@ -48,7 +48,7 @@ "node": ">=20.10.0",
     "ini": "4.1.2",
-    "@php-wasm/node-polyfills": "3.1.5",
-    "@php-wasm/logger": "3.1.5",
-    "@php-wasm/util": "3.1.5",
-    "@php-wasm/stream-compression": "3.1.5",
-    "@php-wasm/progress": "3.1.5"
+    "@php-wasm/node-polyfills": "3.1.8",
+    "@php-wasm/logger": "3.1.8",
+    "@php-wasm/util": "3.1.8",
+    "@php-wasm/stream-compression": "3.1.8",
+    "@php-wasm/progress": "3.1.8"
   },
@@ -62,3 +62,2 @@ "packageManager": "npm@10.9.2",
     "@playwright/test": "1.55.1",
-    "ws": "8.18.3",
     "tmp": "0.2.5",
@@ -65,0 +64,0 @@ "form-data": "^4.0.4",

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Potential vulnerability

Supply chain risk

Initial human review suggests the presence of a vulnerability in this package. It is pending further analysis and confirmation.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1125658

0.55%

Lines of code

8305

0.57%

Number of low supply chain risk alerts

21

-32.26%

Number of medium supply chain risk alerts

2

-33.33%

Dependency changes

• + Added

  @php-wasm/logger@3.1.8
  (transitive)

• + Added

  @php-wasm/node-polyfills@3.1.8
  (transitive)

• + Added

  @php-wasm/progress@3.1.8
  (transitive)

• + Added

  @php-wasm/stream-compression@3.1.8
  (transitive)

• + Added

  @php-wasm/util@3.1.8
  (transitive)

• - Removed

  @php-wasm/logger@3.1.5
  (transitive)

• - Removed

  @php-wasm/node-polyfills@3.1.5
  (transitive)

• - Removed

  @php-wasm/progress@3.1.5
  (transitive)

• - Removed

  @php-wasm/stream-compression@3.1.5
  (transitive)

• - Removed

  @php-wasm/util@3.1.5
  (transitive)

• Updated

  @php-wasm/logger@3.1.8

• Updated

  @php-wasm/node-polyfills@3.1.8

• Updated

  @php-wasm/progress@3.1.8

• Updated

  @php-wasm/stream-compression@3.1.8

• Updated

  @php-wasm/util@3.1.8