Mini-racer

Latest version: v0.12.3

Safety actively analyzes 633355 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 1 of 6

0.12.3

- Fix potential hang if JavaScript calls a function produced by `wrap_py_function` while
we're tearing it down.

0.12.2

- Add optional context manager and `.close()` semantics to Python `MiniRacer` class.

- Fixed a potential hang on MiniRacer teardown if MiniRacer is executing a microtask
which loops infinitely.

- Switch C++ side of MiniRacer to a more straightforward object lifecycle management
model.

0.12.1

- Update to V8 12.4. This includes fixes for CVE-2024-3159, CVE-2024-3156, and
CVE-2024-2625. These vulnerabilities in V8 would impact PyMiniRacer users who are
running untrusted and adversarial JavaScript code.

0.12.0

Not secure
- Added support for installing callbacks from JS back into Python, using
MiniRacer.wrap_py_function.

- Refactored the Python implementation into many internal files. This should mostly not
present a breaking change, except for code which reaches into internal
(`_`-prefixed) variables.

0.11.1

Not secure
- Fixed Python crash on long-running microtasks, introduced in v0.8.1 (before which
long-running microtasks would probably not run at all).

- Fixed memory leak on the exception object reported when an `eval` times out.

- Hardened the memory management of JS value interchange, context tracking, and
asynchronous task tracking between C++ and Python.

- Added exhaustive typing (now with a MyPy pre-commit to verify!)

- Added a test asserting that [the v8 sandbox](https://v8.dev/blog/sandbox) is enabled
on all platforms we build wheels for.

0.11.0

Not secure
- Added a `MutableMapping` (`dict`-like) interface for all derivatives of JS Objects,
and a `MutableSequence` (`list`-like) interface for JS Arrays. You can now use
Pythonic idioms to read and write Object properties and Array elements in Python,
including recursively (i.e., you can read Objects embedded in other objects, and
embed your own).

- Added ability to directly call `JSFunction` objects from Python. E.g.,
`mr.eval("a => a*a")(4)` parses the given number-squaring code into a function,
returns a handle to that function to Python, calls it with the number `4`, and
recieves the result of `16`.

- Added a `JSUndefined` Python object to model JavaScript `undefined`. This is needed to
properly implement the above interface for reading Object and Array elements.
*Unfortunately, this may present a breaking change for users who assume JavaScript
`undefined` is modeled as Python `None`.*

- Removed an old optimization for `eval` on simple no-argument function calls (i.e.,
`myfunc()`). The optimization only delivered about a 17% speedup on no-op calls (and
helped relatively *less* on calls which actually did work), and for the purpose of
optimizing repeated calls to the same function, it's now redundant with extracting
and calling the function from Python, e.g., `mr.eval("myfunc")()`.

- Hardening (meaning "fixing potential but not-yet-seen bugs") related to freeing
`BinaryValue` instances (which convey data from C++ to Python).

- More hardening related to race conditions on teardown of the `MiniRacer` object in the
unlikely condition that `eval` operations are still executing on the C++ side, and
abandoned on the Python side, when Python attempts to garbage collect the
`MiniRacer` object.

Page 1 of 6

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.