LavaMoat

No entries match these filters. Clear filters

1. webpack-v3.0.0 Sep 25, 2026 · release notes

   Webpack v3.0 introduces new @endo/parser-pipeline for node and updates the generatePolicy() API return structure.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch webpack-v3.0.0 https://github.com/lavamoat/lavamoat.git
   # already have the repo? check out this version:
   $ git checkout webpack-v3.0.0

   └──▷ USE IT
   Consume the updated policy object from generatePolicy in your node code.
   code copy

   const { policy, hasWarnings } = await generatePolicy();

   Write a policy to disk using the new dedicated function introduced in this release.
   code copy

   import { writePolicy } from '@lavamoat/node';
   writePolicy(policy);

   • node: use @endo/parser-pipeline

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !generatePolicy() no longer accepts write/writableFs options.
2. types-v2.0.0 Sep 25, 2026 · release notes

   LavaMoat v2.0.0 expands LavaMoatPolicy.include and other breaking changes

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch types-v2.0.0 https://github.com/lavamoat/lavamoat.git
   # already have the repo? check out this version:
   $ git checkout types-v2.0.0

   • Expands the LavaMoatPolicy.include field to allow more granular policy matching.

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !The LavaMoatPolicy.include structure has been expanded; existing configs may need updates.
3. types-v2.0.0 Sep 25, 2026 · issue 085

   LavaMoat types v2.0.0 expands LavaMoatPolicy.include with a breaking change to its shape.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch types-v2.0.0 https://github.com/LavaMoat/LavaMoat.git
   # already have the repo? check out this version:
   $ git checkout types-v2.0.0

   • Expands LavaMoatPolicy.include to support a wider set of values in the LavaMoat policy type definitions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !The shape of LavaMoatPolicy.include has changed — existing code typed against the old LavaMoatPolicy.include definition may no longer type-check and will require updates.
4. react-native-lockdown-v3.0.0 Sep 25, 2026 · release notes

   react-native-lockdown v3.0.0 introduces writePolicy import and API changes to generatePolicy() via @endo/parser-pipeline

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch react-native-lockdown-v3.0.0 https://github.com/lavamoat/lavamoat.git
   # already have the repo? check out this version:
   $ git checkout react-native-lockdown-v3.0.0

   └──▷ USE IT
   Migrate programmatic policy generation to capture warnings and separate write logic.
   shell copy

   const { generatePolicy, writePolicy } = require('@lavamoat/node');
   async function main() {
     const { policy, hasWarnings } = await generatePolicy();
     if (hasWarnings) console.warn('Policy generation had warnings');
     await writePolicy(policy);
   }

   • Introduces writePolicy import from @lavamoat/node for explicit policy disk writes, separating concerns from generation.
   • Switches internal parsing to use @endo/parser-pipeline.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !generatePolicy() now resolves with { policy: LavaMoatPolicy, hasWarnings: boolean } instead of a LavaMoatPolicy directly; destructure policy from the result.
   • !generatePolicy() no longer accepts write or writableFs options.
5. react-native-lockdown-v3.0.0 Sep 25, 2026 · issue 085

   LavaMoat react-native-lockdown v3.0.0 adopts @endo/parser-pipeline and splits generatePolicy() into separate generate and write steps⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch react-native-lockdown-v3.0.0 https://github.com/LavaMoat/LavaMoat.git
   # already have the repo? check out this version:
   $ git checkout react-native-lockdown-v3.0.0

   • Adds writePolicy export from @lavamoat/node to write a policy to disk, separate from generatePolicy().⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Switches @lavamoat/node to use @endo/parser-pipeline for module parsing.
   • Adds writePolicy export from @lavamoat/node to write a policy to disk, separate from generatePolicy().⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !generatePolicy() in @lavamoat/node now resolves with { policy: LavaMoatPolicy, hasWarnings: boolean } instead of a bare LavaMoatPolicy; callers must destructure policy from the result.
   • !generatePolicy() in @lavamoat/node no longer accepts write or writableFs options and no longer writes policy to disk; use the new writePolicy import from @lavamoat/node instead.
6. node-v2.0.0 Sep 25, 2026 · release notes

   LavaMoat v2 adds location-based includes and changes generatePolicy() API

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch node-v2.0.0 https://github.com/lavamoat/lavamoat.git
   # already have the repo? check out this version:
   $ git checkout node-v2.0.0

   • Adds support for location-based includes in @lavamoat/node
   • Exports a new writePolicy function from @lavamoat/node for writing policies to disk

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !generatePolicy() no longer accepts write or writableFs options
   • !generatePolicy() no longer writes policy to disk automatically; use the new writePolicy function instead
   • !The return value of generatePolicy() has changed: destructure policy from the resolved object { policy, hasWarnings }
7. node-v2.0.0 Sep 25, 2026 · issue 085

   LavaMoat Node 2.0 adds location-based policy includes, a new writePolicy export, and switches to @endo/parser-pipeline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch node-v2.0.0 https://github.com/LavaMoat/LavaMoat.git
   # already have the repo? check out this version:
   $ git checkout node-v2.0.0

   └──▷ BREAKING ON UPGRADE

   • !generatePolicy() now resolves with { policy: LavaMoatPolicy, hasWarnings: boolean } instead of a bare LavaMoatPolicy — callers must destructure policy from the resolved object.
   • !generatePolicy() no longer accepts write or writableFs options and no longer writes policy to disk; use writePolicy imported from @lavamoat/node instead.
8. harden-v0.8.0 Sep 25, 2026 · release notes

   LavaMoat v0.8.0 extends script configs for granular hardening rules.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch harden-v0.8.0 https://github.com/lavamoat/lavamoat.git
   # already have the repo? check out this version:
   $ git checkout harden-v0.8.0

   • Extends the scripts configuration block in package.json to allow per-script hardening options such as network and file-system access control.

   1 detail in Everything

9. harden-v0.8.0 Sep 25, 2026 · issue 085

   LavaMoat harden v0.8.0 extends script configs for tighter supply chain control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch harden-v0.8.0 https://github.com/LavaMoat/LavaMoat.git
   # already have the repo? check out this version:
   $ git checkout harden-v0.8.0

   • Extends script configs in the harden package, expanding the configuration surface available for controlling how scripts are hardened.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

10. lavamoat-core-v19.0.0 Sep 25, 2026 · release notes

    lavamoat-core-v19.0.0 adds policy override compact function and expanded LavaMoatPolicy.include support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v19.0.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v19.0.0

    • @lavamoat/node generatePolicy() now returns { policy: LavaMoatPolicy, hasWarnings: boolean } instead of resolving directly to LavaMoatPolicy.
    • writePolicy imported from @lavamoat/node replaces the removed write/writableFs options for writing policies to disk.
    • Exposes policy override compact function for use in custom workflows.
    • Supports expanded LavaMoatPolicy.include patterns.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !generatePolicy() no longer accepts write or writableFs options; use the new writePolicy export instead to write policies to disk.
    • !Destructure policy from the object returned by generatePolicy(); it no longer resolves directly to a LavaMoatPolicy.
11. lavamoat-core-v19.0.0 Sep 25, 2026 · issue 085

    lavamoat-core v19 expands LavaMoatPolicy.include, exposes policy-override compact function, and adopts @endo/parser-pipeline⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v19.0.0 https://github.com/LavaMoat/LavaMoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v19.0.0

    └──▷ USE IT
    Generate a policy and check for warnings before writing it to disk — required migration pattern after the generatePolicy() API change.
    javascript copy

    import { generatePolicy, writePolicy } from '@lavamoat/node';
    
    const { policy, hasWarnings } = await generatePolicy({ projectRoot: '.' });
    if (hasWarnings) console.warn('Policy generated with warnings');
    await writePolicy({ policy, policyPath: './lavamoat/node/policy.json' });

    └──▷ BREAKING ON UPGRADE

    • !generatePolicy() in @lavamoat/node now resolves with { policy: LavaMoatPolicy, hasWarnings: boolean } instead of a bare LavaMoatPolicy — callers must destructure policy from the result.
    • !generatePolicy() no longer accepts write or writableFs options and will not write policy to disk; migrate to writePolicy imported from @lavamoat/node.
    • !LavaMoatPolicy.include has an expanded schema — existing policy files using the previous include format may need to be updated.
12. webpack-v2.3.0 Sep 3, 2026 · release notes

    webpack-v2.3.0 adds opt-in overwrite flag and captures importScripts references for runtime use

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v2.3.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v2.3.0

    └──▷ TRY IT
    Allow a specific build to bypass existing policy restrictions by writing overrides directly.
    copy

    $ lavamoat --overwrite ./path/to/overrides.json

    • Adds --overwrite flag to allow policy.json to be overwritten with overrides
    • Webpack integration now captures importScripts references for use in runtime despite scuttling

    2 details in Everything

13. webpack-v2.3.0 Sep 3, 2026 · issue 064

    LavaMoat webpack plugin gains a policy-overwrite opt-in flag and scuttling-safe importScripts capture.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v2.3.0 https://github.com/LavaMoat/LavaMoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v2.3.0

    • Adds opt-in flag to overwrite policy.json with overrides, enabling automated policy regeneration workflows.
    • Captures importScripts reference for use in the webpack runtime even when scuttling is enabled, unblocking Web Worker builds that rely on importScripts.

    2 details in Everything

14. node-v1.1.0 Sep 3, 2026 · release notes

    LavaMoat node v1.1.0 introduces the new @lavamoat/harden package.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch node-v1.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout node-v1.1.0

15. harden-v0.7.0 Sep 3, 2026 · release notes

    LavaMoat harden v0.7.0 adds JSON output via --json flag and prefix-based scriptsConfig wildcard matching

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch harden-v0.7.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout harden-v0.7.0

    └──▷ USE IT
    Get JSON output from hardening process for CI parsing
    shell copy

    npx lavamoat --harden --json

    • Adds --json option to harden command for machine-readable output
    • Enables prefix-based wildcard matching in the runner scriptsConfig configuration

    2 details in Everything

16. harden-v0.7.0 Sep 3, 2026 · issue 064

    LavaMoat harden adds a --json check option and wildcard prefix matching for runner scriptsConfig

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch harden-v0.7.0 https://github.com/LavaMoat/LavaMoat.git
    # already have the repo? check out this version:
    $ git checkout harden-v0.7.0

    └──▷ TRY IT
    Output harden check results as JSON for ingestion into a CI pipeline or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents..
    copy

    $ harden check --json

    • Adds --json option to the harden check command for machine-readable output.
    • Adds wildcard prefix matching for scriptsConfig entries in the harden runner, allowing glob-style script name patterns.

    2 details in Everything

17. docs update Aug 19, 2026 · issue 050

    LavaMoat adds scriptsConfig to assign Node.js permission profiles per package.json script, enforcing least-privilege on build, test, and release commands.

    └──▷ USE IT
    Security-first setup: lock most scripts to the strict profile and carve out explicit exceptions for build and release commands.
    package.json copy

    {
      "scripts": {
        "lint": "eslint .",
        "test": "ava",
        "build": "vite build",
        "release": "node scripts/release.mjs"
      },
      "scriptsConfig": {
        "#default": "lavamoat/scripts.strict.json",
        "build": "lavamoat/scripts.loose.json",
        "release": "lavamoat/scripts.release.json"
      }
    }

    Allow a composing or highly privileged script to run without any Node.js permission restrictions by pointing it at a null profile.
    lavamoat/scripts.null.json copy

    {
      "NODE_OPTIONS": {}
    }

    • Adds scriptsConfig key to package.json that maps each script name to a JSON file containing NODE_OPTIONS permission flags, letting you assign distinct Node.js permission profiles to lint, test, build, release, and other scripts individually.
    • Introduces #default key in scriptsConfig to set a fallback permission profile for all scripts not explicitly listed, supporting both security-first (strict default) and compatibility-first (no default) strategies.
    • Ships two starter permission profiles — lavamoat/scripts.strict.json (read/write ./, no network, no native modules) and lavamoat/scripts.loose.json (broad file reads, temp-dir writes, child processes and native addons allowed, no network) — auto-generated when script hardening is enabled.
    • Supports a null profile (lavamoat/scripts.null.json with { "NODE_OPTIONS": {} }) to explicitly opt a script out of all permission restrictions.
    • Adds --allow-fs-tmp extension to the Node.js permission model, granting write access to the OS temporary directory without requiring a hardcoded platform-specific path.

    +2 more show less

    • Applies permission profiles by injecting NODE_OPTIONS at script-launch time via package manager hooks — intercepting the shell for npm and pnpm, and using the wrapScriptExecution hook for yarn — requiring no changes to script code itself.
    • Note: node --run is not currently supported; permission flags will not be applied when scripts are invoked via node --run.

    7 details in Everything

18. docs update Aug 19, 2026 · issue 050

    @lavamoat/harden CLI applies opinionated security hardening to npm/yarn/pnpm project configs via three commands: defaults, wizard, and check.

    └──▷ TRY IT
    Run in CI to verify a project meets moderate hardening without changing any files — fails the build if gaps exist.
    copy

    $ harden check --level moderate

    Capture a team's agreed hardening decisions once, then replay them deterministically in CI or onboarding without re-running the interactive wizard.
    copy

    $ harden wizard -s
    harden defaults -d ./decisions-snapshot.json

    • New harden defaults command writes hardening config at a chosen level (baseline, moderate, strict) into .npmrc, .yarnrc.yml, pnpm-workspace.yaml, and package.json; accepts --level (-l) and --package-manager (-p) flags.
    • New harden check command audits the current package manager config against a hardening level without modifying files, printing a pass/fail checklist and exiting with code 0 (all satisfied) or 1 (gaps found) — designed for CI enforcement.
    • New harden wizard command interactively walks through hardening decisions and applies only the settings the user selects, with optional --package-manager (-p) pre-selection.
    • New --decisions-snapshot (-d) flag loads a JSON file of saved hardening decisions to pre-fill the wizard or override level-based defaults in defaults; --save-decisions (-s) writes the result to ./decisions-snapshot.json for reuse.
    • Adds a lavamoat/.env.ban.json file to censor environment variables by name pattern during package.json script execution.

    +4 more show less

    • Adds a scriptsConfig field to package.json to assign per-script Node.js Permissions option files, with a #default fallback, hardening the script execution environment.
    • Supports npm v11.18+, Yarn v4.16+, and pnpm v11+ as target package managers, enforcing minimum versions that unlock security-relevant features such as --ignore-scripts support and git dependency limits.
    • Integrates @lavamoat/allow-scripts for precise per-package, version-pinned lifecycle script allowlisting under yarn (requires node_modules layout instead of Plug'n'Play).
    • Includes pnpm's trustPolicy: no-downgrade and package-manager-specific age gates and git dependency limitations at the baseline level and above.

    9 details in Everything

19. docs update Aug 19, 2026 · issue 050

    @lavamoat/harden CLI applies opinionated security hardening to npm/yarn/pnpm configs via harden defaults, harden wizard, and harden check commands.

    └──▷ TRY IT
    Enforce a strict hardening baseline in CI — fails the build if any strict-level opinions are not satisfied.
    copy

    $ harden check --level strict

    Capture wizard decisions once and replay them non-interactively across all developer machines or pipelines.
    copy

    $ harden wizard -s
    harden defaults -d ./decisions-snapshot.json

    Apply baseline hardening explicitly to a yarn project without relying on package manager auto-detection.
    copy

    $ harden defaults -p yarn --level baseline

    • Adds harden defaults --level <level> command to write hardening config into .npmrc, .yarnrc.yml, pnpm-workspace.yaml, and package.json at baseline, moderate, or strict levels without manual edits.
    • Adds --package-manager (-p) flag to harden defaults and harden check to explicitly target npm, yarn, or pnpm instead of relying on auto-detection.
    • Adds --decisions-snapshot (-d) flag to load a JSON file of saved hardening decisions, and --save-decisions (-s) to write the final choices to ./decisions-snapshot.json for reuse across teams or CI.
    • Adds harden check --level <level> command that audits the current package manager config against a hardening level and exits with code 0 (all satisfied) or 1 (gaps found) — suitable for CI enforcement.
    • Adds harden wizard interactive command that assesses the project and lets practitioners selectively apply hardening settings by answering prompts, with optional decisions snapshot pre-fill via -d.

    +4 more show less

    • Introduces a lavamoat/.env.ban.json file for censoring environment variables by name pattern during package.json script execution.
    • Adds a scriptsConfig field in package.json for selecting per-script Node.js Permissions option files, with a #default fallback, to restrict runtime access during script execution.
    • Enforces minimum package manager versions (npm v11.18+, Yarn v4.16+, pnpm v11+) to guarantee availability of security-relevant features such as --ignore-scripts support and git dependency limits.
    • Rearranges $PATH during script execution to mitigate bin confusion attacks.

    9 details in Everything

20. allow-scripts-v5.1.0 Jun 25, 2026 · release notes

    allow-scripts gains a check command to detect stale allow-lists in CI pipelines.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch allow-scripts-v5.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout allow-scripts-v5.1.0

    └──▷ TRY IT
    Run in CI to fail fast if the allow-scripts config no longer matches installed packages.
    copy

    $ npx allow-scripts check

    • New check command warns when the allow-scripts configuration is out of date, enabling CI to catch unapproved lifecycle script changes before they reach production.

    1 detail in Everything

21. allow-scripts-v5.1.0 Jun 25, 2026 · issue 014

    allow-scripts gains a check command to detect stale allow-lists in CI without making changes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch allow-scripts-v5.1.0 https://github.com/LavaMoat/LavaMoat.git
    # already have the repo? check out this version:
    $ git checkout allow-scripts-v5.1.0

    └──▷ TRY IT
    Catch unapproved or newly-added install scripts in CI before they can run — fails with a warning instead of silently passing.
    copy

    $ npx @lavamoat/allow-scripts check

    • Adds a check command that warns when the allow-scripts configuration is out of date, designed for use in CI pipelines without modifying any files.

    1 detail in Everything

22. webpack-v2.2.0 Apr 22, 2026 · release notes

    LavaMoat webpack plugin gains sourcemap-preserving evasive transforms for easier debugging of hardened bundles.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v2.2.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v2.2.0

    • Adds sourcemap-preserving evasive transforms, keeping source maps intact after LavaMoat's security-oriented code transformations.

    1 detail in Everything

23. lavamoat-v11.1.0 Apr 15, 2026 · release notes

    lavamoat-node gains opt-in modernized module resolution for classic mode

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-v11.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-v11.1.0

24. laverna-v2.1.0 Apr 15, 2026 · release notes

    Laverna v2.1.0 adds Yarn support for automated LavaMoat policy publishing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch laverna-v2.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout laverna-v2.1.0

    • Supports Yarn as a package manager alongside the existing npm support.

    1 detail in Everything

25. allow-scripts-v5.0.0 Apr 15, 2026 · release notes

    allow-scripts v5 pins install scripts to exact versions by default, tightening supply-chain control.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch allow-scripts-v5.0.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout allow-scripts-v5.0.0

    • Install scripts are now pinned to specific package versions, preventing allowlisted scripts from running under unintended versions.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !allow-scripts no longer matches a lower version against an allowed entry — version pinning is now exact, so existing allowlist entries that relied on lower-version matching will stop working.
    • !allow-scripts defaults to pinning versions; upgrading requires a migration action to update existing allowlist configuration.
26. webpack-v2.1.0 Apr 2, 2026 · release notes

    LavaMoat webpack plugin now auto-overrides unsafe devtool settings that break LavaMoat's security guarantees.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v2.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v2.1.0

    • Automatically overrides the webpack devtool setting when it is likely to break LavaMoat, preventing silent security misconfigurations.

    1 detail in Everything

27. types-v1.0.0 Mar 20, 2026 · release notes

    LavaMoat types v1.0.0 adds include property to the LavaMoatPolicy type.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch types-v1.0.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout types-v1.0.0

    └──▷ BREAKING ON UPGRADE

    • !Node.js v18 is no longer supported; upgrading will break installations running on Node.js v18.
28. node-v1.0.0 Mar 20, 2026 · release notes

    LavaMoat Node 1.0.0 adds parallel module inspection and major Node.js compatibility updates.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch node-v1.0.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout node-v1.0.0

    • Adds parallel module inspection, speeding up policy generation for large dependency trees.
    • Major compatibility changes bringing LavaMoat Node to a stable 1.0 release.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Node.js v18 is no longer supported; upgrade to Node.js v20 or later before upgrading this package.
29. lavamoat-core-v18.0.0 Mar 20, 2026 · release notes

    lavamoat-core v18 exports the MODULE_REFS constant for programmatic policy inspection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v18.0.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v18.0.0

    └──▷ USE IT
    Import MODULE_REFS to reference canonical module identifier keys when building or inspecting LavaMoat policies programmatically.
    javascript copy

    import { MODULE_REFS } from 'lavamoat-core'
    
    // Use MODULE_REFS to look up entries in a generated policy
    const ref = MODULE_REFS.some_key
    console.log(policy.resources[ref])

    └──▷ BREAKING ON UPGRADE

    • !Node.js v18 is no longer supported; upgrading requires Node.js v20 or later.
30. lavamoat-v10.1.0 Jan 20, 2026 · release notes

    LavaMoat Node now returns the top-level export as the return value of runLava

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-v10.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-v10.1.0

31. lavamoat-tofu-v8.1.0 Nov 19, 2025 · release notes

    lavamoat-tofu 8.1.0 adds deep ES module dependency analysis and informative policy-merge error messages.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-tofu-v8.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-tofu-v8.1.0

    • Enables deep dependency analysis of ES modules, allowing tofu to traverse transitive ES module imports when generating policies.
    • Adds informative errors when a policy merge produces invalid entries, surfacing actionable diagnostics instead of silent failures.

    2 details in Everything

32. lavamoat-core-v17.1.0 Nov 19, 2025 · release notes

    LavaMoat Core 17.1.0 adds informative errors when policy merge produces invalid entries.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v17.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v17.1.0

33. webpack-v1.5.0 Oct 1, 2025 · release notes

    LavaMoat webpack plugin adds a meta field to policy resources to surface webpack optimization info.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v1.5.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v1.5.0

    • Adds a meta field to policy resource entries, recording webpack optimization data (e.g. sideEffect tree-shaking) for each module.

    1 detail in Everything

34. types-v0.1.0 Oct 1, 2025 · release notes

    LavaMoat types v0.1.0 adds a meta field to policy resources for surfacing webpack optimization reports.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch types-v0.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout types-v0.1.0

    • Adds a meta field to the policy resource type, enabling webpack optimization data to be reported alongside policy entries.

    1 detail in Everything

35. webpack-v1.4.0 Sep 25, 2025 · release notes

    LavaMoat webpack plugin officially releases scuttling support and adds tree-shake-safe policy enforcement.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v1.4.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v1.4.0

    └──▷ USE IT
    Enable scuttling in your webpack build to lock down global object access at runtime, preventing supply-chain attacks from abusing globals.
    javascript copy

    // webpack.config.js
    const { LavaMoatPlugin } = require('@lavamoat/webpack');
    
    module.exports = {
      plugins: [
        new LavaMoatPlugin({
          scuttling: true,
        }),
      ],
    };

    • Officially releases and documents the scuttling feature in the webpack plugin, enabling runtime lockdown of global object access for bundled code.

    1 detail in Everything

36. lavamoat-core-v16.7.0 Sep 25, 2025 · release notes

    LavaMoat webpack plugin now officially supports scuttling with documentation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v16.7.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v16.7.0

37. allow-scripts-v3.4.0 Sep 25, 2025 · release notes

    allow-scripts now recommends global installation for simpler, project-wide lifecycle script control.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch allow-scripts-v3.4.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout allow-scripts-v3.4.0

    • Supports global installation of allow-scripts as the recommended usage pattern, enabling consistent lifecycle script enforcement across projects without per-project setup.

    1 detail in Everything

38. webpack-v1.3.0 Sep 16, 2025 · release notes

    LavaMoat webpack plugin v1.3.0 adds generatePolicyOnly mode, null runtime support, and per-chunk runtime configuration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v1.3.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v1.3.0

    └──▷ USE IT
    Generate a LavaMoat policy file during CI without applying sandbox protections — lets you audit or commit the policy separately from the production build.
    javascript copy

    // webpack.config.js
    const { LavaMoatPlugin } = require('@lavamoat/webpack');
    
    module.exports = {
      plugins: [
        new LavaMoatPlugin({
          generatePolicyOnly: true,
        }),
      ],
    };

    Embed different LavaMoat runtime options per chunk — useful when entry points have different trust boundaries or performance requirements.
    javascript copy

    // webpack.config.js
    const { LavaMoatPlugin } = require('@lavamoat/webpack');
    
    module.exports = {
      plugins: [
        new LavaMoatPlugin({
          runtimeConfigurationPerChunk_experimental: {
            main: { trustRoot: true },
            vendor: { trustRoot: false },
          },
        }),
      ],
    };

    • Adds generatePolicyOnly option to run the plugin in policy-generation mode without applying protections, useful for CI policy auditing without a full build.
    • Adds null runtime support, enabling LavaMoat to work in webpack configurations that use no runtime chunk.
    • Adds runtimeConfigurationPerChunk_experimental option to embed and control LavaMoat runtime options on a per-chunk basis.
    • Adds static shims for the webpack runtime, reducing reliance on dynamic runtime injection.
    • Emits explicit error messages when a webpack compilation completes with no modules protected, surfacing misconfiguration early.

    5 details in Everything

39. lavamoat-core-v16.6.0 Sep 16, 2025 · release notes

    LavaMoat Core 16.6.0 adds Firefox content-script support for cross-realm window prototypes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v16.6.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v16.6.0

40. webpack-v1.2.0 Aug 25, 2025 · release notes

    LavaMoat webpack plugin gains improved handling for globals requiring more than a simple unwrap from core.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v1.2.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v1.2.0

    • Adds support for globals that require more complex handling beyond a simple unwrap from lavamoat-core, improving compatibility with a wider range of webpack bundles.

    1 detail in Everything

41. node-v0.4.0 Aug 25, 2025 · release notes

    LavaMoat node v0.4.0 improves git-safe resilience against network and git instability.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch node-v0.4.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout node-v0.4.0

    • Increases resilience of git-safe against adverse network conditions and git edge cases.

    1 detail in Everything

42. git-safe-dependencies-v0.3.0 Aug 25, 2025 · release notes

    git-safe-dependencies v0.3.0 increases resilience against network conditions and git issues.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch git-safe-dependencies-v0.3.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout git-safe-dependencies-v0.3.0

    • Improves resilience against network conditions and git failures when verifying safe dependencies.

    1 detail in Everything

43. react-native-lockdown-v0.1.0 Jul 30, 2025 · release notes

    react-native-lockdown bumps to SES 1.14.0 for hardened JavaScript in React Native apps.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch react-native-lockdown-v0.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout react-native-lockdown-v0.1.0

    • Upgrades bundled SES (Hardened JavaScript) runtime to v1.14.0, bringing its latest compartment isolation and intrinsic hardening to React Native.

    1 detail in Everything

44. webpack-v1.1.0 Jul 30, 2025 · release notes

    LavaMoat webpack plugin v1.1.0 shields the webpack runtime from scuttling and ships proper TypeScript types.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v1.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v1.1.0

    • Defends the webpack runtime from scuttling, preventing untrusted code from corrupting webpack's own globals at runtime.
    • Exposes proper TypeScript types for the LavaMoat webpack plugin, enabling typed configuration in TS projects.

    2 details in Everything

45. webpack-v1.0.0 Jun 24, 2025 · release notes

    LavaMoat webpack plugin hits v1.0.0 with scuttling, lazy-chunk protection, context-module support, and hardened defaults.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v1.0.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v1.0.0

    └──▷ USE IT
    Harden a webpack bundle by enabling scuttling to prevent dependency packages from accessing or mutating privileged globals.
    javascript copy

    // webpack.config.js
    const LavaMoatPlugin = require('@lavamoat/webpack');
    
    module.exports = {
      plugins: [
        new LavaMoatPlugin({
          scuttling: true,
        }),
      ],
    };

    Opt a legacy or third-party chunk out of LavaMoat protection while the rest of the bundle stays hardened.
    javascript copy

    // webpack.config.js
    const LavaMoatPlugin = require('@lavamoat/webpack');
    
    module.exports = {
      plugins: [
        new LavaMoatPlugin({
          unlockedChunksUnsafe: ['legacy-vendor'],
        }),
      ],
    };

    Experiment with dynamic require / context modules under LavaMoat without leaving them fully unguarded.
    javascript copy

    // webpack.config.js
    const LavaMoatPlugin = require('@lavamoat/webpack');
    
    module.exports = {
      plugins: [
        new LavaMoatPlugin({
          __unsafeAllowContextModules: true,
        }),
      ],
    };

    • Adds scuttling support (scuttling option) to lock down global object properties in webpack bundles at runtime.
    • New unlockedChunksUnsafe option lets teams selectively opt specific chunks out of LavaMoat protection for incremental adoption.
    • Supports webpack context modules and chunk lazy-loading, enabling policy enforcement on dynamically imported code.
    • Adds experimental __unsafeAllowContextModules flag to test context-module scenarios without leaving them fully unprotected.
    • Enables syntax checks by default, running validation before module concatenation to catch policy-breaking code earlier.

    +2 more show less

    • Suppresses resource asset emission from packages by default, reducing unintended file exposure in build output.
    • New policy debugging capabilities for inspecting and testing generated LavaMoat policies.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecated lockdown options have been removed from @lavamoat/webpack and lavamoat-core; configurations using those options will break on upgrade.
46. react-native-lockdown-v0.0.1 Jun 24, 2025 · release notes

    New @lavamoat/react-native-lockdown beta brings SES-based runtime hardening to React Native apps.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch react-native-lockdown-v0.0.1 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout react-native-lockdown-v0.0.1

    • Introduces @lavamoat/react-native-lockdown, a new LavaMoat library that applies SES (Secure ECMAScript) lockdown to React Native environments.
    • Ships with a vendored SES build, making the lockdown self-contained without relying on an external SES package.

    2 details in Everything

47. node-v0.3.0 Jun 24, 2025 · release notes

    LavaMoat Node v0.3.0 adds scuttling support and custom errors for tighter runtime sandbox control.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch node-v0.3.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout node-v0.3.0

    • Adds scuttling support, enabling LavaMoat to restrict access to powerful globals on the Node.js runtime environment.
    • Adds custom error types for more precise programmatic handling of LavaMoat policy and sandbox violations.

    2 details in Everything

48. lavamoat-core-v16.5.0 Jun 24, 2025 · release notes

    LavaMoat core adds Node.js scuttling support and relaxes scuttling to skip intrinsics, reducing false-positive lockdowns.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v16.5.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v16.5.0

    • Adds scuttling support for Node.js environments, extending runtime prototype-pollution defenses to Node targets.
    • Relaxes scuttling by skipping JavaScript intrinsics, reducing breakage when hardening globals without affecting built-in objects.

    2 details in Everything

49. node-v0.2.0 May 5, 2025 · release notes

    LavaMoat Node v0.2.0 adds support for running untrusted entrypoints under policy enforcement.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch node-v0.2.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout node-v0.2.0

    • Supports untrusted entrypoints, allowing policy enforcement to apply even when the application entry script itself is not fully trusted.

    1 detail in Everything

50. lavamoat-core-v16.4.0 May 5, 2025 · release notes

    LavaMoat Core 16.4.0 adds a redefine global policy value and support for untrusted entrypoints.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v16.4.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v16.4.0

    └──▷ USE IT
    Grant a package the ability to redefine a global (e.g. fetch) rather than merely reading it, using the new "redefine" policy value.
    json copy

    {
      "resources": {
        "some-package": {
          "globals": {
            "fetch": "redefine"
          }
        }
      }
    }

    • Adds "redefine" as a new global policy value in the LavaMoat policy schema, giving policy authors finer-grained control over how globals are exposed to packages.
    • Supports untrusted entrypoints, allowing LavaMoat to apply compartment isolation even when the application entry module itself is not fully trusted.

    2 details in Everything

51. webpack-v0.10.0-beta.0 Prerelease May 5, 2025 · release notes

    LavaMoat webpack plugin now supports webpack context modules and chunk lazy loading.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v0.10.0-beta.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v0.10.0-beta.0

52. node-v0.1.0 Mar 11, 2025 · release notes

    LavaMoat Node v0.1.0 adds --quiet/--verbose output control and improved entrypoint UX

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch node-v0.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout node-v0.1.0

    • Adds --quiet and --verbose flags for controlling output verbosity when running LavaMoat Node.
    • Improves UX for specifying entrypoints, making it easier to define application entry in LavaMoat Node.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !dev mode is now disabled by default; setups that relied on dev mode being on by default will no longer behave the same after upgrading.
53. webpack-v0.9.0-beta.0 Prerelease Mar 11, 2025 · release notes

    LavaMoat webpack plugin v0.9.0-beta.0 adds scuttling support to harden global object access in bundled apps.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v0.9.0-beta.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v0.9.0-beta.0

    • Adds scuttling support to the webpack plugin, restricting untrusted modules from accessing or tampering with privileged globals at runtime.

    1 detail in Everything

54. node-v0.0.2 Jan 29, 2025 · release notes

    LavaMoat v0.0.2 now allows passing arbitrary flags to the Node.js entrypoint.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch node-v0.0.2 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout node-v0.0.2

55. git-safe-dependencies-v0.2.0 Jan 29, 2025 · release notes

    LavaMoat git-safe-dependencies adds a GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflow validator to catch unsafe action dependencies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch git-safe-dependencies-v0.2.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout git-safe-dependencies-v0.2.0

56. node-v0.0.1 Jan 15, 2025 · release notes

    LavaMoat introduces @lavamoat/node, a new Node.js runtime protection library.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch node-v0.0.1 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout node-v0.0.1

    • Introduces @lavamoat/node, a new LavaMoat package for applying supply-chain security policies in Node.js environments.

    1 detail in Everything

57. lavamoat-core-v16.3.0 Jan 15, 2025 · release notes

    LavaMoat Core 16.3.0 adds policy debugging capabilities to the webpack integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v16.3.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v16.3.0

58. webpack-v0.8.0-beta.0 Prerelease Jan 15, 2025 · release notes

    LavaMoat webpack plugin gains policy debugging, safer context-module experiments, and tighter resource-asset controls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v0.8.0-beta.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v0.8.0-beta.0

    └──▷ USE IT
    Opt in to context-module support during development without leaving them fully unrestricted — useful when testing dynamic require() patterns.
    javascript copy

    new LavaMoatPlugin({
      __unsafeAllowContextModules: true
    })

    • Adds __unsafeAllowContextModules flag to safely experiment with webpack context modules without leaving them exposed by default.
    • Suppresses emission of resource assets from packages by default, reducing unintended asset exposure.
    • Adds policy debugging capabilities for inspecting and troubleshooting LavaMoat policy resolution in webpack builds.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Resource assets from packages are no longer emitted by default; builds that relied on automatic resource asset emission will need to explicitly enable it.
59. git-safe-dependencies-v0.1.0 Dec 20, 2024 · release notes

    LavaMoat ships git-safe-dependencies v0.1.0, a new tool for securing git-sourced Node.js dependencies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch git-safe-dependencies-v0.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout git-safe-dependencies-v0.1.0

60. lavamoat-browserify-v18.1.0 Dec 5, 2024 · release notes

    lavamoat-browserify 18.1.0 lets you override the module resolve implementation for custom dependency resolution.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-browserify-v18.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-browserify-v18.1.0

    • Supports overriding the resolve implementation, enabling custom module resolution logic in browserify builds.

    1 detail in Everything

61. lavamoat-core-v16.2.0 Dec 5, 2024 · release notes

    LavaMoat Core 16.2.0 adds diff-friendly policy sorting and makes mergePolicy's second param explicitly optional.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v16.2.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v16.2.0

    └──▷ USE IT
    Merge a single policy without a second argument now that the param is explicitly optional.
    javascript copy

    import { mergePolicy } from 'lavamoat-core'
    
    const merged = mergePolicy(existingPolicy)

    • Sorts LavaMoat policy files in a diff-friendly way so sort order remains stable even when a dependency's path changes, reducing noisy diffs on policy updates.
    • Adds a policy sorting CLI helper to migrate existing policy files to the new cleaner sort order.
    • Makes the second parameter of mergePolicy explicitly optional, simplifying single-policy merge calls.

    3 details in Everything

62. lavamoat-core-v16.1.0 Oct 11, 2024 · release notes

    lavamoat-core now exports endowmentsToolkit from the package root for easier direct access.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v16.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v16.1.0

    └──▷ USE IT
    Access endowmentsToolkit directly from the package root instead of hunting for an internal module path.
    javascript copy

    import { endowmentsToolkit } from 'lavamoat-core'

    • Exports endowmentsToolkit directly from the lavamoat-core root, removing the need to import from a deep internal path.

    1 detail in Everything

63. webpack-v0.7.0-beta.0 Prerelease Oct 11, 2024 · release notes

    LavaMoat webpack plugin gains reconfigured lockdown inlining and thisAsExports runtime support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v0.7.0-beta.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v0.7.0-beta.0

    • Changes how inlining of SES lockdown is configured in the webpack plugin.
    • Adds support for the thisAsExports webpack runtime requirement, broadening compatibility with CommonJS modules that rely on this as their exports object.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The way inlining lockdown is configured has changed — existing plugin configuration for lockdown inlining will need to be updated to match the new interface.
64. allow-scripts-v3.3.0 Oct 11, 2024 · release notes

    allow-scripts v3.3.0 lets you configure which lifecycle events are loaded via loadAllPackageConfigurations.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch allow-scripts-v3.3.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout allow-scripts-v3.3.0

    • Supports configuring lifecycleEvents when calling loadAllPackageConfigurations, giving programmatic control over which npm lifecycle hooks are evaluated.

    1 detail in Everything

65. webpack-v0.6.0-beta.0 Prerelease Sep 11, 2024 · release notes

    LavaMoat webpack plugin adds ContextModule support and improved HMR compatibility in v0.6.0-beta.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v0.6.0-beta.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v0.6.0-beta.0

    • Supports webpack ContextModule by skipping policy enforcement for dynamic require contexts, enabling broader webpack project compatibility.
    • Handles HMR-instrumented code gracefully even when Hot Module Replacement is not enabled, preventing build errors in non-HMR setups.

    2 details in Everything

66. lavamoat-core-v16.0.0 Aug 16, 2024 · release notes

    lavamoat-core v16 adds a global store with attenuation support and consistent negative policy override handling for builtins.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v16.0.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v16.0.0

    • Adds a global store with attenuation support, enabling attenuated access to global references across LavaMoat compartments.
    • Makes makeMinimalViewOfRef usage in builtin attenuation consistent with globals for negative policy overrides, now implemented in endowmentsToolkit for reuse by the webpack plugin.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Node.js v16 is no longer supported by lavamoat-core (and lavamoat-browserify, lavamoat-node, lavamoat-perf, lavamoat-tofu, lavamoat-webpack).
67. lavamoat-browserify-v18.0.0 Aug 16, 2024 · release notes

    LavaMoat v18 drops Node.js v16 support and adds compatibility for Node.js ^22.5.1 across all packages.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-browserify-v18.0.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-browserify-v18.0.0

    • Adds support for Node.js ^22.5.1 in the node, browserify, and perf components
    • Removes support for Node.js v16 from all workspace packages (core, node, browserify, perf, tofu, webpack)

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The tool no longer runs on Node.js v16; upgrades to v18.0.0 will fail or crash on that version.
68. allow-scripts-v3.2.0 Aug 16, 2024 · release notes

    allow-scripts v3.2.0 exports new policy-loading APIs and exposes canonical name maps for programmatic use.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch allow-scripts-v3.2.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout allow-scripts-v3.2.0

    └──▷ USE IT
    Audit CI for any packages missing an allow-scripts policy entry without running the CLI directly.
    javascript copy

    const { loadAllPackageConfigurations, printMissingPoliciesIfAny } = require('@lavamoat/allow-scripts');
    
    const config = await loadAllPackageConfigurations({ rootDir: process.cwd() });
    printMissingPoliciesIfAny(config);

    Resolve canonical package names from filesystem paths when building custom policy tooling.
    javascript copy

    const { loadAllPackageContents } = require('@lavamoat/allow-scripts');
    
    const contents = await loadAllPackageContents({ rootDir: process.cwd() });
    console.log(contents.canonicalNamesByPath); // { '/path/to/node_modules/lodash': 'lodash', ... }

    • Exports loadAllPackageConfigurations and printMissingPoliciesIfAny for programmatic access to package script policies.
    • Exposes canonicalNamesByPath on the result of loadAllPackageContents for mapping install paths to canonical package names.

    2 details in Everything

69. webpack-v0.5.0-beta.0 Prerelease Aug 16, 2024 · release notes

    LavaMoat webpack plugin gains builtin attenuation by policy and a global store with attenuation support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v0.5.0-beta.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v0.5.0-beta.0

    • Adds a global store with attenuation support, enabling fine-grained control over shared global state across packages.
    • Adds built-in module support in the webpack plugin options and build-time policy generation.
    • Adds built-in module support in the webpack runtime, allowing builtins to be tracked and controlled at runtime.
    • Enables attenuation of Node.js built-in modules via LavaMoat policy in webpack bundles.
    • Supports Node.js ^22.5.1 for the webpack plugin.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Node.js v16 is no longer supported by lavamoat-webpack (or lavamoat-core, lavamoat-browserify, lavamoat-node, lavamoat-perf, or lavamoat-tofu); upgrading requires Node.js v18 or later.
70. lavamoat-tofu-v7.3.0 Jul 11, 2024 · release notes

    Lavamoat Tofu v7.3.0 adds support for Node.js 22.x

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-tofu-v7.3.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-tofu-v7.3.0

    • lavamoat-tofu-v7.3.0 extends compatibility to include Node.js 22.x

    1 detail in Everything

71. preinstall-always-fail-v2.1.0 Jul 11, 2024 · release notes

    LavaMoat v2.1.0 adds allow-scripts support for Node.js v22

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch preinstall-always-fail-v2.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout preinstall-always-fail-v2.1.0

72. laverna-v1.2.0 Jul 11, 2024 · release notes

    LavaMoat v1.2.0 adds support for Node.js v22 in the allow-scripts feature

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch laverna-v1.2.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout laverna-v1.2.0

73. lavamoat-core-v15.4.0 Jul 11, 2024 · release notes

    Lavamoat v15.4.0 adds Node.js 22 support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v15.4.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v15.4.0

    • Adds nodejs 22 runtime support to lavamoat-core

    1 detail in Everything

74. webpack-v0.4.0-beta.0 Prerelease Jul 11, 2024 · release notes

    LavaMoat webpack plugin adds lockdown inlining feature

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v0.4.0-beta.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v0.4.0-beta.0

75. allow-scripts-v3.1.0 Jul 11, 2024 · release notes

    allow-scripts-v3.1.0 now supports Node.js v22.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch allow-scripts-v3.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout allow-scripts-v3.1.0

    • Supports Node.js v22 in allow-scripts.

    1 detail in Everything

76. aa-v4.3.0 Jul 11, 2024 · release notes

    LavaMoat v4.3.0 adds support for Node.js v22

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch aa-v4.3.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout aa-v4.3.0

    • allow-scripts now supports Node.js v22

    1 detail in Everything

77. laverna-v1.1.0 Mar 26, 2024 · release notes

    LavaMoat 1.1.0 adds automatic CI support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch laverna-v1.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout laverna-v1.1.0

    • Adds automatic CI detection and configuration handling to the laverna subsystem

    1 detail in Everything

78. lavamoat-core-v15.3.0 Mar 26, 2024 · release notes

    lavamoat-core v15.3.0 adds external package name fallback function in generatePolicy

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v15.3.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v15.3.0

    • Adds externalPackageNameFallback option to generatePolicy to control how external package names are resolved when webpack's default method fails.

    1 detail in Everything

79. webpack-v0.3.0-beta.0 Prerelease Mar 26, 2024 · release notes

    LavaMoat webpack now generates external package name fallbacks in policies via generatePolicy

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v0.3.0-beta.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v0.3.0-beta.0

    └──▷ USE IT
    Configure LavaMoat to fall back to a specific name when an external package name cannot be resolved, ensuring valid policy generation.
    code copy

    const policy = generatePolicy(webpackConfig, { externalPackageNamesFallback: 'fallback-package-name' });

    • Adds generatePolicy function with externalPackageNamesFallback option to use fallback names for external packages in the generated webpack policy

    1 detail in Everything

80. aa-v4.2.0 Mar 26, 2024 · release notes

    Adds unknown package directory logging in LavaMoat aa build process

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch aa-v4.2.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout aa-v4.2.0

    • Logs unknown package directories in the error message when running lava-mocha-strict or similar aa tooling

    1 detail in Everything

81. lavamoat-core-v15.2.0 Feb 29, 2024 · release notes

    LavaMoat v15.2.0 adds ESM policy support, improved error paths, and default ses lockdown changes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v15.2.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v15.2.0

    └──▷ USE IT
    Generate a security policy for an ESM-based project that previously failed or produced incomplete coverage.
    shell copy

    lavamoat generate --esm

    • Adds ESM support in policy generation allowing Lavamoat to create policies for ECMAScript modules
    • Changes the default value of localeTaming in ses lockdown to be turned off
    • Improves error reporting by returning the attempted path when JSON policy parsing fails

    3 details in Everything

82. webpack-v0.2.0-beta.0 Prerelease Feb 29, 2024 · release notes

    LavaMoat webpack plugin adds policy generation/loading/overrides and support for __webpack_require__.g.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v0.2.0-beta.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v0.2.0-beta.0

    • Adds experimental policy generation, loading, and override support to the webpack integration.
    • Supports webpack's use of __webpack_require__.g as the global object in lockdown contexts.

    2 details in Everything

83. aa-v4.1.0 Feb 29, 2024 · release notes

    Adds custom resolver support and symlink compatibility for LavaMoat aa

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch aa-v4.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout aa-v4.1.0

    • aa now supports a customResolver option for resolving packages during installation

    1 detail in Everything

84. lavapack-v6.1.0 Feb 7, 2024 · release notes

    lavapack-v6.1.0 adds independent module syntax checking to lavapack

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavapack-v6.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavapack-v6.1.0

    • lavapack now checks the syntax of a module independently of browserify's own check

    1 detail in Everything

85. lavamoat-tofu-v7.2.0 Feb 7, 2024 · release notes

    lavamoat-tofu v7.2.0 adds ESM support for cyber tooling integration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-tofu-v7.2.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-tofu-v7.2.0

    • Add ESM support

    1 detail in Everything

86. lavamoat-tofu-v7.1.0 Jan 18, 2024 · release notes

    LavaMoat tofu v7.1.0 introduces TypeScript type definitions for improved development experience.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-tofu-v7.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-tofu-v7.1.0

    • Provides TypeScript type definitions for the tofu module to enable static analysis and IDE support

    1 detail in Everything

87. lavamoat-core-v15.1.0 Jan 18, 2024 · release notes

    lavamoat-core-v15.1.0 ships TypeScript types

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v15.1.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v15.1.0

    • lavamoat-core now ships with TypeScript type definitions.

    1 detail in Everything

88. webpack-v0.1.0-beta.0 Prerelease Nov 24, 2023 · release notes

    LavaMoat webpack plugin now emits lockdown.js to dist in v0.1.0-beta.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v0.1.0-beta.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v0.1.0-beta.0

    • webpack-v0.1.0-beta.0 adds emitting lockdown.js to the build dist directory, enabling self-contained LavaMoat execution without external runtime injection.

    1 detail in Everything

89. lavamoat-viz-v7.0.0 Oct 19, 2023 · release notes

    lavamoat-viz v7 adds Node.js 20 support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-viz-v7.0.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-viz-v7.0.0

    • node20: Adds support for Node.js 20
    • The minimum supported Node.js version is now v16.20.0

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Drop support for Node.js v14; the minimum supported version is now v16.20.0
90. lavamoat-v8.0.0 Oct 19, 2023 · release notes

    LavaMoat v8 adds overrideTaming: severe and Node.js 20 support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-v8.0.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-v8.0.0

    • Adds overrideTaming: 'severe' to improve developer experience for policy overrides
    • Drops Node.js v14 support and sets minimum supported version to v16.20.0
    • Adds Node.js 20 (v20) runtime support

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The minimum supported Node.js version is now v16.20.0, dropping support for Node.js v14
91. lavapack-v6.0.0 Oct 19, 2023 · release notes

    LavaMoat v6 adds Node.js 20 support and raises minimum supported version to 16.20.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavapack-v6.0.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavapack-v6.0.0

    └──▷ USE IT
    Ensure your project uses the LavaMoat pack compatible with modern Node.js runtimes
    shell copy

    npm install --save-dev lavamoat@lavapack-v6

    • Adds lavapack-v6 release with native Node.js 20 support via the new node20 package
    • Raises the minimum supported Node.js runtime version to v16.20.0, dropping legacy Node.js v14 compatibility

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The minimum supported Node.js version is now v16.20.0; running on Node.js v14 or lower will fail.
92. lavamoat-core-v15.0.0 Oct 19, 2023 · release notes

    lavamoat-core v15.0.0 adds overrideTaming: 'severe' and Node.js 20 support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-core-v15.0.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-core-v15.0.0

    • Adds overrideTaming: 'severe' to lavamoat config for improved developer experience

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The minimum supported Node.js version is now v16.20.0
93. lavamoat-browserify-v17.0.0 Oct 19, 2023 · release notes

    LavaMoat v17 adds overrideTaming and Node.js 20 support; raises minimum Node to v16.20.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch lavamoat-browserify-v17.0.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout lavamoat-browserify-v17.0.0

    • Adds overrideTaming config key with severe option for improved developer experience

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The minimum supported Node.js version is now v16.20.0; installations on older versions will fail.
94. webpack-v0.0.1-beta.0 Prerelease Oct 19, 2023 · release notes

    Initial release of LavaMoat's webpack plugin and scorchwrap with default lockdown options

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch webpack-v0.0.1-beta.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout webpack-v0.0.1-beta.0

95. allow-scripts-v3.0.0 Oct 19, 2023 · release notes

    LavaMoat allow-scripts 3.0 now ships TypeScript declarations for improved type safety.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch allow-scripts-v3.0.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout allow-scripts-v3.0.0

    └──▷ BREAKING ON UPGRADE

    • !The minimum supported Node.js version is now v16.20.0.
96. aa-v4.0.0 Oct 19, 2023 · release notes

    LavaMoat v4.0.0 ships generated TypeScript types for programmatic use

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch aa-v4.0.0 https://github.com/lavamoat/lavamoat.git
    # already have the repo? check out this version:
    $ git checkout aa-v4.0.0

    • Adds aa-scoped generated TypeScript type definitions to the package

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The minimum supported Node.js version is now v16.20.0.