https://cybertoolchain.io/tools/lavamoat New releases and features in LavaMoat, tracked by The Cyber Toolchain. en Fri, 25 Sep 2026 12:00:01 GMT https://github.com/LavaMoat/LavaMoat/releases/tag/types-v2.0.0 https://github.com/LavaMoat/LavaMoat/releases/tag/types-v2.0.0 Fri, 25 Sep 2026 12:00:01 GMT LavaMoat types v2.0.0 expands `LavaMoatPolicy.include` with a breaking change to its shape.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Expands `LavaMoatPolicy.include` to support a wider set of values in the LavaMoat policy type definitions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • The shape of `LavaMoatPolicy.include` has changed — existing code typed against the old `LavaMoatPolicy.include` definition may no longer type-check and will require updates. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/LavaMoat/LavaMoat/releases/tag/react-native-lockdown-v3.0.0 https://github.com/LavaMoat/LavaMoat/releases/tag/react-native-lockdown-v3.0.0 Fri, 25 Sep 2026 12:00:00 GMT LavaMoat react-native-lockdown v3.0.0 adopts @endo/parser-pipeline and splits generatePolicy() into separate generate and write steps⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `writePolicy` export from `@lavamoat/node` to write a policy to disk, separate from generatePolicy().⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Switches `@lavamoat/node` to use `@endo/parser-pipeline` for module parsing. Breaking changes: • generatePolicy() in `@lavamoat/node` now resolves with `{ policy: LavaMoatPolicy, hasWarnings: boolean }` instead of a bare `LavaMoatPolicy`; callers must destructure `policy` from the result. • generatePolicy() in `@lavamoat/node` no longer accepts `write` or `writableFs` options and no longer writes policy to disk; use the new `writePolicy` import from `@lavamoat/node` instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/LavaMoat/LavaMoat/releases/tag/node-v2.0.0 https://github.com/LavaMoat/LavaMoat/releases/tag/node-v2.0.0 Fri, 25 Sep 2026 11:59:59 GMT LavaMoat Node 2.0 adds location-based policy includes, a new `writePolicy` export, and switches to `@endo/parser-pipeline`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for location-based includes in LavaMoat policy configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • generatePolicy() now resolves with `{ policy: LavaMoatPolicy, hasWarnings: boolean }` instead of a bare `LavaMoatPolicy` — callers must destructure `policy` from the resolved object. • generatePolicy() no longer accepts `write` or `writableFs` options and no longer writes policy to disk; use `writePolicy` imported from `@lavamoat/node` instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/LavaMoat/LavaMoat/releases/tag/harden-v0.8.0 https://github.com/LavaMoat/LavaMoat/releases/tag/harden-v0.8.0 Fri, 25 Sep 2026 11:59:56 GMT LavaMoat harden v0.8.0 extends script configs for tighter supply chain control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends script configs in the `harden` package, expanding the configuration surface available for controlling how scripts are hardened.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/LavaMoat/LavaMoat/releases/tag/lavamoat-core-v19.0.0 https://github.com/LavaMoat/LavaMoat/releases/tag/lavamoat-core-v19.0.0 Fri, 25 Sep 2026 11:59:55 GMT lavamoat-core v19 expands LavaMoatPolicy.include, exposes policy-override compact function, and adopts @endo/parser-pipeline⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • generatePolicy() in `@lavamoat/node` now resolves with `{ policy: LavaMoatPolicy, hasWarnings: boolean }` instead of a bare `LavaMoatPolicy` — callers must destructure `policy` from the result. • generatePolicy() no longer accepts `write` or `writableFs` options and will not write policy to disk; migrate to `writePolicy` imported from `@lavamoat/node`. • `LavaMoatPolicy.include` has an expanded schema — existing policy files using the previous `include` format may need to be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/LavaMoat/LavaMoat/releases/tag/webpack-v2.3.0 https://github.com/LavaMoat/LavaMoat/releases/tag/webpack-v2.3.0 Thu, 03 Sep 2026 23:06:07 GMT LavaMoat webpack plugin gains a policy-overwrite opt-in flag and scuttling-safe importScripts capture. • Adds opt-in flag to overwrite `policy.json` with overrides, enabling automated policy regeneration workflows. • Captures `importScripts` reference for use in the webpack runtime even when scuttling is enabled, unblocking Web Worker builds that rely on `importScripts`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/LavaMoat/LavaMoat/releases/tag/harden-v0.7.0 https://github.com/LavaMoat/LavaMoat/releases/tag/harden-v0.7.0 Thu, 03 Sep 2026 23:06:03 GMT LavaMoat harden adds a --json check option and wildcard prefix matching for runner scriptsConfig • Adds `--json` option to the `harden` check command for machine-readable output. • Adds wildcard prefix matching for `scriptsConfig` entries in the harden runner, allowing glob-style script name patterns. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/allow-scripts-v5.1.0 https://github.com/lavamoat/lavamoat/releases/tag/allow-scripts-v5.1.0 Thu, 25 Jun 2026 11:55:48 GMT allow-scripts gains a `check` command to detect stale allow-lists in CI pipelines. • New `check` command warns when the allow-scripts configuration is out of date, enabling CI to catch unapproved lifecycle script changes before they reach production. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/LavaMoat/LavaMoat/releases/tag/allow-scripts-v5.1.0 https://github.com/LavaMoat/LavaMoat/releases/tag/allow-scripts-v5.1.0 Thu, 25 Jun 2026 11:55:48 GMT allow-scripts gains a `check` command to detect stale allow-lists in CI without making changes. • Adds a `check` command that warns when the allow-scripts configuration is out of date, designed for use in CI pipelines without modifying any files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/webpack-v2.2.0 https://github.com/lavamoat/lavamoat/releases/tag/webpack-v2.2.0 Wed, 22 Apr 2026 09:15:51 GMT LavaMoat webpack plugin gains sourcemap-preserving evasive transforms for easier debugging of hardened bundles. • Adds sourcemap-preserving evasive transforms, keeping source maps intact after LavaMoat's security-oriented code transformations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-v11.1.0 https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-v11.1.0 Wed, 15 Apr 2026 10:12:11 GMT lavamoat-node gains opt-in modernized module resolution for classic mode • Adds opt-in modernized `resolve` behavior to lavamoat-node classic mode, enabling more accurate dependency resolution for modern package layouts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/laverna-v2.1.0 https://github.com/lavamoat/lavamoat/releases/tag/laverna-v2.1.0 Wed, 15 Apr 2026 10:12:10 GMT Laverna v2.1.0 adds Yarn support for automated LavaMoat policy publishing. • Supports Yarn as a package manager alongside the existing npm support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/allow-scripts-v5.0.0 https://github.com/lavamoat/lavamoat/releases/tag/allow-scripts-v5.0.0 Wed, 15 Apr 2026 10:12:07 GMT allow-scripts v5 pins install scripts to exact versions by default, tightening supply-chain control. • Install scripts are now pinned to specific package versions, preventing allowlisted scripts from running under unintended versions. Breaking changes: • allow-scripts no longer matches a lower version against an allowed entry — version pinning is now exact, so existing allowlist entries that relied on lower-version matching will stop working. • allow-scripts defaults to pinning versions; upgrading requires a migration action to update existing allowlist configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/webpack-v2.1.0 https://github.com/lavamoat/lavamoat/releases/tag/webpack-v2.1.0 Thu, 02 Apr 2026 20:47:25 GMT LavaMoat webpack plugin now auto-overrides unsafe devtool settings that break LavaMoat's security guarantees. • Automatically overrides the webpack `devtool` setting when it is likely to break LavaMoat, preventing silent security misconfigurations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/types-v1.0.0 https://github.com/lavamoat/lavamoat/releases/tag/types-v1.0.0 Fri, 20 Mar 2026 23:07:11 GMT LavaMoat types v1.0.0 adds `include` property to the `LavaMoatPolicy` type. • Adds `include` property to the `LavaMoatPolicy` type, enabling finer-grained policy composition in TypeScript consumers. Breaking changes: • Node.js v18 is no longer supported; upgrading will break installations running on Node.js v18. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/node-v1.0.0 https://github.com/lavamoat/lavamoat/releases/tag/node-v1.0.0 Fri, 20 Mar 2026 23:07:08 GMT LavaMoat Node 1.0.0 adds parallel module inspection and major Node.js compatibility updates. • Adds parallel module inspection, speeding up policy generation for large dependency trees. • Major compatibility changes bringing LavaMoat Node to a stable 1.0 release. Breaking changes: • Node.js v18 is no longer supported; upgrade to Node.js v20 or later before upgrading this package. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v18.0.0 https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v18.0.0 Fri, 20 Mar 2026 23:07:04 GMT lavamoat-core v18 exports the MODULE_REFS constant for programmatic policy inspection. • Exports the `MODULE_REFS` constant from lavamoat-core, enabling programmatic access to module reference identifiers used in policy generation. Breaking changes: • Node.js v18 is no longer supported; upgrading requires Node.js v20 or later. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-v10.1.0 https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-v10.1.0 Tue, 20 Jan 2026 15:04:46 GMT LavaMoat Node now returns the top-level export as the return value of `runLava` • Exposes the top-level module export as the return value of `runLava`, enabling callers to programmatically consume the sandboxed module's exported API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-tofu-v8.1.0 https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-tofu-v8.1.0 Wed, 19 Nov 2025 19:23:13 GMT lavamoat-tofu 8.1.0 adds deep ES module dependency analysis and informative policy-merge error messages. • Enables deep dependency analysis of ES modules, allowing tofu to traverse transitive ES module imports when generating policies. • Adds informative errors when a policy merge produces invalid entries, surfacing actionable diagnostics instead of silent failures. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v17.1.0 https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v17.1.0 Wed, 19 Nov 2025 19:23:09 GMT LavaMoat Core 17.1.0 adds informative errors when policy merge produces invalid entries. • Adds descriptive errors when the result of a policy merge contains invalid entries, making misconfigured policy merges easier to diagnose. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/webpack-v1.5.0 https://github.com/lavamoat/lavamoat/releases/tag/webpack-v1.5.0 Wed, 01 Oct 2025 10:50:49 GMT LavaMoat webpack plugin adds a `meta` field to policy resources to surface webpack optimization info. • Adds a `meta` field to policy resource entries, recording webpack optimization data (e.g. sideEffect tree-shaking) for each module. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/types-v0.1.0 https://github.com/lavamoat/lavamoat/releases/tag/types-v0.1.0 Wed, 01 Oct 2025 10:50:48 GMT LavaMoat types v0.1.0 adds a `meta` field to policy resources for surfacing webpack optimization reports. • Adds a `meta` field to the policy resource type, enabling webpack optimization data to be reported alongside policy entries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/webpack-v1.4.0 https://github.com/lavamoat/lavamoat/releases/tag/webpack-v1.4.0 Thu, 25 Sep 2025 13:03:19 GMT LavaMoat webpack plugin officially releases scuttling support and adds tree-shake-safe policy enforcement. • Officially releases and documents the scuttling feature in the webpack plugin, enabling runtime lockdown of global object access for bundled code. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v16.7.0 https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v16.7.0 Thu, 25 Sep 2025 13:03:16 GMT LavaMoat webpack plugin now officially supports scuttling with documentation. • Officially releases and documents scuttling support in the LavaMoat webpack plugin. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/allow-scripts-v3.4.0 https://github.com/lavamoat/lavamoat/releases/tag/allow-scripts-v3.4.0 Thu, 25 Sep 2025 13:03:14 GMT allow-scripts now recommends global installation for simpler, project-wide lifecycle script control. • Supports global installation of allow-scripts as the recommended usage pattern, enabling consistent lifecycle script enforcement across projects without per-project setup. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/webpack-v1.3.0 https://github.com/lavamoat/lavamoat/releases/tag/webpack-v1.3.0 Tue, 16 Sep 2025 20:18:26 GMT LavaMoat webpack plugin v1.3.0 adds generatePolicyOnly mode, null runtime support, and per-chunk runtime configuration. • Adds `generatePolicyOnly` option to run the plugin in policy-generation mode without applying protections, useful for CI policy auditing without a full build. • Adds null runtime support, enabling LavaMoat to work in webpack configurations that use no runtime chunk. • Adds `runtimeConfigurationPerChunk_experimental` option to embed and control LavaMoat runtime options on a per-chunk basis. • Adds static shims for the webpack runtime, reducing reliance on dynamic runtime injection. • Emits explicit error messages when a webpack compilation completes with no modules protected, surfacing misconfiguration early. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v16.6.0 https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v16.6.0 Tue, 16 Sep 2025 20:18:24 GMT LavaMoat Core 16.6.0 adds Firefox content-script support for cross-realm window prototypes. • Supports Firefox content-script environments by handling cross-realm window prototypes, enabling LavaMoat to run correctly in Firefox browser extensions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/webpack-v1.2.0 https://github.com/lavamoat/lavamoat/releases/tag/webpack-v1.2.0 Mon, 25 Aug 2025 08:21:17 GMT LavaMoat webpack plugin gains improved handling for globals requiring more than a simple unwrap from core. • Adds support for globals that require more complex handling beyond a simple unwrap from lavamoat-core, improving compatibility with a wider range of webpack bundles. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/node-v0.4.0 https://github.com/lavamoat/lavamoat/releases/tag/node-v0.4.0 Mon, 25 Aug 2025 08:21:16 GMT LavaMoat node v0.4.0 improves git-safe resilience against network and git instability. • Increases resilience of git-safe against adverse network conditions and git edge cases. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/git-safe-dependencies-v0.3.0 https://github.com/lavamoat/lavamoat/releases/tag/git-safe-dependencies-v0.3.0 Mon, 25 Aug 2025 08:21:15 GMT git-safe-dependencies v0.3.0 increases resilience against network conditions and git issues. • Improves resilience against network conditions and git failures when verifying safe dependencies. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/react-native-lockdown-v0.1.0 https://github.com/lavamoat/lavamoat/releases/tag/react-native-lockdown-v0.1.0 Wed, 30 Jul 2025 09:43:20 GMT react-native-lockdown bumps to SES 1.14.0 for hardened JavaScript in React Native apps. • Upgrades bundled SES (Hardened JavaScript) runtime to v1.14.0, bringing its latest compartment isolation and intrinsic hardening to React Native. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/webpack-v1.1.0 https://github.com/lavamoat/lavamoat/releases/tag/webpack-v1.1.0 Wed, 30 Jul 2025 09:43:20 GMT LavaMoat webpack plugin v1.1.0 shields the webpack runtime from scuttling and ships proper TypeScript types. • Defends the webpack runtime from scuttling, preventing untrusted code from corrupting webpack's own globals at runtime. • Exposes proper TypeScript types for the LavaMoat webpack plugin, enabling typed configuration in TS projects. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/webpack-v1.0.0 https://github.com/lavamoat/lavamoat/releases/tag/webpack-v1.0.0 Tue, 24 Jun 2025 20:11:20 GMT LavaMoat webpack plugin hits v1.0.0 with scuttling, lazy-chunk protection, context-module support, and hardened defaults. • Adds scuttling support (`scuttling` option) to lock down global object properties in webpack bundles at runtime. • New `unlockedChunksUnsafe` option lets teams selectively opt specific chunks out of LavaMoat protection for incremental adoption. • Supports webpack context modules and chunk lazy-loading, enabling policy enforcement on dynamically imported code. • Adds experimental `__unsafeAllowContextModules` flag to test context-module scenarios without leaving them fully unprotected. • Enables syntax checks by default, running validation before module concatenation to catch policy-breaking code earlier. • Suppresses resource asset emission from packages by default, reducing unintended file exposure in build output. • New policy debugging capabilities for inspecting and testing generated LavaMoat policies. Breaking changes: • Deprecated lockdown options have been removed from `@lavamoat/webpack` and `lavamoat-core`; configurations using those options will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/react-native-lockdown-v0.0.1 https://github.com/lavamoat/lavamoat/releases/tag/react-native-lockdown-v0.0.1 Tue, 24 Jun 2025 20:11:19 GMT New @lavamoat/react-native-lockdown beta brings SES-based runtime hardening to React Native apps. • Introduces @lavamoat/react-native-lockdown, a new LavaMoat library that applies SES (Secure ECMAScript) lockdown to React Native environments. • Ships with a vendored SES build, making the lockdown self-contained without relying on an external SES package. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/node-v0.3.0 https://github.com/lavamoat/lavamoat/releases/tag/node-v0.3.0 Tue, 24 Jun 2025 20:11:17 GMT LavaMoat Node v0.3.0 adds scuttling support and custom errors for tighter runtime sandbox control. • Adds scuttling support, enabling LavaMoat to restrict access to powerful globals on the Node.js runtime environment. • Adds custom error types for more precise programmatic handling of LavaMoat policy and sandbox violations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v16.5.0 https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v16.5.0 Tue, 24 Jun 2025 20:11:14 GMT LavaMoat core adds Node.js scuttling support and relaxes scuttling to skip intrinsics, reducing false-positive lockdowns. • Adds scuttling support for Node.js environments, extending runtime prototype-pollution defenses to Node targets. • Relaxes scuttling by skipping JavaScript intrinsics, reducing breakage when hardening globals without affecting built-in objects. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/node-v0.2.0 https://github.com/lavamoat/lavamoat/releases/tag/node-v0.2.0 Mon, 05 May 2025 08:37:48 GMT LavaMoat Node v0.2.0 adds support for running untrusted entrypoints under policy enforcement. • Supports untrusted entrypoints, allowing policy enforcement to apply even when the application entry script itself is not fully trusted. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v16.4.0 https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v16.4.0 Mon, 05 May 2025 08:37:44 GMT LavaMoat Core 16.4.0 adds a "redefine" global policy value and support for untrusted entrypoints. • Adds `"redefine"` as a new global policy value in the LavaMoat policy schema, giving policy authors finer-grained control over how globals are exposed to packages. • Supports untrusted entrypoints, allowing LavaMoat to apply compartment isolation even when the application entry module itself is not fully trusted. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/webpack-v0.10.0-beta.0 https://github.com/lavamoat/lavamoat/releases/tag/webpack-v0.10.0-beta.0 Mon, 05 May 2025 08:37:43 GMT LavaMoat webpack plugin now supports webpack context modules and chunk lazy loading. • Supports webpack context modules and chunk lazy loading, enabling LavaMoat policy enforcement across dynamically imported code splits. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/node-v0.1.0 https://github.com/lavamoat/lavamoat/releases/tag/node-v0.1.0 Tue, 11 Mar 2025 15:48:55 GMT LavaMoat Node v0.1.0 adds --quiet/--verbose output control and improved entrypoint UX • Adds `--quiet` and `--verbose` flags for controlling output verbosity when running LavaMoat Node. • Improves UX for specifying entrypoints, making it easier to define application entry in LavaMoat Node. Breaking changes: • "dev" mode is now disabled by default; setups that relied on dev mode being on by default will no longer behave the same after upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/webpack-v0.9.0-beta.0 https://github.com/lavamoat/lavamoat/releases/tag/webpack-v0.9.0-beta.0 Tue, 11 Mar 2025 15:48:51 GMT LavaMoat webpack plugin v0.9.0-beta.0 adds scuttling support to harden global object access in bundled apps. • Adds scuttling support to the webpack plugin, restricting untrusted modules from accessing or tampering with privileged globals at runtime. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/node-v0.0.2 https://github.com/lavamoat/lavamoat/releases/tag/node-v0.0.2 Wed, 29 Jan 2025 09:35:22 GMT LavaMoat v0.0.2 now allows passing arbitrary flags to the Node.js entrypoint. • Allows flags to be passed to the `node` entrypoint process Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/git-safe-dependencies-v0.2.0 https://github.com/lavamoat/lavamoat/releases/tag/git-safe-dependencies-v0.2.0 Wed, 29 Jan 2025 09:35:20 GMT LavaMoat git-safe-dependencies adds a GitHub Actions workflow validator to catch unsafe action dependencies. • Adds `git-safe-actions` GitHub Actions validator to audit GH Actions workflows for unsafe dependencies. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/node-v0.0.1 https://github.com/lavamoat/lavamoat/releases/tag/node-v0.0.1 Wed, 15 Jan 2025 21:05:24 GMT LavaMoat introduces @lavamoat/node, a new Node.js runtime protection library. • Introduces `@lavamoat/node`, a new LavaMoat package for applying supply-chain security policies in Node.js environments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v16.3.0 https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v16.3.0 Wed, 15 Jan 2025 21:05:22 GMT LavaMoat Core 16.3.0 adds policy debugging capabilities to the webpack integration. • Adds policy debugging capabilities to the LavaMoat webpack plugin for easier policy authoring and troubleshooting. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/webpack-v0.8.0-beta.0 https://github.com/lavamoat/lavamoat/releases/tag/webpack-v0.8.0-beta.0 Wed, 15 Jan 2025 21:05:20 GMT LavaMoat webpack plugin gains policy debugging, safer context-module experiments, and tighter resource-asset controls. • Adds `__unsafeAllowContextModules` flag to safely experiment with webpack context modules without leaving them exposed by default. • Suppresses emission of resource assets from packages by default, reducing unintended asset exposure. • Adds policy debugging capabilities for inspecting and troubleshooting LavaMoat policy resolution in webpack builds. Breaking changes: • Resource assets from packages are no longer emitted by default; builds that relied on automatic resource asset emission will need to explicitly enable it. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/git-safe-dependencies-v0.1.0 https://github.com/lavamoat/lavamoat/releases/tag/git-safe-dependencies-v0.1.0 Fri, 20 Dec 2024 14:53:44 GMT LavaMoat ships git-safe-dependencies v0.1.0, a new tool for securing git-sourced Node.js dependencies. • Introduces git-safe-dependencies, a new LavaMoat library for managing or validating git-sourced dependencies in Node.js projects. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-browserify-v18.1.0 https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-browserify-v18.1.0 Thu, 05 Dec 2024 08:13:26 GMT lavamoat-browserify 18.1.0 lets you override the module resolve implementation for custom dependency resolution. • Supports overriding the resolve implementation, enabling custom module resolution logic in browserify builds. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v16.2.0 https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v16.2.0 Thu, 05 Dec 2024 08:13:26 GMT LavaMoat Core 16.2.0 adds diff-friendly policy sorting and makes mergePolicy's second param explicitly optional. • Sorts LavaMoat policy files in a diff-friendly way so sort order remains stable even when a dependency's path changes, reducing noisy diffs on policy updates. • Adds a policy sorting CLI helper to migrate existing policy files to the new cleaner sort order. • Makes the second parameter of `mergePolicy` explicitly optional, simplifying single-policy merge calls. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v16.1.0 https://github.com/lavamoat/lavamoat/releases/tag/lavamoat-core-v16.1.0 Fri, 11 Oct 2024 14:06:00 GMT lavamoat-core now exports endowmentsToolkit from the package root for easier direct access. • Exports `endowmentsToolkit` directly from the `lavamoat-core` root, removing the need to import from a deep internal path. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lavamoat