Maintenance release that makes the package build and run on current Node.js.
- Migrated the binding from NAN to Node-API (
node-addon-api). NAN tracks V8's unstable C++ API and no longer compiles on current Node — the build failed insidenan.hitself. Node-API is ABI-stable, so a build keeps working across future Node major versions. - Vendored Lua 5.1.5 and LuaFileSystem 1.8.0, compiled into the addon. The prebuilt libraries are gone. The package now builds on Linux, macOS and Windows, on x64 and ARM64, with no system Lua to install.
- LuaJIT replaced by stock Lua 5.1.5. Only Windows ever linked LuaJIT; macOS already shipped stock Lua 5.1.5. In exchange, Apple Silicon and ARM64 Linux build at all, which they previously could not.
require('lfs')now works on every platform. It was a Windows-only prebuilt DLL loaded via anLUA_CPATHhack; LuaFileSystem is now compiled in and registered throughpackage.preload.- Node.js 18 or newer is required.
Each of these changes observable behaviour, hence the major version.
SetFieldpushed its key argument as the value, so every assignment wrote the field name into the field. It also failed to resolve a relative stack index before pushing the value, which put Lua into an unprotected error and aborted the process.LoadFileandLoadStringwere bound to theDoFile/DoStringhandlers, so they executed the chunk instead of only compiling it. The correct implementations were unreachable.- Lua booleans converted to the numbers
1and0rather thantrueandfalse. Pushtruncated numbers throughlua_pushinteger, turning3.5into3.AddPackagePathappended topackage.pathwithout a separator, corrupting the last entry sorequireusually failed, and interpolated the path into generated Lua source where a quote could break out of the string literal.- Table conversion used a hardcoded relative stack index and only worked when the table happened to be on top of the stack.
get_strallocated on every string argument and never freed it.- Six
sprintfcalls formatted arbitrary-length Lua error messages into a fixed 1024-byte stack buffer. ~LuaStatenever calledlua_close, leaking the interpreter; callingClosetwice was a use-after-free.Closeis now idempotent and later use of a closed state throws.SetFieldandGetFieldreject non-table targets instead of letting Lua abort the process.- Registered callbacks are looked up through a closure upvalue rather than a global singleton, so
separate
LuaStateinstances no longer clash.
- Test suite covering the public API, with regression tests pinning each fix above.
- CI across Linux, macOS and Windows on Node 20, 22 and 24.
Releases from 2.0.1 onward are generated by release-please from conventional commits.