Merge pull request #105 from sebastianwessel/codex/deep-review-fixes

[codex] harden runtime cleanup and align playground release

Author: sebastianwessel

.gitignore

@@ -6,6 +6,7 @@ yarn-debug.log*
 yarn-error.log*
 lerna-debug.log*
 .pnpm-debug.log*
+.DS_Store
 
 # Diagnostic reports (https://nodejs.org/api/report.html)
 report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
@@ -135,4 +136,4 @@ dist
 src/modules/build
 
 website/.vitepress/cache
-docs
+docs

CHANGELOG.md

@@ -1,18 +1,39 @@
-# Changelog
+## [unreleased]
 
-All notable changes to this project will be documented in this file.
+### 🐛 Bug Fixes
 
-## [unreleased]
+- Harden runtime cleanup and refresh deps
+- Align examples and timeout behavior
+
+### 💼 Other
+
+- Run tests serially per file to avoid bun runner timeouts
+
+### 📚 Documentation
+
+- Add security model and hardening guidance
+
+### ⚙️ Miscellaneous Tasks
+
+- Simplify release trigger and harden publish workflow
+- Require main branch for release workflow
+- Retry flaky per-file test execution once
+- Align release workflow with npm and jsr trusted publishing docs
+- Upgrade npm for trusted publisher releases
+- Create github release and tag after publish
+## [3.0.0] - 2025-07-26
 
 ### 📚 Documentation
 
 - Add blog entry v3.0
 - Fix minor doc issues
+- Update doc
+- Add api doc
 
 ### ⚙️ Miscellaneous Tasks
 
 - Remove dependency
-
+- Bump to version 3
 ## [2.3.1] - 2025-06-24
 
 ### ⚙️ Miscellaneous Tasks
@@ -22,7 +43,6 @@ All notable changes to this project will be documented in this file.
 - Update linter deps
 - Bump version
 - Bump jsr version
-
 ## [2.3.0] - 2025-06-21
 
 ### 🚀 Features
@@ -41,7 +61,6 @@ All notable changes to this project will be documented in this file.
 - Fix lint
 - Bump to version 2.3.0
 - Update packages
-
 ## [2.2.0] - 2025-04-30
 
 ### 🐛 Bug Fixes
@@ -66,7 +85,6 @@ All notable changes to this project will be documented in this file.
 - Improve typings
 - Minor improvements
 - Bump dependencies
-
 ## [2.1.1] - 2025-03-09
 
 ### 🐛 Bug Fixes
@@ -86,7 +104,6 @@ All notable changes to this project will be documented in this file.
 - Correct test file name
 - Improve provideTimingFunctions
 - Bump jsr version
-
 ## [2.1.0] - 2025-03-06
 
 ### 🐛 Bug Fixes
@@ -107,7 +124,6 @@ All notable changes to this project will be documented in this file.
 - Cleanup examples
 - Improve error handling
 - Improve tests
-
 ## [2.0.1] - 2025-02-28
 
 ### 🐛 Bug Fixes
@@ -123,7 +139,6 @@ All notable changes to this project will be documented in this file.
 ### ⚙️ Miscellaneous Tasks
 
 - Bump jsr version
-
 ## [2.0.0] - 2025-02-27
 
 ### 🚀 Features
@@ -207,7 +222,6 @@ All notable changes to this project will be documented in this file.
 - Update project config
 - Fix build
 - Bump jsr version
-
 ## [1.3.0] - 2024-07-11
 
 ### 🚀 Features
@@ -225,7 +239,6 @@ All notable changes to this project will be documented in this file.
 - Cleanup
 - Make Buffer and TextDecoder and TextEncoder global
 - Bump to v1.3
-
 ## [1.2.0] - 2024-07-09
 
 ### 🚀 Features
@@ -239,7 +252,6 @@ All notable changes to this project will be documented in this file.
 ### ⚙️ Miscellaneous Tasks
 
 - Bump to version 1.2
-
 ## [1.1.1] - 2024-07-08
 
 ### 🐛 Bug Fixes
@@ -249,7 +261,6 @@ All notable changes to this project will be documented in this file.
 ### ⚙️ Miscellaneous Tasks
 
 - Bump version to 1.1.0
-
 ## [1.1.0] - 2024-07-08
 
 ### 🚀 Features
@@ -270,7 +281,6 @@ All notable changes to this project will be documented in this file.
 ### ⚙️ Miscellaneous Tasks
 
 - Remove debug logs
-
 ## [1.0.0] - 2024-07-07
 
 ### 🚀 Features
@@ -304,5 +314,3 @@ All notable changes to this project will be documented in this file.
 - Update doc
 - Update
 - Update credits
-
-<!-- generated by git-cliff -->

README.md

@@ -25,7 +25,7 @@ import variant from "@jitl/quickjs-ng-wasmfile-release-sync";
 import { type SandboxOptions, loadQuickJs } from "@sebastianwessel/quickjs";
 
 // General setup like loading and init of the QuickJS wasm
-// It is a ressource intensive job and should be done only once if possible
+// It is a resource-intensive job and should be done only once if possible
 const { runSandboxed } = await loadQuickJs(variant);
 
 const options: SandboxOptions = {

biome.json

@@ -1,5 +1,5 @@
 {
-	"$schema": "https://biomejs.dev/schemas/2.3.15/schema.json",
+	"$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
 	"assist": { "actions": { "source": { "organizeImports": "on" } } },
 	"files": {
 		"includes": [

bun.lock

@@ -21,7 +21,6 @@ bun run example:basic
 ```
 
 from the root of this repository.
-
 ## Server Example
 
 The server example demonstrates how you can use [@sebastianwessel/quickjs](https://github.com/sebastianwessel/quickjs) inside a web server. In this example, we run a web server that spawns workers on request using the [poolifier-web-worker](https://github.com/poolifier/poolifier-web-worker) package. Each worker runs its own QuickJS sandbox and executes the given code.
@@ -34,12 +33,26 @@ bun run example:server
 
 from the root of this repository. Once the server has started, open your browser and go to [http://localhost:3000/](http://localhost:3000/). You will see a simple OpenAPI (Swagger) UI.
 
+If port 3000 is already in use, choose another port:
+
+```sh
+PORT=3910 bun run example:server
+```
+
 ## Run-Tests Example
 
-In the *run-tests* example, the usage of the included test runner is shown. You can test it out by running:
+In the *run-tests* example, the usage of the included test runner is shown.
+
+Before running the tests, build the test runner library:
+
+```sh
+bun run build:vendor
+```
+
+You can test it out by running:
 
 ```sh
-bun run example:test
+bun run example:tests
 ```
 
 from the root of this repository.

example/README.md

@@ -2,7 +2,7 @@ import variant from '@jitl/quickjs-ng-wasmfile-release-sync'
 import { loadQuickJs, type SandboxOptions } from '../../src/index.js'
 
 // General setup like loading and init of the QuickJS wasm
-// It is a ressource intensive job and should be done only once if possible
+// It is a resource intensive job and should be done only once if possible
 const { runSandboxed } = await loadQuickJs(variant)
 
 const options: SandboxOptions = {

example/basic/index.ts

@@ -1,5 +1,5 @@
 # Browser Example
 
-An example on how to use this library witout any build step in the browser.
+An example on how to use this library without any build step in the browser.
 
 The [simple Version](./simple.html) and the [Playground version](./playground.html) are available.

example/browser/README.md

@@ -1,4 +1,4 @@
-<html>
+<html lang="en">
   <title>@sebastianwessel/quickjs</title>
   <body>Hello World</body>
-</html>
+</html>

example/browser/example-request.html

@@ -55,6 +55,7 @@
             </div>
             <button
                 id="runButton"
+                type="button"
                 class="bg-blue-500 text-white font-semibold text-lg p-4 hover:bg-blue-700"
             >
                 Run Code
@@ -93,9 +94,9 @@
             }
 
             // =========== QuickJS =====================
-            import { loadQuickJs } from "https://esm.sh/@sebastianwessel/quickjs@3.0.0";
+            import { loadQuickJs } from "https://esm.sh/@sebastianwessel/quickjs@3.1.0";
             import "https://esm.sh/typescript";
-            import variant from "https://esm.sh/@jitl/quickjs-wasmfile-release-sync";
+            import variant from "https://esm.sh/@jitl/quickjs-ng-wasmfile-release-sync@0.32.0";
 
             const { runSandboxed } = await loadQuickJs(variant);