locutus

Security

• Fix prototype pollution bypass in parse_str where overriding String.prototype.includes could defeat the guard (GHSA-rxrv-835q-v5mh)

Full changelog: https://github.com/locutusjs/locutus/blob/main/CHANGELOG.md

Infrastructure

• Restore published Node engine range to >= 10 for 2.x releases (engine bumps now treated as major changes)
• Add CI guardrail to block raising engines.node without a major version bump

Full changelog: https://github.com/locutusjs/locutus/blob/main/CHANGELOG.md

New Functions (32 across 7 languages)

• R: toupper, tolower, nchar, sqrt, round, max, min (7)
• Lua: string.len, string.rep, string.reverse, math.sqrt, math.sin, math.cos, math.max, math.min (8)
• AWK: cos, exp, log, sin, sqrt (5)
• Elixir: String.downcase, String.upcase, String.length, String.reverse (4)
• Clojure: string/lower-case, `string/u...

New Functions

• Perl string functions: uc (uppercase), lc (lowercase), substr (with negative offset support)

Fixes

• Fixed parity test string normalization for Perl (native print doesn't quote strings)

Full Changelog

New Functions

• Lua string module: upper, lower, sub (with 1-based indexing and negative index support)
• AWK builtin functions: tolower, toupper

Fixes

• Fixed parity test string normalization for Lua and AWK (native print doesn't quote strings)

Full Changelog