{"url":"https://api.github.com/repos/patriksimek/vm2/releases/287041444","assets_url":"https://api.github.com/repos/patriksimek/vm2/releases/287041444/assets","upload_url":"https://uploads.github.com/repos/patriksimek/vm2/releases/287041444/assets{?name,label}","html_url":"https://github.com/patriksimek/vm2/releases/tag/v3.10.5","id":287041444,"author":{"login":"patriksimek","id":1000058,"node_id":"MDQ6VXNlcjEwMDAwNTg=","avatar_url":"https://avatars.githubusercontent.com/u/1000058?v=4","gravatar_id":"","url":"https://api.github.com/users/patriksimek","html_url":"https://github.com/patriksimek","followers_url":"https://api.github.com/users/patriksimek/followers","following_url":"https://api.github.com/users/patriksimek/following{/other_user}","gists_url":"https://api.github.com/users/patriksimek/gists{/gist_id}","starred_url":"https://api.github.com/users/patriksimek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/patriksimek/subscriptions","organizations_url":"https://api.github.com/users/patriksimek/orgs","repos_url":"https://api.github.com/users/patriksimek/repos","events_url":"https://api.github.com/users/patriksimek/events{/privacy}","received_events_url":"https://api.github.com/users/patriksimek/received_events","type":"User","user_view_type":"public","site_admin":false},"node_id":"RE_kwDOAPKd984RG-ek","tag_name":"v3.10.5","target_commitish":"main","name":"v3.10.5","draft":false,"immutable":false,"prerelease":false,"created_at":"2026-02-17T01:05:48Z","updated_at":"2026-02-17T01:14:32Z","published_at":"2026-02-17T01:14:32Z","assets":[],"tarball_url":"https://api.github.com/repos/patriksimek/vm2/tarball/v3.10.5","zipball_url":"https://api.github.com/repos/patriksimek/vm2/zipball/v3.10.5","body":"## What's Changed\r\n* fix: allow Object.setPrototypeOf on sandbox-local objects\r\n* fix: block Function constructor access via getOwnPropertyDescriptor\r\n* fix: block Function constructor from crossing bridge regardless of access path\r\n* fix: block all code-executing constructors from crossing bridge via property descriptors\r\n* fix: block Function constructor extraction via nested property descriptors\r\n* fix: prevent proxy unwrapping to block Function constructor extraction via Object.entries\r\n* fix: prevent sandbox escape via doPreventExtensions exposure in util.inspect\r\n* fix: prevent sandbox escape via getFactory exposure in util.inspect\r\n* fix: sanitize SuppressedError sub-errors to prevent sandbox escape\r\n* fix: block host Function constructor leak via direct handler.get() call\r\n* fix: block WebAssembly.JSTag to prevent wasm-level exception catch sandbox escape in Node 25\r\n\r\n**Full Changelog**: https://github.com/patriksimek/vm2/compare/v3.10.4...v3.10.5"}