zxc v0.14.1

Lossless compression C library built for ultra-fast decode. Faster than LZ4 (40-75%+ on ARM64), at a better ratio. Official Rust, Python, Node.js, Go and WASM bindings. Write-once/read-many, with optional seekable archives for O(1) random access.

Release notes

# Release Notes

v0.14.1 is a hardening release: every decode path got stricter, block decompression is **10-13 % faster**, reusable contexts reach all five wrappers, and seekable archives can verify per-block checksums.

**Drop-in for v0.14.0.** Same format v8, byte-identical output at every level (verified on Silesia), soname still `libzxc.so.4`. One symbol added, `zxc_seekable_set_checksum`; none removed or changed.

## Decoder hardening

- **A forged block size passed off a truncated decode as success (#428).** A payload size spanning the EOF marker made the frame walk run off the archive and return what it had, with checksums off (the default). A data block's payload can no longer exceed the header's block size, the walk must end on the EOF block, and a seek-table entry spans at most one block. The check sits in the block decoder shared by every reader. Both rules are now normative in `FORMAT.md`.
- **Stack address stored in heap memory (#429).** Multi-threaded seekable jobs held the caller's output pointer. This was harmless, since workers are joined before return, but a scanner can't prove that. Jobs now carry offsets from one base pointer on the caller's stack.
- **`zxc_stream_decompress` ignored the dictionary size limit (#430).** A dictionary above `ZXC_DICT_SIZE_MAX` was accepted, or rejected with a misleading `ZXC_ERROR_DICT_MISMATCH`. The check moved into the shared stream engine.
- **Contexts (#417, #422).** Static contexts reject oversized blocks up front. An empty input through a context now yields the canonical 36-byte archive, like the one-shot API.

## API

- **Reusable contexts in every wrapper (#424, #414, #415).** `Cctx` and `Dctx` now ship in Rust, Go, Python, Node.js and WASM. A dictionary given to the factory applies to every call that doesn't override it. The block API also takes a dictionary's shared literal Huffman table (#415), so small blocks no longer spend bytes describing their own.
- **Seekable checksum verification (#425).** `zxc_seekable_decompress_range` can verify per-block checksums through `zxc_seekable_set_checksum`. It is **off by default** and exposed in all five wrappers.
Also fixed: an overflowing offset plus length slipped past the bounds check, and an incomplete range returned a silent partial read instead of `ZXC_ERROR_CORRUPT_DATA`.

## CLI

- **`-l` and `-t` read checksum status from the `HAS_CHECKSUM` header flag (#435).** `-j` adds `checksum_method`; exit codes are unchanged. Thanks to @Vladexy88x for the fix.

## Performance

- **`zxc_decompress_block` writes straight to the destination (#418).** Given the `zxc_decompress_block_bound()` capacity, it skips the bounce-buffer copy and runs **10-13 % faster**, from 64 KB to 2 MB blocks (Apple M3, level 3, Silesia). An exact-size destination falls back to the bounce buffer instead of failing with `ZXC_ERROR_OVERFLOW`.

## Build & Packaging

- Trusted publishing for the release workflows (#421), replacing long-lived tokens.
- Rapidhash is resolved at configure time (#420). The vendored copy is used unless `-DZXC_USE_SYSTEM_RAPIDHASH=ON`, and a missing copy fails at configure rather than mid-build. Thanks to @jeanga for the issue.
- Wrapper packaging and release integrity tightened (#409). Publish jobs no longer install an unpinned global npm (#426, #427).
- One seeded checksum entry point (#423), tidier nudge tuning macros (#412), and SARIF uploads skipped on fork PRs.

## Documentation

`FORMAT.md` gains the two decoder rules and the dictionary ID derivation (#413): a 32-bit value that binds a dictionary to an archive without authenticating it. The Rust crate's `zxc-compress` / `zxc` naming is clarified (#410), with README refinements (#408).

## Changelog

- api: Enforces strict block size and EOF validation (#428)
- api: Implements reusable compression contexts (#424)
- api: Enhances seekable API with checksum control and robust range validation (#425)
- api: Fix empty frame compressio…

Share this resource