v0.9

Added

• Native builds now decode legacy zstd frame formats v0.4-v0.7
  (ZSTD_LEGACY_SUPPORT=4, matching zstd-jni's default). v0.1-v0.3 stay
  unsupported — they predate zstd's 1.0 stabilization and are essentially
  never seen in practice. Verified against a real fixture of five concatenated
  legacy frames extracted from zstd's own test suite. (#73)

Changed

• linux-x86_64/osx-x86_64/windows-x86_64 native builds now include
  zstd's hand-written BMI2 Huffman-decode assembly (previously disabled). It
  is a no-op on non-x86_64 targets and only activates via zstd's own runtime
  CPU detection; benchmarked as throughput-neutral on this project's
  synthetic workload but carries no measured downside either.
  (#71)
• aarch64 native builds now target an ARMv8-A + CRC baseline
  (-mcpu=generic+crc, zig's spelling of -march=armv8-a+crc), instead of
  the fully generic baseline. Measured +6.9% compress / +12-14% decompress
  throughput on Apple Silicon. (#71)

Security

• linux-x86_64/linux-aarch64 native builds now link with full RELRO and
  immediate binding (-Wl,-z,relro,-z,now), closing off the classic
  GOT-overwrite exploit primitive. Verified with llvm-readelf.
  (#71)
• windows-x86_64/windows-aarch64 native builds now export only zstd's
  public API (ZSTD_*/ZDICT_*) from the DLL, via -DZSTD_DLL_EXPORT=1
  (the PE analogue of the -fvisibility=hidden surface already used on
  ELF/Mach-O), instead of dumping every internal symbol
  (FSE_*/HUF_*/COVER_*/...) into the export table via
  --export-all-symbols. Cut the windows-x86_64 export table from 576 to
  185 symbols. (#79)

Fixed

• Building the native library from source on Windows was silently broken:
  Maven's exec plugin tried to execute build-zstd.sh directly, which only
  works via a shebang on macOS/Linux. Windows builds now invoke it through
  bash explicitly. A second latent bug this surfaced — unrecognized/Windows
  host OS detection crashed the build script under set -u — is fixed
  alongside it. (#75)
• Native library compilation now runs every translation unit through a real
  parallel work queue (xargs -P) instead of a fixed-size batch-then-wait
  loop, and aborts immediately if any zig cc invocation fails. Previously a
  failed compile under &/wait was invisible to set -e — it could
  silently produce no .o and only surface later as a cryptic link error, or
  worse, a link that "succeeded" against a stale .o left over from a
  previous run. (#78)

Investigated and rejected as part of the same effort (see
#70 for full benchmark data):
LTO (real compress regression on x86_64, unsupported on macOS entirely — zig's
Mach-O linker has no LTO support, tracked in
#77) and an x86-64-v3
baseline (mixed result, hurts compress more than it helps decompress). Both
would have traded away this project's existing compress-side edge over
zstd-jni for a smaller decompress-side gain.