2.x to 3.x changes

• v3 requires Node.js version 6 or newer.
• To contextify objects between sandboxes v3 uses Proxies rather than deep clone.
• Builtin modules are no longer recompiled in sandbox, they're now Proxied.
• There is no need to call functions inside sandbox with vm.call method.
• Issue with Buffer not being instance of Buffer is now fixed (#22).
• It is now possible to nest VMs (options.nesting = true).
• None of the Node's builtin modules is enabled by default.

VM options

let options = {
    console: 'inherit',
    sandbox: {},
    require: true,
    requireExternal: true,
    requireNative: ['fs', 'path'],
    requireRoot: "./",
    language: 'javascript',
    useStrict: true
};

changed to:

let options = {
    console: 'inherit',
    sandbox: {},
    require: {
        external: true,
        builtin: ['fs', 'path'],
        root: "./"
    },
    compiler: 'javascript'
};

NOTE: useStrict option was removed.

NodeVM

Previous versions wrapped the code into CommonJS wrapper only first time you called the run method. v3 wraps the code everytime you call run method. That means that if you want to return a value from the sandbox, you must always use module.exports = variable assignment. Thanks to that change it is now possible to use require each time you call run method.