sparanoid.com
sparanoid.com copied to clipboard
chore(deps): update dependency terser to v5.14.2 [security]
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| terser (source) | 5.7.0 -> 5.14.2 |
GitHub Vulnerability Alerts
CVE-2022-25858
The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.
Release Notes
terser/terser
v5.14.2
- Security fix for RegExps that should not be evaluated (regexp DDOS)
- Source maps improvements (#1211)
- Performance improvements in long property access evaluation (#1213)
v5.14.1
- keep_numbers option added to TypeScript defs (#1208)
- Fixed parsing of nested template strings (#1204)
v5.14.0
- Switched to @jridgewell/source-map for sourcemap generation (#1190, #1181)
- Fixed source maps with non-terminated segments (#1106)
- Enabled typescript types to be imported from the package (#1194)
- Extra DOM props have been added (#1191)
- Delete the AST while generating code, as a means to save RAM
v5.13.1
- Removed self-assignments (
varname=varname) (closes #1081) - Separated inlining code (for inlining things into references, or removing IIFEs)
- Allow multiple identifiers with the same name in
vardestructuring (egvar { a, a } = x) (#1176)
v5.13.0
- All calls to eval() were removed (#1171, #1184)
source-mapwas updated to 0.8.0-beta.0 (#1164)- NavigatorUAData was added to domprops to avoid property mangling (#1166)
v5.12.1
- Fixed an issue with function definitions inside blocks (#1155)
- Fixed parens of
newin some situations (closes #1159)
v5.12.0
TERSER_DEBUG_DIRenvironment variable- @copyright comments are now preserved with the comments="some" option (#1153)
v5.11.0
- Unicode code point escapes (
\u{abcde}) are not emitted inside RegExp literals anymore (#1147) - acorn is now a regular dependency
v5.10.0
- Massive optimization to max_line_len (#1109)
- Basic support for import assertions
- Marked ES2022 Object.hasOwn as a pure function
- Fix
delete optional?.property - New CI/CD pipeline with github actions (#1057)
- Fix reordering of switch branches (#1092), (#1084)
- Fix error when creating a class property called
get - Acorn dependency is now an optional peerDependency
- Fix mangling collision with exported variables (#1072)
- Fix an issue with
return someVariable = (async () => { ... })()(#1073)
v5.9.0
- Collapsing switch cases with the same bodies (even if they're not next to each other) (#1070).
- Fix evaluation of optional chain expressions (#1062)
- Fix mangling collision in ESM exports (#1063)
- Fix issue with mutating function objects after a second pass (#1047)
- Fix for inlining object spread
{ ...obj }(#1071) - Typescript typings fix (#1069)
v5.8.0
- Fixed shadowing variables while moving code in some cases (#1065)
- Stop mangling computed & quoted properties when keep_quoted is enabled.
- Fix for mangling private getter/setter and .#private access (#1060, #1068)
- Array.from has a new optimization when the unsafe option is set (#737)
- Mangle/propmangle let you generate your own identifiers through the nth_identifier option (#1061)
- More optimizations to switch statements (#1044)
v5.7.2
- Fixed issues with compressing functions defined in
global_defsoption (#1036) - New recipe for using Terser in gulp was added to RECIPES.md (#1035)
- Fixed issues with
??and?.(#1045) - Future reserved words such as
packageno longer require you to disable strict mode to be used as names. - Refactored huge compressor file into multiple more focused files.
- Avoided unparenthesized
inoperator in some for loops (it breaks parsing because of for..in loops) - Improved documentation (#1021, #1025)
- More type definitions (#1021)
v5.7.1
- Avoided collapsing assignments together if it would place a chain assignment on the left hand side, which is invalid syntax (
a?.b = c) - Removed undefined from object expansions (
{ ...void 0 }->{}) - Fix crash when checking if something is nullish or undefined (#1009)
- Fixed comparison of private class properties (#1015)
- Minor performance improvements (#993)
- Fixed scope of function defs in strict mode (they are block scoped)
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- [ ] If you want to rebase/retry this PR, click this checkbox.
This PR has been generated by Mend Renovate. View repository job log here.
Deploying with
Cloudflare Pages
| Latest commit: |
09167e7
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://a7cc75e3.sparanoid.pages.dev |
| Branch Preview URL: | https://renovate-npm-terser-vulnerab.sparanoid.pages.dev |