sparanoid.com icon indicating copy to clipboard operation
sparanoid.com copied to clipboard

chore(deps): update dependency terser to v5.14.2 [security]

Open renovate[bot] opened this issue 3 years ago • 1 comments

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
terser (source) 5.7.0 -> 5.14.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-25858

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.


Release Notes

terser/terser

v5.14.2

Compare Source

  • Security fix for RegExps that should not be evaluated (regexp DDOS)
  • Source maps improvements (#​1211)
  • Performance improvements in long property access evaluation (#​1213)

v5.14.1

Compare Source

  • keep_numbers option added to TypeScript defs (#​1208)
  • Fixed parsing of nested template strings (#​1204)

v5.14.0

Compare Source

v5.13.1

Compare Source

  • Removed self-assignments (varname=varname) (closes #​1081)
  • Separated inlining code (for inlining things into references, or removing IIFEs)
  • Allow multiple identifiers with the same name in var destructuring (eg var { a, a } = x) (#​1176)

v5.13.0

Compare Source

  • All calls to eval() were removed (#​1171, #​1184)
  • source-map was updated to 0.8.0-beta.0 (#​1164)
  • NavigatorUAData was added to domprops to avoid property mangling (#​1166)

v5.12.1

Compare Source

  • Fixed an issue with function definitions inside blocks (#​1155)
  • Fixed parens of new in some situations (closes #​1159)

v5.12.0

Compare Source

  • TERSER_DEBUG_DIR environment variable
  • @​copyright comments are now preserved with the comments="some" option (#​1153)

v5.11.0

Compare Source

  • Unicode code point escapes (\u{abcde}) are not emitted inside RegExp literals anymore (#​1147)
  • acorn is now a regular dependency

v5.10.0

Compare Source

  • Massive optimization to max_line_len (#​1109)
  • Basic support for import assertions
  • Marked ES2022 Object.hasOwn as a pure function
  • Fix delete optional?.property
  • New CI/CD pipeline with github actions (#​1057)
  • Fix reordering of switch branches (#​1092), (#​1084)
  • Fix error when creating a class property called get
  • Acorn dependency is now an optional peerDependency
  • Fix mangling collision with exported variables (#​1072)
  • Fix an issue with return someVariable = (async () => { ... })() (#​1073)

v5.9.0

Compare Source

  • Collapsing switch cases with the same bodies (even if they're not next to each other) (#​1070).
  • Fix evaluation of optional chain expressions (#​1062)
  • Fix mangling collision in ESM exports (#​1063)
  • Fix issue with mutating function objects after a second pass (#​1047)
  • Fix for inlining object spread { ...obj } (#​1071)
  • Typescript typings fix (#​1069)

v5.8.0

Compare Source

  • Fixed shadowing variables while moving code in some cases (#​1065)
  • Stop mangling computed & quoted properties when keep_quoted is enabled.
  • Fix for mangling private getter/setter and .#private access (#​1060, #​1068)
  • Array.from has a new optimization when the unsafe option is set (#​737)
  • Mangle/propmangle let you generate your own identifiers through the nth_identifier option (#​1061)
  • More optimizations to switch statements (#​1044)

v5.7.2

Compare Source

  • Fixed issues with compressing functions defined in global_defs option (#​1036)
  • New recipe for using Terser in gulp was added to RECIPES.md (#​1035)
  • Fixed issues with ?? and ?. (#​1045)
  • Future reserved words such as package no longer require you to disable strict mode to be used as names.
  • Refactored huge compressor file into multiple more focused files.
  • Avoided unparenthesized in operator in some for loops (it breaks parsing because of for..in loops)
  • Improved documentation (#​1021, #​1025)
  • More type definitions (#​1021)

v5.7.1

Compare Source

  • Avoided collapsing assignments together if it would place a chain assignment on the left hand side, which is invalid syntax (a?.b = c)
  • Removed undefined from object expansions ({ ...void 0 } -> {})
  • Fix crash when checking if something is nullish or undefined (#​1009)
  • Fixed comparison of private class properties (#​1015)
  • Minor performance improvements (#​993)
  • Fixed scope of function defs in strict mode (they are block scoped)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • [ ] If you want to rebase/retry this PR, click this checkbox.

This PR has been generated by Mend Renovate. View repository job log here.

renovate[bot] avatar Sep 25 '22 18:09 renovate[bot]

Deploying with  Cloudflare Pages  Cloudflare Pages

Latest commit: 09167e7
Status: ✅  Deploy successful!
Preview URL: https://a7cc75e3.sparanoid.pages.dev
Branch Preview URL: https://renovate-npm-terser-vulnerab.sparanoid.pages.dev

View logs