[pull] master from javascript-obfuscator:master

.github/FUNDING.yml

@@ -1,2 +1,3 @@
+github: sanex3339
 open_collective: javascript-obfuscator
-custom: ["https://xscode.com/sanex3339/javascript-obfuscator"]
+custom: ["https://github.com/javascript-obfuscator/javascript-obfuscator#you-can-support-this-project-by-donating"]

.github/ISSUE_TEMPLATE.md

@@ -17,7 +17,10 @@
 1.
 2.
 3.
-4.
+
+## JavaScript Obfuscator Edition
+- JavaScript Obfuscator Open Source
+- JavaScript Obfuscator Pro via API or [http://obfuscator.io](http://obfuscator.io])
 
 ## Your Environment
 <!--- Include as many relevant details about the environment you experienced the bug in -->

.github/ISSUE_TEMPLATE/bug_report.md

@@ -24,7 +24,10 @@ assignees: ''
 1.
 2.
 3.
-4.
+
+## JavaScript Obfuscator Edition
+- JavaScript Obfuscator Open Source
+- JavaScript Obfuscator Pro via API or [http://obfuscator.io](http://obfuscator.io])
 
 ## Your Environment
 <!--- Include as many relevant details about the environment you experienced the bug in -->

.github/workflows/ci.yml

@@ -2,9 +2,9 @@ name: JavaScript Obfuscator CI
 
 on:
   push:
-    branches: [master]
+    branches: [master, release-**]
   pull_request:
-    branches: [master]
+    branches: [master, release-**]
   schedule:
     - cron: '0 1 * * *'
 
@@ -17,34 +17,50 @@ jobs:
       matrix:
         include:
           - os: ubuntu-latest,
-            node-version: 12.x
+            node-version: 20.x
           - os: ubuntu-latest,
-            node-version: 14.x
+            node-version: 22.x
           - os: ubuntu-latest,
-            node-version: 16.x
+            node-version: 24.x
           - os: windows-latest,
-            node-version: 14.x
+            node-version: 20.x
           - os: windows-latest,
-            node-version: 16.x
+            node-version: 22.x
+          - os: windows-latest,
+            node-version: 24.x
 
     steps:
-      - uses: actions/checkout@v2
-      - uses: styfle/cancel-workflow-action@0.6.0
+      - uses: actions/checkout@v4
+      - uses: styfle/cancel-workflow-action@0.12.1
         with:
           access_token: ${{ github.token }}
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: actions/cache@v2
+      - uses: actions/cache@v4
         with:
           path: '**/node_modules'
           key: ${{ runner.os }}-modules-${{ hashFiles('**/yarn.lock') }}
       - run: yarn install
       - run: yarn run build
+      - run: yarn run test:mocha-coverage
       - run: yarn run test:mocha-coverage:report
       - name: Coveralls
-        uses: coverallsapp/github-action@master
+        uses: coverallsapp/github-action@v2
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          path-to-lcov: './coverage/lcov.info'
+          parallel: true
+          flag-name: node-${{ matrix.node-version }}-${{ matrix.os }}
+
+  coveralls-finish:
+    needs: build
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Coveralls Finished
+        uses: coverallsapp/github-action@v2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
-          path-to-lcov: './coverage/lcov.info'
+          parallel-finished: true

.gitignore

@@ -1,3 +1,4 @@
+.claude
 .DS_Store
 .idea
 .nyc_output
@@ -13,3 +14,4 @@ npm-debug.log
 /test/benchmark/**/**
 *dockerfile
 /test*.js
+/reproductions

.mocharc.json

@@ -0,0 +1,3 @@
+{
+  "node-option": []
+}

.npmignore

@@ -1,4 +1,5 @@
 .awcache
+.claude
 .github
 .idea
 .nyc_output
@@ -9,3 +10,6 @@
 /src/
 /test/
 /test*.js
+index.ts
+index.cli.ts
+/reproductions

.prettierignore

@@ -0,0 +1,34 @@
+# Dependencies
+node_modules
+
+# Build output
+dist
+*.browser.js
+
+# Coverage
+coverage
+.nyc_output
+
+# Type definitions
+typings
+
+# Webpack bundles
+webpack
+
+# Lock files
+package-lock.json
+yarn.lock
+
+# Logs
+*.log
+
+# Temporary files
+*.tmp
+.DS_Store
+
+# Test fixtures and expected output
+test/**/*.expected.js
+test/**/*.fixture.js
+
+# Templates (custom code helpers - these are code templates, not regular code)
+src/custom-code-helpers/**/templates/*.ts

.prettierrc.js

@@ -0,0 +1,50 @@
+module.exports = {
+    // Basic formatting
+    printWidth: 120,
+    tabWidth: 4,
+    useTabs: false,
+    semi: true,
+    singleQuote: true,
+    quoteProps: 'consistent',
+    trailingComma: 'none',
+
+    // Spacing
+    bracketSpacing: true,
+    arrowParens: 'always',
+
+    // Line breaks
+    endOfLine: 'lf',
+
+    // TypeScript
+    parser: 'typescript',
+
+    // Override for specific file types
+    overrides: [
+        {
+            files: '*.ts',
+            options: {
+                parser: 'typescript'
+            }
+        },
+        {
+            files: '*.js',
+            options: {
+                parser: 'babel'
+            }
+        },
+        {
+            files: '*.json',
+            options: {
+                parser: 'json',
+                tabWidth: 2
+            }
+        },
+        {
+            files: '*.md',
+            options: {
+                parser: 'markdown',
+                proseWrap: 'preserve'
+            }
+        }
+    ]
+};

CHANGELOG.md

@@ -1,5 +1,171 @@
 Change Log
 
+v5.5.0
+---
+* Pro API: reworked large file uploads — fixed `413 Content Too Large` for ~4.4–4.6MB request bodies, and Blob uploads now send the raw source (`blobFormat: 'raw'`) instead of the JSON request body, so uploads always fit the plan's file size cap
+
+v5.4.7
+---
+* Fixed directory obfuscation with a set `sourceMapFileName` making all files share and overwrite one `.map`. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/817
+* Fixed CLI `--config` failures hiding the real cause behind a generic `Cannot open config file` message. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1101
+* Fixed `sourceMapFileName` ending in `.js.map` (e.g. `foo.min.js.map`) being mangled in the emitted `//# sourceMappingURL=` comment. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1312
+* Fixed `URIError: URI malformed` crash when `stringArray` with `base64`/`rc4` encoding processed a string literal containing lone surrogate code units (e.g. `"[^\uD800-\uDFFF]"`). Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1431
+* Bumped the production `brace-expansion` transitive dependency to a patched version, resolving `CVE-2026-25547`. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1405
+
+v5.4.6
+---
+* Fixed unicode (`\uXXXX`, `\u{XXXX}`) and hex (`\xXX`) escape sequences of string literals being un-escaped into their literal characters during obfuscation. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/345
+
+v5.4.5
+---
+* Fixed `controlFlowFlattening` intermittently dropping arguments of a spread call (e.g. `foo(...args)`) when it reused a control flow wrapper of a same-arity plain call. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1423
+* Fixed `selfDefending` making obfuscated code run several times slower on Bun/JavaScriptCore. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1421
+* Fixed dropped parentheses around an `in` operator inside an arrow body in a `for`-init, producing unparsable output. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1419
+
+v5.4.4
+---
+* Optimized scope identifiers transformer performance
+* Optimized identifier renaming performance by reusing scope analysis between transformers
+* Fixed `Invalid regular expression` error when obfuscating code that uses ES2025 RegExp pattern modifiers (e.g. `/(?i:abc)/`). Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1410
+* Fixed `SyntaxError` when obfuscating a class that extends a boolean literal (e.g. `class C extends true {}`). Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1131
+
+v5.4.3
+---
+* Fixed `controlFlowFlattening` occasionally dropping the `?.` short-circuit on `foo?.(arg)` calls, causing `TypeError: <X> is not a function`. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1408
+
+v5.4.2
+---
+* Fixed obfuscated code hanging in Bun when `selfDefending` is enabled. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1404
+
+v5.4.1
+---
+* Fixed `Utils.nodeRequire` causing `ReferenceError: require is not defined` in browser build by making it lazy-evaluated
+* Fixed missing space between keywords (`return`, `throw`, `typeof`) and Unicode surrogate pair identifiers in compact mode. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1112
+* Fixed `domainLock` being case-sensitive — domain values are now normalized to lowercase. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1182
+* Removed `source-map-support` runtime dependency. Use `node --enable-source-maps` instead. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1149
+
+v5.4.0
+---
+* Add support for `import attributes`. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1256
+* Add `renameProperties` support for private class fields and methods (`#foo`, `#bar()`). Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1220
+* Fixed `reservedNames` not preserving class method and property names when `stringArray` or `deadCodeInjection` is enabled. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1279
+* Fixed infinite loop / stack overflow when `reservedNames` patterns match all generated identifier names. Now throws a descriptive error instead. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1382
+* Fixed `transformObjectKeys` changing evaluation order when object expression is inside a sequence expression with preceding side effects (e.g. `return aux(ys), { min }`). Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1246
+* Fixed destructuring patterns inside class static blocks not being renamed when `renameGlobals` is disabled. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1141
+* Fixed CLI `--options-preset` not applying preset values for options not explicitly set via command line (e.g. `splitStrings` from `high-obfuscation` preset was ignored). Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1236
+* Replaced `mkdirp` dependency with native `fs.mkdirSync({ recursive: true })`. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1275. Thank you https://github.com/roli-lpci!
+* Updated reserved DOM properties list, fixing `renameProperties` breaking modern built-in methods like `Array.prototype.at()`. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1066
+* Replaced `conf` dependency with custom implementation using `env-paths` and native `fs`
+
+v5.3.1
+---
+* Fixed class expression name references inside class body being incorrectly resolved to an import binding with the same name, causing broken code at runtime. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1386
+
+v5.3.0
+---
+* Add Pro API support to CLI
+* Add large files upload support to Pro API
+
+v5.2.1
+---
+* Fixed `transformObjectKeys` incorrectly hoisting object literal outside of loop when loop body is a single statement without braces, causing all iterations to share the same object reference. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1300
+* Fixed parsing error when `await` is used as an identifier in non-async context. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1127
+* Fixed `deadCodeInjection` causing SyntaxError when `arguments` from collected block statements was injected into class field initializers or static initialization blocks. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1166
+* Fixed `transformObjectKeys` with `mangled` identifier generator causing variable shadowing when extracted object variable name matched an existing inner scope variable. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1232
+
+v5.2.0
+---
+* Skip obfuscation of `process.env.*`
+* Fixed `controlFlowFlattening` breaking short-circuit evaluation with spread operator and conditional objects. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1372
+* Fix Annex B function hoisting: block-scoped function declarations are now correctly linked to references outside the block in non-strict mode
+* Fixed `NodeUtils.cloneRecursive` corrupting `range` property when cloning AST nodes, causing scope analysis to incorrectly resolve destructuring default parameter references
+
+v5.1.0
+---
+* Add `version` parameter to the `apiConfig` to use different versions JavaScript Obfuscator Pro via API
+
+v5.0.1
+---
+* Add JavaScript Obfuscator PRO advertisement message
+
+v5.0.0
+---
+* Add JavaScript Obfuscator PRO support via calling its API
+
+v4.2.1
+---
+* Downgrade `multimatch` version to avoid esm errors
+
+v4.2.0
+---
+* Dropped support of Node versions 17 and below
+* Fix `transformObjectKeys` performance in some edge-cases
+* Fix `controlFlowFlattening` + optional chaining compatibility. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1325
+* Don't obfuscate import.meta.*. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1267
+* Revert `Improved stringArray calls wrapper templates` commit. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1330
+* Fix error when ClassExpression is the CallExpression callee. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1132
+* Don't publish root index.ts files to NPM. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1252
+* Update `class-validator` version. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1324
+* Update other dependencies
+* CLI: support `.mjs` and `.cjs` extensions. Kudos to https://github.com/javascript-obfuscator/javascript-obfuscator/pull/1301 
+
+v4.1.1
+---
+* Update supported Node.js versions up to `node@22`. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/pull/1100
+* Update `class-validator` version. Fixes https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1247
+* Fixed CI
+
+v4.1.0
+---
+* Add target `service-worker`
+
+v4.0.2
+---
+* Add support for `node@18`
+* Update dependencies
+
+v4.0.1
+---
+* Update `class-validator` dependency https://github.com/javascript-obfuscator/javascript-obfuscator/pull/1146
+
+v4.0.0
+---
+* **Breaking change:** `debugProtectionInterval` option now accepts value in milliseconds instead of `boolean` value. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1031
+
+v3.2.7
+---
+* Fixed cases when dead code is added to the inner code of `eval` expressions. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1053
+
+v3.2.6
+---
+* Improved integration between `renameProperties` and `controlFlowFlattening` options. Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1053
+
+v3.2.5
+---
+* Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1056
+
+v3.2.4
+---
+* Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1052
+
+v3.2.3
+---
+* Fixed missing transformation of string array calls in some cases
+* Fixed generation of reserved identifier names like `Map` or `Set` for `mangled` and `mangled-shuffled` identifier names generators
+
+v3.2.2
+---
+* Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/issues/1039
+
+v3.2.1
+---
+* Updated copyright
+
+v3.2.0
+---
+* **New options**: `stringArrayCallsTransform` and `stringArrayCallsTransformThreshold`
+* Fixed https://github.com/javascript-obfuscator/javascript-obfuscator/pull/1046
+
 v3.1.0
 ---
 * Added support of `es2022` features: class static block
@@ -887,4 +1053,4 @@ v0.7.0-dev.1
 * **Breaking API change:** now `obfuscate(sourceCode, options)` returns `ObfuscationResult` object instead `string`. `ObfuscationResult` object contains two public methods: `getObfuscatedCode()` and `getSourceMap()`.
 * CLI. Now any code can be obfuscated through CLI `javascript-obfuscator` command. See `README.md` for available options. 
 * New option `sourceMap` enables source map generation for obfuscated code.
-* New option `sourceMapMode` specifies source map generation mode.
+* New option `sourceMapMode` specifies source map generation mode.