@rhinostone/swig 1.4.4 → 1.4.5

package/.changes/v1.4.5.md

@@ -0,0 +1,10 @@
+[1.4.5](https://github.com/gina-io/swig/tree/v1.4.5) / 2026-04-10
+-----------------------------------------------------------------
+
+* **Added** GitHub Actions CI workflow (lint + test on PRs and pushes)
+
+* **Added** Public roadmap (`ROADMAP.md`)
+
+* **Changed** Clean up legacy `paularmstrong` references in documentation
+
+* **Security** Replace `optimist` with `yargs` in CLI, removing `minimist` from the production dependency tree entirely (CVE-2021-44906 fully resolved)

package/.github/workflows/ci.yml

@@ -0,0 +1,19 @@
+name: CI
+
+on:
+  push:
+    branches: [develop, master]
+  pull_request:
+    branches: [develop, master]
+
+jobs:
+  lint-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: npm install --depth=100 --loglevel=error
+      - run: make lint
+      - run: make test

package/HISTORY.md

@@ -1,3 +1,14 @@
+[1.4.5](https://github.com/gina-io/swig/tree/v1.4.5) / 2026-04-10
+-----------------------------------------------------------------
+
+* **Added** GitHub Actions CI workflow (lint + test on PRs and pushes)
+
+* **Added** Public roadmap (`ROADMAP.md`)
+
+* **Changed** Clean up legacy `paularmstrong` references in documentation
+
+* **Security** Replace `optimist` with `yargs` in CLI, removing `minimist` from the production dependency tree entirely (CVE-2021-44906 fully resolved)
+
 [1.4.4](https://github.com/gina-io/swig/tree/v1.4.4) / 2026-04-10
 -----------------------------------------------------------------
 

package/README.md

@@ -1,7 +1,7 @@
 Swig
 ====
 
-[![NPM version](http://img.shields.io/npm/v/@rhinostone/swig.svg?style=flat)](https://www.npmjs.org/package/@rhinostone/swig) [![NPM Downloads](http://img.shields.io/npm/dm/@rhinostone/swig.svg?style=flat)](https://www.npmjs.org/package/@rhinostone/swig)
+[![CI](https://github.com/gina-io/swig/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/gina-io/swig/actions/workflows/ci.yml) [![NPM version](http://img.shields.io/npm/v/@rhinostone/swig.svg?style=flat)](https://www.npmjs.org/package/@rhinostone/swig) [![NPM Downloads](http://img.shields.io/npm/dm/@rhinostone/swig.svg?style=flat)](https://www.npmjs.org/package/@rhinostone/swig)
 
 > **Maintained fork.** This is [gina-io/swig](https://github.com/gina-io/swig), a maintained fork of the abandoned [paularmstrong/swig](https://github.com/paularmstrong/swig). Security fixes and critical bug fixes land here; no new features are planned. The original project has not had a release since 2014.
 
@@ -33,7 +33,7 @@ Installation
 Documentation
 -------------
 
-API reference is generated from [JSDoc](http://usejsdoc.org) comments inline in `lib/swig.js`, `lib/filters.js`, `lib/tags/`, and `lib/loaders/`. Run `make docs` to build and preview the static documentation site locally.
+API reference is generated from [JSDoc](https://jsdoc.app) comments inline in `lib/swig.js`, `lib/filters.js`, `lib/tags/`, and `lib/loaders/`. Run `make docs` to build and preview the static documentation site locally.
 
 Basic Example
 -------------

package/ROADMAP.md

@@ -0,0 +1,39 @@
+# Roadmap
+
+Planned work for `@rhinostone/swig`. Updated each release.
+
+For bug reports and feature requests, file an issue at [gina-io/swig](https://github.com/gina-io/swig/issues).
+
+---
+
+## v1.5.0 (next)
+
+| Status | Item |
+| --- | --- |
+| Planned | Investigate replacing external deps with internal modules |
+| Planned | Full security audit of dependency tree, template pipeline, and CLI argv flow |
+
+---
+
+## Completed
+
+### v1.4.5 (April 2026)
+
+- Replace `optimist` with `yargs` in CLI, removing `minimist` from the production dependency tree entirely (CVE-2021-44906 fully resolved)
+- Clean up legacy `paularmstrong` references in documentation
+- GitHub Actions CI workflow (lint + test on PRs and pushes)
+- Public roadmap (`ROADMAP.md`)
+
+### v1.4.4 (April 2026)
+
+- Block `__proto__`/`constructor`/`prototype` in templates (CVE-2023-25345)
+- Replace `nodelint` with ESLint v8
+- Fix pre-commit hook (exit-code gates, mocha failure detection)
+- Fix mocha `.bin` shim (silent on Node >= 18)
+- Loosen `tests/bin/bin.test.js` fixtures for modern V8
+- Replace `uglify-js` with `terser` in the Makefile build target
+- Update install/require references to `@rhinostone/swig`
+
+### v1.4.3 (April 2026)
+
+- Pin `minimist` to `^1.2.8` via npm `overrides` (CVE-2021-44906)

package/bin/swig.js

@@ -2,7 +2,7 @@
 /*jslint es5: true */
 
 var swig = require('../index'),
-  optimist = require('optimist'),
+  yargs = require('yargs'),
   fs = require('fs'),
   path = require('path'),
   filters = require('../lib/filters'),
@@ -11,7 +11,7 @@ var swig = require('../index'),
 
 var command,
   wrapstart = 'var tpl = ',
-  argv = optimist
+  argv = yargs
     .usage('\n Usage:\n' +
       '    $0 compile [files] [options]\n' +
       '    $0 run [files] [options]\n' +
@@ -43,7 +43,7 @@ var command,
     .default('method-name', 'tpl')
     .check(function (argv) {
       if (argv.v) {
-        return;
+        return true;
       }
 
       if (!argv._.length) {
@@ -62,6 +62,8 @@ var command,
       if (argv['method-name'] !== 'tpl') {
         argv['wrap-start'] = 'var ' + argv['method-name'] + ' = ';
       }
+
+      return true;
     })
     .argv,
   ctx = {},

package/dist/swig.js

@@ -2290,7 +2290,7 @@ exports.setDefaultTZOffset = function (offset) {
  * Create a new, separate Swig compile/render environment.
  *
  * @example
- * var swig = require('swig');
+ * var swig = require('@rhinostone/swig');
  * var myswig = new swig.Swig({varControls: ['<%=', '%>']});
  * myswig.render('Tacos are <%= tacos =>!', { locals: { tacos: 'delicious' }});
  * // => Tacos are delicious!

package/lib/swig.js

@@ -8,11 +8,11 @@ var utils = require('./utils'),
 /**
  * Swig version number as a string.
  * @example
- * if (swig.version === "1.4.4") { ... }
+ * if (swig.version === "1.4.5") { ... }
  *
  * @type {String}
  */
-exports.version = "1.4.4";
+exports.version = "1.4.5";
 
 /**
  * Swig Options Object. This object can be passed to many of the API-level Swig methods to control various aspects of the engine. All keys are optional.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig",
-  "version": "1.4.4",
+  "version": "1.4.5",
   "description": "A simple, powerful, and extendable templating engine for node.js and browsers, similar to Django, Jinja2, and Twig.",
   "keywords": [
     "template",
@@ -21,11 +21,8 @@
     "Rhinostone <contact@gina.io>"
   ],
   "dependencies": {
-    "optimist": "~0.6",
-    "uglify-js": "~2.4"
-  },
-  "overrides": {
-    "minimist": "^1.2.8"
+    "uglify-js": "~2.4",
+    "yargs": "~3.32"
   },
   "devDependencies": {
     "blanket": "~1.1",