@rhinostone/swig 1.4.4 → 1.4.6

package/.changes/v1.4.5.md

@@ -0,0 +1,10 @@
+[1.4.5](https://github.com/gina-io/swig/tree/v1.4.5) / 2026-04-10
+-----------------------------------------------------------------
+
+* **Added** GitHub Actions CI workflow (lint + test on PRs and pushes)
+
+* **Added** Public roadmap (`ROADMAP.md`)
+
+* **Changed** Clean up legacy `paularmstrong` references in documentation
+
+* **Security** Replace `optimist` with `yargs` in CLI, removing `minimist` from the production dependency tree entirely (CVE-2021-44906 fully resolved)

package/.changes/v1.4.6.md

@@ -0,0 +1,6 @@
+[1.4.6](https://github.com/gina-io/swig/tree/v1.4.6) / 2026-04-10
+-----------------------------------------------------------------
+
+* **Changed** Exclude `.github/` from npm tarball
+
+* **Changed** Replace `uglify-js` with `terser` in CLI (`--minify` flag), removing the last Snyk-flagged runtime dependency (ReDoS, CVE in uglify-js@2.4)

package/HISTORY.md

@@ -1,3 +1,21 @@
+[1.4.6](https://github.com/gina-io/swig/tree/v1.4.6) / 2026-04-10
+-----------------------------------------------------------------
+
+* **Changed** Exclude `.github/` from npm tarball
+
+* **Changed** Replace `uglify-js` with `terser` in CLI (`--minify` flag), removing the last Snyk-flagged runtime dependency (ReDoS, CVE in uglify-js@2.4)
+
+[1.4.5](https://github.com/gina-io/swig/tree/v1.4.5) / 2026-04-10
+-----------------------------------------------------------------
+
+* **Added** GitHub Actions CI workflow (lint + test on PRs and pushes)
+
+* **Added** Public roadmap (`ROADMAP.md`)
+
+* **Changed** Clean up legacy `paularmstrong` references in documentation
+
+* **Security** Replace `optimist` with `yargs` in CLI, removing `minimist` from the production dependency tree entirely (CVE-2021-44906 fully resolved)
+
 [1.4.4](https://github.com/gina-io/swig/tree/v1.4.4) / 2026-04-10
 -----------------------------------------------------------------
 

package/README.md

@@ -1,7 +1,7 @@
 Swig
 ====
 
-[![NPM version](http://img.shields.io/npm/v/@rhinostone/swig.svg?style=flat)](https://www.npmjs.org/package/@rhinostone/swig) [![NPM Downloads](http://img.shields.io/npm/dm/@rhinostone/swig.svg?style=flat)](https://www.npmjs.org/package/@rhinostone/swig)
+[![CI](https://github.com/gina-io/swig/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/gina-io/swig/actions/workflows/ci.yml) [![NPM version](http://img.shields.io/npm/v/@rhinostone/swig.svg?style=flat)](https://www.npmjs.org/package/@rhinostone/swig) [![NPM Downloads](http://img.shields.io/npm/dm/@rhinostone/swig.svg?style=flat)](https://www.npmjs.org/package/@rhinostone/swig)
 
 > **Maintained fork.** This is [gina-io/swig](https://github.com/gina-io/swig), a maintained fork of the abandoned [paularmstrong/swig](https://github.com/paularmstrong/swig). Security fixes and critical bug fixes land here; no new features are planned. The original project has not had a release since 2014.
 
@@ -33,7 +33,7 @@ Installation
 Documentation
 -------------
 
-API reference is generated from [JSDoc](http://usejsdoc.org) comments inline in `lib/swig.js`, `lib/filters.js`, `lib/tags/`, and `lib/loaders/`. Run `make docs` to build and preview the static documentation site locally.
+API reference is generated from [JSDoc](https://jsdoc.app) comments inline in `lib/swig.js`, `lib/filters.js`, `lib/tags/`, and `lib/loaders/`. Run `make docs` to build and preview the static documentation site locally.
 
 Basic Example
 -------------

package/ROADMAP.md

@@ -0,0 +1,43 @@
+# Roadmap
+
+Planned work for `@rhinostone/swig`. Updated each release.
+
+For bug reports and feature requests, file an issue at [gina-io/swig](https://github.com/gina-io/swig/issues).
+
+---
+
+## v1.5.0 (next)
+
+| Status | Item |
+| --- | --- |
+| Planned | Full security audit of dependency tree, template pipeline, and CLI argv flow |
+
+---
+
+## Completed
+
+### v1.4.6 (April 2026)
+
+- Replace `uglify-js` with `terser` in CLI (`--minify` flag), removing the last Snyk-flagged runtime dependency
+- Exclude `.github/` from npm tarball
+
+### v1.4.5 (April 2026)
+
+- Replace `optimist` with `yargs` in CLI, removing `minimist` from the production dependency tree entirely (CVE-2021-44906 fully resolved)
+- Clean up legacy `paularmstrong` references in documentation
+- GitHub Actions CI workflow (lint + test on PRs and pushes)
+- Public roadmap (`ROADMAP.md`)
+
+### v1.4.4 (April 2026)
+
+- Block `__proto__`/`constructor`/`prototype` in templates (CVE-2023-25345)
+- Replace `nodelint` with ESLint v8
+- Fix pre-commit hook (exit-code gates, mocha failure detection)
+- Fix mocha `.bin` shim (silent on Node >= 18)
+- Loosen `tests/bin/bin.test.js` fixtures for modern V8
+- Replace `uglify-js` with `terser` in the Makefile build target
+- Update install/require references to `@rhinostone/swig`
+
+### v1.4.3 (April 2026)
+
+- Pin `minimist` to `^1.2.8` via npm `overrides` (CVE-2021-44906)

package/bin/swig.js

@@ -2,16 +2,16 @@
 /*jslint es5: true */
 
 var swig = require('../index'),
-  optimist = require('optimist'),
+  yargs = require('yargs'),
   fs = require('fs'),
   path = require('path'),
   filters = require('../lib/filters'),
   utils = require('../lib/utils'),
-  uglify = require('uglify-js');
+  terser = require('terser');
 
 var command,
   wrapstart = 'var tpl = ',
-  argv = optimist
+  argv = yargs
     .usage('\n Usage:\n' +
       '    $0 compile [files] [options]\n' +
       '    $0 run [files] [options]\n' +
@@ -23,7 +23,7 @@ var command,
       h: 'Show this help screen.',
       j: 'Variable context as a JSON file.',
       c: 'Variable context as a CommonJS-style file. Used only if option `j` is not provided.',
-      m: 'Minify compiled functions with uglify-js',
+      m: 'Minify compiled functions with terser',
       'filters': 'Custom filters as a CommonJS-style file',
       'tags': 'Custom tags as a CommonJS-style file',
       'options': 'Customize Swig\'s Options from a CommonJS-style file',
@@ -43,7 +43,7 @@ var command,
     .default('method-name', 'tpl')
     .check(function (argv) {
       if (argv.v) {
-        return;
+        return true;
       }
 
       if (!argv._.length) {
@@ -62,6 +62,8 @@ var command,
       if (argv['method-name'] !== 'tpl') {
         argv['wrap-start'] = 'var ' + argv['method-name'] + ' = ';
       }
+
+      return true;
     })
     .argv,
   ctx = {},
@@ -132,7 +134,7 @@ case 'compile':
     r = argv['wrap-start'] + r + argv['wrap-end'];
 
     if (argv.m) {
-      r = uglify.minify(r, { fromString: true }).code;
+      r = terser.minify_sync(r).code;
     }
 
     out(file, r);

package/dist/swig.js

@@ -2290,7 +2290,7 @@ exports.setDefaultTZOffset = function (offset) {
  * Create a new, separate Swig compile/render environment.
  *
  * @example
- * var swig = require('swig');
+ * var swig = require('@rhinostone/swig');
  * var myswig = new swig.Swig({varControls: ['<%=', '%>']});
  * myswig.render('Tacos are <%= tacos =>!', { locals: { tacos: 'delicious' }});
  * // => Tacos are delicious!

package/lib/swig.js

@@ -8,11 +8,11 @@ var utils = require('./utils'),
 /**
  * Swig version number as a string.
  * @example
- * if (swig.version === "1.4.4") { ... }
+ * if (swig.version === "1.4.6") { ... }
  *
  * @type {String}
  */
-exports.version = "1.4.4";
+exports.version = "1.4.6";
 
 /**
  * Swig Options Object. This object can be passed to many of the API-level Swig methods to control various aspects of the engine. All keys are optional.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig",
-  "version": "1.4.4",
+  "version": "1.4.6",
   "description": "A simple, powerful, and extendable templating engine for node.js and browsers, similar to Django, Jinja2, and Twig.",
   "keywords": [
     "template",
@@ -21,11 +21,8 @@
     "Rhinostone <contact@gina.io>"
   ],
   "dependencies": {
-    "optimist": "~0.6",
-    "uglify-js": "~2.4"
-  },
-  "overrides": {
-    "minimist": "^1.2.8"
+    "terser": "^5.46.1",
+    "yargs": "~3.32"
   },
   "devDependencies": {
     "blanket": "~1.1",
@@ -41,7 +38,6 @@
     "mocha-phantomjs": "~3.1",
     "phantomjs": "~1.9.1",
     "still": "0.0.7",
-    "terser": "^5.46.1",
     "travis-cov": "~0.2"
   },
   "license": "MIT",