@rhinostone/swig 1.4.5 → 1.4.6

package/.changes/v1.4.6.md

@@ -0,0 +1,6 @@
+[1.4.6](https://github.com/gina-io/swig/tree/v1.4.6) / 2026-04-10
+-----------------------------------------------------------------
+
+* **Changed** Exclude `.github/` from npm tarball
+
+* **Changed** Replace `uglify-js` with `terser` in CLI (`--minify` flag), removing the last Snyk-flagged runtime dependency (ReDoS, CVE in uglify-js@2.4)

package/HISTORY.md

@@ -1,3 +1,10 @@
+[1.4.6](https://github.com/gina-io/swig/tree/v1.4.6) / 2026-04-10
+-----------------------------------------------------------------
+
+* **Changed** Exclude `.github/` from npm tarball
+
+* **Changed** Replace `uglify-js` with `terser` in CLI (`--minify` flag), removing the last Snyk-flagged runtime dependency (ReDoS, CVE in uglify-js@2.4)
+
 [1.4.5](https://github.com/gina-io/swig/tree/v1.4.5) / 2026-04-10
 -----------------------------------------------------------------
 

package/ROADMAP.md

@@ -10,13 +10,17 @@ For bug reports and feature requests, file an issue at [gina-io/swig](https://gi
 
 | Status | Item |
 | --- | --- |
-| Planned | Investigate replacing external deps with internal modules |
 | Planned | Full security audit of dependency tree, template pipeline, and CLI argv flow |
 
 ---
 
 ## Completed
 
+### v1.4.6 (April 2026)
+
+- Replace `uglify-js` with `terser` in CLI (`--minify` flag), removing the last Snyk-flagged runtime dependency
+- Exclude `.github/` from npm tarball
+
 ### v1.4.5 (April 2026)
 
 - Replace `optimist` with `yargs` in CLI, removing `minimist` from the production dependency tree entirely (CVE-2021-44906 fully resolved)

package/bin/swig.js

@@ -7,7 +7,7 @@ var swig = require('../index'),
   path = require('path'),
   filters = require('../lib/filters'),
   utils = require('../lib/utils'),
-  uglify = require('uglify-js');
+  terser = require('terser');
 
 var command,
   wrapstart = 'var tpl = ',
@@ -23,7 +23,7 @@ var command,
       h: 'Show this help screen.',
       j: 'Variable context as a JSON file.',
       c: 'Variable context as a CommonJS-style file. Used only if option `j` is not provided.',
-      m: 'Minify compiled functions with uglify-js',
+      m: 'Minify compiled functions with terser',
       'filters': 'Custom filters as a CommonJS-style file',
       'tags': 'Custom tags as a CommonJS-style file',
       'options': 'Customize Swig\'s Options from a CommonJS-style file',
@@ -134,7 +134,7 @@ case 'compile':
     r = argv['wrap-start'] + r + argv['wrap-end'];
 
     if (argv.m) {
-      r = uglify.minify(r, { fromString: true }).code;
+      r = terser.minify_sync(r).code;
     }
 
     out(file, r);

package/lib/swig.js

@@ -8,11 +8,11 @@ var utils = require('./utils'),
 /**
  * Swig version number as a string.
  * @example
- * if (swig.version === "1.4.5") { ... }
+ * if (swig.version === "1.4.6") { ... }
  *
  * @type {String}
  */
-exports.version = "1.4.5";
+exports.version = "1.4.6";
 
 /**
  * Swig Options Object. This object can be passed to many of the API-level Swig methods to control various aspects of the engine. All keys are optional.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhinostone/swig",
-  "version": "1.4.5",
+  "version": "1.4.6",
   "description": "A simple, powerful, and extendable templating engine for node.js and browsers, similar to Django, Jinja2, and Twig.",
   "keywords": [
     "template",
@@ -21,7 +21,7 @@
     "Rhinostone <contact@gina.io>"
   ],
   "dependencies": {
-    "uglify-js": "~2.4",
+    "terser": "^5.46.1",
     "yargs": "~3.32"
   },
   "devDependencies": {
@@ -38,7 +38,6 @@
     "mocha-phantomjs": "~3.1",
     "phantomjs": "~1.9.1",
     "still": "0.0.7",
-    "terser": "^5.46.1",
     "travis-cov": "~0.2"
   },
   "license": "MIT",

package/.github/workflows/ci.yml

@@ -1,19 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [develop, master]
-  pull_request:
-    branches: [develop, master]
-
-jobs:
-  lint-and-test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - run: npm install --depth=100 --loglevel=error
-      - run: make lint
-      - run: make test