html-minifier-next 6.2.1 → 6.2.3

package/dist/htmlminifier.cjs

@@ -43,6 +43,17 @@ class LRU {
   delete(key) { this.map.delete(key); }
 }
 
+// FNV-1a 32-bit hash for large-input cache keys
+
+function hashContent(str) {
+  let hash = 2166136261;
+  for (let i = 0; i < str.length; i++) {
+    hash ^= str.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(36);
+}
+
 // Unique ID generator
 
 function uniqueId(value) {
@@ -1816,12 +1827,11 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
           );
         }
 
-        // Cache key: Wrapped content, type, options signature
+        // Cache key: Content + type + options signature; large inputs are hashed to avoid huge Map keys
         const inputCSS = wrapCSS(text, type);
         const cssSig = stableStringify({ type, opts: lightningCssOptions, cont: !!options.continueOnMinifyError });
-        // For large inputs, use length and content fingerprint (first/last 50 chars) to prevent collisions
         const cssKey = inputCSS.length > 2048
-          ? (inputCSS.length + '|' + inputCSS.slice(0, 50) + inputCSS.slice(-50) + '|' + type + '|' + cssSig)
+          ? (hashContent(inputCSS) + '|' + type + '|' + cssSig)
           : (inputCSS + '|' + type + '|' + cssSig);
 
         try {
@@ -1931,8 +1941,8 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
           // Select pre-computed signature based on engine
           const optsSig = useEngine === 'terser' ? terserSig : swcSig;
 
-          // For large inputs, use length and content fingerprint to prevent collisions
-          jsKey = (code.length > 2048 ? (code.length + '|' + code.slice(0, 50) + code.slice(-50) + '|') : (code + '|'))
+          // For large inputs, hash the full content to avoid storing huge strings as Map keys
+          jsKey = (code.length > 2048 ? (hashContent(code) + '|') : (code + '|'))
             + (inline ? '1' : '0') + '|' + (isModule ? 'm' : '') + '|' + useEngine + '|' + optsSig;
 
           const cached = jsMinifyCache.get(jsKey);
@@ -2044,9 +2054,9 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
           return svgContent;
         }
 
-        // Cache key
+        // Cache key: Large inputs are hashed to avoid huge Map keys
         const svgKey = svgContent.length > 2048
-          ? (svgContent.length + '|' + svgContent.slice(0, 50) + svgContent.slice(-50) + '|' + svgSig)
+          ? (hashContent(svgContent) + '|' + svgSig)
           : (svgContent + '|' + svgSig);
 
         try {
@@ -2093,7 +2103,7 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
 // Imports
 
 
-// Lazy-load entities only when `decodeEntities` is enabled
+// Lazy-load entities (used for `decodeEntities` and event-handler attribute decode before `minifyJS`)
 
 let decodeHTMLStrictPromise;
 async function getDecodeHTMLStrict() {
@@ -2389,6 +2399,23 @@ function cleanAttributeValue(tag, attrName, attrValue, options, attrs, minifyHTM
 
   if (isEventAttr) {
     attrValue = trimWhitespace(attrValue).replace(/^javascript:\s*/i, '');
+    // Browsers decode attribute values before running event-handler JS—
+    // decode first so the minifier gets valid JavaScript
+    if (!options.decodeEntities && options.minifyJS !== identity && attrValue.indexOf('&') !== -1) {
+      return getDecodeHTMLStrict().then(decode => {
+        const decoded = decode(attrValue);
+        const result = options.minifyJS(decoded, true);
+        const reEncode = v => (v && v.indexOf('&') !== -1) ? v.replace(RE_AMP_ENTITY, '&amp;$1') : v;
+        if (isThenable(result)) {
+          return result.then(reEncode, err => {
+            if (!options.continueOnMinifyError) throw err;
+            options.log && options.log(err);
+            return attrValue;
+          });
+        }
+        return reEncode(result);
+      });
+    }
     const result = options.minifyJS(attrValue, true);
     if (isThenable(result)) {
       return result.catch(err => {

package/dist/types/lib/attributes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attributes.d.ts","sourceRoot":"","sources":["../../../src/lib/attributes.js"],"names":[],"mappings":"AAmCA,mEAOC;AAED,uEAWC;AAED,8DAGC;AAED,4EAOC;AAgCD,mGAuCC;AAED,mEAGC;AAED,qEAGC;AAED,kEAWC;AAED,sEAGC;AAED,8DAWC;AAED,2EAIC;AAmBD,qEAGC;AAgBD,wEAGC;AAED,sEAUC;AAED,2EAEC;AAED,2DAEC;AAED,8DAUC;AAED,uEAUC;AAED,oGASC;AAED,4DAOC;AAUD,iIA4KC;AAwBD,mGAYC;AA0CD,6GAuHC;AAxlBD;;;;;;;GAOG;AACH,mEAHW,OAAO,SAuBjB"}
+{"version":3,"file":"attributes.d.ts","sourceRoot":"","sources":["../../../src/lib/attributes.js"],"names":[],"mappings":"AAmCA,mEAOC;AAED,uEAWC;AAED,8DAGC;AAED,4EAOC;AAgCD,mGAuCC;AAED,mEAGC;AAED,qEAGC;AAED,kEAWC;AAED,sEAGC;AAED,8DAWC;AAED,2EAIC;AAmBD,qEAGC;AAgBD,wEAGC;AAED,sEAUC;AAED,2EAEC;AAED,2DAEC;AAED,8DAUC;AAED,uEAUC;AAED,oGASC;AAED,4DAOC;AAUD,iIA6LC;AAwBD,mGAYC;AA0CD,6GAuHC;AAzmBD;;;;;;;GAOG;AACH,mEAHW,OAAO,SAuBjB"}

package/dist/types/lib/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/lib/options.js"],"names":[],"mappings":"AAYA,6DAUC;AAID;;;;;;;;;;;GAWG;AACH,6CAXW,OAAO,CAAC,eAAe,CAAC,mGAEhC;IAAuB,eAAe;IACf,SAAS;IACT,MAAM;CAA2B,GAK9C,eAAe,CAiX3B"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/lib/options.js"],"names":[],"mappings":"AAYA,6DAUC;AAID;;;;;;;;;;;GAWG;AACH,6CAXW,OAAO,CAAC,eAAe,CAAC,mGAEhC;IAAuB,eAAe;IACf,SAAS;IACT,MAAM;CAA2B,GAK9C,eAAe,CAgX3B"}

package/dist/types/lib/utils.d.ts

@@ -7,6 +7,7 @@ export class LRU {
     set(key: any, value: any): void;
     delete(key: any): void;
 }
+export function hashContent(str: any): string;
 export function uniqueId(value: any): string;
 export function identity(value: any): any;
 export function isThenable(value: any): boolean;

package/dist/types/lib/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/lib/utils.js"],"names":[],"mappings":"AAEA,+CAUC;AAID;IACE,4BAGC;IAFC,cAAkB;IAClB,mBAAoB;IAEtB,mBAQC;IACD,gCAOC;IACD,uBAAqC;CACtC;AAID,6CAMC;AAID,0CAEC;AAED,gDAEC;AAED,2CAEC;AAID;;;;;;GAMG;AACH,kCALW,MAAM,SACN,MAAM,sBAEJ,OAAO,CAAC,MAAM,CAAC,CAY3B;AAID,6CAUC"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/lib/utils.js"],"names":[],"mappings":"AAEA,+CAUC;AAID;IACE,4BAGC;IAFC,cAAkB;IAClB,mBAAoB;IAEtB,mBAQC;IACD,gCAOC;IACD,uBAAqC;CACtC;AAID,8CAOC;AAID,6CAMC;AAID,0CAEC;AAED,gDAEC;AAED,2CAEC;AAID;;;;;;GAMG;AACH,kCALW,MAAM,SACN,MAAM,sBAEJ,OAAO,CAAC,MAAM,CAAC,CAY3B;AAID,6CAUC"}

package/package.json

@@ -5,25 +5,25 @@
   },
   "bugs": "https://github.com/j9t/html-minifier-next/issues",
   "dependencies": {
-    "commander": "^14.0.2",
+    "commander": "^14.0.3",
     "entities": "^8.0.0",
     "lightningcss": "^1.32.0",
     "svgo": "^4.0.1",
-    "terser": "^5.46.1"
+    "terser": "^5.46.2"
   },
   "description": "Super-configurable and well-tested web page minifier (enhanced successor of HTML Minifier)",
   "devDependencies": {
-    "@commitlint/cli": "^20.5.0",
+    "@commitlint/cli": "^20.5.3",
     "@eslint/js": "^10.0.1",
     "@rollup/plugin-commonjs": "^29.0.2",
     "@rollup/plugin-json": "^6.1.0",
     "@rollup/plugin-node-resolve": "^16.0.3",
-    "@swc/core": "^1.15.30",
-    "eslint": "^10.2.0",
+    "@swc/core": "^1.15.32",
+    "eslint": "^10.3.0",
     "rollup": "^4.60.2",
     "rollup-plugin-polyfill-node": "^0.13.0",
     "typescript": "^6.0.3",
-    "vite": "^8.0.8"
+    "vite": "^8.0.10"
   },
   "exports": {
     ".": {
@@ -96,5 +96,5 @@
   },
   "type": "module",
   "types": "./dist/types/htmlminifier.d.ts",
-  "version": "6.2.1"
+  "version": "6.2.3"
 }

package/src/lib/attributes.js

@@ -19,9 +19,9 @@ import {
 } from './constants.js';
 import { trimWhitespace, collapseWhitespaceAll } from './whitespace.js';
 import { shouldMinifyInnerHTML } from './options.js';
-import { isThenable } from './utils.js';
+import { identity, isThenable } from './utils.js';
 
-// Lazy-load entities only when `decodeEntities` is enabled
+// Lazy-load entities (used for `decodeEntities` and event-handler attribute decode before `minifyJS`)
 
 let decodeHTMLStrictPromise;
 async function getDecodeHTMLStrict() {
@@ -317,6 +317,23 @@ function cleanAttributeValue(tag, attrName, attrValue, options, attrs, minifyHTM
 
   if (isEventAttr) {
     attrValue = trimWhitespace(attrValue).replace(/^javascript:\s*/i, '');
+    // Browsers decode attribute values before running event-handler JS—
+    // decode first so the minifier gets valid JavaScript
+    if (!options.decodeEntities && options.minifyJS !== identity && attrValue.indexOf('&') !== -1) {
+      return getDecodeHTMLStrict().then(decode => {
+        const decoded = decode(attrValue);
+        const result = options.minifyJS(decoded, true);
+        const reEncode = v => (v && v.indexOf('&') !== -1) ? v.replace(RE_AMP_ENTITY, '&$1') : v;
+        if (isThenable(result)) {
+          return result.then(reEncode, err => {
+            if (!options.continueOnMinifyError) throw err;
+            options.log && options.log(err);
+            return attrValue;
+          });
+        }
+        return reEncode(result);
+      });
+    }
     const result = options.minifyJS(attrValue, true);
     if (isThenable(result)) {
       return result.catch(err => {

package/src/lib/options.js

@@ -1,7 +1,7 @@
 // Imports
 
 import { createUrlMinifier } from './urls.js';
-import { LRU, stableStringify, identity, lowercase, replaceAsync, parseRegExp } from './utils.js';
+import { LRU, stableStringify, hashContent, identity, lowercase, replaceAsync, parseRegExp } from './utils.js';
 import { RE_TRAILING_SEMICOLON } from './constants.js';
 import { canCollapseWhitespace, canTrimWhitespace } from './whitespace.js';
 import { wrapCSS, unwrapCSS } from './content.js';
@@ -131,12 +131,11 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
           );
         }
 
-        // Cache key: Wrapped content, type, options signature
+        // Cache key: Content + type + options signature; large inputs are hashed to avoid huge Map keys
         const inputCSS = wrapCSS(text, type);
         const cssSig = stableStringify({ type, opts: lightningCssOptions, cont: !!options.continueOnMinifyError });
-        // For large inputs, use length and content fingerprint (first/last 50 chars) to prevent collisions
         const cssKey = inputCSS.length > 2048
-          ? (inputCSS.length + '|' + inputCSS.slice(0, 50) + inputCSS.slice(-50) + '|' + type + '|' + cssSig)
+          ? (hashContent(inputCSS) + '|' + type + '|' + cssSig)
           : (inputCSS + '|' + type + '|' + cssSig);
 
         try {
@@ -246,8 +245,8 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
           // Select pre-computed signature based on engine
           const optsSig = useEngine === 'terser' ? terserSig : swcSig;
 
-          // For large inputs, use length and content fingerprint to prevent collisions
-          jsKey = (code.length > 2048 ? (code.length + '|' + code.slice(0, 50) + code.slice(-50) + '|') : (code + '|'))
+          // For large inputs, hash the full content to avoid storing huge strings as Map keys
+          jsKey = (code.length > 2048 ? (hashContent(code) + '|') : (code + '|'))
             + (inline ? '1' : '0') + '|' + (isModule ? 'm' : '') + '|' + useEngine + '|' + optsSig;
 
           const cached = jsMinifyCache.get(jsKey);
@@ -359,9 +358,9 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
           return svgContent;
         }
 
-        // Cache key
+        // Cache key: Large inputs are hashed to avoid huge Map keys
         const svgKey = svgContent.length > 2048
-          ? (svgContent.length + '|' + svgContent.slice(0, 50) + svgContent.slice(-50) + '|' + svgSig)
+          ? (hashContent(svgContent) + '|' + svgSig)
           : (svgContent + '|' + svgSig);
 
         try {

package/src/lib/utils.js

@@ -39,6 +39,17 @@ class LRU {
   delete(key) { this.map.delete(key); }
 }
 
+// FNV-1a 32-bit hash for large-input cache keys
+
+function hashContent(str) {
+  let hash = 2166136261;
+  for (let i = 0; i < str.length; i++) {
+    hash ^= str.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(36);
+}
+
 // Unique ID generator
 
 function uniqueId(value) {
@@ -102,6 +113,7 @@ function parseRegExp(value) {
 
 export { stableStringify };
 export { LRU };
+export { hashContent };
 export { uniqueId };
 export { identity };
 export { isThenable };