html-minifier-next 6.2.2 → 6.2.3

package/dist/htmlminifier.cjs

@@ -2103,7 +2103,7 @@ const processOptions = (inputOptions, { getLightningCSS, getTerser, getSwc, getS
 // Imports
 
 
-// Lazy-load entities only when `decodeEntities` is enabled
+// Lazy-load entities (used for `decodeEntities` and event-handler attribute decode before `minifyJS`)
 
 let decodeHTMLStrictPromise;
 async function getDecodeHTMLStrict() {
@@ -2399,6 +2399,23 @@ function cleanAttributeValue(tag, attrName, attrValue, options, attrs, minifyHTM
 
   if (isEventAttr) {
     attrValue = trimWhitespace(attrValue).replace(/^javascript:\s*/i, '');
+    // Browsers decode attribute values before running event-handler JS—
+    // decode first so the minifier gets valid JavaScript
+    if (!options.decodeEntities && options.minifyJS !== identity && attrValue.indexOf('&') !== -1) {
+      return getDecodeHTMLStrict().then(decode => {
+        const decoded = decode(attrValue);
+        const result = options.minifyJS(decoded, true);
+        const reEncode = v => (v && v.indexOf('&') !== -1) ? v.replace(RE_AMP_ENTITY, '&$1') : v;
+        if (isThenable(result)) {
+          return result.then(reEncode, err => {
+            if (!options.continueOnMinifyError) throw err;
+            options.log && options.log(err);
+            return attrValue;
+          });
+        }
+        return reEncode(result);
+      });
+    }
     const result = options.minifyJS(attrValue, true);
     if (isThenable(result)) {
       return result.catch(err => {

package/dist/types/lib/attributes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attributes.d.ts","sourceRoot":"","sources":["../../../src/lib/attributes.js"],"names":[],"mappings":"AAmCA,mEAOC;AAED,uEAWC;AAED,8DAGC;AAED,4EAOC;AAgCD,mGAuCC;AAED,mEAGC;AAED,qEAGC;AAED,kEAWC;AAED,sEAGC;AAED,8DAWC;AAED,2EAIC;AAmBD,qEAGC;AAgBD,wEAGC;AAED,sEAUC;AAED,2EAEC;AAED,2DAEC;AAED,8DAUC;AAED,uEAUC;AAED,oGASC;AAED,4DAOC;AAUD,iIA4KC;AAwBD,mGAYC;AA0CD,6GAuHC;AAxlBD;;;;;;;GAOG;AACH,mEAHW,OAAO,SAuBjB"}
+{"version":3,"file":"attributes.d.ts","sourceRoot":"","sources":["../../../src/lib/attributes.js"],"names":[],"mappings":"AAmCA,mEAOC;AAED,uEAWC;AAED,8DAGC;AAED,4EAOC;AAgCD,mGAuCC;AAED,mEAGC;AAED,qEAGC;AAED,kEAWC;AAED,sEAGC;AAED,8DAWC;AAED,2EAIC;AAmBD,qEAGC;AAgBD,wEAGC;AAED,sEAUC;AAED,2EAEC;AAED,2DAEC;AAED,8DAUC;AAED,uEAUC;AAED,oGASC;AAED,4DAOC;AAUD,iIA6LC;AAwBD,mGAYC;AA0CD,6GAuHC;AAzmBD;;;;;;;GAOG;AACH,mEAHW,OAAO,SAuBjB"}

package/package.json

@@ -5,25 +5,25 @@
   },
   "bugs": "https://github.com/j9t/html-minifier-next/issues",
   "dependencies": {
-    "commander": "^14.0.2",
+    "commander": "^14.0.3",
     "entities": "^8.0.0",
     "lightningcss": "^1.32.0",
     "svgo": "^4.0.1",
-    "terser": "^5.46.1"
+    "terser": "^5.46.2"
   },
   "description": "Super-configurable and well-tested web page minifier (enhanced successor of HTML Minifier)",
   "devDependencies": {
-    "@commitlint/cli": "^20.5.0",
+    "@commitlint/cli": "^20.5.3",
     "@eslint/js": "^10.0.1",
     "@rollup/plugin-commonjs": "^29.0.2",
     "@rollup/plugin-json": "^6.1.0",
     "@rollup/plugin-node-resolve": "^16.0.3",
-    "@swc/core": "^1.15.30",
-    "eslint": "^10.2.0",
+    "@swc/core": "^1.15.32",
+    "eslint": "^10.3.0",
     "rollup": "^4.60.2",
     "rollup-plugin-polyfill-node": "^0.13.0",
     "typescript": "^6.0.3",
-    "vite": "^8.0.8"
+    "vite": "^8.0.10"
   },
   "exports": {
     ".": {
@@ -96,5 +96,5 @@
   },
   "type": "module",
   "types": "./dist/types/htmlminifier.d.ts",
-  "version": "6.2.2"
+  "version": "6.2.3"
 }

package/src/lib/attributes.js

@@ -19,9 +19,9 @@ import {
 } from './constants.js';
 import { trimWhitespace, collapseWhitespaceAll } from './whitespace.js';
 import { shouldMinifyInnerHTML } from './options.js';
-import { isThenable } from './utils.js';
+import { identity, isThenable } from './utils.js';
 
-// Lazy-load entities only when `decodeEntities` is enabled
+// Lazy-load entities (used for `decodeEntities` and event-handler attribute decode before `minifyJS`)
 
 let decodeHTMLStrictPromise;
 async function getDecodeHTMLStrict() {
@@ -317,6 +317,23 @@ function cleanAttributeValue(tag, attrName, attrValue, options, attrs, minifyHTM
 
   if (isEventAttr) {
     attrValue = trimWhitespace(attrValue).replace(/^javascript:\s*/i, '');
+    // Browsers decode attribute values before running event-handler JS—
+    // decode first so the minifier gets valid JavaScript
+    if (!options.decodeEntities && options.minifyJS !== identity && attrValue.indexOf('&') !== -1) {
+      return getDecodeHTMLStrict().then(decode => {
+        const decoded = decode(attrValue);
+        const result = options.minifyJS(decoded, true);
+        const reEncode = v => (v && v.indexOf('&') !== -1) ? v.replace(RE_AMP_ENTITY, '&$1') : v;
+        if (isThenable(result)) {
+          return result.then(reEncode, err => {
+            if (!options.continueOnMinifyError) throw err;
+            options.log && options.log(err);
+            return attrValue;
+          });
+        }
+        return reEncode(result);
+      });
+    }
     const result = options.minifyJS(attrValue, true);
     if (isThenable(result)) {
       return result.catch(err => {