terser 5.9.0 → 5.14.2

package/CHANGELOG.md

@@ -1,5 +1,61 @@
 # Changelog
 
+## v5.14.2
+
+ - Security fix for RegExps that should not be evaluated (regexp DDOS)
+ - Source maps improvements (#1211)
+ - Performance improvements in long property access evaluation (#1213)
+
+## v5.14.1
+ - keep_numbers option added to TypeScript defs (#1208)
+ - Fixed parsing of nested template strings (#1204)
+
+## v5.14.0
+ - Switched to @jridgewell/source-map for sourcemap generation (#1190, #1181)
+ - Fixed source maps with non-terminated segments (#1106)
+ - Enabled typescript types to be imported from the package (#1194)
+ - Extra DOM props have been added (#1191)
+ - Delete the AST while generating code, as a means to save RAM
+
+## v5.13.1
+ - Removed self-assignments (`varname=varname`) (closes #1081)
+ - Separated inlining code (for inlining things into references, or removing IIFEs)
+ - Allow multiple identifiers with the same name in `var` destructuring (eg `var { a, a } = x`) (#1176)
+
+## v5.13.0
+
+ - All calls to eval() were removed (#1171, #1184)
+ - `source-map` was updated to 0.8.0-beta.0 (#1164)
+ - NavigatorUAData was added to domprops to avoid property mangling (#1166)
+
+## v5.12.1
+
+ - Fixed an issue with function definitions inside blocks (#1155)
+ - Fixed parens of `new` in some situations (closes #1159)
+
+## v5.12.0
+
+ - `TERSER_DEBUG_DIR` environment variable
+ - @copyright comments are now preserved with the comments="some" option (#1153)
+
+## v5.11.0
+
+ - Unicode code point escapes (`\u{abcde}`) are not emitted inside RegExp literals anymore (#1147)
+ - acorn is now a regular dependency
+
+## v5.10.0
+
+ - Massive optimization to max_line_len (#1109)
+ - Basic support for import assertions
+ - Marked ES2022 Object.hasOwn as a pure function
+ - Fix `delete optional?.property`
+ - New CI/CD pipeline with github actions (#1057)
+ - Fix reordering of switch branches (#1092), (#1084)
+ - Fix error when creating a class property called `get`
+ - Acorn dependency is now an optional peerDependency
+ - Fix mangling collision with exported variables (#1072)
+ - Fix an issue with `return someVariable = (async () => { ... })()` (#1073)
+
 ## v5.9.0
 
  - Collapsing switch cases with the same bodies (even if they're not next to each other) (#1070).
@@ -156,6 +212,13 @@ Hotfix release, fixes package.json "engines" syntax
  - Module is now distributed as a dual package - You can `import` and `require()` too.
  - Inline improvements were made
 
+
+-----
+
+## v4.8.1 (backport)
+
+ - Security fix for RegExps that should not be evaluated (regexp DDOS)
+
 ## v4.8.0
 
  - Support for numeric separators (`million = 1_000_000`) was added.

package/README.md

@@ -5,7 +5,7 @@
   [![Travis Build][travis-image]][travis-url]
   [![Opencollective financial contributors][opencollective-contributors]][opencollective-url]
 
-A JavaScript parser and mangler/compressor toolkit for ES6+.
+A JavaScript mangler/compressor toolkit for ES6+.
 
 *note*: You can support this project on patreon: <a target="_blank" rel="nofollow" href="https://www.patreon.com/fabiosantoscode"><img src="https://c5.patreon.com/external/logo/become_a_patron_button@2x.png" alt="patron" width="100px" height="auto"></a>. Check out [PATRONS.md](https://github.com/terser/terser/blob/master/PATRONS.md) for our first-tier patrons.
 
@@ -60,6 +60,12 @@ in sequence and apply any compression options.  The files are parsed in the
 same global scope, that is, a reference from a file to some
 variable/function declared in another file will be matched properly.
 
+Command line arguments that take options (like --parse, --compress, --mangle and
+--format) can take in a comma-separated list of default option overrides. For
+instance:
+
+    terser input.js --compress ecma=2015,computed_props=false
+
 If no input file is specified, Terser will read from STDIN.
 
 If you wish to pass your options before the input files, separate the two with
@@ -121,8 +127,8 @@ a double dash to prevent input files being used as option arguments:
                                 as JSON to STDOUT respectively.
     --comments [filter]         Preserve copyright comments in the output. By
                                 default this works like Google Closure, keeping
-                                JSDoc-style comments that contain "@license" or
-                                "@preserve". You can optionally pass one of the
+                                JSDoc-style comments that contain e.g. "@license",
+                                or start with "!". You can optionally pass one of the
                                 following arguments to this flag:
                                 - "all" to keep all comments
                                 - `false` to omit comments in the output
@@ -983,8 +989,8 @@ as "output options".
   statement.
 
 - `comments` (default `"some"`) -- by default it keeps JSDoc-style comments
-  that contain "@license", "@preserve" or start with `!`, pass `true` or
-  `"all"` to preserve all comments, `false` to omit comments in the output,
+  that contain "@license", "@copyright", "@preserve" or start with `!`, pass `true`
+  or `"all"` to preserve all comments, `false` to omit comments in the output,
   a regular expression string (e.g. `/^!/`) or a function.
 
 - `ecma` (default `5`) -- set desired EcmaScript standard version for output.
@@ -1056,9 +1062,9 @@ as "output options".
 ### Keeping copyright notices or other comments
 
 You can pass `--comments` to retain certain comments in the output.  By
-default it will keep JSDoc-style comments that contain "@preserve",
-"@license" or "@cc_on" (conditional compilation for IE).  You can pass
-`--comments all` to keep all the comments, or a valid JavaScript regexp to
+default it will keep comments starting with "!" and JSDoc-style comments that
+contain "@preserve", "@copyright", "@license" or "@cc_on" (conditional compilation for IE).
+You can pass `--comments all` to keep all the comments, or a valid JavaScript regexp to
 keep only comments that match this regexp.  For example `--comments /^!/`
 will keep comments like `/*! Copyright Notice */`.
 
@@ -1312,6 +1318,22 @@ $ yarn
 
 In the terser CLI we use [source-map-support](https://npmjs.com/source-map-support) to produce good error stacks. In your own app, you're expected to enable source-map-support (read their docs) to have nice stack traces that will help you write good issues.
 
+## Obtaining the source code given to Terser
+
+Because users often don't control the call to `await minify()` or its arguments, Terser provides a `TERSER_DEBUG_DIR` environment variable to make terser output some debug logs. If you're using a bundler or a project that includes a bundler and are not sure what went wrong with your code, pass that variable like so:
+
+```
+$ TERSER_DEBUG_DIR=/path/to/logs command-that-uses-terser
+$ ls /path/to/logs
+terser-debug-123456.log
+```
+
+If you're not sure how to set an environment variable on your shell (the above example works in bash), you can try using cross-env:
+
+```
+> npx cross-env TERSER_DEBUG_DIR=/path/to/logs command-that-uses-terser
+```
+
 # README.md Patrons:
 
 *note*: You can support this project on patreon: <a target="_blank" rel="nofollow" href="https://www.patreon.com/fabiosantoscode"><img src="https://c5.patreon.com/external/logo/become_a_patron_button@2x.png" alt="patron" width="100px" height="auto"></a>. Check out [PATRONS.md](https://github.com/terser/terser/blob/master/PATRONS.md) for our first-tier patrons.