terser 5.9.0 → 5.14.2

package/lib/size.js

@@ -115,6 +115,7 @@ AST_Directive.prototype._size = function () {
     return 2 + this.value.length;
 };
 
+/** Count commas/semicolons necessary to show a list of expressions/statements */
 const list_overhead = (array) => array.length && array.length - 1;
 
 AST_Block.prototype._size = function () {
@@ -167,7 +168,7 @@ AST_Arrow.prototype._size = function () {
             && this.argnames[0] instanceof AST_Symbol
         )
     ) {
-        args_and_arrow += 2;
+        args_and_arrow += 2; // parens around the args
     }
 
     const body_overhead = this.is_braceless() ? 0 : list_overhead(this.body) + 2;
@@ -229,19 +230,16 @@ AST_Finally.prototype._size = function () {
     return 7 + list_overhead(this.body);
 };
 
-/*#__INLINE__*/
-const def_size = (size, def) => size + list_overhead(def.definitions);
-
 AST_Var.prototype._size = function () {
-    return def_size(4, this);
+    return 4 + list_overhead(this.definitions);
 };
 
 AST_Let.prototype._size = function () {
-    return def_size(4, this);
+    return 4 + list_overhead(this.definitions);
 };
 
 AST_Const.prototype._size = function () {
-    return def_size(6, this);
+    return 6 + list_overhead(this.definitions);
 };
 
 AST_VarDef.prototype._size = function () {
@@ -477,7 +475,7 @@ AST_NaN.prototype._size = () => 3;
 
 AST_Undefined.prototype._size = () => 6; // "void 0"
 
-AST_Hole.prototype._size = () => 0;  // comma is taken into account
+AST_Hole.prototype._size = () => 0;  // comma is taken into account by list_overhead()
 
 AST_Infinity.prototype._size = () => 8;
 

package/lib/sourcemap.js

@@ -43,45 +43,59 @@
 
 "use strict";
 
-import MOZ_SourceMap from "source-map";
-import {
-    defaults,
-} from "./utils/index.js";
+import {SourceMapConsumer, SourceMapGenerator} from "@jridgewell/source-map";
+import {defaults, HOP} from "./utils/index.js";
 
-// a small wrapper around fitzgen's source-map library
+// a small wrapper around source-map and @jridgewell/source-map
 async function SourceMap(options) {
     options = defaults(options, {
         file : null,
         root : null,
         orig : null,
-
-        orig_line_diff : 0,
-        dest_line_diff : 0,
+        files: {},
     });
 
     var orig_map;
-    var generator = new MOZ_SourceMap.SourceMapGenerator({
+    var generator = new SourceMapGenerator({
         file       : options.file,
         sourceRoot : options.root
     });
 
+    let sourcesContent = {__proto__: null};
+    let files = options.files;
+    for (var name in files) if (HOP(files, name)) {
+        sourcesContent[name] = files[name];
+    }
     if (options.orig) {
-        orig_map = await new MOZ_SourceMap.SourceMapConsumer(options.orig);
-        orig_map.sources.forEach(function(source) {
-            var sourceContent = orig_map.sourceContentFor(source, true);
-            if (sourceContent) {
-                generator.setSourceContent(source, sourceContent);
-            }
-        });
+        // We support both @jridgewell/source-map (which has a sync
+        // SourceMapConsumer) and source-map (which has an async
+        // SourceMapConsumer).
+        orig_map = await new SourceMapConsumer(options.orig);
+        if (orig_map.sourcesContent) {
+            orig_map.sources.forEach(function(source, i) {
+                var content = orig_map.sourcesContent[i];
+                if (content) {
+                    sourcesContent[source] = content;
+                }
+            });
+        }
     }
 
     function add(source, gen_line, gen_col, orig_line, orig_col, name) {
+        let generatedPos = { line: gen_line, column: gen_col };
+
         if (orig_map) {
             var info = orig_map.originalPositionFor({
                 line: orig_line,
                 column: orig_col
             });
             if (info.source === null) {
+                generator.addMapping({
+                    generated: generatedPos,
+                    original: null,
+                    source: null,
+                    name: null
+                });
                 return;
             }
             source = info.source;
@@ -90,22 +104,42 @@ async function SourceMap(options) {
             name = info.name || name;
         }
         generator.addMapping({
-            generated : { line: gen_line + options.dest_line_diff, column: gen_col },
-            original  : { line: orig_line + options.orig_line_diff, column: orig_col },
+            generated : generatedPos,
+            original  : { line: orig_line, column: orig_col },
             source    : source,
             name      : name
         });
+        generator.setSourceContent(source, sourcesContent[source]);
+    }
+
+    function clean(map) {
+        const allNull = map.sourcesContent && map.sourcesContent.every(c => c == null);
+        if (allNull) delete map.sourcesContent;
+        if (map.file === undefined) delete map.file;
+        if (map.sourceRoot === undefined) delete map.sourceRoot;
+        return map;
+    }
+
+    function getDecoded() {
+        if (!generator.toDecodedMap) return null;
+        return clean(generator.toDecodedMap());
+    }
+
+    function getEncoded() {
+        return clean(generator.toJSON());
+    }
+
+    function destroy() {
+        // @jridgewell/source-map's SourceMapConsumer does not need to be
+        // manually freed.
+        if (orig_map && orig_map.destroy) orig_map.destroy();
     }
 
     return {
-        add        : add,
-        get        : function() { return generator; },
-        toString   : function() { return generator.toString(); },
-        destroy    : function () {
-            if (orig_map && orig_map.destroy) {
-                orig_map.destroy();
-            }
-        }
+        add,
+        getDecoded,
+        getEncoded,
+        destroy,
     };
 }
 

package/lib/utils/index.js

@@ -249,7 +249,15 @@ function regexp_source_fix(source) {
         return (escaped ? "" : "\\") + lineTerminatorEscape[match];
     });
 }
-const all_flags = "gimuy";
+
+// Subset of regexps that is not going to cause regexp based DDOS
+// https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
+const re_safe_regexp = /^[\\/|\0\s\w^$.[\]()]*$/;
+
+/** Check if the regexp is safe for Terser to create without risking a RegExp DOS */
+export const regexp_is_safe = (source) => re_safe_regexp.test(source);
+
+const all_flags = "dgimsuy";
 function sort_regexp_flags(flags) {
     const existing_flags = new Set(flags.split(""));
     let out = "";

package/package.json

@@ -4,7 +4,7 @@
   "homepage": "https://terser.org",
   "author": "Mihai Bazon <mihai.bazon@gmail.com> (http://lisperator.net/)",
   "license": "BSD-2-Clause",
-  "version": "5.9.0",
+  "version": "5.14.2",
   "engines": {
     "node": ">=10"
   },
@@ -18,6 +18,7 @@
   "exports": {
     ".": [
       {
+        "types": "./tools/terser.d.ts",
         "import": "./main.js",
         "require": "./dist/bundle.min.js"
       },
@@ -43,22 +44,23 @@
     "main.js"
   ],
   "dependencies": {
+    "@jridgewell/source-map": "^0.3.2",
+    "acorn": "^8.5.0",
     "commander": "^2.20.0",
-    "source-map": "~0.7.2",
     "source-map-support": "~0.5.20"
   },
   "devDependencies": {
     "@ls-lint/ls-lint": "^1.10.0",
-    "acorn": "^8.5.0",
     "astring": "^1.7.5",
     "eslint": "^7.32.0",
     "eslump": "^3.0.0",
     "esm": "^3.2.25",
-    "mocha": "^9.1.1",
+    "mocha": "^9.2.0",
     "pre-commit": "^1.2.2",
     "rimraf": "^3.0.2",
     "rollup": "2.56.3",
-    "semver": "^7.3.4"
+    "semver": "^7.3.4",
+    "source-map": "~0.8.0-beta.0"
   },
   "scripts": {
     "test": "node test/compress.js && mocha test/mocha",
@@ -104,6 +106,8 @@
       "describe": false,
       "it": false,
       "require": false,
+      "before": false,
+      "after": false,
       "global": false,
       "process": false
     },

package/tools/domprops.js

@@ -320,6 +320,7 @@ export var domprops = [
     "COMMENT_NODE",
     "COMPARE_REF_TO_TEXTURE",
     "COMPILE_STATUS",
+    "COMPLETION_STATUS_KHR",
     "COMPRESSED_RGBA_S3TC_DXT1_EXT",
     "COMPRESSED_RGBA_S3TC_DXT3_EXT",
     "COMPRESSED_RGBA_S3TC_DXT5_EXT",
@@ -2979,6 +2980,7 @@ export var domprops = [
     "applyElement",
     "arc",
     "arcTo",
+    "architecture",
     "archive",
     "areas",
     "arguments",
@@ -3153,6 +3155,7 @@ export var domprops = [
     "bindTexture",
     "bindTransformFeedback",
     "bindVertexArray",
+    "bitness",
     "blendColor",
     "blendEquation",
     "blendEquationSeparate",
@@ -3314,6 +3317,8 @@ export var domprops = [
     "boxDecorationBreak",
     "boxShadow",
     "boxSizing",
+    "brand",
+    "brands",
     "break-after",
     "break-before",
     "break-inside",
@@ -4312,6 +4317,7 @@ export var domprops = [
     "fround",
     "fullPath",
     "fullScreen",
+    "fullVersionList",
     "fullscreen",
     "fullscreenElement",
     "fullscreenEnabled",
@@ -4437,6 +4443,7 @@ export var domprops = [
     "getFrequencyResponse",
     "getFullYear",
     "getGamepads",
+    "getHighEntropyValues",
     "getHitTestResults",
     "getHitTestResultsForTransientInput",
     "getHours",
@@ -5277,7 +5284,9 @@ export var domprops = [
     "mix-blend-mode",
     "mixBlendMode",
     "mm",
+    "mobile",
     "mode",
+    "model",
     "modify",
     "mount",
     "move",
@@ -6183,6 +6192,7 @@ export var domprops = [
     "placeItems",
     "placeSelf",
     "placeholder",
+    "platformVersion",
     "platform",
     "platforms",
     "play",
@@ -7421,6 +7431,7 @@ export var domprops = [
     "user-select",
     "userActivation",
     "userAgent",
+    "userAgentData",
     "userChoice",
     "userHandle",
     "userHint",
@@ -7734,6 +7745,7 @@ export var domprops = [
     "wordSpacing",
     "wordWrap",
     "workerStart",
+    "wow64",
     "wrap",
     "wrapKey",
     "writable",

package/tools/terser.d.ts

@@ -1,11 +1,12 @@
 /// <reference lib="es2015" />
 
-import { RawSourceMap } from 'source-map';
+import { SectionedSourceMapInput, EncodedSourceMap, DecodedSourceMap } from '@jridgewell/source-map';
 
 export type ECMA = 5 | 2015 | 2016 | 2017 | 2018 | 2019 | 2020;
 
 export interface ParseOptions {
     bare_returns?: boolean;
+    /** @deprecated legacy option. Currently, all supported EcmaScript is valid to parse. */
     ecma?: ECMA;
     html5_comments?: boolean;
     shebang?: boolean;
@@ -144,6 +145,7 @@ export interface FormatOptions {
     }) => boolean );
     ecma?: ECMA;
     ie8?: boolean;
+    keep_numbers?: boolean;
     indent_level?: number;
     indent_start?: number;
     inline_script?: boolean;
@@ -192,12 +194,13 @@ export interface MinifyOptions {
 
 export interface MinifyOutput {
     code?: string;
-    map?: RawSourceMap | string;
+    map?: EncodedSourceMap | string;
+    decoded_map?: DecodedSourceMap | null;
 }
 
 export interface SourceMapOptions {
     /** Source map object, 'inline' or source map file content */
-    content?: RawSourceMap | string;
+    content?: SectionedSourceMapInput | string;
     includeSources?: boolean;
     filename?: string;
     root?: string;