[Security] Bump terser from 5.5.1 to 5.14.2
Bumps terser from 5.5.1 to 5.14.2. This update includes a security fix.
Vulnerabilities fixed
Terser insecure use of regular expressions before v4.8.1 and v5.14.2 leads to ReDoS The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.
Patched versions: 5.14.2 Affected versions: >= 5.0.0, < 5.14.2
Changelog
Sourced from terser's changelog.
v5.14.2
- Security fix for RegExps that should not be evaluated (regexp DDOS)
- Source maps improvements (#1211)
- Performance improvements in long property access evaluation (#1213)
v5.14.1
- keep_numbers option added to TypeScript defs (#1208)
- Fixed parsing of nested template strings (#1204)
v5.14.0
- Switched to
@jridgewell/source-map
for sourcemap generation (#1190, #1181)- Fixed source maps with non-terminated segments (#1106)
- Enabled typescript types to be imported from the package (#1194)
- Extra DOM props have been added (#1191)
- Delete the AST while generating code, as a means to save RAM
v5.13.1
- Removed self-assignments (
varname=varname
) (closes #1081)- Separated inlining code (for inlining things into references, or removing IIFEs)
- Allow multiple identifiers with the same name in
var
destructuring (egvar { a, a } = x
) (#1176)v5.13.0
- All calls to eval() were removed (#1171, #1184)
source-map
was updated to 0.8.0-beta.0 (#1164)- NavigatorUAData was added to domprops to avoid property mangling (#1166)
v5.12.1
- Fixed an issue with function definitions inside blocks (#1155)
- Fixed parens of
new
in some situations (closes #1159)v5.12.0
TERSER_DEBUG_DIR
environment variable@copyright
comments are now preserved with the comments="some" option (#1153)v5.11.0
- Unicode code point escapes (
\u{abcde}
) are not emitted inside RegExp literals anymore (#1147)- acorn is now a regular dependency
v5.10.0
... (truncated)
Commits
-
c5cb19d
5.14.2 -
a4da734
fix potential regexp DDOS -
839b81b
Add source mapping for closing}
(#1211) -
645a092
Optimize property access evaluation (#1213) -
6706fec
5.14.1 -
4a56ef2
update changelog -
c558e12
Add keep_numbers option. Closes #1208 -
f745ac7
fix parsing of nested template strings. Closes #1204 -
1707753
5.14.0 -
cb82833
update changelog - Additional commits viewable in compare view
Dependabot commands
You can trigger Dependabot actions by commenting on this MR
-
$dependabot rebase
will rebase this MR -
$dependabot recreate
will recreate this MR rewriting all the manual changes and resolving conflicts