Releases · javascript-obfuscator/javascript-obfuscator

Replaced multimatch with minimatch@11 for the CLI --exclude option, resolving the minimatch denial of service advisory GHSA-g3hv-75wg-m249
Require Node.js 20 or newer, as minimatch@11 does

Fixed splitStrings/stringArray breaking a quoted constructor class key. Fixed #1464
Fixed identifiers inside functions nested in class field initializers being neither renamed nor preserved. Fixed #1462

Pro API: added getProQuota(), which returns the usage left on the API key's plan.
Pro API: ApiError now carries code, the machine-readable cause sent by the API; a build refused for quota has code dailyLimit or monthlyLimit
The Node dist bundle is no longer minified, so uncaught errors print a readable stack frame instead of the whole bundle.

Fixed transformObjectKeys making default parameter objects shared across calls. Fixed #1455
Fixed controlFlowFlattening breaking short-circuit evaluation of &&, || and ??. Fixed #1456

Pro API: added support for custom presets. optionsPreset accepts the alias of a custom preset saved in the obfuscator.io dashboard; obfuscatePro() and the CLI (--pro-api-token) fetch it and merge its options
CLI: --options-preset with a VM preset name (e.g. vm-default) no longer fails locally when --pro-api-token is set; the name is passed to the Pro API

New option: advertisement allows to control the display of the JavaScript Obfuscator Pro advertisement message in the console. Fixed #1448

Pro API: obfuscatePro now fall back to the basic local obfuscation API when no Pro feature (vmObfuscation or parseHtml) is enabled, instead of throwing an ApiError
Improved stringArrayEncoding runtime performance

Fixed leading whitespace of the source code being stripped without being reflected in the source map, shifting all sourcesContent and original position mappings. Fixes #1437

Pro API: reworked large file uploads — fixed 413 Content Too Large for ~4.4–4.6MB request bodies, and Blob uploads now send the raw source (blobFormat: 'raw') instead of the JSON request body, so uploads always fit the plan's file size cap

Fixed directory obfuscation with a set sourceMapFileName making all files share and overwrite one .map. Fixes #817
Fixed CLI --config failures hiding the real cause behind a generic Cannot open config file message. Fixes #1101
Fixed sourceMapFileName ending in .js.map (e.g. foo.min.js.map) being mangled in the emitted //# sourceMappingURL= comment. Fixes #1312
Fixed URIError: URI malformed crash when stringArray with base64/rc4 encoding processed a string literal containing lone surrogate code units (e.g. "[^\uD800-\uDFFF]"). Fixes #1431
Bumped the production brace-expansion transitive dependency to a patched version, resolving CVE-2026-25547. Fixes #1405

Releases: javascript-obfuscator/javascript-obfuscator