Releases · javascript-obfuscator/javascript-obfuscator

Pro API: reworked large file uploads — fixed 413 Content Too Large for ~4.4–4.6MB request bodies, and Blob uploads now send the raw source (blobFormat: 'raw') instead of the JSON request body, so uploads always fit the plan's file size cap

Fixed directory obfuscation with a set sourceMapFileName making all files share and overwrite one .map. Fixes #817
Fixed CLI --config failures hiding the real cause behind a generic Cannot open config file message. Fixes #1101
Fixed sourceMapFileName ending in .js.map (e.g. foo.min.js.map) being mangled in the emitted //# sourceMappingURL= comment. Fixes #1312
Fixed URIError: URI malformed crash when stringArray with base64/rc4 encoding processed a string literal containing lone surrogate code units (e.g. "[^\uD800-\uDFFF]"). Fixes #1431
Bumped the production brace-expansion transitive dependency to a patched version, resolving CVE-2026-25547. Fixes #1405

Fixed unicode (\uXXXX, \u{XXXX}) and hex (\xXX) escape sequences of string literals being un-escaped into their literal characters during obfuscation. Fixes #345

Fixed controlFlowFlattening intermittently dropping arguments of a spread call (e.g. foo(...args)) when it reused a control flow wrapper of a same-arity plain call. Fixes #1423
Fixed selfDefending making obfuscated code run several times slower on Bun/JavaScriptCore. Fixes #1421
Fixed dropped parentheses around an in operator inside an arrow body in a for-init, producing unparsable output. Fixes #1419

Optimized scope identifiers transformer performance
Optimized identifier renaming performance by reusing scope analysis between transformers
Fixed Invalid regular expression error when obfuscating code that uses ES2025 RegExp pattern modifiers (e.g. /(?i:abc)/). Fixes #1410
Fixed SyntaxError when obfuscating a class that extends a boolean literal (e.g. class C extends true {}). Fixes #1131

Fixed controlFlowFlattening occasionally dropping the ?. short-circuit on foo?.(arg) calls, causing TypeError: <X> is not a function. Fixes #1408

Fixed obfuscated code hanging in Bun when selfDefending is enabled. Fixes #1404

Fixed Utils.nodeRequire causing ReferenceError: require is not defined in browser build by making it lazy-evaluated
Fixed missing space between keywords (return, throw, typeof) and Unicode surrogate pair identifiers in compact mode. Fixes #1112
Fixed domainLock being case-sensitive — domain values are now normalized to lowercase. Fixes #1182
Removed source-map-support runtime dependency. Use node --enable-source-maps instead. Fixes #1149

Add support for import attributes. Fixes #1256
Add renameProperties support for private class fields and methods (#foo, #bar()). Fixes #1220
Fixed reservedNames not preserving class method and property names when stringArray or deadCodeInjection is enabled. Fixes #1279
Fixed infinite loop / stack overflow when reservedNames patterns match all generated identifier names. Now throws a descriptive error instead. Fixes #1382
Fixed transformObjectKeys changing evaluation order when object expression is inside a sequence expression with preceding side effects (e.g. return aux(ys), { min }). Fixes #1246
Fixed destructuring patterns inside class static blocks not being renamed when renameGlobals is disabled. Fixes #1141
Fixed CLI --options-preset not applying preset values for options not explicitly set via command line (e.g. splitStrings from high-obfuscation preset was ignored). Fixes #1236
Replaced mkdirp dependency with native fs.mkdirSync({ recursive: true }). Fixes #1275. Thank you https://github.com/roli-lpci!
Updated reserved DOM properties list, fixing renameProperties breaking modern built-in methods like Array.prototype.at(). Fixes #1066
Replaced conf dependency with custom implementation using env-paths and native fs

Fixed class expression name references inside class body being incorrectly resolved to an import binding with the same name, causing broken code at runtime. Fixes #1386

Releases: javascript-obfuscator/javascript-obfuscator