Skip to content
This repository was archived by the owner on Sep 7, 2025. It is now read-only.

fix(deps): update dependency terser to v5.14.2 [security]#3514

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-terser-vulnerability
Open

fix(deps): update dependency terser to v5.14.2 [security]#3514
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-terser-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jul 20, 2022

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
terser (source) 5.10.0 -> 5.14.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-25858

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.


Release Notes

terser/terser (terser)

v5.14.2

Compare Source

  • Security fix for RegExps that should not be evaluated (regexp DDOS)
  • Source maps improvements (#​1211)
  • Performance improvements in long property access evaluation (#​1213)

v5.14.1

Compare Source

  • keep_numbers option added to TypeScript defs (#​1208)
  • Fixed parsing of nested template strings (#​1204)

v5.14.0

Compare Source

v5.13.1

Compare Source

  • Removed self-assignments (varname=varname) (closes #​1081)
  • Separated inlining code (for inlining things into references, or removing IIFEs)
  • Allow multiple identifiers with the same name in var destructuring (eg var { a, a } = x) (#​1176)

v5.13.0

Compare Source

  • All calls to eval() were removed (#​1171, #​1184)
  • source-map was updated to 0.8.0-beta.0 (#​1164)
  • NavigatorUAData was added to domprops to avoid property mangling (#​1166)

v5.12.1

Compare Source

  • Fixed an issue with function definitions inside blocks (#​1155)
  • Fixed parens of new in some situations (closes #​1159)

v5.12.0

Compare Source

  • TERSER_DEBUG_DIR environment variable
  • @​copyright comments are now preserved with the comments="some" option (#​1153)

v5.11.0

Compare Source

  • Unicode code point escapes (\u{abcde}) are not emitted inside RegExp literals anymore (#​1147)
  • acorn is now a regular dependency

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the security Pull requests that address a security vulnerability label Jul 20, 2022
@renovate
renovate Bot requested a review from fisker July 20, 2022 03:11
@renovate
renovate Bot force-pushed the renovate/npm-terser-vulnerability branch from 0d2aade to dbe2a71 Compare September 25, 2022 14:51
@renovate
renovate Bot force-pushed the renovate/npm-terser-vulnerability branch from dbe2a71 to 8c78165 Compare October 6, 2022 13:33
@renovate
renovate Bot force-pushed the renovate/npm-terser-vulnerability branch from 8c78165 to 77d958a Compare October 27, 2022 23:03
@renovate
renovate Bot force-pushed the renovate/npm-terser-vulnerability branch from 77d958a to 4882c40 Compare November 4, 2022 16:12
@renovate
renovate Bot force-pushed the renovate/npm-terser-vulnerability branch from 4882c40 to 2cdada6 Compare November 14, 2022 09:05
@renovate renovate Bot changed the title fix(deps): update dependency terser to v5.14.2 [security] fix(deps): update dependency terser to v5.14.2 [security] - autoclosed Jul 3, 2023
@renovate renovate Bot closed this Jul 3, 2023
@renovate
renovate Bot deleted the renovate/npm-terser-vulnerability branch July 3, 2023 12:51
@renovate renovate Bot changed the title fix(deps): update dependency terser to v5.14.2 [security] - autoclosed fix(deps): update dependency terser to v5.14.2 [security] Jul 3, 2023
@renovate renovate Bot reopened this Jul 3, 2023
@renovate
renovate Bot restored the renovate/npm-terser-vulnerability branch July 3, 2023 17:34
@renovate
renovate Bot force-pushed the renovate/npm-terser-vulnerability branch from 2cdada6 to 2dd968b Compare July 3, 2023 17:34
@renovate
renovate Bot force-pushed the renovate/npm-terser-vulnerability branch from 2dd968b to 4f580e6 Compare August 10, 2025 13:04
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

security Pull requests that address a security vulnerability

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant