chore(deps-dev): bump javascript-obfuscator from 4.1.1 to 5.5.0

[dependabot]

Bumps javascript-obfuscator from 4.1.1 to 5.5.0.

Release notes

Sourced from javascript-obfuscator's releases.

5.5.0 version

• Pro API: reworked large file uploads — fixed 413 Content Too Large for ~4.4–4.6MB request bodies, and Blob uploads now send the raw source (blobFormat: 'raw') instead of the JSON request body, so uploads always fit the plan's file size cap

5.4.7 version

• Fixed directory obfuscation with a set sourceMapFileName making all files share and overwrite one .map. Fixes javascript-obfuscator/javascript-obfuscator#817
• Fixed CLI --config failures hiding the real cause behind a generic Cannot open config file message. Fixes javascript-obfuscator/javascript-obfuscator#1101
• Fixed sourceMapFileName ending in .js.map (e.g. foo.min.js.map) being mangled in the emitted //# sourceMappingURL= comment. Fixes javascript-obfuscator/javascript-obfuscator#1312
• Fixed URIError: URI malformed crash when stringArray with base64/rc4 encoding processed a string literal containing lone surrogate code units (e.g. "[^\uD800-\uDFFF]"). Fixes javascript-obfuscator/javascript-obfuscator#1431
• Bumped the production brace-expansion transitive dependency to a patched version, resolving CVE-2026-25547. Fixes javascript-obfuscator/javascript-obfuscator#1405

5.4.6 version

• Fixed unicode (\uXXXX, \u{XXXX}) and hex (\xXX) escape sequences of string literals being un-escaped into their literal characters during obfuscation. Fixes javascript-obfuscator/javascript-obfuscator#345

5.4.5 version

• Fixed controlFlowFlattening intermittently dropping arguments of a spread call (e.g. foo(...args)) when it reused a control flow wrapper of a same-arity plain call. Fixes javascript-obfuscator/javascript-obfuscator#1423
• Fixed selfDefending making obfuscated code run several times slower on Bun/JavaScriptCore. Fixes javascript-obfuscator/javascript-obfuscator#1421
• Fixed dropped parentheses around an in operator inside an arrow body in a for-init, producing unparsable output. Fixes javascript-obfuscator/javascript-obfuscator#1419

5.4.4 version

• Optimized scope identifiers transformer performance
• Optimized identifier renaming performance by reusing scope analysis between transformers
• Fixed Invalid regular expression error when obfuscating code that uses ES2025 RegExp pattern modifiers (e.g. /(?i:abc)/). Fixes javascript-obfuscator/javascript-obfuscator#1410
• Fixed SyntaxError when obfuscating a class that extends a boolean literal (e.g. class C extends true {}). Fixes javascript-obfuscator/javascript-obfuscator#1131

5.4.3 version

• Fixed controlFlowFlattening occasionally dropping the ?. short-circuit on foo?.(arg) calls, causing TypeError: <X> is not a function. Fixes javascript-obfuscator/javascript-obfuscator#1408

5.4.2 version

• Fixed obfuscated code hanging in Bun when selfDefending is enabled. Fixes javascript-obfuscator/javascript-obfuscator#1404

5.4.1 version

• Fixed Utils.nodeRequire causing ReferenceError: require is not defined in browser build by making it lazy-evaluated
• Fixed missing space between keywords (return, throw, typeof) and Unicode surrogate pair identifiers in compact mode. Fixes javascript-obfuscator/javascript-obfuscator#1112
• Fixed domainLock being case-sensitive — domain values are now normalized to lowercase. Fixes javascript-obfuscator/javascript-obfuscator#1182
• Removed source-map-support runtime dependency. Use node --enable-source-maps instead. Fixes javascript-obfuscator/javascript-obfuscator#1149

5.4.0 version

• Add support for import attributes. Fixes javascript-obfuscator/javascript-obfuscator#1256
• Add renameProperties support for private class fields and methods (#foo, #bar()). Fixes javascript-obfuscator/javascript-obfuscator#1220
• Fixed reservedNames not preserving class method and property names when stringArray or deadCodeInjection is enabled. Fixes javascript-obfuscator/javascript-obfuscator#1279
• Fixed infinite loop / stack overflow when reservedNames patterns match all generated identifier names. Now throws a descriptive error instead. Fixes javascript-obfuscator/javascript-obfuscator#1382
• Fixed transformObjectKeys changing evaluation order when object expression is inside a sequence expression with preceding side effects (e.g. return aux(ys), { min }). Fixes javascript-obfuscator/javascript-obfuscator#1246
• Fixed destructuring patterns inside class static blocks not being renamed when renameGlobals is disabled. Fixes javascript-obfuscator/javascript-obfuscator#1141
• Fixed CLI --options-preset not applying preset values for options not explicitly set via command line (e.g. splitStrings from high-obfuscation preset was ignored). Fixes javascript-obfuscator/javascript-obfuscator#1236
• Replaced mkdirp dependency with native fs.mkdirSync({ recursive: true }). Fixes javascript-obfuscator/javascript-obfuscator#1275. Thank you https://github.com/roli-lpci!
• Updated reserved DOM properties list, fixing renameProperties breaking modern built-in methods like Array.prototype.at(). Fixes javascript-obfuscator/javascript-obfuscator#1066
• Replaced conf dependency with custom implementation using env-paths and native fs

5.3.1 version

• Fixed class expression name references inside class body being incorrectly resolved to an import binding with the same name, causing broken code at runtime. Fixes javascript-obfuscator/javascript-obfuscator#1386

... (truncated)

Changelog

Sourced from javascript-obfuscator's changelog.

v5.5.0

• Pro API: reworked large file uploads — fixed 413 Content Too Large for ~4.4–4.6MB request bodies, and Blob uploads now send the raw source (blobFormat: 'raw') instead of the JSON request body, so uploads always fit the plan's file size cap

v5.4.7

• Fixed directory obfuscation with a set sourceMapFileName making all files share and overwrite one .map. Fixes javascript-obfuscator/javascript-obfuscator#817
• Fixed CLI --config failures hiding the real cause behind a generic Cannot open config file message. Fixes javascript-obfuscator/javascript-obfuscator#1101
• Fixed sourceMapFileName ending in .js.map (e.g. foo.min.js.map) being mangled in the emitted //# sourceMappingURL= comment. Fixes javascript-obfuscator/javascript-obfuscator#1312
• Fixed URIError: URI malformed crash when stringArray with base64/rc4 encoding processed a string literal containing lone surrogate code units (e.g. "[^\uD800-\uDFFF]"). Fixes javascript-obfuscator/javascript-obfuscator#1431
• Bumped the production brace-expansion transitive dependency to a patched version, resolving CVE-2026-25547. Fixes javascript-obfuscator/javascript-obfuscator#1405

v5.4.6

• Fixed unicode (\uXXXX, \u{XXXX}) and hex (\xXX) escape sequences of string literals being un-escaped into their literal characters during obfuscation. Fixes javascript-obfuscator/javascript-obfuscator#345

v5.4.5

• Fixed controlFlowFlattening intermittently dropping arguments of a spread call (e.g. foo(...args)) when it reused a control flow wrapper of a same-arity plain call. Fixes javascript-obfuscator/javascript-obfuscator#1423
• Fixed selfDefending making obfuscated code run several times slower on Bun/JavaScriptCore. Fixes javascript-obfuscator/javascript-obfuscator#1421
• Fixed dropped parentheses around an in operator inside an arrow body in a for-init, producing unparsable output. Fixes javascript-obfuscator/javascript-obfuscator#1419

v5.4.4

• Optimized scope identifiers transformer performance
• Optimized identifier renaming performance by reusing scope analysis between transformers
• Fixed Invalid regular expression error when obfuscating code that uses ES2025 RegExp pattern modifiers (e.g. /(?i:abc)/). Fixes javascript-obfuscator/javascript-obfuscator#1410
• Fixed SyntaxError when obfuscating a class that extends a boolean literal (e.g. class C extends true {}). Fixes javascript-obfuscator/javascript-obfuscator#1131

v5.4.3

• Fixed controlFlowFlattening occasionally dropping the ?. short-circuit on foo?.(arg) calls, causing TypeError: <X> is not a function. Fixes javascript-obfuscator/javascript-obfuscator#1408

v5.4.2

• Fixed obfuscated code hanging in Bun when selfDefending is enabled. Fixes javascript-obfuscator/javascript-obfuscator#1404

v5.4.1

• Fixed Utils.nodeRequire causing ReferenceError: require is not defined in browser build by making it lazy-evaluated
• Fixed missing space between keywords (return, throw, typeof) and Unicode surrogate pair identifiers in compact mode. Fixes javascript-obfuscator/javascript-obfuscator#1112
• Fixed domainLock being case-sensitive — domain values are now normalized to lowercase. Fixes javascript-obfuscator/javascript-obfuscator#1182
• Removed source-map-support runtime dependency. Use node --enable-source-maps instead. Fixes javascript-obfuscator/javascript-obfuscator#1149

v5.4.0

• Add support for import attributes. Fixes javascript-obfuscator/javascript-obfuscator#1256
• Add renameProperties support for private class fields and methods (#foo, #bar()). Fixes javascript-obfuscator/javascript-obfuscator#1220
• Fixed reservedNames not preserving class method and property names when stringArray or deadCodeInjection is enabled. Fixes javascript-obfuscator/javascript-obfuscator#1279
• Fixed infinite loop / stack overflow when reservedNames patterns match all generated identifier names. Now throws a descriptive error instead. Fixes javascript-obfuscator/javascript-obfuscator#1382

... (truncated)

Commits

• 45ad03b Reworked large file uploads (#1438)
• d250166 Add esbuild plugin link
• 35860ec Fixed directory obfuscation with a set sourceMapFileName making all files s...
• ecbffd8 Fixed CLI --config failures hiding the real cause behind a generic `Cannot ...
• 1bdaa51 Bumped the production brace-expansion transitive dependency to a patched ve...
• 4626dd5 Fixed sourceMapFileName ending in .js.map (e.g. foo.min.js.map) being m...
• 09b2ff1 Fixed URIError: URI malformed crash when stringArray with base64/rc4 ...
• f180550 Fixed unicode (\uXXXX, \u{XXXX}) and hex (\xXX) escape sequences of str...
• a3df841 Fixed dropped parentheses around an in operator inside an arrow body in a `...
• f3d0a64 Fixed selfDefending making obfuscated code run several times slower on Bun/...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)