chore(deps): update dependency javascript-obfuscator to v5

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
javascript-obfuscator (source)	4.1.0 → 5.5.0

---

Release Notes

javascript-obfuscator/javascript-obfuscator (javascript-obfuscator)

v5.5.0

Compare Source

• Pro API: reworked large file uploads — fixed 413 Content Too Large for ~4.4–4.6MB request bodies, and Blob uploads now send the raw source (blobFormat: 'raw') instead of the JSON request body, so uploads always fit the plan's file size cap

v5.4.7

Compare Source

• Fixed directory obfuscation with a set sourceMapFileName making all files share and overwrite one .map. Fixes #​817
• Fixed CLI --config failures hiding the real cause behind a generic Cannot open config file message. Fixes #​1101
• Fixed sourceMapFileName ending in .js.map (e.g. foo.min.js.map) being mangled in the emitted //# sourceMappingURL= comment. Fixes #​1312
• Fixed URIError: URI malformed crash when stringArray with base64/rc4 encoding processed a string literal containing lone surrogate code units (e.g. "[^\uD800-\uDFFF]"). Fixes #​1431
• Bumped the production brace-expansion transitive dependency to a patched version, resolving CVE-2026-25547. Fixes #​1405

v5.4.6

Compare Source

• Fixed unicode (\uXXXX, \u{XXXX}) and hex (\xXX) escape sequences of string literals being un-escaped into their literal characters during obfuscation. Fixes #​345

v5.4.5

Compare Source

• Fixed controlFlowFlattening intermittently dropping arguments of a spread call (e.g. foo(...args)) when it reused a control flow wrapper of a same-arity plain call. Fixes #​1423
• Fixed selfDefending making obfuscated code run several times slower on Bun/JavaScriptCore. Fixes #​1421
• Fixed dropped parentheses around an in operator inside an arrow body in a for-init, producing unparsable output. Fixes #​1419

v5.4.4

Compare Source

• Optimized scope identifiers transformer performance
• Optimized identifier renaming performance by reusing scope analysis between transformers
• Fixed Invalid regular expression error when obfuscating code that uses ES2025 RegExp pattern modifiers (e.g. /(?i:abc)/). Fixes #​1410
• Fixed SyntaxError when obfuscating a class that extends a boolean literal (e.g. class C extends true {}). Fixes #​1131

v5.4.3

Compare Source

• Fixed controlFlowFlattening occasionally dropping the ?. short-circuit on foo?.(arg) calls, causing TypeError: <X> is not a function. Fixes #​1408

v5.4.2

Compare Source

• Fixed obfuscated code hanging in Bun when selfDefending is enabled. Fixes #​1404

v5.4.1

Compare Source

• Fixed Utils.nodeRequire causing ReferenceError: require is not defined in browser build by making it lazy-evaluated
• Fixed missing space between keywords (return, throw, typeof) and Unicode surrogate pair identifiers in compact mode. Fixes #​1112
• Fixed domainLock being case-sensitive — domain values are now normalized to lowercase. Fixes #​1182
• Removed source-map-support runtime dependency. Use node --enable-source-maps instead. Fixes #​1149

v5.4.0

Compare Source

• Add support for import attributes. Fixes #​1256
• Add renameProperties support for private class fields and methods (#foo, #bar()). Fixes #​1220
• Fixed reservedNames not preserving class method and property names when stringArray or deadCodeInjection is enabled. Fixes #​1279
• Fixed infinite loop / stack overflow when reservedNames patterns match all generated identifier names. Now throws a descriptive error instead. Fixes #​1382
• Fixed transformObjectKeys changing evaluation order when object expression is inside a sequence expression with preceding side effects (e.g. return aux(ys), { min }). Fixes #​1246
• Fixed destructuring patterns inside class static blocks not being renamed when renameGlobals is disabled. Fixes #​1141
• Fixed CLI --options-preset not applying preset values for options not explicitly set via command line (e.g. splitStrings from high-obfuscation preset was ignored). Fixes #​1236
• Replaced mkdirp dependency with native fs.mkdirSync({ recursive: true }). Fixes #​1275. Thank you https://github.com/roli-lpci!
• Updated reserved DOM properties list, fixing renameProperties breaking modern built-in methods like Array.prototype.at(). Fixes #​1066
• Replaced conf dependency with custom implementation using env-paths and native fs

v5.3.1

Compare Source

• Fixed class expression name references inside class body being incorrectly resolved to an import binding with the same name, causing broken code at runtime. Fixes #​1386

v5.3.0

Compare Source

• Add Pro API support to CLI
• Add large files upload support to Pro API

v5.2.1

Compare Source

• Fixed transformObjectKeys incorrectly hoisting object literal outside of loop when loop body is a single statement without braces, causing all iterations to share the same object reference. Fixes #​1300
• Fixed parsing error when await is used as an identifier in non-async context. Fixes #​1127
• Fixed deadCodeInjection causing SyntaxError when arguments from collected block statements was injected into class field initializers or static initialization blocks. Fixes #​1166
• Fixed transformObjectKeys with mangled identifier generator causing variable shadowing when extracted object variable name matched an existing inner scope variable. Fixes #​1232

v5.2.0

Compare Source

• Skip obfuscation of process.env.*
• Fixed controlFlowFlattening breaking short-circuit evaluation with spread operator and conditional objects. Fixes #​1372
• Fix Annex B function hoisting: block-scoped function declarations are now correctly linked to references outside the block in non-strict mode
• Fixed NodeUtils.cloneRecursive corrupting range property when cloning AST nodes, causing scope analysis to incorrectly resolve destructuring default parameter references

v5.1.0

Compare Source

• Add version parameter to the apiConfig to use different versions JavaScript Obfuscator Pro via API

v5.0.1

Compare Source

• Add JavaScript Obfuscator PRO advertisement message

v5.0.0

Compare Source

• Add JavaScript Obfuscator PRO support via calling its API

v4.2.2

Compare Source

v4.2.1

Compare Source

• Downgrade multimatch version to avoid esm errors

v4.2.0

Compare Source

• Dropped support of Node versions 17 and below
• Fix transformObjectKeys performance in some edge-cases
• Fix controlFlowFlattening + optional chaining compatibility. Fixes #​1325
• Don't obfuscate import.meta.*. Fixes #​1267
• Revert Improved stringArray calls wrapper templates commit. Fixes #​1330
• Fix error when ClassExpression is the CallExpression callee. Fixes #​1132
• Don't publish root index.ts files to NPM. Fixes #​1252
• Update class-validator version. Fixes #​1324
• Update other dependencies
• CLI: support .mjs and .cjs extensions. Kudos to #​1301

v4.1.1

Compare Source

• Update supported Node.js versions up to node@22. Fixes #​1100
• Update class-validator version. Fixes #​1247
• Fixed CI

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.