Releases · javascript-obfuscator/javascript-obfuscator

Pro API: obfuscatePro now fall back to the basic local obfuscation API when no Pro feature (vmObfuscation or parseHtml) is enabled, instead of throwing an ApiError
Improved stringArrayEncoding runtime performance

Fixed leading whitespace of the source code being stripped without being reflected in the source map, shifting all sourcesContent and original position mappings. Fixes #1437

Pro API: reworked large file uploads — fixed 413 Content Too Large for ~4.4–4.6MB request bodies, and Blob uploads now send the raw source (blobFormat: 'raw') instead of the JSON request body, so uploads always fit the plan's file size cap

Fixed directory obfuscation with a set sourceMapFileName making all files share and overwrite one .map. Fixes #817
Fixed CLI --config failures hiding the real cause behind a generic Cannot open config file message. Fixes #1101
Fixed sourceMapFileName ending in .js.map (e.g. foo.min.js.map) being mangled in the emitted //# sourceMappingURL= comment. Fixes #1312
Fixed URIError: URI malformed crash when stringArray with base64/rc4 encoding processed a string literal containing lone surrogate code units (e.g. "[^\uD800-\uDFFF]"). Fixes #1431
Bumped the production brace-expansion transitive dependency to a patched version, resolving CVE-2026-25547. Fixes #1405

Fixed unicode (\uXXXX, \u{XXXX}) and hex (\xXX) escape sequences of string literals being un-escaped into their literal characters during obfuscation. Fixes #345

Fixed controlFlowFlattening intermittently dropping arguments of a spread call (e.g. foo(...args)) when it reused a control flow wrapper of a same-arity plain call. Fixes #1423
Fixed selfDefending making obfuscated code run several times slower on Bun/JavaScriptCore. Fixes #1421
Fixed dropped parentheses around an in operator inside an arrow body in a for-init, producing unparsable output. Fixes #1419

Optimized scope identifiers transformer performance
Optimized identifier renaming performance by reusing scope analysis between transformers
Fixed Invalid regular expression error when obfuscating code that uses ES2025 RegExp pattern modifiers (e.g. /(?i:abc)/). Fixes #1410
Fixed SyntaxError when obfuscating a class that extends a boolean literal (e.g. class C extends true {}). Fixes #1131

Fixed controlFlowFlattening occasionally dropping the ?. short-circuit on foo?.(arg) calls, causing TypeError: <X> is not a function. Fixes #1408

Fixed obfuscated code hanging in Bun when selfDefending is enabled. Fixes #1404

Fixed Utils.nodeRequire causing ReferenceError: require is not defined in browser build by making it lazy-evaluated
Fixed missing space between keywords (return, throw, typeof) and Unicode surrogate pair identifiers in compact mode. Fixes #1112
Fixed domainLock being case-sensitive — domain values are now normalized to lowercase. Fixes #1182
Removed source-map-support runtime dependency. Use node --enable-source-maps instead. Fixes #1149

Releases: javascript-obfuscator/javascript-obfuscator