deps: bump javascript-obfuscator from 5.1.0 to 5.4.3 in /OASIS

[dependabot]

Bumps javascript-obfuscator from 5.1.0 to 5.4.3.

Release notes

Sourced from javascript-obfuscator's releases.

5.4.3 version

• Fixed controlFlowFlattening occasionally dropping the ?. short-circuit on foo?.(arg) calls, causing TypeError: <X> is not a function. Fixes javascript-obfuscator/javascript-obfuscator#1408

5.4.2 version

• Fixed obfuscated code hanging in Bun when selfDefending is enabled. Fixes javascript-obfuscator/javascript-obfuscator#1404

5.4.1 version

• Fixed Utils.nodeRequire causing ReferenceError: require is not defined in browser build by making it lazy-evaluated
• Fixed missing space between keywords (return, throw, typeof) and Unicode surrogate pair identifiers in compact mode. Fixes javascript-obfuscator/javascript-obfuscator#1112
• Fixed domainLock being case-sensitive — domain values are now normalized to lowercase. Fixes javascript-obfuscator/javascript-obfuscator#1182
• Removed source-map-support runtime dependency. Use node --enable-source-maps instead. Fixes javascript-obfuscator/javascript-obfuscator#1149

5.4.0 version

• Add support for import attributes. Fixes javascript-obfuscator/javascript-obfuscator#1256
• Add renameProperties support for private class fields and methods (#foo, #bar()). Fixes javascript-obfuscator/javascript-obfuscator#1220
• Fixed reservedNames not preserving class method and property names when stringArray or deadCodeInjection is enabled. Fixes javascript-obfuscator/javascript-obfuscator#1279
• Fixed infinite loop / stack overflow when reservedNames patterns match all generated identifier names. Now throws a descriptive error instead. Fixes javascript-obfuscator/javascript-obfuscator#1382
• Fixed transformObjectKeys changing evaluation order when object expression is inside a sequence expression with preceding side effects (e.g. return aux(ys), { min }). Fixes javascript-obfuscator/javascript-obfuscator#1246
• Fixed destructuring patterns inside class static blocks not being renamed when renameGlobals is disabled. Fixes javascript-obfuscator/javascript-obfuscator#1141
• Fixed CLI --options-preset not applying preset values for options not explicitly set via command line (e.g. splitStrings from high-obfuscation preset was ignored). Fixes javascript-obfuscator/javascript-obfuscator#1236
• Replaced mkdirp dependency with native fs.mkdirSync({ recursive: true }). Fixes javascript-obfuscator/javascript-obfuscator#1275. Thank you https://github.com/roli-lpci!
• Updated reserved DOM properties list, fixing renameProperties breaking modern built-in methods like Array.prototype.at(). Fixes javascript-obfuscator/javascript-obfuscator#1066
• Replaced conf dependency with custom implementation using env-paths and native fs

5.3.1 version

• Fixed class expression name references inside class body being incorrectly resolved to an import binding with the same name, causing broken code at runtime. Fixes javascript-obfuscator/javascript-obfuscator#1386

5.3.0 version

• Add Pro API support to CLI
• Add large files upload support to Pro API

5.2.1 version

• Fixed transformObjectKeys incorrectly hoisting object literal outside of loop when loop body is a single statement without braces, causing all iterations to share the same object reference. Fixes javascript-obfuscator/javascript-obfuscator#1300
• Fixed parsing error when await is used as an identifier in non-async context. Fixes javascript-obfuscator/javascript-obfuscator#1127
• Fixed deadCodeInjection causing SyntaxError when arguments from collected block statements was injected into class field initializers or static initialization blocks. Fixes javascript-obfuscator/javascript-obfuscator#1166
• Fixed transformObjectKeys with mangled identifier generator causing variable shadowing when extracted object variable name matched an existing inner scope variable. Fixes javascript-obfuscator/javascript-obfuscator#1232

5.2.0 version

• Skip obfuscation of process.env.*
• Fixed controlFlowFlattening breaking short-circuit evaluation with spread operator and conditional objects. Fixes javascript-obfuscator/javascript-obfuscator#1372
• Fix Annex B function hoisting: block-scoped function declarations are now correctly linked to references outside the block in non-strict mode
• Fixed NodeUtils.cloneRecursive corrupting range property when cloning AST nodes, causing scope analysis to incorrectly resolve destructuring default parameter references

Changelog

Sourced from javascript-obfuscator's changelog.

v5.4.3

• Fixed controlFlowFlattening occasionally dropping the ?. short-circuit on foo?.(arg) calls, causing TypeError: <X> is not a function. Fixes javascript-obfuscator/javascript-obfuscator#1408

v5.4.2

• Fixed obfuscated code hanging in Bun when selfDefending is enabled. Fixes javascript-obfuscator/javascript-obfuscator#1404

v5.4.1

• Fixed Utils.nodeRequire causing ReferenceError: require is not defined in browser build by making it lazy-evaluated
• Fixed missing space between keywords (return, throw, typeof) and Unicode surrogate pair identifiers in compact mode. Fixes javascript-obfuscator/javascript-obfuscator#1112
• Fixed domainLock being case-sensitive — domain values are now normalized to lowercase. Fixes javascript-obfuscator/javascript-obfuscator#1182
• Removed source-map-support runtime dependency. Use node --enable-source-maps instead. Fixes javascript-obfuscator/javascript-obfuscator#1149

v5.4.0

• Add support for import attributes. Fixes javascript-obfuscator/javascript-obfuscator#1256
• Add renameProperties support for private class fields and methods (#foo, #bar()). Fixes javascript-obfuscator/javascript-obfuscator#1220
• Fixed reservedNames not preserving class method and property names when stringArray or deadCodeInjection is enabled. Fixes javascript-obfuscator/javascript-obfuscator#1279
• Fixed infinite loop / stack overflow when reservedNames patterns match all generated identifier names. Now throws a descriptive error instead. Fixes javascript-obfuscator/javascript-obfuscator#1382
• Fixed transformObjectKeys changing evaluation order when object expression is inside a sequence expression with preceding side effects (e.g. return aux(ys), { min }). Fixes javascript-obfuscator/javascript-obfuscator#1246
• Fixed destructuring patterns inside class static blocks not being renamed when renameGlobals is disabled. Fixes javascript-obfuscator/javascript-obfuscator#1141
• Fixed CLI --options-preset not applying preset values for options not explicitly set via command line (e.g. splitStrings from high-obfuscation preset was ignored). Fixes javascript-obfuscator/javascript-obfuscator#1236
• Replaced mkdirp dependency with native fs.mkdirSync({ recursive: true }). Fixes javascript-obfuscator/javascript-obfuscator#1275. Thank you https://github.com/roli-lpci!
• Updated reserved DOM properties list, fixing renameProperties breaking modern built-in methods like Array.prototype.at(). Fixes javascript-obfuscator/javascript-obfuscator#1066
• Replaced conf dependency with custom implementation using env-paths and native fs

v5.3.1

• Fixed class expression name references inside class body being incorrectly resolved to an import binding with the same name, causing broken code at runtime. Fixes javascript-obfuscator/javascript-obfuscator#1386

v5.3.0

• Add Pro API support to CLI
• Add large files upload support to Pro API

v5.2.1

• Fixed transformObjectKeys incorrectly hoisting object literal outside of loop when loop body is a single statement without braces, causing all iterations to share the same object reference. Fixes javascript-obfuscator/javascript-obfuscator#1300
• Fixed parsing error when await is used as an identifier in non-async context. Fixes javascript-obfuscator/javascript-obfuscator#1127
• Fixed deadCodeInjection causing SyntaxError when arguments from collected block statements was injected into class field initializers or static initialization blocks. Fixes javascript-obfuscator/javascript-obfuscator#1166
• Fixed transformObjectKeys with mangled identifier generator causing variable shadowing when extracted object variable name matched an existing inner scope variable. Fixes javascript-obfuscator/javascript-obfuscator#1232

v5.2.0

• Skip obfuscation of process.env.*
• Fixed controlFlowFlattening breaking short-circuit evaluation with spread operator and conditional objects. Fixes javascript-obfuscator/javascript-obfuscator#1372
• Fix Annex B function hoisting: block-scoped function declarations are now correctly linked to references outside the block in non-strict mode
• Fixed NodeUtils.cloneRecursive corrupting range property when cloning AST nodes, causing scope analysis to incorrectly resolve destructuring default parameter references

Commits

• a4ed355 Fixed controlFlowFlattening occasionally dropping the ?. short-circuit on...
• 10c763f Add reference letter mention
• 4ebced3 Inversify v7 migration (#1368)
• e2abba3 Update readme
• 1857849 Fix self-defending obfuscated code hanging in Bun environments (#1407)
• 6a31817 Update VM options
• ea26067 Add Vite plugin to README (#1402)
• dd62fea Make Utils.nodeRequire lazy-evaluated to avoid ReferenceError in browser en...
• 459fb31 Fix domain lock to be case-insensitive by normalizing domain values to lowerc...
• fb74744 Removed source-map-support runtime dependency (#1399)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.