Skip to content

Releases: browserify/static-eval

v2.1.1

01 Jan 17:28
Compare
Choose a tag to compare
  • Update escodegen. @FabianWarnecke in #43

    escodegen doesn't officially support all the Node.js versions that static-eval supports, but so far it still works on them.
    This has been the case for both v1.x and v2.1.0 of escodegen, so the upgrade doesn't change that situation.

v2.1.0

15 Jun 10:23
1a4d734
Compare
Choose a tag to compare
  • Add allowAccessToMethodsOnFunctions option to restore 1.x behaviour so that cwise can upgrade. (@archmoj in #31)

    Do not use this option if you are not sure that you need it, as it had previously been removed for security reasons. There is a known exploit to execute arbitrary code. Only use it on trusted inputs, like the developer's JS files in a build system.

v2.0.5

07 Mar 15:45
b5ab0d7
Compare
Choose a tag to compare
  • Fix function bodies being invoked during declaration. (@RoboPhred in #30)

v2.0.4

07 Mar 15:43
b9cd982
Compare
Choose a tag to compare
  • Short-circuit evaluation in && and || expressions. (@RoboPhred in #28)
  • Start tracking changes.

v2.0.3

19 Nov 15:23
b694d0f
Compare
Choose a tag to compare

Disallows accessing .constructor and .__proto__ properties, which could be used to access the Function() constructor. (#27)
Thanks to an anonymous reporter!