Releases

Fixed controlFlowFlattening changing let and const declarations into var inside functions passed as call arguments or used as operands, when var is the prevailing kind of variables. Fixes #1471
Fixed controlFlowFlattening turning a #x in obj private brand check into invalid code. Fixes #1472
Fixed an escaped 'use\x20strict' directive being emitted as an actual 'use strict' directive. Fixes #1474
Fixed selfDefending, disableConsoleOutput, debugProtection and domainLock code helpers being placed before the 'use strict' directive, which disabled strict mode. Fixes #1475
Fixed numbersToExpressions producing invalid code for non-computed numeric keys of class members. Fixes #1476
Template literals are now transformed into String.prototype.concat calls instead of + concatenation, so substitutions are converted to strings with toString instead of valueOf. Fixes #1477
Fixed controlFlowFlattening dropping the ?. short-circuit on an optional call in the middle of a chain (foo?.(x).bar()), causing TypeError: <X> is not a function. Follow-up to #1408

Replaced multimatch with minimatch@11 for the CLI --exclude option, resolving the minimatch denial of service advisory GHSA-g3hv-75wg-m249
Require Node.js 20 or newer, as minimatch@11 does

Fixed splitStrings/stringArray breaking a quoted constructor class key. Fixed #1464
Fixed identifiers inside functions nested in class field initializers being neither renamed nor preserved. Fixed #1462

Pro API: added getProQuota(), which returns the usage left on the API key's plan.
Pro API: ApiError now carries code, the machine-readable cause sent by the API; a build refused for quota has code dailyLimit or monthlyLimit
The Node dist bundle is no longer minified, so uncaught errors print a readable stack frame instead of the whole bundle.

Fixed transformObjectKeys making default parameter objects shared across calls. Fixed #1455
Fixed controlFlowFlattening breaking short-circuit evaluation of &&, || and ??. Fixed #1456

Pro API: added support for custom presets. optionsPreset accepts the alias of a custom preset saved in the obfuscator.io dashboard; obfuscatePro() and the CLI (--pro-api-token) fetch it and merge its options
CLI: --options-preset with a VM preset name (e.g. vm-default) no longer fails locally when --pro-api-token is set; the name is passed to the Pro API

New option: advertisement allows to control the display of the JavaScript Obfuscator Pro advertisement message in the console. Fixed #1448

Pro API: obfuscatePro now fall back to the basic local obfuscation API when no Pro feature (vmObfuscation or parseHtml) is enabled, instead of throwing an ApiError
Improved stringArrayEncoding runtime performance

Fixed leading whitespace of the source code being stripped without being reflected in the source map, shifting all sourcesContent and original position mappings. Fixes #1437

Pro API: reworked large file uploads — fixed 413 Content Too Large for ~4.4–4.6MB request bodies, and Blob uploads now send the raw source (blobFormat: 'raw') instead of the JSON request body, so uploads always fit the plan's file size cap

5.10.1 version