Blocks a medium level prototype pollution vulnerability.
- #81 [Main] Task 26377610: [DynamicProto] Investigate possible security issue with prototype pollution
- This removes the identified methods for polluting the prototype chain by
- adding additional checks to the _isDynamicCandidate() and _populateProtype() functions.
- Using Object.create(null) for internal objects to avoid prototype pollution.
- This removes the identified methods for polluting the prototype chain by
- #78 [Packaging] 2.0.1 does not include the removeDynamic.ts script
- #73 [Main] Fix npm pack and publish issues
- Removed ES3 / IE8 support
- ES5
Object.defineProperty()is required during runtime.
- Version 2.x development moved to main branch which is now the default branch, Version 1.x is still maintained from the master branch
- Removed private internal getGlobal() and hasOwnProperty() functions to provide better minification when bundled with other packages that also implement these functions by using @nevware21/ts-utils as the dependency.
- #61 Exclude files from published package
- #65 Bump external library Sinon.JS to newer version which does not use eval
- #64 Internal Task 17133116: Add Policheck exclusion file
- #62 Add --no-sandbox to test runs
- #55 Update and add legal compliance notices and license terms
- #56 Semmle warning help
- #57 [Bug] Corner case issue when extending the same "Class" name from different components
- #50 [IE8] Fix in 1.1.5 only handles 2 levels of dynamically nested classes
- #47 [IE8] The _checkPrototype always fails on IE in IE8 mode
- #36 v1.1.3 postinstall requires rush to be installed
There are no functional (code) differences between v1.1.2 and v1.1.3, both issues below are related to the build and packaging pipelines only.
- #33 Version 1.1.2 has extraneous dependencies such as findup-sync (Build Only)
- #34 Task 9901543: Remediate security vulnerabilities (Build only)
- #31 [BUG] _checkPrototype function loops indefinitely when calling Invoke-WebRequest cmdlet against a docs.microsoft.com webpage
- #28 [ES6] TypeError: xxx is not a function or TypeError: DynamicProto [XXXX] is not in class heirarchy of [Object]
- Added this RELEASES.md file
- #24 [Feature Request] Performance optimization - ability to keep/set instance level function to avoid dynamic proxy lookup
- #22 Add sideEffects field to package.json
- Update version to major release based on stability
- #20 WARN @microsoft/dynamicproto-js@0.5.2 requires a peer of tslib@^1.9.3 but none was installed.
- Remove unused peerDependency for tslib
- Fix issue causing long running script error on IE7/8
- #19 getBaseFuncs() usage of _getObjProto() is causing a long running script (it's broken) when running Internet explorer in 7/8 mode.
- #16 The dynamicRemove() rollup is not removing methods with default arguments or is using the spread operator
- #14 postinstall script is causing consumption of the npm package to fail -- remove
- Enable the tagging and removal of stub methods during packaging #11
- Added rollup plugin to enable the removal of stub functions, required to enable declaration (*.d.ts) files to match the runtime resulting class definition.
- By using the rollup plugin this will remove the tagged stub functions during packaging with rollup.
- #11 Enable the tagging and removal of stub methods during packaging
- Added rollup plugin to enable the removal of stub functions, required to enable declaration (*.d.ts) files to match the runtime resulting class definition.
- By using the rollup plugin this will remove the tagged stub functions during packaging with rollup.
- Corrected the publishing and minification of the dist/esm module
- Update NPM packaging and distribution packages
- Fixes location of the typescript declaration in the root package.json
- Initial working release
- Initial publish release, merging code from internal repo's