v1.4.0

Wakaru v1.4.0

This release fixes a security issue in @wakaru/cli bundle unpacking and includes continued decompiler correctness work for helper recovery, webpack output, and React hook naming.

Security

• Fixed an arbitrary file write vulnerability when running wakaru --unpack on a crafted bundle with malicious module filenames.
• Affected npm versions: @wakaru/cli >=1.0.0 <1.4.0.
• Users should upgrade to @wakaru/cli@1.4.0 or later:

npx @wakaru/cli@latest --help
npm install -g @wakaru/cli@latest

See the published advisory: GHSA-7wpj-vvmv-pgm8

Highlights

• Expanded stable builtin alias roots for more reliable recovery of minified helper patterns.
• Improved cross-module helper namespace recovery and numeric require() ID rewriting.
• Recovered additional SWC namespace object spread, object-rest helper, inline sliced-array helper, async helper, and CommonJS export getter patterns.
• Improved React hook renaming inside arrow function bodies.
• Reused normalized ASTs across unpack phases for better unpack performance.

Correctness and Safety

This release strengthens path handling and unpack safety:

• Bundle-controlled filenames are sanitized component-by-component instead of by substring replacement.
• CLI unpack output paths are checked against the canonical output directory before writing.
• Parent-directory, absolute-path, Windows-prefix, and symlink escape cases are covered by regression tests.
• Raw unpack output continues to run before decompile rules, preserving expected raw extraction behavior.

No Breaking Changes

No user-facing breaking changes are expected. Existing CLI usage should continue to work, but users on affected versions should upgrade promptly.

Full Changelog: v1.3.0...v1.4.0