javascript-obfuscator 5.5.0: Pro API large uploads now send raw source blobs

What happened on 18 July

On 18 July 2026 at 08:41 UTC, javascript-obfuscator 5.5.0 was published on GitHub. Its release notes list a single change: large file uploads to the Pro API were reworked. That covers a fix for 413 Content Too Large errors with request bodies of roughly 4.4 to 4.6 MB, a switch to sending the raw source code as a blob in raw format instead of wrapping it inside the JSON request body, and the expectation that uploads now stay within the plan's file size limit. It is a narrow fix release; the notes do not mention any change to the obfuscation transforms or options themselves.

Why it is worth noting

The change highlights an easily overlooked fact: when you use a cloud obfuscation API, your unobfuscated source leaves your build environment and goes to a third-party service. That can be perfectly acceptable, but it should be a recorded decision, reviewed with the same care you apply to source hosting or CI providers. Separately, whether obfuscation runs locally or remotely, the JavaScript inside an Electron or web front end still ships in executable form and can be observed at runtime; obfuscation raises the cost of reading and modifying it, not its confidentiality. Bundles in the multi-megabyte range also show how much front-end code desktop apps carry, which raises the odds that a key or an internal endpoint slipped in.

Suggested checks

First, list every build step that sends source to an external service, such as obfuscation, minification or source-map uploads for error reporting, and confirm the contractual and data-handling terms for each. Second, run a secret scan on the bundle before obfuscation, and move API keys, signing salts and pricing rules out of the front end, issuing short-lived tokens from the server instead. Third, pin the obfuscator version and compare output for the same input when upgrading; after packaging and signing, run the full regression suite to confirm the transform neither broke behavior nor was silently skipped.

Your checklist

• Document every build step that sends source to an external service
• Secret-scan the bundle before obfuscation and move sensitive rules server-side
• Pin the obfuscator version, diff outputs on upgrade and run full regression