1.5.2

DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS, resolved.

Author: badosa

docs/INSTALL.md

@@ -11,18 +11,18 @@
 Copy the latest version of the [jsonstat-toolkit code](https://raw.githubusercontent.com/jsonstat/toolkit/master/iife.js) to your server and use a script tag in your webpage to link to it. <strong>jsonstat-toolkit</strong> is also available from several CDNs ([unpkg](https://unpkg.com), [jsDelivr](https://www.jsdelivr.com/)):
 
 ```html
-<script src="https://unpkg.com/[email protected].1"></script>
+<script src="https://unpkg.com/[email protected].2"></script>
 ```
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/[email protected].1"></script>
+<script src="https://cdn.jsdelivr.net/npm/[email protected].2"></script>
 ```
 
 The Toolkit works on any modern browser. It also supports Internet Explorer 9 or higher as long as its connection capabilities (*JSONstat(url).then(func)*) are not used (and even older Internet Explorer versions as long as polyfills are provided for [Array.isArray](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/isArray), [Object.keys](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/keys) and [Array.forEach](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/forEach)). It is also possible to use the Toolkit connection capabilities on Internt Explorer as long as polyfills for [promises](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise) and [fetch](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) are provided:
 
 ```html
 <script src="https://cdn.jsdelivr.net/combine/npm/[email protected],npm/[email protected]"></script>
-<script src="https://unpkg.com/[email protected].1"></script>
+<script src="https://unpkg.com/[email protected].2"></script>
 ```
 
 ### ECMAScript module
@@ -31,13 +31,13 @@ Very modern browsers support ECMAScript modules. Copy the latest version of the
 
 ```html
 <script type="module">
-import JSONstat from "https://unpkg.com/[email protected].1/import.mjs";
+import JSONstat from "https://unpkg.com/[email protected].2/import.mjs";
 </script>
 ```
 
 ```html
 <script type="module">
-import JSONstat from "https://cdn.jsdelivr.net/npm/[email protected].1/import.mjs";
+import JSONstat from "https://cdn.jsdelivr.net/npm/[email protected].2/import.mjs";
 </script>
 ```
 
@@ -72,5 +72,5 @@ import { JSONstat } from "@jsonstat/toolkit"
 To import a particular version of the jsonstat-toolkit in [Observable](https://observablehq.com/):
 
 ```js
-JSONstat = require("[email protected].1").catch(() => window["JSONstat"])
+JSONstat = require("[email protected].2").catch(() => window["JSONstat"])
 ```

iife.js

@@ -1,6 +1,6 @@
 {
 	"name": "jsonstat-toolkit",
-	"version": "1.5.1",
+	"version": "1.5.2",
 	"description": "JSON-stat Javascript Toolkit: a library to deal with JSON-stat responses.",
 	"homepage": "https://jsonstat.com",
 	"keywords": [
@@ -32,9 +32,9 @@
 		"node-fetch": "^2.6.0"
 	},
 	"devDependencies": {
-		"@rollup/plugin-json": "^4.0.0",
-		"rollup": "^1.27.1",
-		"rollup-plugin-terser": "^5.1.2"
+		"@rollup/plugin-json": "^6.1.0",
+		"rollup": "^4.26.0",
+		"@rollup/plugin-terser": "^0.4.4"
 	},
 	"license": "Apache-2.0",
 	"files": [

import.mjs

@@ -1,6 +1,6 @@
-import {terser} from "rollup-plugin-terser";
+import terser from "@rollup/plugin-terser";
 import json from '@rollup/plugin-json';
-import * as pkg from "./package.json";
+import pkg from "./package.json" with {type: "json"};
 
 const
   preamble=`// ${pkg.name} v${pkg.version} Copyright ${(new Date).getFullYear()} ${pkg.author.name} ${pkg.homepage}`,