Skip to content

fix(deps): bump serialize-javascript and mocha - #259

Merged
TobiTenno merged 1 commit into
masterfrom
dependabot-npm_and_yarn-multi-67416dcff4
Sep 3, 2026
Merged

fix(deps): bump serialize-javascript and mocha#259
TobiTenno merged 1 commit into
masterfrom
dependabot-npm_and_yarn-multi-67416dcff4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor

Bumps serialize-javascript to 7.1.1 and updates ancestor dependency mocha. These dependencies need to be updated together.

Updates serialize-javascript from 6.0.2 to 7.1.1

Release notes

Sourced from serialize-javascript's releases.

v7.1.1

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.7...v7.1.0

v7.0.7

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.6...v7.0.7

v7.0.6

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.5...v7.0.6

v7.0.5

Fixes

  • Improve robustness and validation for array-like object serialization.
  • Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

v7.0.4

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.3...v7.0.4

v7.0.3

  • fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString (#207) 2e609d0

... (truncated)

Commits
  • 8c8caa7 release: v7.1.1
  • ffda9f1 fix: fix XSS bypass via split </script payload across function bodies
  • 739145a release: v7.1.0
  • 57865ed feat: add Node.js 26 to test matrix
  • 01bec60 release: v7.0.7
  • 5009715 fix: reject spoofed RegExp objects with non-string source property
  • 153eb43 release: v7.0.6
  • a83d2cb fix: reject spoofed URL objects with non-string toString() result
  • 451af65 build(deps-dev): bump lodash from 4.17.23 to 4.18.1 (#215)
  • df3f1c1 release: v7.0.5
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serialize-javascript since your current version.


Updates mocha from 11.8.0 to 12.0.0

Release notes

Sourced from mocha's releases.

v12.0.0

12.0.0 (2026-08-31)

馃┕ Fixes

  • fixup parsing negative numbers and quoted strings (#6250) (2962875)
  • preserve FIFO descriptors when respawning (#6254) (3bb317d)

馃摎 Documentation

馃Ч Chores

v12.0.0-rc.6

12.0.0-rc.6 (2026-08-09)

馃┕ Fixes

  • deps: update dependency starlight-blog to ^0.28.0 (#6153) (6b79044)
  • docs: restore homepage logo (#6183) (06e81a8)
  • docs: restore spacing around footer links (#6185) (163d751)
  • use main instead of exports for the package entry point (#6193) (c32a696)

馃摎 Documentation

  • blog: add community contributions post (#6172) (5fcc0fe)
  • blog: update community-contributions to 2026-community-sponsorships (5462d84)
  • fix blog/2026-community-sponsorships description (#6177) (98c4746)
  • sync CLI docs with v12 options and defaults (#6140) (579fd15)

馃Ч Chores

  • deps: update dependency @鈥媝laywright/test to v1.62.1 (#6197) (dcc539a)
  • deps: update dependency eslint to v10.8.0 (#6196) (deeeec6)
  • deps: update dependency globals to v17.9.0 (#6201) (c2c6d63)
  • deps: update dependency knip to v6.31.0 (#6166) (b7cd1bd)
  • deps: update dependency sinon to v22.1.0 (#6188) (284f0c2)
  • deps: update dependency webpack to v5.109.2 (#6194) (badf733)
  • extract stripLeadingDashes helper + cover CLI arg-parsing edge cases (#6171) (867e175)
  • fix esm-utils tests when run without coverage (#6160) (c54539f)

... (truncated)

Changelog

Sourced from mocha's changelog.

12.0.0 (2026-08-31)

馃┕ Fixes

  • fixup parsing negative numbers and quoted strings (#6250) (2962875)
  • preserve FIFO descriptors when respawning (#6254) (3bb317d)

馃摎 Documentation

馃Ч Chores

12.0.0-rc.6 (2026-08-09)

馃┕ Fixes

  • deps: update dependency starlight-blog to ^0.28.0 (#6153) (6b79044)
  • docs: restore homepage logo (#6183) (06e81a8)
  • docs: restore spacing around footer links (#6185) (163d751)
  • use main instead of exports for the package entry point (#6193) (c32a696)

馃摎 Documentation

  • blog: add community contributions post (#6172) (5fcc0fe)
  • blog: update community-contributions to 2026-community-sponsorships (5462d84)
  • fix blog/2026-community-sponsorships description (#6177) (98c4746)
  • sync CLI docs with v12 options and defaults (#6140) (579fd15)

馃Ч Chores

  • deps: update dependency @鈥媝laywright/test to v1.62.1 (#6197) (dcc539a)
  • deps: update dependency eslint to v10.8.0 (#6196) (deeeec6)
  • deps: update dependency globals to v17.9.0 (#6201) (c2c6d63)
  • deps: update dependency knip to v6.31.0 (#6166) (b7cd1bd)
  • deps: update dependency sinon to v22.1.0 (#6188) (284f0c2)
  • deps: update dependency webpack to v5.109.2 (#6194) (badf733)
  • extract stripLeadingDashes helper + cover CLI arg-parsing edge cases (#6171) (867e175)
  • fix esm-utils tests when run without coverage (#6160) (c54539f)
  • keep stderr out of the JSON parsed by the FIFO test (#6187) (ea6489e)
  • limit token perms in protect-manifest workflow (#6175) (8cf0030)

... (truncated)

Commits

@dependabot
dependabot Bot requested a review from a team as a code owner September 3, 2026 04:53
@dependabot
dependabot Bot requested a review from SlayerOrnstein September 3, 2026 04:53
@dependabot dependabot Bot added Scope: Dependencies Pull requests that update a dependency file Type: Maintenance labels Sep 3, 2026
@dependabot
dependabot Bot force-pushed the dependabot-npm_and_yarn-multi-67416dcff4 branch from 199d3f9 to 9366f83 Compare September 3, 2026 04:57
@TobiTenno
TobiTenno enabled auto-merge (squash) September 3, 2026 13:04
@dependabot
dependabot Bot force-pushed the dependabot-npm_and_yarn-multi-67416dcff4 branch from 9366f83 to fb41b39 Compare September 3, 2026 13:08
Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) to 7.1.1 and updates ancestor dependency [mocha](https://github.com/mochajs/mocha). These dependencies need to be updated together.


Updates `serialize-javascript` from 6.0.2 to 7.1.1
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v6.0.2...v7.1.1)

Updates `mocha` from 11.8.0 to 12.0.0
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md)
- [Commits](mochajs/mocha@v11.8.0...v12.0.0)

---
updated-dependencies:
- dependency-name: mocha
  dependency-version: 12.0.0
  dependency-type: direct:development
- dependency-name: serialize-javascript
  dependency-version: 7.1.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot-npm_and_yarn-multi-67416dcff4 branch from fb41b39 to b16887e Compare September 3, 2026 13:13
@TobiTenno
TobiTenno merged commit 59aab8f into master Sep 3, 2026
5 checks passed
@TobiTenno
TobiTenno deleted the dependabot-npm_and_yarn-multi-67416dcff4 branch September 3, 2026 13:15
@wfcd-bot-boi

Copy link
Copy Markdown
Collaborator

馃帀 This PR is included in version 2.149.47 馃帀

The release is available on:

Your semantic-release bot 馃摝馃殌

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

released Scope: Dependencies Pull requests that update a dependency file Type: Maintenance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants