Skip to content

deps: bump serialize-javascript and mocha - #552

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-67416dcff4
Open

deps: bump serialize-javascript and mocha#552
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-67416dcff4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps serialize-javascript to 7.1.1 and updates ancestor dependency mocha. These dependencies need to be updated together.

Updates serialize-javascript from 6.0.2 to 7.1.1

Release notes

Sourced from serialize-javascript's releases.

v7.1.1

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.7...v7.1.0

v7.0.7

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.6...v7.0.7

v7.0.6

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.5...v7.0.6

v7.0.5

Fixes

  • Improve robustness and validation for array-like object serialization.
  • Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

v7.0.4

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.3...v7.0.4

v7.0.3

  • fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString (#207) 2e609d0

... (truncated)

Commits
  • 8c8caa7 release: v7.1.1
  • ffda9f1 fix: fix XSS bypass via split </script payload across function bodies
  • 739145a release: v7.1.0
  • 57865ed feat: add Node.js 26 to test matrix
  • 01bec60 release: v7.0.7
  • 5009715 fix: reject spoofed RegExp objects with non-string source property
  • 153eb43 release: v7.0.6
  • a83d2cb fix: reject spoofed URL objects with non-string toString() result
  • 451af65 build(deps-dev): bump lodash from 4.17.23 to 4.18.1 (#215)
  • df3f1c1 release: v7.0.5
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serialize-javascript since your current version.


Updates mocha from 11.7.5 to 12.0.0

Release notes

Sourced from mocha's releases.

v12.0.0

12.0.0 (2026-08-31)

🩹 Fixes

  • fixup parsing negative numbers and quoted strings (#6250) (2962875)
  • preserve FIFO descriptors when respawning (#6254) (3bb317d)

📚 Documentation

🧹 Chores

v12.0.0-rc.6

12.0.0-rc.6 (2026-08-09)

🩹 Fixes

  • deps: update dependency starlight-blog to ^0.28.0 (#6153) (6b79044)
  • docs: restore homepage logo (#6183) (06e81a8)
  • docs: restore spacing around footer links (#6185) (163d751)
  • use main instead of exports for the package entry point (#6193) (c32a696)

📚 Documentation

  • blog: add community contributions post (#6172) (5fcc0fe)
  • blog: update community-contributions to 2026-community-sponsorships (5462d84)
  • fix blog/2026-community-sponsorships description (#6177) (98c4746)
  • sync CLI docs with v12 options and defaults (#6140) (579fd15)

🧹 Chores

  • deps: update dependency @​playwright/test to v1.62.1 (#6197) (dcc539a)
  • deps: update dependency eslint to v10.8.0 (#6196) (deeeec6)
  • deps: update dependency globals to v17.9.0 (#6201) (c2c6d63)
  • deps: update dependency knip to v6.31.0 (#6166) (b7cd1bd)
  • deps: update dependency sinon to v22.1.0 (#6188) (284f0c2)
  • deps: update dependency webpack to v5.109.2 (#6194) (badf733)
  • extract stripLeadingDashes helper + cover CLI arg-parsing edge cases (#6171) (867e175)
  • fix esm-utils tests when run without coverage (#6160) (c54539f)

... (truncated)

Changelog

Sourced from mocha's changelog.

12.0.0 (2026-08-31)

🩹 Fixes

  • fixup parsing negative numbers and quoted strings (#6250) (2962875)
  • preserve FIFO descriptors when respawning (#6254) (3bb317d)

📚 Documentation

🧹 Chores

12.0.0-rc.6 (2026-08-09)

🩹 Fixes

  • deps: update dependency starlight-blog to ^0.28.0 (#6153) (6b79044)
  • docs: restore homepage logo (#6183) (06e81a8)
  • docs: restore spacing around footer links (#6185) (163d751)
  • use main instead of exports for the package entry point (#6193) (c32a696)

📚 Documentation

  • blog: add community contributions post (#6172) (5fcc0fe)
  • blog: update community-contributions to 2026-community-sponsorships (5462d84)
  • fix blog/2026-community-sponsorships description (#6177) (98c4746)
  • sync CLI docs with v12 options and defaults (#6140) (579fd15)

🧹 Chores

  • deps: update dependency @​playwright/test to v1.62.1 (#6197) (dcc539a)
  • deps: update dependency eslint to v10.8.0 (#6196) (deeeec6)
  • deps: update dependency globals to v17.9.0 (#6201) (c2c6d63)
  • deps: update dependency knip to v6.31.0 (#6166) (b7cd1bd)
  • deps: update dependency sinon to v22.1.0 (#6188) (284f0c2)
  • deps: update dependency webpack to v5.109.2 (#6194) (badf733)
  • extract stripLeadingDashes helper + cover CLI arg-parsing edge cases (#6171) (867e175)
  • fix esm-utils tests when run without coverage (#6160) (c54539f)
  • keep stderr out of the JSON parsed by the FIFO test (#6187) (ea6489e)
  • limit token perms in protect-manifest workflow (#6175) (8cf0030)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mocha since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 2, 2026
@justinmk justinmk closed this Sep 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/multi-67416dcff4 branch September 3, 2026 00:23
@justinmk

justinmk commented Sep 11, 2026

Copy link
Copy Markdown
Member

@dependabot recreate

@dependabot @github

dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR is closed. If the branch still exists, you can re-open the PR and then use @dependabot rebase or @dependabot recreate. If the branch was deleted, Dependabot will create a new PR on the next scheduled run, or you can trigger an update from the Dependency graph page.

@justinmk
justinmk restored the dependabot/npm_and_yarn/multi-67416dcff4 branch September 11, 2026 14:48
@justinmk

justinmk commented Sep 11, 2026

Copy link
Copy Markdown
Member

@dependabot recreate

@justinmk justinmk reopened this Sep 11, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR is closed. If the branch still exists, you can re-open the PR and then use @dependabot rebase or @dependabot recreate. If the branch was deleted, Dependabot will create a new PR on the next scheduled run, or you can trigger an update from the Dependency graph page.

@justinmk

justinmk commented Sep 11, 2026

Copy link
Copy Markdown
Member

@dependabot recreate

@dependabot
deps: bump serialize-javascript and mocha
9f712c3 
Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) to 7.1.1 and updates ancestor dependency [mocha](https://github.com/mochajs/mocha). These dependencies need to be updated together.


Updates `serialize-javascript` from 6.0.2 to 7.1.1
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v6.0.2...v7.1.1)

Updates `mocha` from 11.7.5 to 12.0.0
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md)
- [Commits](mochajs/mocha@v11.7.5...v12.0.0)

---
updated-dependencies:
- dependency-name: mocha
  dependency-version: 12.0.0
  dependency-type: direct:development
- dependency-name: serialize-javascript
  dependency-version: 7.1.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-67416dcff4 branch from 5056fb3 to 9f712c3 Compare September 11, 2026 14:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@justinmk