From 5af9f69812e593b5c9ba860c5b2c553b50403ba7 Mon Sep 17 00:00:00 2001 From: Revopush Date: Wed, 4 Nov 2026 11:03:06 +0200 Subject: [PATCH] fix(deps): bump serialize-javascript to 7.1.4 (CVE-2026-115897) The exact 7.0.7 override pinned mocha's serialize-javascript below the patched release; relax it to ^7.1.4. Co-Authored-By: Claude Opus 5.5 --- package-lock.json | 7 ++++--- package.json | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 882009e4..42ec0409 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1300,10 +1300,11 @@ } }, "node_modules/serialize-javascript": { - "version": "7.0.7", - "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.7.tgz", - "integrity": "sha512-YAy8Od6KV+uuwUuU50np8fGB/Aues6Y0nAhA9y/hId74PlKUcme4pXcBD46NWKr1Q4osN/iseZ17YqO1XfmI8g==", + "version": "7.1.4", + "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.4.tgz", + "integrity": "sha512-FqlEuoTq/zRmA4Lg6aOqyH3lCHbUtCB0bmHCeFniX2GBdDqMJM3FwdvEhlE5Pim1dlt2FfBdVPmUNNiGhhKqpw==", "dev": true, + "license": "BSD-3-Clause", "engines": { "node": ">=20.0.0" } diff --git a/package.json b/package.json index 3b7ebbda..a3fbb1bf 100644 --- a/package.json +++ b/package.json @@ -44,7 +44,7 @@ "typescript": "^5.1.6" }, "overrides": { - "serialize-javascript": "7.0.7", + "serialize-javascript": "^7.1.4", "diff": "9.0.0" } }