[dependabot]

Bumps serialize-javascript from 7.0.5 to 7.1.4.

Release notes

Sourced from serialize-javascript's releases.

v7.1.4

What's Changed

• Fix methods containing nested functions and arrows by @​Shubham-Padkonde in yahoo/serialize-javascript#231
• docs: add SECURITY.md by @​redonkulus in yahoo/serialize-javascript#237
• release: v7.1.4 by @​redonkulus in yahoo/serialize-javascript#238

Note on method serialization

Concise methods ({ m() {} }), including async, generator and computed-key methods, are now serialized correctly when their bodies contain a nested arrow function or function declaration. Previously these were emitted unchanged, producing invalid output that failed to deserialize (#118). Class expressions continue to be emitted as-is.

Reporting security issues

This repo now has a security policy. Please report vulnerabilities privately through GitHub's private vulnerability reporting rather than public issues.

Full Changelog: yahoo/serialize-javascript@v7.1.3...v7.1.4

v7.1.3

See: GHSA-m5mm-p8h7-m29v

What's Changed

• fix: escape </script at the end of a serialized function body by @​redonkulus in yahoo/serialize-javascript#235
• Fix serialization of Dates with expanded ISO years by @​Shubham-Padkonde in yahoo/serialize-javascript#232
• fix: ignore functions without mutating input objects by @​Shubham-Padkonde in yahoo/serialize-javascript#233
• release: v7.1.3 by @​redonkulus in yahoo/serialize-javascript#236

Note on ignoreFunction

With ignoreFunction: true, function values are now omitted the same way JSON.stringify omits them, without deleting them from the input object. Functions inside arrays are emitted as null (previously this produced Array.prototype.slice.call(...) output).

New Contributors

• @​Shubham-Padkonde made their first contribution in yahoo/serialize-javascript#232

Full Changelog: yahoo/serialize-javascript@v7.1.2...v7.1.3

v7.1.2

See: GHSA-gfhx-hw2g-v5hg

v7.1.1

What's Changed

• fix: fix XSS bypass via split </script payload across function bodies by @​okuryu in yahoo/serialize-javascript#226
• release: v7.1.1 by @​okuryu in yahoo/serialize-javascript#227

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

• feat: add Node.js 26 to test matrix by @​okuryu in yahoo/serialize-javascript#224
• release: v7.1.0 by @​okuryu in yahoo/serialize-javascript#225

... (truncated)

Commits

• 05c5ceb release: v7.1.4 (#238)
• fdb853d Fix methods containing nested functions and arrows (#231)
• f7dfeae docs: add SECURITY.md pointing to private vulnerability reporting (#237)
• 4d36b82 release: v7.1.3 (#236)
• 45e5397 fix: ignore functions without mutating input objects (#233)
• e978a1b fix: serialize Dates with expanded ISO years (#232)
• 2864b3c fix: escape </script at the end of a serialized function body (#235)
• 6a73fa1 release: v7.1.2
• 2bdbaaf Merge commit from fork
• 8c8caa7 release: v7.1.1
• Additional commits viewable in compare view

[Changyong Gong (chagong)]

Dependabot (@dependabot) rebase

[Changyong Gong (chagong)]

Decision: NOT_MERGED

Dependabot PR Manager result

Repository: microsoft/vscode-java-test
Pull request: microsoft/vscode-java-test#1950 - fix(deps-dev): bump serialize-javascript from 7.0.5 to 7.1.4
Update: serialize-javascript 7.0.5 -> 7.1.4; minor, including security hardening; transitive development dependency and override retained.
Safety assessment: Dependabot-only commit; current base is included. Standard Dependency Gate passes static audit: manifest/lockfile-only diff, verified registry integrity, unchanged Node >=20 requirement. Mocha uses the serializer for worker options; no direct dependency exists to remove. Low static risk, but CI causality remains unresolved.
Final state: Head 47668c1; OPEN, MERGEABLE, BLOCKED, REVIEW_REQUIRED. CI: 7 successful, 2 failed, 0 pending; required Linux and license/cla pass. Failed: VSCode-Test-Runner-CI-Build (INDETERMINATE); VSCode-Test-Runner-CI-Build (Build Validate dependencies from CFS) (INDETERMINATE).
Actions taken: Re-audited current-head provenance, complete diff, tracked dependency usages, upstream changes, registry metadata, reviews, threads and checks in an isolated exact-head worktree. Verified live main c094535 is the head's parent; no branch recovery needed. Current-head GitHub CI passed installation, lint, Java build, production bundling and extension tests on Linux, Windows and macOS. Retrieved both failed-check annotations; the CI-log skill found no matching GitHub Actions job, and Azure timeline/log APIs returned HTTP 401. No local test execution, rerun, rebase, recreation, remediation, commit, push, approval or merge this run.
Reason: Azure build 32410325 reports Bash exit code 1, but detailed logs are inaccessible. Its prerequisite-deprecation annotation is explicitly non-blocking. Successful base-branch Azure build 32409650 exercised a different job, so neither failed check has established causality. Classic branch-protection details also returned HTTP 403; effective rules require review.
Next action: An authorized Azure pipeline owner must inspect build 32410325, establish and resolve the CFS failure, and obtain successful current-head checks; then rerun management and satisfy required review.

[Changyong Gong (chagong)]

Dependabot (@dependabot) rebase