Skip to content

chore(deps): bump serialize-javascript and mocha - #555

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-67416dcff4
Open

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-67416dcff4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 8, 2026 •

Copy link
Copy Markdown
Contributor

Bumps serialize-javascript to 7.1.2 and updates ancestor dependency mocha. These dependencies need to be updated together.

Updates serialize-javascript from 6.0.2 to 7.1.2

Release notes

Sourced from serialize-javascript's releases.

v7.1.2

See: GHSA-gfhx-hw2g-v5hg

v7.1.1

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.7...v7.1.0

v7.0.7

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.6...v7.0.7

v7.0.6

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.5...v7.0.6

v7.0.5

Fixes

  • Improve robustness and validation for array-like object serialization.
  • Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

v7.0.4

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.3...v7.0.4

... (truncated)

Commits
  • 6a73fa1 release: v7.1.2
  • 2bdbaaf Merge commit from fork
  • 8c8caa7 release: v7.1.1
  • ffda9f1 fix: fix XSS bypass via split </script payload across function bodies
  • 739145a release: v7.1.0
  • 57865ed feat: add Node.js 26 to test matrix
  • 01bec60 release: v7.0.7
  • 5009715 fix: reject spoofed RegExp objects with non-string source property
  • 153eb43 release: v7.0.6
  • a83d2cb fix: reject spoofed URL objects with non-string toString() result
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serialize-javascript since your current version.


Updates mocha from 10.8.2 to 12.0.3

Release notes

Sourced from mocha's releases.

v12.0.3

12.0.3 (2026-10-01)

🩹 Fixes

  • keep watching when the last test file is removed (#6355) (921c161)
  • show require() error on unsupported directory import (#6354) (a68344f)
  • support --X one-char aliases (#6391) (1227939)

📚 Documentation

🧹 Chores

v12.0.2

12.0.2 (2026-09-17)

🩹 Fixes

  • fail nested tests on beforeEach failure (#6292) (a75b43b)
  • give CLI reporter-option precedence over config file (#6331) (571110f)
  • propagate spec file path on parallel worker death (#6268) (55a544a)
  • use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
  • watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

🧹 Chores

  • add "stale branch" workflow (#6315) (ad17f9f)
  • add dependency conflict detection workflow (#6246) (ef0ae32)
  • add folder for reproducing issues (#6330) (6728030)
  • add stale triage reminder for unreviewed issues (#6314) (ee35133)
  • auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
  • convert file-unloader to ESM (#6294) (dc73f4c)
  • deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
  • deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)

... (truncated)

Changelog

Sourced from mocha's changelog.

12.0.3 (2026-10-01)

🩹 Fixes

  • keep watching when the last test file is removed (#6355) (921c161)
  • show require() error on unsupported directory import (#6354) (a68344f)
  • support --X one-char aliases (#6391) (1227939)

📚 Documentation

🧹 Chores

12.0.2 (2026-09-17)

🩹 Fixes

  • fail nested tests on beforeEach failure (#6292) (a75b43b)
  • give CLI reporter-option precedence over config file (#6331) (571110f)
  • propagate spec file path on parallel worker death (#6268) (55a544a)
  • use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
  • watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

🧹 Chores

  • add "stale branch" workflow (#6315) (ad17f9f)
  • add dependency conflict detection workflow (#6246) (ef0ae32)
  • add folder for reproducing issues (#6330) (6728030)
  • add stale triage reminder for unreviewed issues (#6314) (ee35133)
  • auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
  • convert file-unloader to ESM (#6294) (dc73f4c)
  • deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
  • deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)
  • deps: update dependency knip to v6.35.0 (#6324) (a2416af)
  • deps: update octoguide/bot action to v0.23.0 (#6304) (bbe5a27)

... (truncated)

Commits
  • 51a0cc5 chore(main): release 12.0.3 (#6353)
  • 1227939 fix: support --X one-char aliases (#6391)
  • bb2e69a docs: refresh help output, fix stale links (#6357)
  • 921c161 fix: keep watching when the last test file is removed (#6355)
  • 3382fdd test: add --import=tsx integration test (#6356)
  • a68344f fix: show require() error on unsupported directory import (#6354)
  • d59467a test: touch a new file without stamping it afterwards (#6349)
  • 70db1c7 chore(main): release 12.0.2 (#6300)
  • 571110f fix: give CLI reporter-option precedence over config file (#6331)
  • a652ff5 fix: use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mocha since your current version.


@dependabot dependabot Bot added dependencies Adds, updates or removes a dependency, or changes the lockfile javascript Pull requests that update Javascript code labels Sep 8, 2026
@cjbarth cjbarth added this to the v7.0 milestone Sep 25, 2026
Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) to 7.1.2 and updates ancestor dependency [mocha](https://github.com/mochajs/mocha). These dependencies need to be updated together.


Updates `serialize-javascript` from 6.0.2 to 7.1.2
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v6.0.2...v7.1.2)

Updates `mocha` from 10.8.2 to 12.0.3
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md)
- [Commits](mochajs/mocha@v10.8.2...v12.0.3)

---
updated-dependencies:
- dependency-name: mocha
  dependency-version: 12.0.0
  dependency-type: direct:development
- dependency-name: serialize-javascript
  dependency-version: 7.1.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump serialize-javascript and mocha chore(deps): bump serialize-javascript and mocha Oct 5, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-67416dcff4 branch from 23754eb to 5f0fbeb Compare October 5, 2026 13:28
@coderabbitai

coderabbitai Bot commented Oct 5, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 9f6fcd02-b916-40b8-bde8-01f44dfed7b3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Adds, updates or removes a dependency, or changes the lockfile javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant