Skip to content

Javascript dependency: Bump serialize-javascript from 7.0.5 to 7.1.3 in /web - #10679

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/web/serialize-javascript-7.1.3
Open

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/web/serialize-javascript-7.1.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026 •

Copy link
Copy Markdown
Contributor

Bumps serialize-javascript from 7.0.5 to 7.1.3.

Release notes

Sourced from serialize-javascript's releases.

v7.1.3

See: GHSA-m5mm-p8h7-m29v

What's Changed

Note on ignoreFunction

With ignoreFunction: true, function values are now omitted the same way JSON.stringify omits them, without deleting them from the input object. Functions inside arrays are emitted as null (previously this produced Array.prototype.slice.call(...) output).

New Contributors

Full Changelog: yahoo/serialize-javascript@v7.1.2...v7.1.3

v7.1.2

See: GHSA-gfhx-hw2g-v5hg

v7.1.1

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.7...v7.1.0

v7.0.7

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.6...v7.0.7

v7.0.6

What's Changed

... (truncated)

Commits
  • 4d36b82 release: v7.1.3 (#236)
  • 45e5397 fix: ignore functions without mutating input objects (#233)
  • e978a1b fix: serialize Dates with expanded ISO years (#232)
  • 2864b3c fix: escape </script at the end of a serialized function body (#235)
  • 6a73fa1 release: v7.1.2
  • 2bdbaaf Merge commit from fork
  • 8c8caa7 release: v7.1.1
  • ffda9f1 fix: fix XSS bypass via split </script payload across function bodies
  • 739145a release: v7.1.0
  • 57865ed feat: add Node.js 26 to test matrix
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the Dependencies Pull requests that update a dependency file label Oct 26, 2026
@coderabbitai

coderabbitai Bot commented Oct 26, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) from 7.0.5 to 7.1.3.
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v7.0.5...v7.1.3)

---
updated-dependencies:
- dependency-name: serialize-javascript
  dependency-version: 7.1.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/web/serialize-javascript-7.1.3 branch from 9d42fa3 to 7b44bc0 Compare October 26, 2026 10:33

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants