Skip to content

chore(deps): bump serialize-javascript and nitropack#5

Merged
SergioRibera merged 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-59f07b7826
Apr 8, 2026
Merged

chore(deps): bump serialize-javascript and nitropack#5
SergioRibera merged 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-59f07b7826

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 7, 2026

Copy link
Copy Markdown
Contributor

Bumps serialize-javascript and nitropack. These dependencies needed to be updated together.
Updates serialize-javascript from 6.0.2 to 7.0.5

Release notes

Sourced from serialize-javascript's releases.

v7.0.5

Fixes

  • Improve robustness and validation for array-like object serialization.
  • Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

v7.0.4

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.3...v7.0.4

v7.0.3

  • fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString (#207) 2e609d0
  • build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (#206) 42b7cdb

yahoo/serialize-javascript@v7.0.2...v7.0.3

v7.0.2

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.1...v7.0.2

v7.0.1

What's Changed

New Contributors

Full Changelog: yahoo/serialize-javascript@v7.0.0...v7.0.1

v7.0.0

Breaking Changes

  • requires Node.js v20+

What's Changed

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for serialize-javascript since your current version.


Updates nitropack from 2.11.12 to 2.13.3

Release notes

Sourced from nitropack's releases.

v2.13.3

compare changes

📦 Dependency Updates

Package From To
httpxy ^0.3.1 ^0.5.0
h3 ^1.15.9 ^1.15.10
esbuild ^0.27.4 ^0.27.5
rollup ^4.59.0 ^4.60.1
@vercel/nft ^1.4.0 ^1.5.0
c12 ^3.3.3 ^3.3.4
citty ^0.2.1 ^0.2.2
defu ^6.1.4 ^6.1.6
globby ^16.1.1 ^16.2.0
listhen ^1.9.0 ^1.9.1
unstorage ^1.17.4 ^1.17.5
cookie-es ^2.0.0 ^2.0.1
youch ^4.1.0 ^4.1.1

v2.13.2

compare changes

[!NOTE] This release upgrades h3 to latest 1.15.9 which contains security fixes.

🩹 Fixes

  • prerender: Skip writing routes with .. or outside of public dir (81f76800)
  • prerender: Mark invalid routes as skipped (9cb795c7)

📖 Documentation

  • Fix icon assets (#4022)

Preset Changes

  • vercel: Add types and docs for isr.exposeErrBody (f7753152)

❤️ Contributors

v2.13.1

compare changes

This release mainly updates dependencies (696dc3a9)

... (truncated)

Commits
  • 9479721 presets(vercel): support max value on maxDuration types (#4172)
  • 55f30f4 fix(build)!: remove custom moduleSideEffects config (#4164)
  • 3052ae4 chore: apply automated updates
  • c1c3ce9 chore: update deps
  • c38312e chore: update deps
  • 5cd5cb2 chore: update deps
  • 589e8ad feat(vercel): allow overriding function config by route (#4124)
  • 2888e8f fix(runtime): avoid infinite recursion in fetch for external URLs (#4153)
  • 75cc89d fix(vite): proxy nitro/* imports from service environments (#4152)
  • feaa125 build: upgrade mdzilla to 0.2
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 7, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-59f07b7826 branch 2 times, most recently from ad768ce to 680c9ff Compare April 8, 2026 00:00
Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) and [nitropack](https://github.com/nitrojs/nitro). These dependencies needed to be updated together.

Updates `serialize-javascript` from 6.0.2 to 7.0.5
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v6.0.2...v7.0.5)

Updates `nitropack` from 2.11.12 to 2.13.3
- [Release notes](https://github.com/nitrojs/nitro/releases)
- [Changelog](https://github.com/nitrojs/nitro/blob/main/changelog.config.ts)
- [Commits](nitrojs/nitro@v2.11.12...v2.13.3)

---
updated-dependencies:
- dependency-name: serialize-javascript
  dependency-version: 7.0.5
  dependency-type: indirect
- dependency-name: nitropack
  dependency-version: 2.13.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-59f07b7826 branch from 680c9ff to b289b47 Compare April 8, 2026 00:02
@SergioRibera SergioRibera merged commit 1d6408f into main Apr 8, 2026
1 check failed
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/multi-59f07b7826 branch April 8, 2026 00:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant