Skip to content

Bump serialize-javascript, nuxt and webpack#357

Closed
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/multi-372dce1085
Closed

Bump serialize-javascript, nuxt and webpack#357
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/multi-372dce1085

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 29, 2026

Bumps serialize-javascript to 7.0.5 and updates ancestor dependencies serialize-javascript, nuxt and webpack. These dependencies need to be updated together.

Updates serialize-javascript from 6.0.2 to 7.0.5

Release notes

Sourced from serialize-javascript's releases.

v7.0.5

Fixes

  • Improve robustness and validation for array-like object serialization.
  • Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

v7.0.4

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.3...v7.0.4

v7.0.3

  • fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString (#207) 2e609d0
  • build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (#206) 42b7cdb

yahoo/serialize-javascript@v7.0.2...v7.0.3

v7.0.2

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.1...v7.0.2

v7.0.1

What's Changed

New Contributors

Full Changelog: yahoo/serialize-javascript@v7.0.0...v7.0.1

v7.0.0

Breaking Changes

  • requires Node.js v20+

What's Changed

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for serialize-javascript since your current version.


Updates nuxt from 2.18.1 to 4.4.2

Release notes

Sourced from nuxt's releases.

v4.3.1

4.3.1 is a regularly scheduled patch release.

👉 Changelog

compare changes

🩹 Fixes

  • nuxt: Correct reference format of server builder (#34177)
  • nuxt: Add status/statusText getters to NuxtError (#34188)
  • nuxt: Don't inject shared types for differing auto-imports (#34191)
  • schema: Add direnv and vendor to default ignore (#34190)
  • nuxt: Focus hash links after navigation (#34193)
  • nuxt: Exclude head runtime from unhead imports transform (#34195)
  • kit: Include prereleases in semver satisfy check (#34210)
  • nitro: Encode unicode paths in x-nitro-prerender header (#34202)
  • nuxt: Watch server/ for builder:watch hook (#34208)
  • nitro: Preserve error.message for fatal errors (#34226)
  • Only enable dynamic imports when ts plugin (#34205)
  • webpack: Use H3Error for 403 in dev server (#34233)
  • nuxt: Ensure NuxtError extends Error type (#34242)
  • vite: Use H3Error for 404 in dev server (#34225)
  • nuxt: Add backwards compat for #app barrel export in keyed functions (#34199)
  • nuxt: Track + re-add custom routes on hmr (#32044)
  • nuxt: Keep vnode when leaving deeper nested route (#33778)
  • vite: Prevent CSS flickering in dev mode after config changes (#33856)
  • nuxt: Do not start view transition if there is no route (#33723)
  • nuxt: Call deferHydration done on NuxtPage unmount (#34152)
  • nuxt: Handle invalid datetime in ` (#33992)
  • nuxt: Preserve middleware error status in 404 fallback (#34148)
  • nitro: Do not augment nuxt/schema (#34255)
  • nuxt: Cache manifest files to preserve buildId (#34002)
  • nuxt: Don't decode query string in SSR context URL (#34252)
  • nuxt: Allow specifying moduleDependencies by meta.name (#34263)
  • nuxt: Resolve #components import mapping conflict for packages outside rootDir (#34139)
  • vite,webpack: Use node.res to send 403/404 (#34266)
  • nitro,nuxt: Align path encoding with vue-router (#34265)
  • nitro: Augment nuxt/schema once more (552bbd8d1)

💅 Refactors

  • nuxt: Prefer genObjectKey to omit unnecessary quotes (#34245)
  • nuxt: Use ComponentProps helper to extract layout props (#34248)

📖 Documentation

  • Update roadmap dates (#34166)
  • Correct default value of nitroAutoImports (#34182)
  • Clarify shared type context limitations for custom imports (#34194)
  • Fix broken links (#34223)
  • Document payload extraction for ISR/SWR routes (#34222)
  • Update default aliases in configuration reference (#34237)

... (truncated)

Commits
  • d042505 v4.4.2
  • 7781701 v4.4.1
  • 5c3ca59 v4.4.0
  • 31028d2 chore: lint
  • df7ef5d feat(nuxt,kit,schema): add a factory function for useFetch and `useAsyncDat...
  • 2dc5255 fix(nuxt): handle rejected promise in view transition abort (#34515)
  • cf3e2ad fix(nuxt): fix cookie expiration timeout for long-lived cookies (#34513)
  • 3b9d0bc fix(nuxt): pass deleteCount to splice in preloadRouteComponents (#34514)
  • 414a283 fix(nuxt): never preload manifest (#34511)
  • d586631 fix(nuxt): check file freshness before truncating in cache restore (#34509)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for nuxt since your current version.


Updates webpack from 4.47.0 to 5.105.4

Release notes

Sourced from webpack's releases.

v5.105.4

Patch Changes

  • Add Module.getSourceBasicTypes to distinguish basic source types and clarify how modules with non-basic source types like remote still produce JavaScript output. (by @​xiaoxiaojx in #20546)

  • Handle createRequire in expressions. (by @​alexander-akait in #20549)

  • Fixed types for multi stats. (by @​alexander-akait in #20556)

  • Remove empty needless js output for normal css module. (by @​JSerFeng in #20162)

  • Update enhanced-resolve to support new features for tsconfig.json. (by @​alexander-akait in #20555)

  • Narrows export presence guard detection to explicit existence checks on namespace imports only, i.e. patterns like "x" in ns. (by @​hai-x in #20561)

v5.105.3

Patch Changes

  • Context modules now handle rejections correctly. (by @​alexander-akait in #20455)

  • Only mark asset modules as side-effect-free when experimental.futureDefaults is set to true, so asset-copying use cases (e.g. import "./x.png") won’t break unless the option is enabled. (by @​hai-x in #20535)

  • Add the missing webpack_exports declaration in certain cases when bundling a JS entry together with non-JS entries (e.g., CSS entry or asset module entry). (by @​hai-x in #20463)

  • Fixed HMR failure for CSS modules with @​import when exportType !== "link". When exportType is not "link", CSS modules now behave like JavaScript modules and don't require special HMR handling, allowing @​import CSS to work correctly during hot module replacement. (by @​xiaoxiaojx in #20514)

  • Fixed an issue where empty JavaScript files were generated for CSS-only entry points. The code now correctly checks if entry modules have JavaScript source types before determining whether to generate a JS file. (by @​xiaoxiaojx in #20454)

  • Do not crash when a referenced chunk is not a runtime chunk. (by @​alexander-akait in #20461)

  • Fix some types. (by @​alexander-akait in #20412)

  • Ensure that missing module error are thrown after the interception handler (if present), allowing module interception to customize the module factory. (by @​hai-x in #20510)

  • Added createRequire support for ECMA modules. (by @​stefanbinoj in #20497)

  • Added category for CJS reexport dependency to fix issues with ECMA modules. (by @​hai-x in #20444)

  • Implement immutable bytes for bytes import attribute to match tc39 spec. (by @​alexander-akait in #20481)

  • Fixed deterministic search for graph roots regardless of edge order. (by @​veeceey in #20452)

v5.105.2

Patch Changes

v5.105.1

Patch Changes

... (truncated)

Changelog

Sourced from webpack's changelog.

5.105.4

Patch Changes

  • Add Module.getSourceBasicTypes to distinguish basic source types and clarify how modules with non-basic source types like remote still produce JavaScript output. (by @​xiaoxiaojx in #20546)

  • Handle createRequire in expressions. (by @​alexander-akait in #20549)

  • Fixed types for multi stats. (by @​alexander-akait in #20556)

  • Remove empty needless js output for normal css module. (by @​JSerFeng in #20162)

  • Update enhanced-resolve to support new features for tsconfig.json. (by @​alexander-akait in #20555)

  • Narrows export presence guard detection to explicit existence checks on namespace imports only, i.e. patterns like "x" in ns. (by @​hai-x in #20561)

5.105.3

Patch Changes

  • Context modules now handle rejections correctly. (by @​alexander-akait in #20455)

  • Only mark asset modules as side-effect-free when experimental.futureDefaults is set to true, so asset-copying use cases (e.g. import "./x.png") won’t break unless the option is enabled. (by @​hai-x in #20535)

  • Add the missing webpack_exports declaration in certain cases when bundling a JS entry together with non-JS entries (e.g., CSS entry or asset module entry). (by @​hai-x in #20463)

  • Fixed HMR failure for CSS modules with @​import when exportType !== "link". When exportType is not "link", CSS modules now behave like JavaScript modules and don't require special HMR handling, allowing @​import CSS to work correctly during hot module replacement. (by @​xiaoxiaojx in #20514)

  • Fixed an issue where empty JavaScript files were generated for CSS-only entry points. The code now correctly checks if entry modules have JavaScript source types before determining whether to generate a JS file. (by @​xiaoxiaojx in #20454)

  • Do not crash when a referenced chunk is not a runtime chunk. (by @​alexander-akait in #20461)

  • Fix some types. (by @​alexander-akait in #20412)

  • Ensure that missing module error are thrown after the interception handler (if present), allowing module interception to customize the module factory. (by @​hai-x in #20510)

  • Added createRequire support for ECMA modules. (by @​stefanbinoj in #20497)

  • Added category for CJS reexport dependency to fix issues with ECMA modules. (by @​hai-x in #20444)

  • Implement immutable bytes for bytes import attribute to match tc39 spec. (by @​alexander-akait in #20481)

  • Fixed deterministic search for graph roots regardless of edge order. (by @​veeceey in #20452)

5.105.2

Patch Changes

... (truncated)

Commits
  • 27c13b4 chore(release): new release (#20550)
  • 9b2f41e chore: bump terser plugin (#20569)
  • eafe060 fix: narrow the export presence guard detection (#20561)
  • 75d605c refactor: add AppendOnlyStackedSet iteration support and tests (#20560)
  • afa607d refactor: remove unused code (#20562)
  • 4098902 test: add source files for web-webworker and web-webworker-auto-public-path (...
  • f97be67 refactor: fix duplicated word in Compilation JSDoc (#20547)
  • 9d76fff refactor: add Module.getSourceBasicTypes for basic JS type detection (#20546)
  • a3d7839 fix: types for multi stats (#20556)
  • b8e9b05 fix: update enhanced-resolve to support new features for tsconfig.json (#...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for webpack since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
nuxt [>= 3.a, < 4]
nuxt [>= 4.a, < 5]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump serialize-javascript, nuxt and webpack
75f07b7 
Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) to 7.0.5 and updates ancestor dependencies [serialize-javascript](https://github.com/yahoo/serialize-javascript), [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt) and [webpack](https://github.com/webpack/webpack). These dependencies need to be updated together.


Updates `serialize-javascript` from 6.0.2 to 7.0.5
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v6.0.2...v7.0.5)

Updates `nuxt` from 2.18.1 to 4.4.2
- [Release notes](https://github.com/nuxt/nuxt/releases)
- [Commits](https://github.com/nuxt/nuxt/commits/v4.4.2/packages/nuxt)

Updates `webpack` from 4.47.0 to 5.105.4
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v4.47.0...v5.105.4)

---
updated-dependencies:
- dependency-name: serialize-javascript
  dependency-version: 7.0.5
  dependency-type: indirect
- dependency-name: nuxt
  dependency-version: 4.4.2
  dependency-type: direct:production
- dependency-name: webpack
  dependency-version: 5.105.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 29, 2026
@lewisgoddard lewisgoddard added the breaking This pull request introduces changes that break build or production runtime. label Mar 29, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot bot commented on behalf of github Mar 29, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot bot deleted the dependabot/npm_and_yarn/multi-372dce1085 branch March 29, 2026 20:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

breaking This pull request introduces changes that break build or production runtime. dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lewisgoddard