Skip to content

fix(deps-dev): bump serialize-javascript from 7.0.5 to 7.1.4 - #1950

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/serialize-javascript-7.1.4
Open

fix(deps-dev): bump serialize-javascript from 7.0.5 to 7.1.4#1950
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/serialize-javascript-7.1.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps serialize-javascript from 7.0.5 to 7.1.4.

Release notes

Sourced from serialize-javascript's releases.

v7.1.4

What's Changed

Note on method serialization

Concise methods ({ m() {} }), including async, generator and computed-key methods, are now serialized correctly when their bodies contain a nested arrow function or function declaration. Previously these were emitted unchanged, producing invalid output that failed to deserialize (#118). Class expressions continue to be emitted as-is.

Reporting security issues

This repo now has a security policy. Please report vulnerabilities privately through GitHub's private vulnerability reporting rather than public issues.

Full Changelog: yahoo/serialize-javascript@v7.1.3...v7.1.4

v7.1.3

See: GHSA-m5mm-p8h7-m29v

What's Changed

Note on ignoreFunction

With ignoreFunction: true, function values are now omitted the same way JSON.stringify omits them, without deleting them from the input object. Functions inside arrays are emitted as null (previously this produced Array.prototype.slice.call(...) output).

New Contributors

Full Changelog: yahoo/serialize-javascript@v7.1.2...v7.1.3

v7.1.2

See: GHSA-gfhx-hw2g-v5hg

v7.1.1

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 28, 2026
@chagong

Changyong Gong (chagong) commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

Dependabot (@dependabot) rebase

@dependabot
fix(deps-dev): bump serialize-javascript from 7.0.5 to 7.1.4
609127a 
Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) from 7.0.5 to 7.1.4.
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v7.0.5...v7.1.4)

---
updated-dependencies:
- dependency-name: serialize-javascript
  dependency-version: 7.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/serialize-javascript-7.1.4 branch from 666da4a to 609127a Compare October 29, 2026 09:28
@chagong

Changyong Gong (chagong) commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

Decision: NOT_MERGED

Dependabot PR Manager result

Repository: microsoft/vscode-java-test
Pull request: microsoft/vscode-java-test#1950 — fix(deps-dev): bump serialize-javascript from 7.0.5 to 7.1.4
Update: serialize-javascript 7.0.5 -> 7.1.4; minor, includes security fixes; indirect development dependency and security override retained.
Safety assessment: Dependabot-only history; Standard Dependency Gate passes static audit. Mocha requires the serializer; dependency-tree and consumer-source inspection justify retention. Node >=20 requirement is unchanged and matches CI. Low static risk; CI failure causality remains unverified.
Final state: Head 609127a; OPEN, BLOCKED, REVIEW_REQUIRED. CI: 7 successful, 2 failed, 0 pending; required Linux and license/cla pass. Failed: VSCode-Test-Runner-CI-Build (INDETERMINATE); VSCode-Test-Runner-CI-Build (Build Validate dependencies from CFS) (INDETERMINATE).
Actions taken: Posted Dependabot (@dependabot) rebase; verified head changed from 666da4a to 609127a and includes current main. Audited complete diff, commits, reviews, dependency usage, upstream changes, registry integrity, and manifest/lock consistency. Current-head CI passed installation, lint, Java build, production bundling, and extension tests on Linux/Windows/macOS. Retrieved failed-check annotations; CI-log skill cannot retrieve Azure jobs, and Azure timeline/log APIs returned HTTP 401. No rerun, remediation, approval, or merge attempted.
Reason: CFS validation reports Bash exit code 1; full Azure logs are inaccessible. The additional prerequisite-deprecation annotation explicitly says non-blocking and does not establish the failure cause. Neither failed check can be safely classified as update-caused, transient, or unrelated.
Next action: An authorized pipeline owner must inspect Azure build 32399275, establish and resolve the CFS failure, and obtain successful current-head checks; then rerun management and complete the required review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

See More

Successfully merging this pull request may close these issues.

1 participant

@chagong