Add GHSA-5c6j-r48x-rmvq override (backport #9046) [release/4.11.x] (#9049)

Co-authored-by: Nam Le <50554904+hl662@users.noreply.github.com>

Author: mergify[bot]

.github/workflows/extract-api.yaml

@@ -31,7 +31,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@v4
         with:
-          node-version: "18"
+          node-version: "22"
 
       - name: Rush install
         run: node common/scripts/install-run-rush.js install

common/config/rush/pnpm-config.json

@@ -18,7 +18,8 @@
     "minimatch@>=5.0.0 <5.1.8": "^5.1.8", // https://github.com/advisories/GHSA-7r86-cg39-jmmj and https://github.com/advisories/GHSA-23c5-xmqv-rm74
     "minimatch@>=9.0.0 <9.0.7": "^9.0.7", // https://github.com/advisories/GHSA-7r86-cg39-jmmj and https://github.com/advisories/GHSA-23c5-xmqv-rm74
     "glob@>=11.0.0 <11.1.0": "^11.1.0", // https://github.com/advisories/GHSA-5j98-mcp5-4vw2 cpx2>glob
-    "axios": "^1.13.5" // https://github.com/advisories/GHSA-43fc-jf86-j433
+    "axios": "^1.13.5", // https://github.com/advisories/GHSA-43fc-jf86-j433
+    "serialize-javascript": "^7.0.3" // https://github.com/advisories/GHSA-5c6j-r48x-rmvq mocha>serialize-javascript (related to CVE-2020-7660)
   },
   // A list of temporary advisories excluded from the High and Critical list.
   // Warning this should only be used as a temporary measure to avoid build failures