fix(deps): override serialize-javascript to ^7.0.5#112
Merged
Conversation
Forces transitive devDep serialize-javascript (via mocha) to a patched version. Closes Dependabot alerts: - #28 (HIGH, GHSA-5c6j-r48x-rmvq): RCE via RegExp.flags and Date.prototype.toISOString - #32 (MEDIUM, CVE-2026-34043): CPU DoS via crafted array-like objects Dev-only change. The published tarball's source files (index.js, index.d.ts, README.md, LICENSE) are byte-identical to 0.6.4 -- verified via diff -r of pre/post npm pack output. No version bump needed; consumers ignore overrides declared in transitive dependencies. Lockfile also picks up incidental minor/patch bumps of unrelated devDeps (within existing semver ranges) from the full re-resolve, and corrects a stale "version": "0.6.3" field that the 0.6.4 release commit didn't refresh. Verified: - All 39 tests pass on Node 18.x / 20.x / 22.x (locally via nvm) - mocha --parallel passes (exercises serialize-javascript IPC path) - npm audit reports 0 vulnerabilities (was 5) - Published tarball file listing unchanged - index.js, index.d.ts, README.md, LICENSE bit-for-bit identical - Only package.json differs in the tarball, by exactly the overrides block addition Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
overridesto forceserialize-javascript@^7.0.5, closing two Dependabot alertsAlerts closed
serialize-javascriptRCE viaRegExp.flags/Date.prototype.toISOString(GHSA-5c6j-r48x-rmvq)serialize-javascriptCPU DoS via crafted array-like objects (CVE-2026-34043)Why no release / no version bump
serialize-javascriptis a transitive devDep pulled in by mocha. The published tarball contains onlyindex.js,index.d.ts,README.md,LICENSE— verified byte-identical to the 0.6.4 tarball after this change. Per npm's resolution semantics,overridesdeclared inside a transitive dependency are ignored, so the 1M+ weekly consumers see no behavioral difference whatsoever.Lockfile churn
The
package-lock.jsondiff is larger than the single override would suggest because regenerating the lock vianpm installre-resolved unrelated devDeps within their existing semver ranges (e.g.,chai4.4.0→4.5.0,binary-extensions2.2.0→2.3.0). It also corrects a stale"version": "0.6.3"field that the 0.6.4 release commit didn't refresh. None of these changes affect anything consumers see.Verification performed
npm test— 39 passing on Node 18.x, 20.x, 22.x (locally via nvm)mocha --parallel— 39 passing (exercises theserialize-javascriptIPC code path most heavily)npm audit— 0 vulnerabilities (was 5: 1 low, 1 moderate, 3 high)node -e "require('serialize-javascript/package.json').version"reports7.0.5serialize-javascriptentry in lockfile, resolved to 7.0.5tar -tzfof pre/post 0.6.4 tarballs produce identical file listingsdiff -rof extracted tarballs shows onlypackage.jsondifferspackage.jsondiff in the tarball is exactly theoverridesblock addition — nothing elseTest plan
fixedwithin ~10 min of merge🤖 Generated with Claude Code