Skip to content

Bump serialize-javascript and mocha - #146

Merged
Raymond Zhao (rzhao271) merged 2 commits into
mainfrom
dependabot/npm_and_yarn/multi-2685d10102
Oct 19, 2026
Merged

Raymond Zhao (rzhao271) merged 2 commits into
mainfrom
dependabot/npm_and_yarn/multi-2685d10102

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 15, 2026 •

Copy link
Copy Markdown
Contributor

Bumps serialize-javascript to 7.1.2 and updates ancestor dependency mocha. These dependencies need to be updated together.

Updates serialize-javascript from 6.0.2 to 7.1.2

Release notes

Sourced from serialize-javascript's releases.

v7.1.2

See: GHSA-gfhx-hw2g-v5hg

v7.1.1

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.7...v7.1.0

v7.0.7

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.6...v7.0.7

v7.0.6

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.5...v7.0.6

v7.0.5

Fixes

  • Improve robustness and validation for array-like object serialization.
  • Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

v7.0.4

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.3...v7.0.4

... (truncated)

Commits
  • 6a73fa1 release: v7.1.2
  • 2bdbaaf Merge commit from fork
  • 8c8caa7 release: v7.1.1
  • ffda9f1 fix: fix XSS bypass via split </script payload across function bodies
  • 739145a release: v7.1.0
  • 57865ed feat: add Node.js 26 to test matrix
  • 01bec60 release: v7.0.7
  • 5009715 fix: reject spoofed RegExp objects with non-string source property
  • 153eb43 release: v7.0.6
  • a83d2cb fix: reject spoofed URL objects with non-string toString() result
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serialize-javascript since your current version.


Updates mocha from 11.7.5 to 12.0.3

Release notes

Sourced from mocha's releases.

v12.0.3

12.0.3 (2026-10-01)

🩹 Fixes

  • keep watching when the last test file is removed (#6355) (921c161)
  • show require() error on unsupported directory import (#6354) (a68344f)
  • support --X one-char aliases (#6391) (1227939)

📚 Documentation

🧹 Chores

v12.0.2

12.0.2 (2026-09-17)

🩹 Fixes

  • fail nested tests on beforeEach failure (#6292) (a75b43b)
  • give CLI reporter-option precedence over config file (#6331) (571110f)
  • propagate spec file path on parallel worker death (#6268) (55a544a)
  • use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
  • watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

🧹 Chores

  • add "stale branch" workflow (#6315) (ad17f9f)
  • add dependency conflict detection workflow (#6246) (ef0ae32)
  • add folder for reproducing issues (#6330) (6728030)
  • add stale triage reminder for unreviewed issues (#6314) (ee35133)
  • auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
  • convert file-unloader to ESM (#6294) (dc73f4c)
  • deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
  • deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)

... (truncated)

Changelog

Sourced from mocha's changelog.

12.0.3 (2026-10-01)

🩹 Fixes

  • keep watching when the last test file is removed (#6355) (921c161)
  • show require() error on unsupported directory import (#6354) (a68344f)
  • support --X one-char aliases (#6391) (1227939)

📚 Documentation

🧹 Chores

12.0.2 (2026-09-17)

🩹 Fixes

  • fail nested tests on beforeEach failure (#6292) (a75b43b)
  • give CLI reporter-option precedence over config file (#6331) (571110f)
  • propagate spec file path on parallel worker death (#6268) (55a544a)
  • use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
  • watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

🧹 Chores

  • add "stale branch" workflow (#6315) (ad17f9f)
  • add dependency conflict detection workflow (#6246) (ef0ae32)
  • add folder for reproducing issues (#6330) (6728030)
  • add stale triage reminder for unreviewed issues (#6314) (ee35133)
  • auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
  • convert file-unloader to ESM (#6294) (dc73f4c)
  • deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
  • deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)
  • deps: update dependency knip to v6.35.0 (#6324) (a2416af)
  • deps: update octoguide/bot action to v0.23.0 (#6304) (bbe5a27)

... (truncated)

Commits
  • 51a0cc5 chore(main): release 12.0.3 (#6353)
  • 1227939 fix: support --X one-char aliases (#6391)
  • bb2e69a docs: refresh help output, fix stale links (#6357)
  • 921c161 fix: keep watching when the last test file is removed (#6355)
  • 3382fdd test: add --import=tsx integration test (#6356)
  • a68344f fix: show require() error on unsupported directory import (#6354)
  • d59467a test: touch a new file without stamping it afterwards (#6349)
  • 70db1c7 chore(main): release 12.0.2 (#6300)
  • 571110f fix: give CLI reporter-option precedence over config file (#6331)
  • a652ff5 fix: use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mocha since your current version.


@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 15, 2026
Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) to 7.1.2 and updates ancestor dependency [mocha](https://github.com/mochajs/mocha). These dependencies need to be updated together.


Updates `serialize-javascript` from 6.0.2 to 7.1.2
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v6.0.2...v7.1.2)

Updates `mocha` from 11.7.5 to 12.0.3
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md)
- [Commits](mochajs/mocha@v11.7.5...v12.0.3)

---
updated-dependencies:
- dependency-name: mocha
  dependency-version: 12.0.1
  dependency-type: direct:development
- dependency-name: serialize-javascript
  dependency-version: 7.1.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-2685d10102 branch from c3cb567 to 8d77cfb Compare October 3, 2026 04:04
@rzhao271

Copy link
Copy Markdown
Contributor

Copilot Check for mocha config to migrate now that we're on v12.

Co-authored-by: rzhao271 <7199958+rzhao271@users.noreply.github.com>

Copilot AI commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

Copilot Check for mocha config to migrate now that we're on v12.

There is no standalone Mocha config to migrate. The VS Code test launch config referenced Mocha’s removed bin/_mocha; it now uses bin/mocha.js (commit 420668b).

@rzhao271
Raymond Zhao (rzhao271) enabled auto-merge (squash) October 19, 2026 23:21
@rzhao271
Raymond Zhao (rzhao271) merged commit 2544337 into main Oct 19, 2026
4 checks passed
@rzhao271
Raymond Zhao (rzhao271) deleted the dependabot/npm_and_yarn/multi-2685d10102 branch October 19, 2026 23:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants