[dependabot]

Bumps serialize-javascript from 7.0.5 to 7.1.3.

Release notes

Sourced from serialize-javascript's releases.

v7.1.3

See: GHSA-m5mm-p8h7-m29v

What's Changed

• fix: escape </script at the end of a serialized function body by @​redonkulus in yahoo/serialize-javascript#235
• Fix serialization of Dates with expanded ISO years by @​Shubham-Padkonde in yahoo/serialize-javascript#232
• fix: ignore functions without mutating input objects by @​Shubham-Padkonde in yahoo/serialize-javascript#233
• release: v7.1.3 by @​redonkulus in yahoo/serialize-javascript#236

Note on ignoreFunction

With ignoreFunction: true, function values are now omitted the same way JSON.stringify omits them, without deleting them from the input object. Functions inside arrays are emitted as null (previously this produced Array.prototype.slice.call(...) output).

New Contributors

• @​Shubham-Padkonde made their first contribution in yahoo/serialize-javascript#232

Full Changelog: yahoo/serialize-javascript@v7.1.2...v7.1.3

v7.1.2

See: GHSA-gfhx-hw2g-v5hg

v7.1.1

What's Changed

• fix: fix XSS bypass via split </script payload across function bodies by @​okuryu in yahoo/serialize-javascript#226
• release: v7.1.1 by @​okuryu in yahoo/serialize-javascript#227

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

• feat: add Node.js 26 to test matrix by @​okuryu in yahoo/serialize-javascript#224
• release: v7.1.0 by @​okuryu in yahoo/serialize-javascript#225

Full Changelog: yahoo/serialize-javascript@v7.0.7...v7.1.0

v7.0.7

What's Changed

• fix: reject spoofed RegExp objects with non-string source property by @​redonkulus in yahoo/serialize-javascript#222
• release: v7.0.7 by @​okuryu in yahoo/serialize-javascript#223

Full Changelog: yahoo/serialize-javascript@v7.0.6...v7.0.7

v7.0.6

What's Changed

• build(deps-dev): bump lodash from 4.17.23 to 4.18.1 by @​dependabot[bot] in yahoo/serialize-javascript#215
• fix: reject spoofed URL objects with non-string toString() result by @​redonkulus in yahoo/serialize-javascript#217
• release: v7.0.6 by @​okuryu in yahoo/serialize-javascript#221

... (truncated)

Commits

• 4d36b82 release: v7.1.3 (#236)
• 45e5397 fix: ignore functions without mutating input objects (#233)
• e978a1b fix: serialize Dates with expanded ISO years (#232)
• 2864b3c fix: escape </script at the end of a serialized function body (#235)
• 6a73fa1 release: v7.1.2
• 2bdbaaf Merge commit from fork
• 8c8caa7 release: v7.1.1
• ffda9f1 fix: fix XSS bypass via split </script payload across function bodies
• 739145a release: v7.1.0
• 57865ed feat: add Node.js 26 to test matrix
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: e36984a8-702e-41b2-837f-a8acf2d4b2f4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📊 Benchmark results

Comparing with 4d59b5c

• Dependency count: 968 (no change)
• Package size: 337 MB (no change)
• Number of ts-expect-error directives: 280 (no change)

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/netlify-cli@8711

commit: c6ab50d