[dependabot]

Bumps serialize-javascript from 7.0.5 to 7.1.4.

Release notes

Sourced from serialize-javascript's releases.

v7.1.4

What's Changed

• Fix methods containing nested functions and arrows by @​Shubham-Padkonde in yahoo/serialize-javascript#231
• docs: add SECURITY.md by @​redonkulus in yahoo/serialize-javascript#237
• release: v7.1.4 by @​redonkulus in yahoo/serialize-javascript#238

Note on method serialization

Concise methods ({ m() {} }), including async, generator and computed-key methods, are now serialized correctly when their bodies contain a nested arrow function or function declaration. Previously these were emitted unchanged, producing invalid output that failed to deserialize (#118). Class expressions continue to be emitted as-is.

Reporting security issues

This repo now has a security policy. Please report vulnerabilities privately through GitHub's private vulnerability reporting rather than public issues.

Full Changelog: yahoo/serialize-javascript@v7.1.3...v7.1.4

v7.1.3

See: GHSA-m5mm-p8h7-m29v

What's Changed

• fix: escape </script at the end of a serialized function body by @​redonkulus in yahoo/serialize-javascript#235
• Fix serialization of Dates with expanded ISO years by @​Shubham-Padkonde in yahoo/serialize-javascript#232
• fix: ignore functions without mutating input objects by @​Shubham-Padkonde in yahoo/serialize-javascript#233
• release: v7.1.3 by @​redonkulus in yahoo/serialize-javascript#236

Note on ignoreFunction

With ignoreFunction: true, function values are now omitted the same way JSON.stringify omits them, without deleting them from the input object. Functions inside arrays are emitted as null (previously this produced Array.prototype.slice.call(...) output).

New Contributors

• @​Shubham-Padkonde made their first contribution in yahoo/serialize-javascript#232

Full Changelog: yahoo/serialize-javascript@v7.1.2...v7.1.3

v7.1.2

See: GHSA-gfhx-hw2g-v5hg

v7.1.1

What's Changed

• fix: fix XSS bypass via split </script payload across function bodies by @​okuryu in yahoo/serialize-javascript#226
• release: v7.1.1 by @​okuryu in yahoo/serialize-javascript#227

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

• feat: add Node.js 26 to test matrix by @​okuryu in yahoo/serialize-javascript#224
• release: v7.1.0 by @​okuryu in yahoo/serialize-javascript#225

... (truncated)

Commits

• 05c5ceb release: v7.1.4 (#238)
• fdb853d Fix methods containing nested functions and arrows (#231)
• f7dfeae docs: add SECURITY.md pointing to private vulnerability reporting (#237)
• 4d36b82 release: v7.1.3 (#236)
• 45e5397 fix: ignore functions without mutating input objects (#233)
• e978a1b fix: serialize Dates with expanded ISO years (#232)
• 2864b3c fix: escape </script at the end of a serialized function body (#235)
• 6a73fa1 release: v7.1.2
• 2bdbaaf Merge commit from fork
• 8c8caa7 release: v7.1.1
• Additional commits viewable in compare view

[Changyong Gong (chagong)]

Decision: MERGED

Dependabot PR Manager result

Repository: microsoft/vscode-gradle
Pull request: microsoft/vscode-gradle#1976 - chore(deps-dev): bump serialize-javascript from 7.0.5 to 7.1.4 in /extension
Update: serialize-javascript 7.0.5 -> 7.1.4; minor transitive development-dependency update including upstream security fixes.
Safety assessment: Passed the Standard Dependency Gate: one Dependabot-authored commit, lockfile-only diff, low risk. Mocha and webpack's terser plugin still need the package; no direct declaration exists to remove. Node >=20 and the existing override are unchanged. Registry integrity matches; no unresolved review threads.
Final state: Head d13714e; MERGED at 2026-11-01T09:55:49Z as 08599a4; APPROVED. Merge state was CLEAN before merge and is UNKNOWN afterward. Current-head CI: 19 successful, 1 neutral, 0 failed, 0 pending.
Actions taken: Requested and verified Dependabot (@dependabot) rebase: 008c82c -> d13714e. Verified live base 587dde4 is the new head's parent. Audited the complete diff, provenance, source usage, upstream changes, registry metadata and lockfile dependency tree. Fresh CI passed build/lint, packaging, platform tests, Java compatibility, E2E and Azure validation; no local test suite was run. Old-head Azure failures remained INDETERMINATE because logs returned HTTP 401; they did not recur after rebasing. Classic protection reads returned HTTP 403; per-PR required-check discovery reported none, active rules were inspected, and approval produced APPROVED/CLEAN. Copilot review reported no active issues but skipped the generated lockfile. Approved the exact head and squash-merged with an expected-head guard. No rerun, recreation, remediation commit or source push. Updated this actor's existing result comment and recorded the live-base freshness lesson in local agent instructions.
Reason: None
Next action: None

[Changyong Gong (chagong)]

Dependabot (@dependabot) rebase

[Copilot]

🟢 Approval recommended

No active review issues were identified for the lockfile-only update to serialize-javascript 7.1.4.

Copilot wasn't able to review any files in this pull request.

1 file not reviewed

• extension/package-lock.json: Generated file