Skip to content

Bump serialize-javascript, @symfony/webpack-encore and terser-webpack-plugin#13

Open
dependabot[bot] wants to merge 1 commit intov3from
dependabot/npm_and_yarn/multi-fe0135fba0
Open

Bump serialize-javascript, @symfony/webpack-encore and terser-webpack-plugin#13
dependabot[bot] wants to merge 1 commit intov3from
dependabot/npm_and_yarn/multi-fe0135fba0

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Mar 29, 2026

Bumps serialize-javascript to 7.0.5 and updates ancestor dependencies serialize-javascript, @symfony/webpack-encore and terser-webpack-plugin. These dependencies need to be updated together.

Updates serialize-javascript from 6.0.2 to 7.0.5

Release notes

Sourced from serialize-javascript's releases.

v7.0.5

Fixes

  • Improve robustness and validation for array-like object serialization.
  • Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

v7.0.4

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.3...v7.0.4

v7.0.3

  • fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString (#207) 2e609d0
  • build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (#206) 42b7cdb

yahoo/serialize-javascript@v7.0.2...v7.0.3

v7.0.2

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.1...v7.0.2

v7.0.1

What's Changed

New Contributors

Full Changelog: yahoo/serialize-javascript@v7.0.0...v7.0.1

v7.0.0

Breaking Changes

  • requires Node.js v20+

What's Changed

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for serialize-javascript since your current version.


Updates @symfony/webpack-encore from 5.3.1 to 6.0.0

Changelog

Sourced from @​symfony/webpack-encore's changelog.

6.0.0

This is a new major version that contains several backwards-compatibility breaks, but for the best!

BC Breaks

  • Remove support of Node.js <22.13.0
  • Remove support of babel-loader@^9.1.3, see possible BC breaks in 10.0.0 release notes
  • Remove support of style-loader@^3.3.0, see possible BC breaks in 4.0.0 release notes
  • Remove support of less-loader@^11.0.0, see possible BC breaks in 12.0.0 release notes
  • Remove support of postcss-loader@^7.0.0, see possible BC breaks in 8.0.0 release notes
  • Remove support of stylus-loader@^7.0.0, see possible BC breaks in 8.0.0 release notes
  • Remove support of webpack-cli@^5.0.0, see possible BC breaks in 6.0.0 release notes
  • Remove unmaintained file-loader dependency The [N] placeholder (regex capture groups in filename patterns) is no longer supported. If you were using patterns like [1] or [2] in your Encore.copyFiles() filename option, you will need to restructure your file organization or use a different naming strategy.
  • Remove deprecated --https flag and devServerConfig.https option for webpack-dev-server, use --server-type https or configureDevServerOptions() with server: 'https' instead

Features

  • Update @​nuxt/friendly-errors-webpack-plugin to @​kocal/friendly-errors-webpack-plugin, a maintained fork of the original plugin
  • Update webpack from ^5.74.0 to ^5.82.0
  • Update css-minimizer-webpack-plugin to ^8.0.0, see release notes
  • Finish removing Vue 2 support leftovers (JSX code path, vue-jsx feature, version: 2 option, Vue 2 peer dependencies), which was forgotten during v5.0.0

5.3.0

  • Add support for Svelte 5

5.2.0

  • Add support for Webpack CLI ^6.0.0

  • Add support for babel-loader ^10.0.0

  • Add support for style-loader ^4.0.0

If you manually specified the option insert, now it can only be a selector or the path to the module. Follow the style-loader migration guide to upgrade!

5.1.0

Features

5.0.1

... (truncated)

Commits
  • 93016b8 Tagging 6.0.0
  • fb434b5 bug #1401 Follow-up #1400 (fix URLs generation) (Kocal)
  • 3e149b9 Follow-up #1400 (fix URLs generation)
  • 5557f89 feature #1400 Remove deprecated --https flag and devServerConfig.https op...
  • c5d7afa Remove deprecated --https flag and devServerConfig.https option
  • 0c706d2 feature #1399 Remove Vue 2 support leftovers (Kocal)
  • 94619b0 Remove Vue 2 support leftovers
  • b8c997b feature #1398 Remove unmaintained file-loader dependency (Kocal)
  • 1200947 Remove unmaintained file-loader dependency
  • b0542cf minor #1397 Add AGENTS.md (Kocal)
  • Additional commits viewable in compare view

Updates terser-webpack-plugin from 5.3.14 to 5.4.0

Release notes

Sourced from terser-webpack-plugin's releases.

v5.4.0

5.4.0 (2026-03-10)

Features

  • added ability to minimize JSON using jsonMinify (#657) (29ac915)

v5.3.17

5.3.17 (2026-03-03)

Bug Fixes

  • update serialize-javascript (37c490c)

v5.3.16

5.3.16 (2025-12-11)

Bug Fixes

v5.3.15

5.3.15 (2025-12-05)

Bug Fixes

  • catch error when loading minimizers (#639) (586af0a)
  • respect errors and warnings from minimizer without code (8607f79)
Changelog

Sourced from terser-webpack-plugin's changelog.

5.4.0 (2026-03-10)

Features

  • added ability to minimizer JSON using jsonMinify (#657) (29ac915)

5.3.17 (2026-03-03)

Bug Fixes

  • update serialize-javascript (37c490c)

5.3.16 (2025-12-11)

Bug Fixes

5.3.15 (2025-12-05)

Bug Fixes

  • catch error when loading minimizers (#639) (586af0a)
  • respect errors and warnings from minimizer without code (8607f79)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…-plugin

Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) to 7.0.5 and updates ancestor dependencies [serialize-javascript](https://github.com/yahoo/serialize-javascript), [@symfony/webpack-encore](https://github.com/symfony/webpack-encore) and [terser-webpack-plugin](https://github.com/webpack/terser-webpack-plugin). These dependencies need to be updated together.


Updates `serialize-javascript` from 6.0.2 to 7.0.5
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v6.0.2...v7.0.5)

Updates `@symfony/webpack-encore` from 5.3.1 to 6.0.0
- [Release notes](https://github.com/symfony/webpack-encore/releases)
- [Changelog](https://github.com/symfony/webpack-encore/blob/main/CHANGELOG.md)
- [Commits](symfony/webpack-encore@v5.3.1...v6.0.0)

Updates `terser-webpack-plugin` from 5.3.14 to 5.4.0
- [Release notes](https://github.com/webpack/terser-webpack-plugin/releases)
- [Changelog](https://github.com/webpack/terser-webpack-plugin/blob/main/CHANGELOG.md)
- [Commits](webpack/terser-webpack-plugin@v5.3.14...v5.4.0)

---
updated-dependencies:
- dependency-name: serialize-javascript
  dependency-version: 7.0.5
  dependency-type: indirect
- dependency-name: "@symfony/webpack-encore"
  dependency-version: 6.0.0
  dependency-type: direct:development
- dependency-name: terser-webpack-plugin
  dependency-version: 5.4.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants