From 4703c2d4607b4251a307617f0d2b914c5ca2ab4b Mon Sep 17 00:00:00 2001
From: Akinori Musha <knu@idaemons.org>
Date: Mon, 19 Oct 2026 01:04:03 +0900
Subject: [PATCH] Override vulnerable test serialization dependency

The latest VS Code test CLI still requires Mocha 11, which pins the
vulnerable serializer to version 6.  Override only Mocha's serializer
with the patched version 7 line.
---
 package-lock.json | 20 +++++---------------
 package.json      |  5 +++++
 2 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 6b3e32e..a3ea788 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8478,16 +8478,6 @@
       ],
       "license": "MIT"
     },
-    "node_modules/randombytes": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz",
-      "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "^5.1.0"
-      }
-    },
     "node_modules/rc": {
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
@@ -8866,13 +8856,13 @@
       }
     },
     "node_modules/serialize-javascript": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.2.tgz",
-      "integrity": "sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==",
+      "version": "7.1.2",
+      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.1.2.tgz",
+      "integrity": "sha512-GL2BWwVa6JydKO6l/ljVgjAZF4QJ3S7dWDWi53s5GZT8PJzD2fNxi67HANQGKAqPrwEpL5ba7gUBGi0Ls/sEoQ==",
       "dev": true,
       "license": "BSD-3-Clause",
-      "dependencies": {
-        "randombytes": "^2.1.0"
+      "engines": {
+        "node": ">=20.0.0"
       }
     },
     "node_modules/setimmediate": {
diff --git a/package.json b/package.json
index fb41d7b..c9b987f 100644
--- a/package.json
+++ b/package.json
@@ -473,5 +473,10 @@
     "prettier": "^3.7.4",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "typescript-eslint": "^8.50.0"
+  },
+  "overrides": {
+    "mocha": {
+      "serialize-javascript": "^7.0.5"
+    }
   }
 }