From 54af056b64fcf40ac77b8869054062d9be9f5590 Mon Sep 17 00:00:00 2001 From: John Alden Date: Tue, 31 Mar 2026 15:07:29 -0700 Subject: [PATCH] Fix serialize-javascript CPU exhaustion vulnerability (GHSA-qj8w-gfj5-8c6v) Update serialize-javascript resolution from ^7.0.3 to ^7.0.5 to address CVE for CPU Exhaustion Denial of Service via crafted array-like objects. Co-Authored-By: Claude Opus 4.6 (1M context) --- package.json | 2 +- yarn.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index f7d89b8..fb3b9d0 100644 --- a/package.json +++ b/package.json @@ -40,7 +40,7 @@ "mocha": "^10.6.0" }, "resolutions": { - "serialize-javascript": "^7.0.3" + "serialize-javascript": "^7.0.5" }, "keywords": [ "FileWatcher", diff --git a/yarn.lock b/yarn.lock index 7136a00..05cc524 100644 --- a/yarn.lock +++ b/yarn.lock @@ -851,10 +851,10 @@ run-parallel@^1.1.9: dependencies: queue-microtask "^1.2.2" -serialize-javascript@^6.0.2, serialize-javascript@^7.0.3: - version "7.0.4" - resolved "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.4.tgz#c517735bd5b7631dd1fc191ee19cbb713ff8e05c" - integrity sha512-DuGdB+Po43Q5Jxwpzt1lhyFSYKryqoNjQSA9M92tyw0lyHIOur+XCalOUe0KTJpyqzT8+fQ5A0Jf7vCx/NKmIg== +serialize-javascript@^6.0.2, serialize-javascript@^7.0.5: + version "7.0.5" + resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-7.0.5.tgz#c798cc0552ffbb08981914a42a8756e339d0d5b1" + integrity sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw== shebang-command@^2.0.0: version "2.0.0"