Bump serialize-javascript, @angular-builders/custom-webpack and @angular-devkit/build-angular by dependabot[bot] · Pull Request #209 · capitalone/acronym-decoder

dependabot · 2026-10-19T12:47:26Z

Bumps serialize-javascript to 7.1.2 and updates ancestor dependencies serialize-javascript, @angular-builders/custom-webpack and @angular-devkit/build-angular. These dependencies need to be updated together.

Updates serialize-javascript from 6.0.2 to 7.1.2

Release notes

Sourced from serialize-javascript's releases.

v7.1.2

See: GHSA-gfhx-hw2g-v5hg

v7.1.1

What's Changed

fix: fix XSS bypass via split </script payload across function bodies by @okuryu in yahoo/serialize-javascript#226

release: v7.1.1 by @okuryu in yahoo/serialize-javascript#227

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

feat: add Node.js 26 to test matrix by @okuryu in yahoo/serialize-javascript#224

release: v7.1.0 by @okuryu in yahoo/serialize-javascript#225

Full Changelog: yahoo/serialize-javascript@v7.0.7...v7.1.0

v7.0.7

What's Changed

fix: reject spoofed RegExp objects with non-string source property by @redonkulus in yahoo/serialize-javascript#222

release: v7.0.7 by @okuryu in yahoo/serialize-javascript#223

Full Changelog: yahoo/serialize-javascript@v7.0.6...v7.0.7

v7.0.6

What's Changed

build(deps-dev): bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in yahoo/serialize-javascript#215

fix: reject spoofed URL objects with non-string toString() result by @redonkulus in yahoo/serialize-javascript#217

release: v7.0.6 by @okuryu in yahoo/serialize-javascript#221

Full Changelog: yahoo/serialize-javascript@v7.0.5...v7.0.6

v7.0.5

Fixes

Improve robustness and validation for array-like object serialization.

Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

v7.0.4

What's Changed

release: v7.0.4 by @okuryu in yahoo/serialize-javascript#211

Full Changelog: yahoo/serialize-javascript@v7.0.3...v7.0.4

... (truncated)

Commits

6a73fa1 release: v7.1.2
2bdbaaf Merge commit from fork
8c8caa7 release: v7.1.1
ffda9f1 fix: fix XSS bypass via split </script payload across function bodies
739145a release: v7.1.0
57865ed feat: add Node.js 26 to test matrix
01bec60 release: v7.0.7
5009715 fix: reject spoofed RegExp objects with non-string source property
153eb43 release: v7.0.6
a83d2cb fix: reject spoofed URL objects with non-string toString() result
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serialize-javascript since your current version.

Updates @angular-builders/custom-webpack from 19.0.1 to 22.0.1

Changelog

Sourced from @angular-builders/custom-webpack's changelog.

22.0.1 (2026-06-23)

Note: Version bump only for package @angular-builders/custom-webpack

22.0.1-beta.0 (2026-06-22)

Note: Version bump only for package @angular-builders/custom-webpack

22.0.0 (2026-06-10)

Note: Version bump only for package @angular-builders/custom-webpack

22.0.0-beta.1 (2026-06-09)

Note: Version bump only for package @angular-builders/custom-webpack

22.0.0-beta.0 (2026-06-09)

⚠ BREAKING CHANGES

All packages now require Angular 22.

User TypeScript config/plugin modules now load via jiti instead of ts-node. Configs are transpiled rather than type-checked (run tsc --noEmit separately if you relied on build-time type-checking); ts-node and tsconfig-paths are no longer dependencies; and the NODE_OPTIONS='--loader ts-node/esm' workaround for ESM apps is no longer needed.

Features

ng add / ng update schematics for jest, custom-esbuild, custom-webpack (#2267) (062f423), closes #22

replace ts-node with jiti for loading TypeScript modules (#2287) (0348e06), closes #816

upgrade builders + examples to Angular 22 (22.0.0-rc.2) (#2264) (9ed7020)

Miscellaneous Chores

graduate Angular 22 from RC to GA (daec882)

21.1.0 (2026-06-08)

Note: Version bump only for package @angular-builders/custom-webpack

21.1.0-beta.13 (2026-06-05)

Reverts

remove redundant TS2742 builder annotations (#2275, #2278) (#2279) (a2882e5)

21.1.0-beta.12 (2026-06-04)

Bug Fixes

builders: annotate builder default exports with Builder to avoid TS2742 (#2278) (7db3848)

21.1.0-beta.11 (2026-06-01)

... (truncated)

Commits

0a130ae ci(release): publish
79b145a ci(release): publish
6cdd684 style: format repo with prettier and add CI format gate (#2323)
7cebff9 ci(release): publish
6647e73 ci(release): publish
49f90e4 docs(changelog): clean up v22 breaking-change sections
a27c6b0 ci(release): publish
daec882 chore!: graduate Angular 22 from RC to GA
2cb9a56 chore(deps): update bazel-example to Angular CLI 22
0348e06 feat!: replace ts-node with jiti for loading TypeScript modules (#2287)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @angular-builders/custom-webpack since your current version.

Updates @angular-devkit/build-angular from 19.2.27 to 21.2.27

Release notes

Sourced from @angular-devkit/build-angular's releases.

21.2.27

@angular/cli

Commit Description

update zod to 4.6.6

21.2.26

@angular/cli

Commit Description

bump @modelcontextprotocol/sdk to 1.31.0

21.2.25

@angular/build

Commit Description

bump piscina to 5.3.2

21.2.24

@angular/build

Commit Description

update undici to 7.29.1

21.2.23

@angular-devkit/build-angular

Commit Description

update less to 4.9.0

@angular/ssr

Commit Description

ensure public directory containment in CommonEngine

21.2.22

@angular-devkit/build-angular

Commit Description

update webpack-dev-server to 5.2.6

21.2.21

@angular/cli

Commit Description

update dependency @modelcontextprotocol/sdk to v1.30.0

@angular/build

Commit Description

bump undici to 7.29.0

... (truncated)

Changelog

Sourced from @angular-devkit/build-angular's changelog.

21.2.27 (2026-10-14)

@angular/cli

Commit Type Description

2e1742adf fix update zod to 4.6.6

20.3.40 (2026-10-14)

@angular/cli

Commit Type Description

bfe1908f4 fix update zod to 4.6.6

22.3.0-next.1 (2026-10-07)

@angular-devkit/build-angular

Commit Type Description

3379a13314 fix preserve Host header when proxying in ssr-dev-server

@angular/build

Commit Type Description

4244eb7ba1 fix allow library outputPath within project root

f61de66202 fix capture and report Rolldown warnings and errors in library builder

3871a9da91 fix keep the order of glob entries in the proxy configuration

3d00c76eb9 fix resolve library bundle sourcemap sources relative to output directory

5ffed3f3b6 fix scope cache directory by project and builder name

1e45d4d46a fix support a string context in array-form proxy configurations

2ffbebf24c perf immediately purge freed rolldown arena memory

22.2.2 (2026-10-07)

... (truncated)

Commits

6ee7980 release: cut the v21.2.27 release
2e1742a fix(@angular/cli): update zod to 4.6.6
4bbeadd release: cut the v21.2.26 release
9d2987f fix(@angular/cli): bump @modelcontextprotocol/sdk to 1.31.0
2a30aa2 release: cut the v21.2.25 release
7e6d2da fix(@angular/build): bump piscina to 5.3.2
aad747e release: cut the v21.2.24 release
c7d3f18 build: replace pnpm -s shorthand with --silent for improved readability
2aa61dc test: update e2e global npm version to 11.19.1
dbaadc2 fix(@angular/build): update undici to 7.29.1
Additional commits viewable in compare view

socket-security · 2026-10-19T12:47:54Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Quality	Maintenance
@angular-devkit/build-angular@19.2.27 ⏵ 21.2.27	⁺¹
@angular-builders/custom-webpack@19.0.1 ⏵ 22.0.1	⁺¹	⁺¹
webpack@5.109.2 ⏵ 5.111.0	⁺¹	^-1

View full report

socket-security · 2026-10-19T12:47:56Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	License policy violation: npm `caniuse-lite` License: LicenseRef-CC-BY-4.0-0c618849 - The applicable license policy does not permit this license (5) (package/LICENSE) From: package-lock.json → `npm/@angular/compiler-cli@19.2.18` → `npm/@angular-builders/custom-webpack@22.0.1` → `npm/webpack@5.111.0` → `npm/@angular-devkit/build-angular@21.2.27` → `npm/karma-coverage@2.2.1` → `npm/caniuse-lite@1.0.30001816` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/caniuse-lite@1.0.30001816`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm `typescript` License: LicenseRef-CC-BY-4.0-0c618849 - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: package-lock.json → `npm/@angular-builders/custom-webpack@22.0.1` → `npm/typescript@6.0.3` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typescript@6.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

…lar-devkit/build-angular Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) to 7.1.2 and updates ancestor dependencies [serialize-javascript](https://github.com/yahoo/serialize-javascript), [@angular-builders/custom-webpack](https://github.com/just-jeb/angular-builders/tree/HEAD/packages/custom-webpack) and [@angular-devkit/build-angular](https://github.com/angular/angular-cli). These dependencies need to be updated together. Updates `serialize-javascript` from 6.0.2 to 7.1.2 - [Release notes](https://github.com/yahoo/serialize-javascript/releases) - [Commits](yahoo/serialize-javascript@v6.0.2...v7.1.2) Updates `@angular-builders/custom-webpack` from 19.0.1 to 22.0.1 - [Release notes](https://github.com/just-jeb/angular-builders/releases) - [Changelog](https://github.com/just-jeb/angular-builders/blob/master/packages/custom-webpack/CHANGELOG.md) - [Commits](https://github.com/just-jeb/angular-builders/commits/@angular-builders/custom-webpack@22.0.1/packages/custom-webpack) Updates `@angular-devkit/build-angular` from 19.2.27 to 21.2.27 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@v19.2.27...v21.2.27) --- updated-dependencies: - dependency-name: "@angular-builders/custom-webpack" dependency-version: 22.0.1 dependency-type: direct:development - dependency-name: "@angular-devkit/build-angular" dependency-version: 21.2.27 dependency-type: direct:development - dependency-name: serialize-javascript dependency-version: 7.1.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

sonarqubecloud · 2026-10-20T00:38:41Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot Bot requested review from a team as code owners October 19, 2026 12:47

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 19, 2026

github-actions Bot enabled auto-merge (squash) October 19, 2026 12:47

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-1d6bf19484 branch 5 times, most recently from 554202b to a5dab44 Compare October 19, 2026 23:23

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-1d6bf19484 branch from a5dab44 to 6a62f23 Compare October 20, 2026 00:38

amadib mentioned this pull request Oct 20, 2026

Upgrade to Angular 21 #212

Open

2 tasks

Navigation Menu

Repository navigation

Bump serialize-javascript, @angular-builders/custom-webpack and @angular-devkit/build-angular - #209

Bump serialize-javascript, @angular-builders/custom-webpack and @angular-devkit/build-angular#209
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-1d6bf19484

dependabot Bot commented on behalf of github Oct 19, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Oct 20, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Commit	Type	Description
4244eb7ba1	fix	allow library outputPath within project root
f61de66202	fix	capture and report Rolldown warnings and errors in library builder
3871a9da91	fix	keep the order of glob entries in the proxy configuration
3d00c76eb9	fix	resolve library bundle sourcemap sources relative to output directory
5ffed3f3b6	fix	scope cache directory by project and builder name
1e45d4d46a	fix	support a string `context` in array-form proxy configurations
2ffbebf24c	perf	immediately purge freed rolldown arena memory

Conversation

dependabot Bot commented on behalf of github Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.1.2

v7.1.1

What's Changed

v7.1.0

What's Changed

v7.0.7

What's Changed

v7.0.6

What's Changed

v7.0.5

Fixes

v7.0.4

What's Changed

22.0.1 (2026-06-23)

22.0.1-beta.0 (2026-06-22)

22.0.0 (2026-06-10)

22.0.0-beta.1 (2026-06-09)

22.0.0-beta.0 (2026-06-09)

⚠ BREAKING CHANGES

Features

Miscellaneous Chores

21.1.0 (2026-06-08)

21.1.0-beta.13 (2026-06-05)

Reverts

21.1.0-beta.12 (2026-06-04)

Bug Fixes

21.1.0-beta.11 (2026-06-01)

21.2.27

@​angular/cli

21.2.26

@​angular/cli

21.2.25

@​angular/build

21.2.24

@​angular/build

21.2.23

@​angular-devkit/build-angular

@​angular/ssr

21.2.22

@​angular-devkit/build-angular

21.2.21

@​angular/cli

@​angular/build

21.2.27 (2026-10-14)

@​angular/cli

20.3.40 (2026-10-14)

@​angular/cli

22.3.0-next.1 (2026-10-07)

@​angular-devkit/build-angular

@​angular/build

22.2.2 (2026-10-07)

Uh oh!

socket-security Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud Bot commented Oct 20, 2026

Quality Gate passed

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 19, 2026 •

edited

Loading

`@angular/cli`

`@angular/cli`

`@angular/build`

`@angular/build`

`@angular-devkit/build-angular`

`@angular/ssr`

`@angular-devkit/build-angular`

`@angular/cli`

`@angular/build`

`@angular/cli`

`@angular/cli`

`@angular-devkit/build-angular`

`@angular/build`

socket-security Bot commented Oct 19, 2026 •

edited

Loading

socket-security Bot commented Oct 19, 2026 •

edited

Loading