mongodb-js / devtools-shared / 24655124033 / 7 – mongodb-downloader

78%

main: 79%

Pull #687

github

chore(deps): add overrides to force serialize-javascript>=7.0.5

Addresses two Dependabot alerts:
- Alert #173: GHSA-5c6j-r48x-rmvq (RCE via RegExp.flags/Date.toISOString, high severity)
- Alert #199: GHSA-qj8w-gfj5-8c6v / CVE-2026-34043 (DoS via CPU exhaustion, medium severity)

Both mocha@^8.4.0 and terser-webpack-plugin@^5.3.x ship serialize-javascript
6.x, and neither has released a version shipping >=7.0.5. Adding an npm
`overrides` entry forces all transitive instances to resolve to 7.0.5+.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

22 of 41 branches covered (53.66%)

Branch coverage included in aggregate %.

70 of 90 relevant lines covered (77.78%)

9.29 hits per line