serialise-javascript outdated!

[erisnuts]

Description

Hello, please, could you update serialise-javascript library asap?

https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.1

[evenstensberg]

Send a pr

[askoufis]

I'm happy to make a PR for this, however v7 dropped support for Node<20, which doesn't align with this plugin's supported node versions (>=10.13.0).

[alexander-akait]

@okuryu hello, can you backport security fix to serialize-javascript@6 we have a lot of repos which uses 6 version and currently can't update it (but it is in our roadmap), thanks

[okuryu]

serialize-javascript v6.x is actually intended for use with Node.js 18 or higher. Is that okay?
https://github.com/yahoo/serialize-javascript/blob/v6.0.2/.github/workflows/test.yml#L14
I might be able to backport security fixes to serialize-javascript v6.x on my end, but if you have a requirement to support Node.js 10.x or higher, this may not be appropriate.

(Generally, many npm packages operate under the principle of supporting LTS Node.js versions. Personally, I don't have a good impression of being forced to support older Node.js versions.)

[alexander-akait]

@okuryu I see... that is an interesting problem we have a lot of CI tests for Node@10+ and serialize-javascript@6 works fine, maybe we can remove the engines in the such case, because code works fine with node@10, I often feel that using engines without actually using the new features brings more problems in the update than improvements, but that's my opinion, but it will be enough for us to just port security fixes, because serialize-javascript@6 works fine with Node@10, we don't need here new features, just security fixes

[NookieGrey]

npm audit fix --force fails for this package due to a critical vulnerability. Please prioritize a fix.

[olivier1980]

Hi my npm audit is giving high severity warning for this package, please update.

edit:
If v7 dropped support for node<20 then maybe this package needs to align with that as well, through a new major version release. Let's fix this issue first and worry about outdated legacy support/backports later?

[dargmuesli]

serialize-javascript v7 not only increased the node engine to v20 but also makes use of a node:crypto function that is available starting with node v17.4 (or node v15, see https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues#browser_compatibility):

• yahoo/serialize-javascript@v6.0.2...v7.0.0#diff-e727e4bdf3657fd1d798edcd6b099d6e092f8573cba266154583a746bba0f346R36

So I guess the engine would need to be set to a higher major value with serialize-javascript v7 per se if no backport is done. I'm in favor of supporting LTS versions of node only simply because I see no reason to cater for users of outdated node version without extended support payment. The default should be progressive.

[dargmuesli]

Submitted a PR for my suggestion:

• chore(deps)!: upgrade serialize-javascript to v7 and node to v20 #650

[runephilosof-abtion]

How about just

    "serialize-javascript": "^6.0.2 || ^7.0.3",

As suggested by @tats-u https://github.com/webpack/terser-webpack-plugin/pull/650/changes#r2872784439