Skip to content

Bump serialize-javascript, terser-webpack-plugin, compression-webpack-plugin and shakapacker#9848

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/multi-468b21b6b7
Open

Bump serialize-javascript, terser-webpack-plugin, compression-webpack-plugin and shakapacker#9848
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/multi-468b21b6b7

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 29, 2026

Bumps serialize-javascript to 7.0.5 and updates ancestor dependencies serialize-javascript, terser-webpack-plugin, compression-webpack-plugin and shakapacker. These dependencies need to be updated together.

Updates serialize-javascript from 6.0.2 to 7.0.5

Release notes

Sourced from serialize-javascript's releases.

v7.0.5

Fixes

  • Improve robustness and validation for array-like object serialization.
  • Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

v7.0.4

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.3...v7.0.4

v7.0.3

  • fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString (#207) 2e609d0
  • build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (#206) 42b7cdb

yahoo/serialize-javascript@v7.0.2...v7.0.3

v7.0.2

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.1...v7.0.2

v7.0.1

What's Changed

New Contributors

Full Changelog: yahoo/serialize-javascript@v7.0.0...v7.0.1

v7.0.0

Breaking Changes

  • requires Node.js v20+

What's Changed

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for serialize-javascript since your current version.


Updates terser-webpack-plugin from 5.3.14 to 5.4.0

Release notes

Sourced from terser-webpack-plugin's releases.

v5.4.0

5.4.0 (2026-03-10)

Features

  • added ability to minimize JSON using jsonMinify (#657) (29ac915)

v5.3.17

5.3.17 (2026-03-03)

Bug Fixes

  • update serialize-javascript (37c490c)

v5.3.16

5.3.16 (2025-12-11)

Bug Fixes

v5.3.15

5.3.15 (2025-12-05)

Bug Fixes

  • catch error when loading minimizers (#639) (586af0a)
  • respect errors and warnings from minimizer without code (8607f79)
Changelog

Sourced from terser-webpack-plugin's changelog.

5.4.0 (2026-03-10)

Features

  • added ability to minimizer JSON using jsonMinify (#657) (29ac915)

5.3.17 (2026-03-03)

Bug Fixes

  • update serialize-javascript (37c490c)

5.3.16 (2025-12-11)

Bug Fixes

5.3.15 (2025-12-05)

Bug Fixes

  • catch error when loading minimizers (#639) (586af0a)
  • respect errors and warnings from minimizer without code (8607f79)
Commits

Updates compression-webpack-plugin from 11.1.0 to 12.0.0

Release notes

Sourced from compression-webpack-plugin's releases.

v12.0.0

12.0.0 (2026-03-02)

⚠ BREAKING CHANGES

  • minimum supported Node.js version is 20.9.0 (#423) (5d0ab70)
Changelog

Sourced from compression-webpack-plugin's changelog.

12.0.0 (2026-03-02)

⚠ BREAKING CHANGES

  • minimum supported Node.js version is 20.9.0 (#423) (5d0ab70)
Commits

Updates shakapacker from 9.5.0 to 9.7.0

Release notes

Sourced from shakapacker's releases.

v9.7.0

Added

  • Added rspack v2 support. [PR #975](shakacode/shakapacker#975) by justin808. Peer dependencies now accept both rspack v1 and v2 (^1.0.0 || ^2.0.0-0). No source code changes were needed — all existing APIs work identically in v2. Note that rspack v2 requires Node.js 20.19.0+.

Fixed

  • Fixed config exporter path traversal and annotation format validation. [PR #914](shakacode/shakapacker#914) by justin808. Added safeResolvePath security check to prevent path traversal in export save paths, and enforced YAML format when using annotations with build exports.
  • Fixed webpack-subresource-integrity v5 named export handling. [PR #978](shakacode/shakapacker#978) by justin808. Supports both the default export (older versions) and the named SubresourceIntegrityPlugin export (v5.1+), preventing runtime breakage when upgrading the plugin. Fixes #972.

v9.6.1

[v9.6.1] - March 8, 2026

Fixed

  • Fixed Env#current crashing when Rails is not loaded. [PR #963](shakacode/shakapacker#963) by ihabadham. Added defined?(Rails) guard to Shakapacker::Env#current so it falls back to RAILS_ENV/RACK_ENV environment variables when called from non-Rails Ruby processes (e.g., bin/dev scripts). Previously, this would raise a NameError and silently fall back to "production".

Documentation

  • Added Node package API documentation. [PR #900](shakacode/shakapacker#900) by justin808. New guide (docs/node_package_api.md) documenting the JavaScript API exports, configuration objects, import entrypoints for webpack and rspack, and built-in third-party support resources.

v9.6.0

[v9.6.0] - March 7, 2026

Security

  • Removed default Access-Control-Allow-Origin: * header from dev server configuration. This header allowed any website to access dev server resources. If your setup runs webpack-dev-server on a different port from your Rails server, uncomment the headers section in config/shakapacker.yml to restore cross-origin asset loading. [PR #936](shakacode/shakapacker#936) by justin808. Fixes #935.

Added

  • Added SKIP=true installer mode to preserve existing files. [PR #926](shakacode/shakapacker#926) by justin808. Running rails shakapacker:install SKIP=true now skips conflicting files instead of overwriting them. This is useful for CI/CD pipelines and automated setups where you want to install only missing files without touching existing configuration.

  • Export bundler utility functions for Webpack/Rspack compatibility. [PR #922](shakacode/shakapacker#922) by justin808. New utility functions that make it easier to write bundler-agnostic configuration code: isRspack, isWebpack, getBundler(), getCssExtractPlugin(), getCssExtractPluginLoader(), getDefinePlugin(), getEnvironmentPlugin(), and getProvidePlugin(). Users no longer need to write conditional logic to handle differences between Webpack and Rspack.

    // Before: manual conditional logic
const { config } = require("shakapacker")
const CssPlugin =
  config.assets_bundler === "rspack"
    ? require("@rspack/core").CssExtractRspackPlugin
    : require("mini-css-extract-plugin")
// After: use bundler utilities
const { getCssExtractPlugin } = require("shakapacker")
const CssPlugin = getCssExtractPlugin()

Changed

  • Changed default file rule type from asset/resource to asset. [PR #901](shakacode/shakapacker#901) by justin808. Static assets (images, fonts, SVGs) now use webpack/rspack's asset type instead of asset/resource, allowing the bundler to automatically inline small files as data URIs for better performance.
  • Allow compression-webpack-plugin v12. [PR #937](shakacode/shakapacker#937) by G-Rath.

... (truncated)

Changelog

Sourced from shakapacker's changelog.

[v9.7.0] - March 15, 2026

Added

  • Added rspack v2 support. [PR #975](shakacode/shakapacker#975) by justin808. Peer dependencies now accept both rspack v1 and v2 (^1.0.0 || ^2.0.0-0). No source code changes were needed — all existing APIs work identically in v2. Note that rspack v2 requires Node.js 20.19.0+.

Fixed

  • Fixed config exporter path traversal and annotation format validation. [PR #914](shakacode/shakapacker#914) by justin808. Added safeResolvePath security check to prevent path traversal in export save paths, and enforced YAML format when using annotations with build exports.
  • Fixed webpack-subresource-integrity v5 named export handling. [PR #978](shakacode/shakapacker#978) by justin808. Supports both the default export (older versions) and the named SubresourceIntegrityPlugin export (v5.1+), preventing runtime breakage when upgrading the plugin. Fixes #972.

[v9.6.1] - March 8, 2026

Fixed

  • Fixed Env#current crashing when Rails is not loaded. [PR #963](shakacode/shakapacker#963) by ihabadham. Added defined?(Rails) guard to Shakapacker::Env#current so it falls back to RAILS_ENV/RACK_ENV environment variables when called from non-Rails Ruby processes (e.g., bin/dev scripts). Previously, this would raise a NameError and silently fall back to "production".

Documentation

  • Added Node package API documentation. [PR #900](shakacode/shakapacker#900) by justin808. New guide (docs/node_package_api.md) documenting the JavaScript API exports, configuration objects, import entrypoints for webpack and rspack, and built-in third-party support resources.

[v9.6.0] - March 7, 2026

Security

  • Removed default Access-Control-Allow-Origin: * header from dev server configuration. This header allowed any website to access dev server resources. If your setup runs webpack-dev-server on a different port from your Rails server, uncomment the headers section in config/shakapacker.yml to restore cross-origin asset loading. [PR #936](shakacode/shakapacker#936) by justin808. Fixes #935.

Added

  • Added SKIP=true installer mode to preserve existing files. [PR #926](shakacode/shakapacker#926) by justin808. Running rails shakapacker:install SKIP=true now skips conflicting files instead of overwriting them. This is useful for CI/CD pipelines and automated setups where you want to install only missing files without touching existing configuration.

  • Export bundler utility functions for Webpack/Rspack compatibility. [PR #922](shakacode/shakapacker#922) by justin808. New utility functions that make it easier to write bundler-agnostic configuration code: isRspack, isWebpack, getBundler(), getCssExtractPlugin(), getCssExtractPluginLoader(), getDefinePlugin(), getEnvironmentPlugin(), and getProvidePlugin(). Users no longer need to write conditional logic to handle differences between Webpack and Rspack.

    // Before: manual conditional logic
const { config } = require("shakapacker")
const CssPlugin =
  config.assets_bundler === "rspack"
    ? require("@rspack/core").CssExtractRspackPlugin
    : require("mini-css-extract-plugin")
// After: use bundler utilities
const { getCssExtractPlugin } = require("shakapacker")
const CssPlugin = getCssExtractPlugin()

Changed

  • Changed default file rule type from asset/resource to asset. [PR #901](shakacode/shakapacker#901) by justin808. Static assets (images, fonts, SVGs) now use webpack/rspack's asset type instead of asset/resource, allowing the bundler to automatically inline small files as data URIs for better performance.
  • Allow compression-webpack-plugin v12. [PR #937](shakacode/shakapacker#937) by G-Rath.
  • BREAKING: sass-loader now defaults to modern Sass API. [PR #879](shakacode/shakapacker#879) by justin808. The sass-loader configuration now uses api: "modern" instead of the deprecated legacy API. This improves compatibility with plugins like sass-resources-loader that require the modern API. If you experience issues after upgrading, you can revert to the legacy API by customizing your webpack config:

... (truncated)

Commits
  • db297e3 Release 9.7.0
  • 17bf648 Rename create_release to release and fix version.rb staging path (#986)
  • 34e95ac Add v9.7.0 release notes to CHANGELOG (#985)
  • 55af8b9 Port update-changelog improvements from react_on_rails (#982)
  • 5d55b9a Fix webpack-subresource-integrity v5 named export handling (#978)
  • d9232d8 Improve release-task dry-run UX and AUTO_CONFIRM docs (#981)
  • f7ebb57 Fix claude-code-review checkout action version (#979)
  • 73a08bd Remove yalc artifact from spec/dummy lockfiles (#977)
  • 2df4659 Add rspack v2 support (#975)
  • b259a0e Supersede #905: all-builds validation fix with lint unblock (#914)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump serialize-javascript, terser-webpack-plugin, compression-webpack…
f363696 
…-plugin and shakapacker

Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) to 7.0.5 and updates ancestor dependencies [serialize-javascript](https://github.com/yahoo/serialize-javascript), [terser-webpack-plugin](https://github.com/webpack/terser-webpack-plugin), [compression-webpack-plugin](https://github.com/webpack/compression-webpack-plugin) and [shakapacker](https://github.com/shakacode/shakapacker). These dependencies need to be updated together.


Updates `serialize-javascript` from 6.0.2 to 7.0.5
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v6.0.2...v7.0.5)

Updates `terser-webpack-plugin` from 5.3.14 to 5.4.0
- [Release notes](https://github.com/webpack/terser-webpack-plugin/releases)
- [Changelog](https://github.com/webpack/terser-webpack-plugin/blob/main/CHANGELOG.md)
- [Commits](webpack/terser-webpack-plugin@v5.3.14...v5.4.0)

Updates `compression-webpack-plugin` from 11.1.0 to 12.0.0
- [Release notes](https://github.com/webpack/compression-webpack-plugin/releases)
- [Changelog](https://github.com/webpack/compression-webpack-plugin/blob/main/CHANGELOG.md)
- [Commits](webpack/compression-webpack-plugin@v11.1.0...v12.0.0)

Updates `shakapacker` from 9.5.0 to 9.7.0
- [Release notes](https://github.com/shakacode/shakapacker/releases)
- [Changelog](https://github.com/shakacode/shakapacker/blob/main/CHANGELOG.md)
- [Commits](shakacode/shakapacker@v9.5.0...v9.7.0)

---
updated-dependencies:
- dependency-name: serialize-javascript
  dependency-version: 7.0.5
  dependency-type: indirect
- dependency-name: terser-webpack-plugin
  dependency-version: 5.4.0
  dependency-type: direct:production
- dependency-name: compression-webpack-plugin
  dependency-version: 12.0.0
  dependency-type: direct:production
- dependency-name: shakapacker
  dependency-version: 9.7.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 29, 2026
@github-actions github-actions bot requested a review from okuramasafumi March 29, 2026 06:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@okuramasafumi okuramasafumi Awaiting requested review from okuramasafumi

Assignees

@dependabot dependabot[bot]

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants