Skip to content

chore(deps): bump serialize-javascript and mocha - #1115

Open
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/npm_and_yarn/multi-0a3c4c2672
Open

chore(deps): bump serialize-javascript and mocha#1115
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/npm_and_yarn/multi-0a3c4c2672

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Bumps serialize-javascript to 7.1.4 and updates ancestor dependency mocha. These dependencies need to be updated together.

Updates serialize-javascript from 7.0.5 to 7.1.4

Release notes

Sourced from serialize-javascript's releases.

v7.1.4

What's Changed

Note on method serialization

Concise methods ({ m() {} }), including async, generator and computed-key methods, are now serialized correctly when their bodies contain a nested arrow function or function declaration. Previously these were emitted unchanged, producing invalid output that failed to deserialize (#118). Class expressions continue to be emitted as-is.

Reporting security issues

This repo now has a security policy. Please report vulnerabilities privately through GitHub's private vulnerability reporting rather than public issues.

Full Changelog: yahoo/serialize-javascript@v7.1.3...v7.1.4

v7.1.3

See: GHSA-m5mm-p8h7-m29v

What's Changed

Note on ignoreFunction

With ignoreFunction: true, function values are now omitted the same way JSON.stringify omits them, without deleting them from the input object. Functions inside arrays are emitted as null (previously this produced Array.prototype.slice.call(...) output).

New Contributors

Full Changelog: yahoo/serialize-javascript@v7.1.2...v7.1.3

v7.1.2

See: GHSA-gfhx-hw2g-v5hg

v7.1.1

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

... (truncated)

Commits

Updates mocha from 11.7.5 to 12.0.3

Release notes

Sourced from mocha's releases.

v12.0.3

12.0.3 (2026-10-01)

🩹 Fixes

  • keep watching when the last test file is removed (#6355) (921c161)
  • show require() error on unsupported directory import (#6354) (a68344f)
  • support --X one-char aliases (#6391) (1227939)

📚 Documentation

🧹 Chores

v12.0.2

12.0.2 (2026-09-17)

🩹 Fixes

  • fail nested tests on beforeEach failure (#6292) (a75b43b)
  • give CLI reporter-option precedence over config file (#6331) (571110f)
  • propagate spec file path on parallel worker death (#6268) (55a544a)
  • use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
  • watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

🧹 Chores

  • add "stale branch" workflow (#6315) (ad17f9f)
  • add dependency conflict detection workflow (#6246) (ef0ae32)
  • add folder for reproducing issues (#6330) (6728030)
  • add stale triage reminder for unreviewed issues (#6314) (ee35133)
  • auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
  • convert file-unloader to ESM (#6294) (dc73f4c)
  • deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
  • deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)

... (truncated)

Changelog

Sourced from mocha's changelog.

12.0.3 (2026-10-01)

🩹 Fixes

  • keep watching when the last test file is removed (#6355) (921c161)
  • show require() error on unsupported directory import (#6354) (a68344f)
  • support --X one-char aliases (#6391) (1227939)

📚 Documentation

🧹 Chores

12.0.2 (2026-09-17)

🩹 Fixes

  • fail nested tests on beforeEach failure (#6292) (a75b43b)
  • give CLI reporter-option precedence over config file (#6331) (571110f)
  • propagate spec file path on parallel worker death (#6268) (55a544a)
  • use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
  • watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

🧹 Chores

  • add "stale branch" workflow (#6315) (ad17f9f)
  • add dependency conflict detection workflow (#6246) (ef0ae32)
  • add folder for reproducing issues (#6330) (6728030)
  • add stale triage reminder for unreviewed issues (#6314) (ee35133)
  • auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
  • convert file-unloader to ESM (#6294) (dc73f4c)
  • deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
  • deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)
  • deps: update dependency knip to v6.35.0 (#6324) (a2416af)
  • deps: update octoguide/bot action to v0.23.0 (#6304) (bbe5a27)

... (truncated)

Commits
  • 51a0cc5 chore(main): release 12.0.3 (#6353)
  • 1227939 fix: support --X one-char aliases (#6391)
  • bb2e69a docs: refresh help output, fix stale links (#6357)
  • 921c161 fix: keep watching when the last test file is removed (#6355)
  • 3382fdd test: add --import=tsx integration test (#6356)
  • a68344f fix: show require() error on unsupported directory import (#6354)
  • d59467a test: touch a new file without stamping it afterwards (#6349)
  • 70db1c7 chore(main): release 12.0.2 (#6300)
  • 571110f fix: give CLI reporter-option precedence over config file (#6331)
  • a652ff5 fix: use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mocha since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump serialize-javascript and mocha
9f85756 
Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) to 7.1.4 and updates ancestor dependency [mocha](https://github.com/mochajs/mocha). These dependencies need to be updated together.


Updates `serialize-javascript` from 7.0.5 to 7.1.4
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v7.0.5...v7.1.4)

Updates `mocha` from 11.7.5 to 12.0.3
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md)
- [Commits](mochajs/mocha@v11.7.5...v12.0.3)

---
updated-dependencies:
- dependency-name: serialize-javascript
  dependency-version: 7.1.4
  dependency-type: indirect
- dependency-name: mocha
  dependency-version: 12.0.3
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 28, 2026
@dependabot dependabot Bot added the javascript Pull requests that update Javascript code label Oct 28, 2026
@azure-pipelines

azure-pipelines Bot commented Oct 28, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

fix(test): support Mocha 12 ESM runner exports
3f25817 
Use default constructor imports with ESM/CommonJS interop, and verify all runners propagate success and failure in plain Node as well as the extension host.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@chagong
Changyong Gong (chagong) requested a balanced review from Copilot October 29, 2026 09:18
Copilot AI reviewed Oct 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues are reported for the dependency upgrade and related runner compatibility changes.

No open issues 🎉

What changed in this PR

Updates the extension’s test dependencies to Mocha 12.0.3 and serialize-javascript 7.1.4, with import compatibility changes and runner checks to support the upgrade.

Changes:

  • Updates dependency versions, the serialization override, and the lockfile.
  • Enables esModuleInterop and switches all nine Mocha runners to default imports.
  • Adds success/failure checks for runner entry points to npm test and documents them.
File Description
tsconfig.json Enables default-import interoperability.
test/​suite/​index.ts Uses the Mocha default import.
test/​simple-suite/​index.ts Uses the Mocha default import.
test/​non-java-gradle-suite/​index.ts Uses the Mocha default import.
test/​multiple-suite/​index.ts Uses the Mocha default import.
test/​multi-module-suite/​index.ts Uses the Mocha default import.
test/​mochaRunners.ts Adds isolated success/failure checks for all nine runners.
test/​maven-suite/​index.ts Uses the Mocha default import.
test/​lsp-tools-suite/​index.ts Uses the Mocha default import.
test/​invisible-suite/​index.ts Uses the Mocha default import.
test/​gradle-suite/​index.ts Uses the Mocha default import.
package.json Updates dependencies and adds runner checks to npm test.
package-lock.json Locks upgraded dependencies and refreshes transitive packages.
CONTRIBUTING.md Documents runner checks and import compatibility.

Review effort: Balanced

@chagong

Changyong Gong (chagong) commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Decision: NOT_MERGED

Dependabot PR Manager result

Repository: microsoft/vscode-java-dependency
Pull request: microsoft/vscode-java-dependency#1115 - chore(deps): bump serialize-javascript and mocha
Update: mocha 11.7.5 -> 12.0.3 (major, direct development); serialize-javascript 7.0.5 -> 7.1.4 (minor, transitive); grouped update.
Safety assessment: Dependabot start, official Copilot remediation, and prior update-branch provenance verified. The Compatibility Remediation Gate applies; dependency necessity and migration safety were not reassessed while the branch is stale and independent approval blocks recovery. Merge safety remains uncertified.
Final state: OPEN; head 10f3da3e7951c80bdbfea80cabd18dfe220d7271; MERGEABLE, BEHIND, REVIEW_REQUIRED. CI: 33/33 rollup checks, 34/34 check runs and 4/4 required checks successful; no failed or pending checks and no unresolved review threads. Failure causality is not applicable.
Actions taken: Fetched the diff, commits, reviews, checks and rules; verified historical update-branch merge 10f3da3e7951c80bdbfea80cabd18dfe220d7271, old head/preserved remediation 3f258176847b23a721c9bb09414a2b508896849e, and audited/applied base 1a5c7b3570c196bc454d35e6751d81d5d082663f. Current main 4b6386c11754147212546a44bb0f136315c17bb8 is one commit ahead. No branch update, rerun, remediation, local validation, commit, push, review request, approval or merge was attempted.
Reason: Organization rules require code-owner approval and approval by someone other than the last pusher; only the current actor has approved and GitHub still reports REVIEW_REQUIRED. The branch is also behind. Classic branch-protection details were inaccessible (HTTP 403).
Next action: Arrange an independent code-owner review from @testforstephen or @wenytang-ms, preserve remediation with an expected-SHA update-branch, repeat necessity/compatibility and CI audits, and obtain approval of the refreshed head.

@chagong
Changyong Gong (chagong) requested a balanced review from Copilot October 30, 2026 09:13
Copilot AI reviewed Oct 30, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No active review issues were identified for the test-dependency and Mocha runner updates.

No open issues 🎉

Review effort: Balanced

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@chagong Changyong Gong (chagong) chagong approved these changes
@testforstephen Jinbo Wang (testforstephen) Awaiting requested review from testforstephen testforstephen is a code owner
@wenytang-ms wenyt (wenytang-ms) Awaiting requested review from wenytang-ms wenytang-ms is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@chagong