chore(deps): Bump seroval from 1.5.0 to 1.7.7

DE
7d ago
+1579-279

Bumps seroval from 1.5.0 to 1.7.7.

Release notes

Sourced from seroval's releases.

seroval-plugins@1.7.7

Patch Changes

  • bb4c3fc: Streamed Request payloads now deserialize where stream request bodies are supported. RequestPlugin adds duplex: 'half' to the request options when the body is a ReadableStream, which Chrome 105+ and Node 19.1+ require. Runtimes without stream request bodies ignore the option.

    RequestPlugin also keeps the body of a Request in runtimes without the Request.body getter, such as Firefox. The async parse reads the body with arrayBuffer(), and the stream parse pushes that buffer into a new ReadableStream.

seroval@1.7.7

Patch Changes

  • Serialization reads an object's class from its prototype instead of its constructor property, and reads Date, Temporal, typed array and DataView values through the built-in methods and getters instead of properties on the value. An object whose own constructor names a built-in class is now serialized as a plain object, and an object that only inherits a built-in prototype, such as Object.create(Date.prototype), is rejected.
  • 00e3abf: Bundles that never create a live stream no longer include the LiveStream class: about 570 bytes gzipped less for toJSONAsync, fromJSON or fromCrossJSON on the production ESM build, measured with seroval's bundle size report. An object made with Object.create(LiveStream.prototype) is no longer treated as a live stream.

seroval-plugins@1.7.6

Patch Changes

  • eb60188: Check the File, ImageData, Event and CustomEvent fields during deserialization. The options of each are checked field by field and copied, and ImageData's data must be a Uint8ClampedArray.

seroval@1.7.6

Patch Changes

  • Read a RegExp's pattern and flags through the RegExp.prototype getters, so own source or flags properties on the value no longer change the output.

seroval-plugins@1.7.5

Patch Changes

  • Check the FormData, Headers, Response and Request fields during deserialization.

seroval@1.7.5

Patch Changes

  • d85ec3f: Keep two round-trip cases intact. An object whose own constructor key holds a falsy value, such as { constructor: undefined }, now keeps Object.prototype instead of coming back with a null prototype. A null-prototype object with an own __proto__ key, or any object serialized with Feature.ObjectAssign disabled, no longer turns equal-looking values such as two new Set() into one shared object in serialize, crossSerialize and compileJSON output.

seroval-plugins@1.7.4

Patch Changes

  • Check that a ReadableStream's stream source is a seroval Stream before deserializing it.

seroval@1.7.4

No changes in this release.

seroval-plugins@1.7.3

No changes in this release.

seroval@1.7.3

Patch Changes

  • 3a60f79: Republish the 1.7.2 changes through CI with npm provenance. 1.7.2 was published manually without an attestation, so pnpm's trustPolicy: no-downgrade refused to install it (#278). No code changes.

seroval-plugins@1.7.1

... (truncated)

Commits
  • 0e64cac test: load the Temporal polyfill in the class member tests
  • c91bf31 chore: version packages
  • 7803b42 fix: read the class and internal state of built-in values directly
  • b36d295 Merge pull request #302 from lxsmnsyc/test/request-stream-round-trip
  • 8e34158 test: check streamed Request round-trips instead of snapshots
  • c637998 Merge pull request #292 from lxsmnsyc/fix/request-stream-duplex
  • 122e67b test: hide Request.body on the prototype in the Firefox tests
  • b474992 Merge remote-tracking branch 'origin/main' into fix/request-stream-duplex
  • e8db662 Merge pull request #272 from LadyBluenotes/perf/live-stream-brand
  • 0d350e1 Merge remote-tracking branch 'origin/main' into pr-272
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for seroval since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by cubic

Updates seroval from 1.5.0 to 1.7.7 in package-lock.json. The upgrade detects built-in objects from their prototype instead of the constructor property, drops the LiveStream class from bundles that never create live streams (about 570 bytes smaller for common entry points), and raises the required Node version from >= 10 to >= 20.

The lockfile also records the package version changing from 2.0.0-alpha.0 to 2.0.0 and includes previously missing optional platform packages for esbuild, rollup, lightningcss, and tailwindcss.