Update dependency serialize-javascript to v3 [SECURITY]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
serialize-javascript	`^1.3.0` -> `^3.0.0`

GitHub Vulnerability Alerts

CVE-2019-16769

Versions of serialize-javascript prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.

Recommendation

Upgrade to version 2.1.1 or later.

CVE-2020-7660

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

An object such as {"foo": /1"/, "bar": "a\"@__R-<UID>-0__@"} was serialized as {"foo": /1"/, "bar": "a\/1"/}, which allows an attacker to escape the bar key. This requires the attacker to control the values of both foo and bar and guess the value of <UID>. The UID has a keyspace of approximately 4 billion making it a realistic network attack.

The following proof-of-concept calls console.log() when the running eval(): eval('('+ serialize({"foo": /1" + console.log(1)/i, "bar": '"@__R-<UID>-0__@'}) + ')');

Release Notes

yahoo/serialize-javascript

### [`v3.1.0`](https://togithub.com/yahoo/serialize-javascript/releases/v3.1.0) [Compare Source](https://togithub.com/yahoo/serialize-javascript/compare/v3.0.0...v3.1.0) - Bump mocha from 7.1.2 to 7.2.0 ([#83](https://togithub.com/yahoo/serialize-javascript/issues/83)) - Bump mocha from 7.1.1 to 7.1.2 ([#82](https://togithub.com/yahoo/serialize-javascript/issues/82)) - Bump nyc from 15.0.0 to 15.0.1 ([#81](https://togithub.com/yahoo/serialize-javascript/issues/81)) - Don't replace regex / function placeholders within string literals ([#79](https://togithub.com/yahoo/serialize-javascript/issues/79)) - [Security] Bump minimist from 1.2.0 to 1.2.5 ([#78](https://togithub.com/yahoo/serialize-javascript/issues/78)) - Bump mocha from 7.1.0 to 7.1.1 ([#77](https://togithub.com/yahoo/serialize-javascript/issues/77)) - Bump mocha from 7.0.1 to 7.1.0 ([#74](https://togithub.com/yahoo/serialize-javascript/issues/74)) - Update example in README ([#73](https://togithub.com/yahoo/serialize-javascript/issues/73)) Note: the `randombytes` has been added to the dependency package to improve the generation of UIDs. Check the [#22](https://togithub.com/yahoo/serialize-javascript/issues/22) for more information. Thanks to [@JordanMilne](https://togithub.com/JordanMilne) and [@Siebes](https://togithub.com/Siebes) for this change. ### [`v3.0.0`](https://togithub.com/yahoo/serialize-javascript/releases/v3.0.0) [Compare Source](https://togithub.com/yahoo/serialize-javascript/compare/v2.1.2...v3.0.0) - Introduce support for Infinity ([@vthibault](https://togithub.com/vthibault), [#72](https://togithub.com/yahoo/serialize-javascript/issues/72)) - Bump mocha from 7.0.0 to 7.0.1 ([#71](https://togithub.com/yahoo/serialize-javascript/issues/71)) - Test on Node.js v12 ([@okuryu](https://togithub.com/okuryu), [#70](https://togithub.com/yahoo/serialize-javascript/issues/70)) - Bump mocha from 6.2.2 to 7.0.0 ([#69](https://togithub.com/yahoo/serialize-javascript/issues/69)) - Bump nyc from 14.1.1 to 15.0.0 ([#68](https://togithub.com/yahoo/serialize-javascript/issues/68)) ##### Behavior changes for `Infinity` It serializes `Infinity` values as follows since this version. The result of serialization may be changed if you are passing `Infinity` values into the `serialize-javascript`. **v3.x** ```js const serialize = require('serialize-javascript'); serialize({inf: Infinity}); // '{"inf":Infinity}' ``` **v2.x** ```js const serialize = require('serialize-javascript'); serialize({inf: Infinity}); // '{"inf":null}' ``` ### [`v2.1.2`](https://togithub.com/yahoo/serialize-javascript/releases/v2.1.2) [Compare Source](https://togithub.com/yahoo/serialize-javascript/compare/v2.1.1...v2.1.2) - Ignore .nyc_output ([@styfle](https://togithub.com/styfle), [#64](https://togithub.com/yahoo/serialize-javascript/issues/64)) ### [`v2.1.1`](https://togithub.com/yahoo/serialize-javascript/releases/v2.1.1) [Compare Source](https://togithub.com/yahoo/serialize-javascript/compare/v2.1.0...v2.1.1) - Fix regular expressions Cross-Site Scripting (XSS) vulnerability (see [security advisory](https://togithub.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx)) - Migrate to nyc from istanbul ### [`v2.1.0`](https://togithub.com/yahoo/serialize-javascript/releases/v2.1.0) [Compare Source](https://togithub.com/yahoo/serialize-javascript/compare/v2.0.0...v2.1.0) - Add `ignoreFunction` option ([@realdennis](https://togithub.com/realdennis), [#58](https://togithub.com/yahoo/serialize-javascript/issues/58)) ### [`v2.0.0`](https://togithub.com/yahoo/serialize-javascript/releases/v2.0.0) [Compare Source](https://togithub.com/yahoo/serialize-javascript/compare/v1.9.1...v2.0.0) - re-landed [#54](https://togithub.com/yahoo/serialize-javascript/issues/54) with bump major version (see: [#57](https://togithub.com/yahoo/serialize-javascript/issues/57)) ##### Behavior changes for `undefined` It serializes `undefined` values as follows since this version. The result of serialization may be changed if you are passing `undefined` values into the `serialize-javascript`. **v2.x** ```js const serialize = require('serialize-javascript'); serialize({undef: undefined}); // '{"undef":undefined}' ``` **v1.x** ```js const serialize = require('serialize-javascript'); serialize({undef: undefined}); // '{}' ```

Renovate configuration

:date: Schedule: "" (UTC).

:vertical_traffic_light: Automerge: Disabled by config. Please merge this manually once you are satisfied.

:recycle: Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

:no_bell: Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by WhiteSource Renovate. View repository job log here.

yurikrupnik / node-playground