Skip to content

chore(deps): bump serialize-javascript, @symfony/webpack-encore and workbox-webpack-plugin - #3838

Open
dependabot[bot] wants to merge 1 commit into
6.1from
dependabot/npm_and_yarn/multi-b4d66dfb8f
Open

chore(deps): bump serialize-javascript, @symfony/webpack-encore and workbox-webpack-plugin#3838
dependabot[bot] wants to merge 1 commit into
6.1from
dependabot/npm_and_yarn/multi-b4d66dfb8f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps serialize-javascript to 7.1.4 and updates ancestor dependencies serialize-javascript, @symfony/webpack-encore and workbox-webpack-plugin. These dependencies need to be updated together.

Updates serialize-javascript from 4.0.0 to 7.1.4

Release notes

Sourced from serialize-javascript's releases.

v7.1.4

What's Changed

Note on method serialization

Concise methods ({ m() {} }), including async, generator and computed-key methods, are now serialized correctly when their bodies contain a nested arrow function or function declaration. Previously these were emitted unchanged, producing invalid output that failed to deserialize (#118). Class expressions continue to be emitted as-is.

Reporting security issues

This repo now has a security policy. Please report vulnerabilities privately through GitHub's private vulnerability reporting rather than public issues.

Full Changelog: yahoo/serialize-javascript@v7.1.3...v7.1.4

v7.1.3

See: GHSA-m5mm-p8h7-m29v

What's Changed

Note on ignoreFunction

With ignoreFunction: true, function values are now omitted the same way JSON.stringify omits them, without deleting them from the input object. Functions inside arrays are emitted as null (previously this produced Array.prototype.slice.call(...) output).

New Contributors

Full Changelog: yahoo/serialize-javascript@v7.1.2...v7.1.3

v7.1.2

See: GHSA-gfhx-hw2g-v5hg

v7.1.1

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serialize-javascript since your current version.


Updates @symfony/webpack-encore from 1.8.2 to 7.2.0

Release notes

Sourced from @​symfony/webpack-encore's releases.

7.2.0 - The Now-With-Types Release

[!NOTE] The entire codebase is now TypeScript, and the package ships type definitions out of the box, so methods like enableSassLoader() and configureDevServerOptions() give you real autocompletion and validation for every option you pass in webpack.config.js.

[!IMPORTANT] Reprise v0.6.0 reaches near feature-parity with Encore on both Vite and Rsbuild, including a migration guide that maps every Encore.* call to its equivalent. Active maintenance on Webpack Encore slows from here (mostly dependency updates and bug fixes), but Encore stays supported, and Reprise is the recommended path if you want to move to a modern setup.

What's Changed

New Contributors

Full Changelog: symfony/webpack-encore@v7.1.0...v7.2.0

Thanks to everyone who contributed to this release! 🙌

Update Encore in your project:

npm install @symfony/webpack-encore@latest --save-dev
pnpm add --save-dev @symfony/webpack-encore@latest
yarn add --dev @symfony/webpack-encore@latest

7.1.0 - The "Wait, We Forgot Some Things" Release

[!NOTE] A small follow-up to 7.0.0: a few dependency updates didn't make it into that release, so 7.1.0 ships them now. You get support for sass-loader v17 (v16 still works), @vue/babel-plugin-jsx bumped to v3, webpack-manifest-plugin requiring at least v6.0.1, and JS/CSS minifier peer dependencies relaxed to optional with no version constraint. No upgrade steps needed for most projects, just bump and go.

What's Changed

Full Changelog: symfony/webpack-encore@v7.0.0...v7.1.0

Thanks to everyone who contributed to this release! 🙌

Update Encore in your project:

... (truncated)

Changelog

Sourced from @​symfony/webpack-encore's changelog.

7.2.0

  • Migrate internal code to TypeScript, ship package with type definitions (better DX and IDE support!)
  • Improve the typing of the configuration methods (enableSassLoader(), configureDevServerOptions(), enableVueLoader(), configureBabelPresetEnv(), etc.): options now resolve to the real loader/plugin types, giving full autocompletion and validation in your webpack.config
  • Add support for webpack-dev-server ^6.0.0 (requires webpack ^5.102.0 and webpack-cli ^7.0.2)

7.1.0

  • Add support for sass-loader ^17.0.0
  • Add support for @vue/babel-plugin-jsx to ^3.0.0, remove support for @vue/babel-plugin-jsx to ^1.0.0
  • Update the minimum version of webpack-manifest-plugin to ^6.0.1
  • Declare the JS/CSS minifiers as optional peer dependencies without a version constraint, matching minimizer-webpack-plugin behavior

7.0.0

This is a new major version that contains several backwards-compatibility breaks.

BC Breaks

  • Migrate from CJS (CommonJS) to ESM (ES Modules)
  • Migrate synchronous API to asynchronous API
  • Drop support of Babel 7 in favor of Babel 8
  • Remove Encore.configureTerserPlugin() in favor of Encore.configureJsMinimizerPlugin()

Features

  • Add support for webpack-cli ^7.0.0
  • Add support for typescript ^6.0.0
  • Add support for Node.js` ^26.0.0
  • Add support of Babel 8
  • Use ESM exports in Encore.copyFiles() for better webpack optimizations
  • Use peerDependencies instead of devDependencies for optional dependencies checking
  • Replace css-minimizer-webpack-plugin and terser-webpack-plugin by minimizer-webpack-plugin to unify the minification process

See the upgrade guide for the full list of breaking changes and upgrade steps.

6.0.0

This is a new major version that contains several backwards-compatibility breaks, but for the best!

BC Breaks

  • Remove support of Node.js <22.13.0
  • Remove support of babel-loader@^9.1.3, see possible BC breaks in 10.0.0 release notes
  • Remove support of style-loader@^3.3.0, see possible BC breaks in 4.0.0 release notes
  • Remove support of less-loader@^11.0.0, see possible BC breaks in 12.0.0 release notes
  • Remove support of postcss-loader@^7.0.0, see possible BC breaks in 8.0.0 release notes
  • Remove support of stylus-loader@^7.0.0, see possible BC breaks in 8.0.0 release notes
  • Remove support of webpack-cli@^5.0.0, see possible BC breaks in 6.0.0 release notes
  • Remove unmaintained file-loader dependency

... (truncated)

Upgrade guide

Sourced from @​symfony/webpack-encore's upgrade guide.

Upgrading

7.0.0

[!IMPORTANT] v7.0.0 is ESM-only, Encore.getWebpackConfig() is now async, Babel 8 is required, and CSS minification is no longer enabled by default. These are real breaking changes, so please follow the steps below.

The Node.js ecosystem has largely moved to ESM as the standard module format. Most actively maintained packages now ship ESM-only, and since Encore already requires Node.js ^22.13.0 || >=24.0 (which has full ESM support), continuing to publish as CJS would mean fighting the ecosystem: pinning to older dependencies, adding workarounds, and missing out on tree-shaking and static analysis.

Moving to ESM also unlocks async/await in Encore's internals. Now that getWebpackConfig() is natively async, Encore can adopt modern async APIs from the ecosystem without hacks.

  • Migrate from CommonJS to ESM: the package now requires "type": "module" in your project or the use of .mjs file extensions. Update your webpack.config.js:

    // Before (CJS)
const Encore = require('@symfony/webpack-encore');
// ...
module.exports = Encore.getWebpackConfig();
// After (ESM)
import Encore from '@​symfony/webpack-encore';
// ...
export default await Encore.getWebpackConfig();

    Note: Encore.getWebpackConfig() is now async and returns a Promise. Use await at the top level of your webpack config (webpack supports async config files natively).

  • If you prefer not to add "type": "module", rename your webpack config to webpack.config.mjs instead; webpack detects the .mjs extension and treats it as ESM automatically.

  • Replace __dirname and __filename with their ESM equivalents in your webpack config:

    // Before (CJS)
path.resolve(__dirname, 'src/utilities/');
config: [__filename];
// After (ESM)
path.resolve(import.meta.dirname, 'src/utilities/');
config: [import.meta.filename];

... (truncated)

Commits
  • a995eff Tagging 7.2.0
  • da6a33b bug #1520 Recommend the project's package manager for missing dependency erro...
  • 0f0389e Recommend the project's package manager for missing dependency errors
  • 09800d2 feature #1523 Add support for webpack-dev-server ^6.0.0 (Kocal)
  • eb48ad3 Add support for webpack-dev-server ^6.0.0
  • 5198083 feature #1503 Migrate project to TypeScript ✨ (Kocal)
  • 53a691a [TypeScript] Improve public API configuration option types (#1521)
  • bbebcee Minor improvements
  • c1e0ecc [TypeScript] Use .js import specifiers and drop TS-extension tsconfig options...
  • 283f574 [TypeScript] Migrate index.js (#1511)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by kocal, a new releaser for @​symfony/webpack-encore since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates workbox-webpack-plugin from 6.6.0 to 7.4.1

Release notes

Sourced from workbox-webpack-plugin's releases.

Workbox v7.4.1

What's Changed

New Contributors

Full Changelog: GoogleChrome/workbox@v7.4.0...v7.4.1

Workbox v7.4.0

v7.4.0

  • Critical dependency updates.

Workbox v7.3.0

v7.3.0

  • Critical dependency updates.

v7.1.0

What's Changed ✏️

... (truncated)

Commits
  • 62b9d8b v7.4.1
  • b6b696c Merge pull request #3510 from GoogleChrome/chore/update-lock-file
  • 6524a7d Update test
  • 9a57e39 Run npm audit fix
  • 86035d8 Update lock file
  • c75363a Merge pull request #3508 from GoogleChrome/dependabot/github_actions/github/c...
  • 85383d6 Merge pull request #3507 from GoogleChrome/dependabot/npm_and_yarn/apideck/be...
  • a1cdb47 Bump github/codeql-action from 4 to 4.35.2
  • 05b276d Bump @​apideck/better-ajv-errors from 0.3.1 to 0.3.7
  • 8e6df29 Merge pull request #3489 from rtritto/replace-lodash
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by swissspidy, a new releaser for workbox-webpack-plugin since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file 🧹 Chore labels Oct 24, 2026
@dependabot dependabot Bot mentioned this pull request Oct 24, 2026
Closed
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-b4d66dfb8f branch from 2de16c1 to 49dfb2f Compare October 24, 2026 14:57
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-b4d66dfb8f branch 2 times, most recently from d883553 to 65e4fcf Compare October 24, 2026 16:08
@dependabot
chore(deps): bump serialize-javascript, @symfony/webpack-encore and w…
2bd06da 
…orkbox-webpack-plugin

Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) to 7.1.4 and updates ancestor dependencies [serialize-javascript](https://github.com/yahoo/serialize-javascript), [@symfony/webpack-encore](https://github.com/symfony/webpack-encore) and [workbox-webpack-plugin](https://github.com/googlechrome/workbox). These dependencies need to be updated together.


Updates `serialize-javascript` from 4.0.0 to 7.1.4
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v4.0.0...v7.1.4)

Updates `@symfony/webpack-encore` from 1.8.2 to 7.2.0
- [Release notes](https://github.com/symfony/webpack-encore/releases)
- [Changelog](https://github.com/symfony/webpack-encore/blob/main/CHANGELOG.md)
- [Upgrade guide](https://github.com/symfony/webpack-encore/blob/main/UPGRADE.md)
- [Commits](symfony/webpack-encore@v1.8.2...v7.2.0)

Updates `workbox-webpack-plugin` from 6.6.0 to 7.4.1
- [Release notes](https://github.com/googlechrome/workbox/releases)
- [Commits](GoogleChrome/workbox@v6.6.0...v7.4.1)

---
updated-dependencies:
- dependency-name: "@symfony/webpack-encore"
  dependency-version: 7.2.0
  dependency-type: direct:development
- dependency-name: serialize-javascript
  dependency-version: 7.1.4
  dependency-type: indirect
- dependency-name: workbox-webpack-plugin
  dependency-version: 7.4.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-b4d66dfb8f branch from 65e4fcf to 2bd06da Compare October 24, 2026 16:11

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

🧹 Chore dependencies Pull requests that update a dependency file Vue 3

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bobvandevijver