build(deps): bump serialize-javascript, nuxt and webpack

[dependabot]

Bumps serialize-javascript to 6.0.2 and updates ancestor dependencies serialize-javascript, nuxt and webpack. These dependencies need to be updated together.

Updates serialize-javascript from 6.0.1 to 6.0.2

Release notes

Sourced from serialize-javascript's releases.

v6.0.2

• fix: serialize URL string contents to prevent XSS (#173) f27d65d
• Bump @​babel/traverse from 7.10.1 to 7.23.7 (#171) 02499c0
• docs: update readme with URL support (#146) 0d88527
• chore: update node version and lock file e2a3a91
• fix typo (#164) 5a1fa64

yahoo/serialize-javascript@v6.0.1...v6.0.2

Commits

• b71ec23 6.0.2
• f27d65d fix: serialize URL string contents to prevent XSS (#173)
• 02499c0 Bump @​babel/traverse from 7.10.1 to 7.23.7 (#171)
• 0d88527 docs: update readme with URL support (#146)
• e2a3a91 chore: update node version and lock file
• 5a1fa64 fix typo (#164)
• See full diff in compare view

Updates nuxt from 2.17.2 to 3.15.4

Release notes

Sourced from nuxt's releases.

v3.15.4

3.15.4 is the next patch release.

✅ Upgrading

As usual, our recommendation for upgrading is to run:

npx nuxi@latest upgrade --force

This will refresh your lockfile as well, and ensures that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

👉 Changelog

compare changes

🩹 Fixes

• nuxt: Improve error logging when parsing with acorn (#30754)
• nuxt: Clear island uid before saving into the payload (#30767)
• kit: Load @nuxt/schema from nuxt package dir (#30774)
• nuxt: Allow restarting nuxt on paths outside srcDir (#30771)
• nuxt: Don't warn about calling useRoute in SFC setup (#30788)
• webpack: Disallow cross-site requests in no-cors mode (#30757)
• vite: Restore externality for dev server externals (#30802)

💅 Refactors

• vite: Use new rollup chunk.names for asset names (#30780)

❤️ Contributors

• Daniel Roe (@​danielroe)
• Peter Radko (@​Gwynerva)
• Lansi (@​lansi951)
• Julien Huang (@​huang-julien)
• Norbiros (@​Norbiros)

v3.15.3

3.15.3 is the next regularly scheduled patch release.

👀 Highlights

CORS configuration for dev server

Alongside a range of improvements, we've also shipped a significant fix to impose CORS origin restrictions on the dev server. This applies to your Vite or Webpack/Rspack dev middleware only.

This is a significant/breaking change we would not normally ship in a patch but it is a security fix (see GHSA-4gf7-ff8x-hq99 and GHSA-2452-6xj8-jh47) and we urge you to update ASAP.

You can configure the allowed origins and other CORS options via the devServer.cors options in your nuxt.config, which may be relevant if you are developing with a custom hostname:

export default defineNuxtConfig({
</tr></table> 

... (truncated)

Commits

• 244da17 v3.15.4
• ceaf0f5 chore(deps): update all non-major dependencies (3.x) (#30804)
• 626eba0 fix(nuxt): don't warn about calling useRoute in SFC setup (#30788)
• 7a1e5c8 fix(nuxt): allow restarting nuxt on paths outside srcDir (#30771)
• ca2d91f fix(kit): load @nuxt/schema from nuxt package dir (#30774)
• b78da56 fix(nuxt): clear island uid before saving into the payload (#30767)
• e0c47f9 fix(nuxt): improve error logging when parsing with acorn (#30754)
• 940bcb8 chore(deps): update all non-major dependencies (3.x) (#30747)
• 048f974 v3.15.3
• e96a96d perf(nuxt): enable Transition component only on client side (#30720)
• Additional commits viewable in compare view

Updates webpack from 4.47.0 to 5.98.0

Release notes

Sourced from webpack's releases.

v5.98.0

Fixes

• Avoid the deprecation message #19062 by @​alexander-akait
• Should not escape CSS local ident in JS #19060 by @​JSerFeng
• MF parse range not compatible with Safari #19083 by @​alexander-akait
• Preserve filenameTemplate in new split chunk #19104 by @​henryqdineen
• Use module IDs for final render order #19184 by @​dmichon-msft
• Strip blob: protocol when public path is auto #19199 by @​alexander-akait
• Respect output.charset everywhere #19202 by @​alexander-akait
• Node async WASM loader generation #19210 by @​ashi009
• Correct BuildInfo and BuildMeta type definitions #19200 by @​inottn

Performance Improvements

• Improve FlagDependencyExportsPlugin for large JSON by depth #19058 by @​hai-x
• Optimize assign-depths #19193 by @​dmichon-msft
• Use startsWith for matching instead of converting the string to a regex #19207 by @​inottn

Chores

• Bump nanoid from 3.3.7 to 3.3.8 #19063 by @​dependabot
• Fixed incorrect typecast in DefaultStatsFactoryPlugin #19156 by @​Andarist
• Improved readme.md by adding video links for understanding webpack #19101 by @​Vansh5632
• Typo fix #19205 by @​hai-x
• Adopt the new webpack governance model #18804 by @​ovflowd

Features

• Implement /* webpackIgnore: true */ for require.resolve #19201 by @​alexander-akait

Continuous Integration

• CI fix #19196 by @​alexander-akait

New Contributors

• @​Andarist made their first contribution in webpack/webpack#19156
• @​Vansh5632 made their first contribution in webpack/webpack#19101
• @​ashi009 made their first contribution in webpack/webpack#19210
• @​ovflowd made their first contribution in webpack/webpack#18804

Full Changelog: webpack/webpack@v5.97.1...v5.98.0

v5.97.1

Bug Fixes

• Performance regression
• Sub define key should't be renamed when it's a defined variable

v5.97.0

Bug Fixes

• Don't crash with filesystem cache and unknown scheme
• Generate a valid code when output.iife is true and output.library.type is umd
• Fixed conflict variable name with concatenate modules and runtime code
• Merge duplicate chunks before

... (truncated)

Commits

• f1bdec5 5.98.0
• 9579f22 chore: adopt the new webpack governance model (#18804)
• a1edb20 fix: node async wasm loader now use output.module to determinate code gener...
• e55b08b perf: use startsWith for matching instead of converting the string to a regex
• 6e14dba chore: fix typo (#19205)
• f123ce5 fix: respect output.charset everywhere (#19202)
• af20c7b fix: strip blob: protocol when public path is auto (#19199)
• 80826c5 feat: implement /* webpackIgnore: true */ for require.resolve (#19201)
• ac6ffca fix(types): correct BuildInfo and BuildMeta type definitions (#19200)
• 8ac130a ci: fix
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 10a7c74

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.