fix(deps): patch serialize-javascript vulnerability

package.json

@@ -5,7 +5,7 @@
   },
   "pnpm": {
     "overrides": {
-      "serialize-javascript": "7.0.4"
+      "serialize-javascript": "7.0.5"
     }
   },
   "private": true,

pnpm-lock.yaml

@@ -5,7 +5,7 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
-  serialize-javascript: 7.0.4
+  serialize-javascript: 7.0.5
 
 importers:
 
@@ -1474,8 +1474,8 @@ packages:
     resolution: {integrity: sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==}
     engines: {node: '>= 18'}
 
-  serialize-javascript@7.0.4:
+  serialize-javascript@7.0.5:
-    resolution: {integrity: sha512-DuGdB+Po43Q5Jxwpzt1lhyFSYKryqoNjQSA9M92tyw0lyHIOur+XCalOUe0KTJpyqzT8+fQ5A0Jf7vCx/NKmIg==}
+    resolution: {integrity: sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw==}
     engines: {node: '>=20.0.0'}
 
   serve-placeholder@2.0.2:
@@ -2068,7 +2068,7 @@ snapshots:
 
   '@rollup/plugin-terser@0.4.4(rollup@4.59.0)':
     dependencies:
-      serialize-javascript: 7.0.4
+      serialize-javascript: 7.0.5
       smob: 1.6.1
       terser: 5.46.1
     optionalDependencies:
@@ -3145,7 +3145,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  serialize-javascript@7.0.4: {}
+  serialize-javascript@7.0.5: {}
 
   serve-placeholder@2.0.2:
     dependencies:

tests/dependency-security.test.mjs

@@ -0,0 +1,15 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+
+test('serialize-javascript is patched for CVE-2026-34043', async () => {
+  const packageJson = JSON.parse(
+    await readFile(new URL('../node_modules/serialize-javascript/package.json', import.meta.url), 'utf8'),
+  );
+
+  assert.equal(
+    packageJson.version,
+    '7.0.5',
+    'serialize-javascript must be upgraded to 7.0.5 or later',
+  );
+});