v7.1.0

What's Changed

• feat: add Node.js 26 to test matrix by @okuryu in #224
• release: v7.1.0 by @okuryu in #225

Full Changelog: v7.0.7...v7.1.0

v7.0.7

What's Changed

• fix: reject spoofed RegExp objects with non-string source property by @redonkulus in #222
• release: v7.0.7 by @okuryu in #223

Full Changelog: v7.0.6...v7.0.7

v7.0.6

What's Changed

• build(deps-dev): bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in #215
• fix: reject spoofed URL objects with non-string toString() result by @redonkulus in #217
• release: v7.0.6 by @okuryu in #221

Full Changelog: v7.0.5...v7.0.6

v7.0.5

Fixes

• Improve robustness and validation for array-like object serialization.
• Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

v7.0.4

What's Changed

• release: v7.0.4 by @okuryu in #211

Full Changelog: v7.0.3...v7.0.4

v7.0.3

• fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString (#207) 2e609d0
• build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (#206) 42b7cdb

---

v7.0.2...v7.0.3

v7.0.2

What's Changed

• ci: bump GitHub Actions to latest versions by @okuryu in #203
• ci: setup trusted publishing workflow by @okuryu in #204
• release: v7.0.2 by @okuryu in #205

Full Changelog: v7.0.1...v7.0.2

v7.0.1

What's Changed

• Add warning about using this package to send arbitrary data to worker threads by @valadaptive in #200
• security: sanitize function bodies by @redonkulus in #199
• docs: tweak README by @okuryu in #201
• release: v7.0.1 by @okuryu in #202

New Contributors

• @redonkulus made their first contribution in #199

Full Changelog: v7.0.0...v7.0.1

v7.0.0

Breaking Changes

• requires Node.js v20+

What's Changed

• Bump mocha from 10.2.0 to 10.4.0 by @dependabot[bot] in #178
• Bump mocha from 10.4.0 to 10.5.2 by @dependabot[bot] in #183
• Bump nyc from 15.1.0 to 17.0.0 by @dependabot[bot] in #184
• Bump braces from 3.0.2 to 3.0.3 by @dependabot[bot] in #181
• Bump mocha from 10.5.2 to 10.7.0 by @dependabot[bot] in #185
• Bump mocha from 10.7.0 to 10.7.3 by @dependabot[bot] in #186
• Bump nyc from 17.0.0 to 17.1.0 by @dependabot[bot] in #187
• Bump mocha from 10.7.3 to 10.8.2 by @dependabot[bot] in #188
• feat: test on Node.js 22 and built-in test runner by @okuryu in #192
• Generate UID without randombytes dependency by @valadaptive in #196
• release: v7.0.0 by @okuryu in #197

New Contributors

• @valadaptive made their first contribution in #196

Full Changelog: v6.0.2...v7.0.0

v6.0.2

• fix: serialize URL string contents to prevent XSS (#173) f27d65d
• Bump @babel/traverse from 7.10.1 to 7.23.7 (#171) 02499c0
• docs: update readme with URL support (#146) 0d88527
• chore: update node version and lock file e2a3a91
• fix typo (#164) 5a1fa64

v6.0.1...v6.0.2