What's Changed

• Fix methods containing nested functions and arrows by @Shubham-Padkonde in #231
• docs: add SECURITY.md by @redonkulus in #237
• release: v7.1.4 by @redonkulus in #238

Note on method serialization

Concise methods ({ m() {} }), including async, generator and computed-key methods, are now serialized correctly when their bodies contain a nested arrow function or function declaration. Previously these were emitted unchanged, producing invalid output that failed to deserialize (#118). Class expressions continue to be emitted as-is.

Reporting security issues

This repo now has a security policy. Please report vulnerabilities privately through GitHub's private vulnerability reporting rather than public issues.

Full Changelog: v7.1.3...v7.1.4

See: GHSA-m5mm-p8h7-m29v

What's Changed

• fix: escape </script at the end of a serialized function body by @redonkulus in #235
• Fix serialization of Dates with expanded ISO years by @Shubham-Padkonde in #232
• fix: ignore functions without mutating input objects by @Shubham-Padkonde in #233
• release: v7.1.3 by @redonkulus in #236

Note on ignoreFunction

With ignoreFunction: true, function values are now omitted the same way JSON.stringify omits them, without deleting them from the input object. Functions inside arrays are emitted as null (previously this produced Array.prototype.slice.call(...) output).

New Contributors

• @Shubham-Padkonde made their first contribution in #232

Full Changelog: v7.1.2...v7.1.3

See: GHSA-gfhx-hw2g-v5hg

What's Changed

• fix: fix XSS bypass via split </script payload across function bodies by @okuryu in #226
• release: v7.1.1 by @okuryu in #227

Full Changelog: v7.1.0...v7.1.1

What's Changed

• feat: add Node.js 26 to test matrix by @okuryu in #224
• release: v7.1.0 by @okuryu in #225

Full Changelog: v7.0.7...v7.1.0

What's Changed

• fix: reject spoofed RegExp objects with non-string source property by @redonkulus in #222
• release: v7.0.7 by @okuryu in #223

Full Changelog: v7.0.6...v7.0.7

What's Changed

• build(deps-dev): bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in #215
• fix: reject spoofed URL objects with non-string toString() result by @redonkulus in #217
• release: v7.0.6 by @okuryu in #221

Full Changelog: v7.0.5...v7.0.6

Fixes

• Improve robustness and validation for array-like object serialization.
• Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

What's Changed

• release: v7.0.4 by @okuryu in #211

Full Changelog: v7.0.3...v7.0.4

• fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString (#207) 2e609d0
• build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (#206) 42b7cdb

v7.0.2...v7.0.3