security vulnerability in downstream dependency (serialize-javascript@6.0.2)

[trimble]

Snyk reports a vulnerability down the dependency chain:

Arbitrary Code Injection [High Severity][https://security.snyk.io/vuln/SNYK-JS-SERIALIZEJAVASCRIPT-570062] in serialize-javascript@6.0.2
    introduced by nuxt@4.3.1 > @nuxt/nitro-server@4.3.1 > nitropack@2.13.1 > @rollup/plugin-terser@0.4.4 > serialize-javascript@6.0.2

serialize-javascript has been updated to 7.0.4: https://www.npmjs.com/package/serialize-javascript/v/7.0.4
@rollup/plugin-terser has been updated to 1.0.0: https://www.npmjs.com/package/@rollup/plugin-terser/v/1.0.0
nitropack has an open issue: nitrojs/nitro#4074

[danielroe]

this isn't applicable to this project and shouldn't be raised here.

[trimble]

If pnpm-lock.yaml contains that chain of specific dependency versions, is an update necessary to update to the newer versions once the update bubbles up the chain?

[danielroe]

no. you just refresh your lockfile.