See: GHSA-gfhx-hw2g-v5hg

What's Changed

• fix: fix XSS bypass via split </script payload across function bodies by @okuryu in #226
• release: v7.1.1 by @okuryu in #227

Full Changelog: v7.1.0...v7.1.1

What's Changed

• feat: add Node.js 26 to test matrix by @okuryu in #224
• release: v7.1.0 by @okuryu in #225

Full Changelog: v7.0.7...v7.1.0

What's Changed

• fix: reject spoofed RegExp objects with non-string source property by @redonkulus in #222
• release: v7.0.7 by @okuryu in #223

Full Changelog: v7.0.6...v7.0.7

What's Changed

• build(deps-dev): bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in #215
• fix: reject spoofed URL objects with non-string toString() result by @redonkulus in #217
• release: v7.0.6 by @okuryu in #221

Full Changelog: v7.0.5...v7.0.6

Fixes

• Improve robustness and validation for array-like object serialization.
• Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

What's Changed

• release: v7.0.4 by @okuryu in #211

Full Changelog: v7.0.3...v7.0.4

• fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString (#207) 2e609d0
• build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (#206) 42b7cdb

v7.0.2...v7.0.3

What's Changed

• ci: bump GitHub Actions to latest versions by @okuryu in #203
• ci: setup trusted publishing workflow by @okuryu in #204
• release: v7.0.2 by @okuryu in #205

Full Changelog: v7.0.1...v7.0.2

What's Changed

• Add warning about using this package to send arbitrary data to worker threads by @valadaptive in #200
• security: sanitize function bodies by @redonkulus in #199
• docs: tweak README by @okuryu in #201
• release: v7.0.1 by @okuryu in #202

New Contributors

• @redonkulus made their first contribution in #199

Full Changelog: v7.0.0...v7.0.1