chore(deps)!: upgrade serialize-javascript to v7 and node to v20

[dargmuesli]

Summary

Upgrade serialize-javascript to v7 to resolve GHSA-5c6j-r48x-rmvq

What kind of change does this PR introduce?

Chore.
Resolves #644

Did you add tests for your changes?

no

Does this PR introduce a breaking change?

drop support for EOL node versions

If relevant, what needs to be documented once your changes are merged or what have you already documented?

Minimum support node js version maybe.

Use of AI

nope

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: dargmuesli / name: Jonas Thelemann (903594c)

[evenstensberg]

We need to discuss this because we try to support the most oldest node versions based on that people use legacy deps. Thanks for the PR!

[olivier1980]

We need to discuss this because we try to support the most oldest node versions based on that people use legacy deps. Thanks for the PR!

Is this pacakge dead now because you cant do security upgrades because of legacy node?

[G-Rath]

I think one of the better paths forward would be for webpack to fork the package, though I'd be happy to do that if they'd prefer not to have it under their org

[jrmhaig]

We need to discuss this because we try to support the most oldest node versions based on that people use legacy deps. Thanks for the PR!

Would it therefore make sense to create a new major version, 6, that drops support for older node versions and then, if support for older versions is necessary, backport any changes to version 5 as necessary?

[tats-u]

You can bump the major version if you are careful of breaking changes.

[alexander-akait]

We can't it is a breaking change for webpack

[taylorreece]

There's a PR to backport the fix to serialize-javascript v6 - might be worth waiting for that to deploy, and then bump this package's dep to the patched 6.x version yahoo/serialize-javascript#209

[tats-u]

I heard that npm does not respect the engines field when it selects a version of a package. We will not be able to avoid breaking changes.