feat(deps): BREAKING CHANGE Resolve serialize-javascript to ^7.0.3 and drop Node 18

[jfox-box]

Summary by CodeRabbit

• Chores
  • Added a dependency resolution to address a specific package version, improving build stability and reducing potential runtime issues.
• Compatibility
  • Updated supported Node.js versions: removed older Node 18 support and now require newer Node 20 or 22 runtimes, affecting environment compatibility.

[coderabbitai]

Walkthrough

Updated package.json: removed >=18.x from engines.node (now ^20.x || ^22.x) and added a top-level resolutions entry for serialize-javascript pinned to ^7.0.3.

Changes

Cohort / File(s)	Summary
Package manifest package.json	Removed >=18.x from engines.node (now `^20.x

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• box/box-ui-elements#4386 — Also modifies the top-level resolutions in package.json (pins a transitive dependency), touching the same area.

Suggested reviewers

• tjuanitas
• reneshen0328
• jpan-box

Poem

🐇 A nibble here, a careful pin,
One version set to keep builds in,
Node trimmed to twenty and twenty-two,
serialize-javascript now fixed too,
Hops of code—steady, snug, and grin.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description contains only boilerplate template content about the ready-to-merge label and Mergify process, with no actual explanation of the changes made.	Add a meaningful description explaining why the serialize-javascript resolution is needed, what problem it solves, and any relevant context about the Node.js engine version changes.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The PR title mentions both the serialize-javascript resolution and Node 18 dropping, matching the actual changes in the changeset.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch bump-serialize-javascript-resolution-7.0.3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[mergify]

Merge Queue Status

Rule: Automatic strict merge

---

• ✅ Entered queue — 2026-03-06 02:24 UTC
• 🚫 Left the queue — 2026-03-06 06:29 UTC · at 644656865bfbf18c6a971a7ee27d8be8ecbbe05d

This pull request spent 4 hours 4 minutes 49 seconds in the queue, with no time running CI.

Reason

The pull request #4469 has been manually updated

Hint

If you want to requeue this pull request, you can post a @mergifyio queue comment.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Line 361: The forced resolutions entry pinning "serialize-javascript" to
"^7.0.3" is incompatible with Node 18; either relax the resolution to a v6.x
range compatible with Node 18 (e.g., "serialize-javascript": "^6.0.0") or update
the package.json engines.node field to remove Node 18 support (e.g., bump to
">=20.x || ^22.x"); update the "resolutions" entry that references
serialize-javascript or the "engines.node" value in package.json accordingly and
ensure any lockfile is regenerated so the chosen version is installed.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 51a794e8-47c2-4d86-bdfc-22bc738bd958

📥 Commits

Reviewing files that changed from the base of the PR and between 6446568 and b2aea4c.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• package.json