build(deps-dev): bump serve from 14.2.5 to 14.2.6

[dependabot]

Bumps serve from 14.2.5 to 14.2.6.

Release notes

Sourced from serve's releases.

v14.2.6

Patch Changes

• 7fcb924: Bump ajv to 8.18.0
• b3888f9: Update serve-handler to 6.1.7 to fix ReDoS vulnerabilities

Changelog

Sourced from serve's changelog.

14.2.6

Patch Changes

• 7fcb924: Bump ajv to 8.18.0
• b3888f9: Update serve-handler to 6.1.7 to fix ReDoS vulnerabilities

Commits

• f3c702c Version Packages (#846)
• 7fcb924 Add changeset for #842
• a2fecb3 chore(deps): update ajv to v8.18.0 (#842)
• b3888f9 Bump serve-handler to 6.1.7 (#845)
• See full diff in compare view

[sanrai]

@dependabot rebase

[github-actions]

🧪 Feature QA review — injected feature test (advisory, non-blocking)

Last updated Sep 10, 2026, 12:55 PM PT · commit 9ba286a · pull_request.

Overall: SAFE (no bundle change)

No injectable feature to exercise — and the deterministic build-output-diff proves the shipped bundle is byte-identical to base after normalization, so this change is safe for what ships.

This PR only bumps a dev-dependency (serve) version in package.json/package-lock.json with no changes to CaaS config, card data, or UI behavior to exercise.

Screenshot in the workflow run.

Review history (4 runs)

• Sep 10, 2026, 12:55 PM PT · SAFE (no bundle change) · 9ba286a · pull_request
• Sep 10, 2026, 11:58 AM PT · SAFE (no bundle change) · 19860eb · pull_request
• Sep 4, 2026, 2:13 AM PT · SAFE (no bundle change) · ffb3907 · pull_request
• Aug 26, 2026, 10:43 PM PT · SAFE (no bundle change) · a84aac6 · pull_request

[github-actions]

AI Code Review

Last updated Sep 10, 2026 12:54 PM PDT · new commit pushed · commit f86cc95 · 2 files changed in PR.

0 open · 0 resolved

Open findings

No open findings. ✅

Review history (4 runs)

• f86cc95 · Sep 10, 2026 12:54 PM PDT · new commit pushed · no changes (0 open) — Merge branch 'main' into dependabot/npm_and_yarn/serve-14.2.6
• b42c455 · Sep 10, 2026 12:02 PM PDT · new commit pushed · no changes (0 open) — Merge branch 'main' into dependabot/npm_and_yarn/serve-14.2.6
• 430dd96 · Sep 4, 2026 1:49 AM PDT · new commit pushed · no changes (0 open) — build(deps-dev): bump serve from 14.2.5 to 14.2.6
• a7e58f2 · Aug 26, 2026 10:43 PM PDT · new commit pushed · no changes (0 open) — build(deps-dev): bump serve from 14.2.5 to 14.2.6

[github-actions]

Agent QA review — interactive + visual diff (advisory, non-blocking)

Last updated Sep 10, 2026, 12:06 PM PDT · new commit pushed · commit b42c455 · 2 files changed.

0 open · 0 resolved · visual diff 0.00% · verdict PASS

Open findings

• Smoke test passed ✅

What the agent checked

Tested PR #594 (devDependency bump of serve 14.2.5 → 14.2.6, used only for local dev serving; not part of the production/CaaS client bundle) against the live business.adobe.com/resources/main.html page.

Pixel diff of PR build vs stable build was 0.00% and the diff overlay image showed no magenta/highlighted regions - consistent with expectations since this change only touches a devDependency (serve) and its transitive deps (ajv, serve-handler, minimatch), none of which ship in the runtime CaaS bundle.

Live-page manual QA performed:

• Page loads correctly: header, breadcrumb, hero, "Explore all Adobe resources" section, and CardsGrid all render normally with images, headlines, descriptions, and CTAs intact (e.g. "The NFL cuts content creation..." and "Virtual Create Now" cards displayed correctly).
• Left filter panel ("Refine Your Results") renders correctly with Search field, Clear button, and expandable Products/Content type/Industry filter groups.
• Typed "AI" into the search filter input - text entry worked and displayed correctly in the field, "Clear Search filter" (x) button appeared. Result count (3888 results) did not change after typing, but this is pre-existing site search behavior unrelated to the PR's code diff (package.json/package-lock.json only) and not something this dependency bump could affect.
• Clicked "Products" filter accordion - expanded to show checkbox list (Acrobat, Acrobat Sign, Advertising, Analytics, Brand Visibility, Campaign, Commerce, Creative Cloud, Experience Manager, etc.) without layout issues.
• run_axe on the LeftFilters panel: 0 violations, 20 passes, 0 incomplete.
• get_console_errors: two 404s for some resource, but no JS errors/crashes; these are pre-existing on the base site and not related to the serve devDependency bump.

Conclusion: This PR is a pure devDependency version bump (build tooling only) with no code path into the deployed CaaS bundle. No visual regressions, no accessibility violations, no console errors attributable to this change, and core interactive elements (search input, filter accordions, cards grid) all function as expected. Matches the 0.00% pixel diff result.

PR / stable / diff screenshots + console + axe artifacts in the workflow run.

Review history (2 runs)

• b42c455 · Sep 10, 2026, 12:06 PM PDT · new commit pushed · passing, no regressions — Merge branch 'main' into dependabot/npm_and_yarn/serve-14.2.
• a7e58f2 · Aug 26, 2026, 10:52 PM PDT · new commit pushed · passing, no regressions — build(deps-dev): bump serve from 14.2.5 to 14.2.6

[sanrai]

@dependabot rebase