deps: override seroval to ^1.5.3 for CVE-2026-59940

[pedrogaudencio]

• pin seroval/seroval-plugins via pnpm.overrides, lifting the transitive asciinema-player > solid-js > seroval@1.3.2 to 1.5.5.
• vulnerable fromJSON() was unreachable: no first-party call sites, and solid-js imports only serializer APIs in its SSR-only entry, which this Go-served app never bundles.

Fixes seroval: seroval.fromJSON() Promise resolver type confusion invokes attacker-controlled methods during deserialization

AI Disclosure

Co-authored with: Opus 5

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm seroval is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/asciinema-player@3.10.0 → npm/seroval@1.5.5 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/seroval@1.5.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Copilot]

Pull request overview

Updates the frontend dependency graph to mitigate CVE-2026-59940 by forcing seroval and seroval-plugins to resolve to a safe version range via pnpm.overrides, ensuring transitive consumers (e.g., solid-js) no longer pull seroval@1.3.2.

Changes:

• Added pnpm.overrides entries for seroval and seroval-plugins (^1.5.3) in package.json.
• Regenerated pnpm-lock.yaml to reflect resolution to seroval@1.5.5 / seroval-plugins@1.5.5 and updated related snapshot entries.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Adds pnpm.overrides for seroval and seroval-plugins to enforce upgraded transitive resolution.
pnpm-lock.yaml	Locks the overridden packages to 1.5.5 and updates the dependency snapshots (including solid-js) accordingly.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[pedrogaudencio]

/review

---

AI review started.

[github-actions]

Advanced AI Review

• Type: Agentic (crush)
• Model: glm-5.2

Click to expand review

I reviewed the change thoroughly, verifying the security claims, dependency tree, lockfile consistency, and reachability of the vulnerable code.

Verification performed

• Patched version is correct: CVE-2026-59940 (GHSA-mv8w-475r-vwqw, CVSS 9.8) is fixed in seroval 1.5.3. The override floor ^1.5.3 is correct, and the lockfile resolves it to 1.5.5 (pnpm-lock.yaml:4280, pnpm-lock.yaml:9059).
• No vulnerable versions remain: the lockfile contains only seroval@1.5.5 and seroval-plugins@1.5.5; the old seroval@1.3.2 / seroval-plugins@1.3.3 are fully removed.
• Dependency chain is accurate: asciinema-player@3.10.0 → solid-js@1.9.9 → seroval/seroval-plugins (pnpm-lock.yaml:6615-6618, pnpm-lock.yaml:9089-9093), matching the PR description.
• Reachability claim is accurate: no first-party call sites of seroval.fromJSON() exist anywhere in web_src/ (grep for fromJSON/seroval in *.ts returns nothing), and there are no first-party solid-js imports.
• Both overrides are necessary: overriding only seroval would have left seroval-plugins@1.3.3 in place (its pre-fix peer range was seroval: ^1.0). Pinning both keeps the pair in sync — correct defensive practice.
• Formatting is consistent: the two new entries are correctly alphabetized (safer-buffer < seroval < string.prototype.includes) and the override syntax (bare range vs. npm: alias) is the idiomatic pnpm form for a version-floor override.

Findings

The code change itself (the two lines added to package.json and the regenerated lockfile) is correct and complete. I found no 🔴 or 🟡 issues — no bugs, security gaps, DRY violations, simplification opportunities, spelling/grammar problems, or naming issues in the actual code.

1. ⚪️ PR/commit title omits seroval-plugins

• Addressed
• Dismissed

The title is deps: override seroval to ^1.5.3 for CVE-2026-59940, but the change overrides two packages:

"seroval": "^1.5.3",
"seroval-plugins": "^1.5.3",

(package.json:139-140)

This is a minor discoverability concern rather than a code defect: someone auditing dependency history for seroval-plugins won't find this commit by title alone. A more precise title would be:

deps: override seroval and seroval-plugins to ^1.5.3 for CVE-2026-59940

No code changes are required for this PR — it is a sound, complete fix for the advisory.

---

Review generated using glm-5.2 via Z.AI. Comment /review to re-run.

[pedrogaudencio]

@taoeffect approved! ✅