[ValgulNecron]

Summary

Fixes Dependabot alerts #29 (script injection through RegExp sources, patched in 1.6.10) and #30 (code injection through a typed array's own constructor property, patched in 1.6.11). Dependabot timed out on both.

seroval 1.6.8 came in through @tanstack/react-router 1.170.44 > @tanstack/router-core 1.171.37, which already allows seroval ^1.6.7. Regenerating the lockfile (npm update seroval seroval-plugins) is enough, so no override and no router bump is needed:

• seroval 1.6.8 → 1.7.5
• seroval-plugins 1.6.8 → 1.7.6
• npm also dropped a duplicate nested node_modules/eslint/node_modules/@eslint/js 9.39.5, identical to the root copy (ESLint stays on 9).

Only web/package-lock.json changes. web/Dockerfile is untouched (PR #816 owns it); its node:26 base meets seroval's new node >=20 engine.

Exploitability

Not exploitable in Gameplane. seroval is used only by router-core's SSR serializer (router-core/dist/esm/ssr/). The dashboard is a client-only Vite SPA: web/src has no SSR, dehydration or seroval imports, and it never serializes RegExps or typed arrays through seroval. A production build contains no seroval code.

Verification

• npx tsc --noEmit passes; npm run build succeeds.
• Tests and lint run in CI.

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• web/package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: GameplanePanel/Gameplane
• Branch: fix/seroval-1.6.11
• File: .coderabbit.yaml
• Commit: 4a57c4b
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 36fc8cdd-620d-46ef-ae10-54810e9b176f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CI Report - 4a57c4b

run 41150202303 - attempt 1

0 failed - 10 passed - 23 skipped - 27m48s elapsed

Test selection: partial - per-suite table

Coverage

Module	Measured	Gate	Margin
web	L95.87 S94.37 B89.27 F91.79	L92 S92 B82 F76	+2.37

Changed

Area	Files	+/-
web/	1	+8/-21

Slowest jobs

Job	Duration
build e2e images	15m37s
build e2e images (arm64)	11m29s
e2e web live / amd64 (kind)	10m18s
web	9m50s
e2e web live / arm64 (kind)	9m24s

e2e buckets run

multicluster, upgrade