From 4a57c4baa25cb16c0f35d4f6897664f604b80455 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sat, 31 Oct 2026 00:26:31 +0000
Subject: [PATCH] fix(web): bump seroval to 1.7.5 for Dependabot alerts #29 and
 #30

seroval 1.6.8 (via @tanstack/react-router > @tanstack/router-core) is
affected by GHSA script injection through RegExp sources (< 1.6.10) and
code injection through a typed array's constructor property (< 1.6.11).
router-core already allows ^1.6.7, so regenerating the lockfile is
enough: seroval 1.7.5 and seroval-plugins 1.7.6. npm also dropped a
duplicate nested @eslint/js 9.39.5 that matches the root copy.

Not exploitable here: seroval is only used by router-core's SSR
serializer, the dashboard is a client-only SPA, and no seroval code
ends up in the production bundle.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Claude <noreply@anthropic.com>
---
 web/package-lock.json | 29 ++++++++---------------------
 1 file changed, 8 insertions(+), 21 deletions(-)

diff --git a/web/package-lock.json b/web/package-lock.json
index 6f21c289d..731d83335 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -5423,19 +5423,6 @@
         "url": "https://opencollective.com/eslint"
       }
     },
-    "node_modules/eslint/node_modules/@eslint/js": {
-      "version": "9.39.5",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.5.tgz",
-      "integrity": "sha512-QywQuszQh77pIXCsq998c8hbhSTI/azTty1Z6N53dmAudKHhy573j3yvRLsX2BSp8YpLtoCEG8E9DJe+8zUh4A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://eslint.org/donate"
-      }
-    },
     "node_modules/eslint/node_modules/balanced-match": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
@@ -8237,21 +8224,21 @@
       }
     },
     "node_modules/seroval": {
-      "version": "1.6.8",
-      "resolved": "https://registry.npmjs.org/seroval/-/seroval-1.6.8.tgz",
-      "integrity": "sha512-HlSgSAkTk4EqHcje1ptJjfZi1YDv5KbhVJ/d3P7T/nAXua2VmDu+AKDX5VTdFfZf48nDkWB2TKYt0DrCSa+3wg==",
+      "version": "1.7.5",
+      "resolved": "https://registry.npmjs.org/seroval/-/seroval-1.7.5.tgz",
+      "integrity": "sha512-UdNgpHdq0gVpme5JdQF+S3jNscnjFr4NTwUWOc1qcOa8OuWZmbV0+YX2hsqxkUZshBpHnpxDZfAKVZG2ugbrJA==",
       "license": "MIT",
       "engines": {
-        "node": ">=10"
+        "node": ">=20"
       }
     },
     "node_modules/seroval-plugins": {
-      "version": "1.6.8",
-      "resolved": "https://registry.npmjs.org/seroval-plugins/-/seroval-plugins-1.6.8.tgz",
-      "integrity": "sha512-N7mWAMydj89EnYTHtRpS3LBrAz3J9O6oVrqpuXuvlAHfAUG8WEKqtbAd7SBiJNY5NfCAFhSdyAh7wI4Shjqy4g==",
+      "version": "1.7.6",
+      "resolved": "https://registry.npmjs.org/seroval-plugins/-/seroval-plugins-1.7.6.tgz",
+      "integrity": "sha512-/TPCAd6q5stAZnugD2fsvNKtM2UpgwrS8/fO1cXTgPC0EqCsGB+UfkEEsToFCfg35CDTMlWkppfr/zWnLJGpBA==",
       "license": "MIT",
       "engines": {
-        "node": ">=10"
+        "node": ">=20"
       },
       "peerDependencies": {
         "seroval": "^1.0"