[chaliy]

What changed

Two moderate advisories against seroval 1.6.8 in the site lockfile are cleared by flooring it to >=1.6.11 <1.7.0, which resolves 1.6.12.

• GHSA-9wx9-5pv9-3349 — script injection through RegExp sources in serialized output (>=1.5.5 <1.6.10).
• GHSA-f86p-h4j2-7qgj — code injection through a typed array's own constructor property (>=1.6.0 <1.6.11).

seroval is transitive and pinned by its parent — asciinema-player 3.17.0 → solid-js 1.9.16 → seroval — so it moves as a pnpm.overrides floor, the same way zod and fast-uri did in #2773.

No behaviour change in bashkit or on the site. No suppression added, so deny.toml and the threat model's suppressed-advisory list are untouched; npm-only, so no supply-chain audit applies.

Why

Nightly run 285 went red on Advisory Audit, and main would have followed on its next push. The scan reads every lockfile regardless of the diff, so an advisory published against code that has not changed reddens everything. Advisory Audit was the only failing job in that run — Miri, AddressSanitizer and Security Analysis all passed, and the site lockfile was the only failing lockfile in the scan.

Before / After

Before, on main:

##[group]pnpm audit ./site/pnpm-lock.yaml
./site: 2 advisories
  moderate	seroval >=1.5.5 <1.6.10	GHSA-9wx9-5pv9-3349
    Seroval: Script injection through RegExp sources in serialized output
  moderate	seroval >=1.6.0 <1.6.11	GHSA-f86p-h4j2-7qgj
    Seroval: Code injection through a typed array's own constructor property
##[error]Process completed with exit code 1.

After, on this branch:

$ ./scripts/lib/npm_audit.py site
site: no known vulnerabilities found

CI's own Audit job — the same scripts/audit-lockfiles.sh the nightly advisories job runs — passes on this branch, which is the direct check.

The other four pnpm lockfiles and the uv lockfile are clean on this branch (crates/bashkit-js, examples/bashkit-pi, examples/browser, examples, examples/docs-grep-agent/uv.lock), matching the nightly log. No Cargo.lock changed, and the nightly run showed the cargo half passing with only its two allowed warnings (atomic-polyfill unmaintained, crypto-bigint yanked).

seroval is the serializer solid-js uses for SSR hydration, so the site was built rather than argued. On Node 22.23.4 — the version js.yml pins — with seroval@1.6.12 installed:

[build] 45 page(s) built in 10.63s
[build] Complete!
Normalized 148 rustdoc hidden line(s) in 17 generated HTML file(s).
Verified 37 docs route metadata entries.
Verified 37 docs Markdown routes and negotiation helpers.
Verified inline SVG blocks are CommonMark-safe.
Verified generated HTML has no local markdown links.
Verified 45 generated HTML route(s) in sitemap.xml.
Verified robots.txt Content Signals.
Verified 1 Agent Skills discovery entry.
Verified homepage Link response headers.
Verified crawler-reported meta descriptions.
Verified llms.txt and llms-full.txt (37 guides indexed) and /llms.txt back-links.

The Cloudflare Workers preview also deployed successfully. Also 185/185 script tests, just check-doc-links, just check-okf, just check-workflow-parity, just check-capability-parity and just check-changelog pass.

The lockfile delta is the seroval entry and the three references to it, and nothing else — pnpm install --lockfile-only moved no other package, so there is no opportunistic re-resolution to carry.

Risk

• Low. Dev/site dependency only; seroval reaches no published bashkit artifact.
• The floor holds the upper bound at the current minor, so this is a patch move (1.6.8 → 1.6.12) on a serializer in the site's rendering path. 1.7.3 exists and satisfies solid-js's ^1.0 range, but nothing about clearing these advisories justifies a minor bump there, so the floor's shape matches the existing sharp entry.
• What would break if wrong: site SSR hydration for the asciinema player. The build, all eleven postbuild verifications and the Workers preview deploy are the check on that, and they pass.
• Both advisories are moderate and neither is a patched-code claim about anything bashkit ships; a newly published finding still fails the scan normally.

Checklist

• Tests added or updated — no new test; the advisory scan (scripts/audit-lockfiles.sh, run by both CI audit and nightly advisories) is the regression test for this class, and it was failing before this change and passes after
• Backward compatibility considered — no API or behaviour surface changes

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	24c1297	Commit Preview URL Branch Preview URL	Oct 29 2026, 09:44 AM