From 24c1297e656163076983ca671f8295058ab462a0 Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Thu, 29 Oct 2026 09:16:55 +0000 Subject: [PATCH] fix(deps): clear the seroval script-injection advisories in the site lockfileNightly run 285 went red on `Advisory Audit`, and main would have followed on its next push: the scan reads every lockfile regardless of the diff, so an advisory against unchanged code reddens everything.Two moderate advisories against seroval 1.6.8, both published against code that has not changed here:- GHSA-9wx9-5pv9-3349, script injection through RegExp sources in serialized output (>=1.5.5 <1.6.10). - GHSA-f86p-h4j2-7qgj, code injection through a typed array's own constructor property (>=1.6.0 <1.6.11).seroval is transitive and pinned by its parent -- asciinema-player 3.17.0 -> solid-js 1.9.16 -> seroval -- so it moves as a `pnpm.overrides` floor, the same way zod and fast-uri did in #2773.Floored to `>=1.6.11 <1.7.0`, which resolves 1.6.12. Both advisories clear at 1.6.11, and holding the upper bound at the current minor keeps this a patch move on a serializer that solid-js uses for SSR hydration; 1.7.3 exists and satisfies solid-js's `^1.0` range, but nothing about clearing these advisories justifies a minor bump there. Matches the existing `sharp` floor's shape.The lockfile delta is the seroval entry and the three references to it, and nothing else; `pnpm install --lockfile-only` moved no other package, so there is no opportunistic re-resolution to carry.No suppression added, so deny.toml and the threat model's suppressed-advisory list are untouched. npm-only, so no supply-chain audit applies. No behaviour change in bashkit or on the site.Verified: the site advisory scan goes from the two findings above to "no known vulnerabilities found", and the other four pnpm lockfiles and the uv lockfile are clean. The site builds on seroval 1.6.12 -- 45 pages, all eleven postbuild verifications pass -- on Node 22.23.4, the version js.yml pins. 185/185 script tests, doc links, OKF and workflow parity all pass. No Cargo.lock changed. --- site/package.json | 1 + site/pnpm-lock.yaml | 17 +++++++++-------- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/site/package.json b/site/package.json index 87030bb2c..8f694790c 100644 --- a/site/package.json +++ b/site/package.json @@ -44,6 +44,7 @@ "js-yaml": "^4.3.1", "nanoid": "^3.3.17", "postcss": ">=8.5.18", + "seroval": ">=1.6.11 <1.7.0", "sharp": ">=0.35.0 <0.36.0", "source-map-js": ">=1.2.2", "svgo": "^4.0.2", diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml index 6e9c65213..fcf1f0d38 100644 --- a/site/pnpm-lock.yaml +++ b/site/pnpm-lock.yaml @@ -11,6 +11,7 @@ overrides: js-yaml: ^4.3.1 nanoid: ^3.3.17 postcss: '>=8.5.18' + seroval: '>=1.6.11 <1.7.0' sharp: '>=0.35.0 <0.36.0' source-map-js: '>=1.2.2' svgo: ^4.0.2 @@ -1966,10 +1967,10 @@ packages: resolution: {integrity: sha512-N7mWAMydj89EnYTHtRpS3LBrAz3J9O6oVrqpuXuvlAHfAUG8WEKqtbAd7SBiJNY5NfCAFhSdyAh7wI4Shjqy4g==} engines: {node: '>=10'} peerDependencies: - seroval: ^1.0 + seroval: '>=1.6.11 <1.7.0' - seroval@1.6.8: - resolution: {integrity: sha512-HlSgSAkTk4EqHcje1ptJjfZi1YDv5KbhVJ/d3P7T/nAXua2VmDu+AKDX5VTdFfZf48nDkWB2TKYt0DrCSa+3wg==} + seroval@1.6.12: + resolution: {integrity: sha512-CqbIVfk/7GL3ITwZI55lcPbpQbjHZ2DD5cUj4iH7E9YsCfHNJV1mx7yNp86Z84w5IpmkZZS/2s5vPOWmVWSdQg==} engines: {node: '>=10'} sharp@0.35.5: @@ -4699,11 +4700,11 @@ snapshots: semver@7.8.5: {} - seroval-plugins@1.6.8(seroval@1.6.8): + seroval-plugins@1.6.8(seroval@1.6.12): dependencies: - seroval: 1.6.8 + seroval: 1.6.12 - seroval@1.6.8: {} + seroval@1.6.12: {} sharp@0.35.5(@types/node@26.6.5): dependencies: @@ -4763,8 +4764,8 @@ snapshots: solid-js@1.9.16: dependencies: csstype: 3.2.3 - seroval: 1.6.8 - seroval-plugins: 1.6.8(seroval@1.6.8) + seroval: 1.6.12 + seroval-plugins: 1.6.8(seroval@1.6.12) solid-transition-group@0.2.3(solid-js@1.9.16): dependencies: