chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940

[jsourcebot]

Fixes SOU-1628

Summary

• Refresh the existing seroval@~1.5.0 lockfile resolution from 1.5.0 to 1.5.6.
• Address CVE-2026-59940, which affects seroval through 1.5.2 and is first patched in 1.5.3.
• Keep the supported transitive dependency range unchanged, with no forced resolution override.

Verification

• yarn why seroval --recursive
• yarn workspace @sourcebot/web test --run (97 files, 1,145 tests)
• yarn workspace @sourcebot/web lint (0 errors; 4 pre-existing warnings)
• yarn build:deps
• yarn test

Summary by CodeRabbit

• Bug Fixes
  • Updated the changelog to record an upgrade of seroval to version 1.5.6.

---

Note

Low Risk
Patch-level transitive dependency refresh with no app logic changes; typical low-risk security maintenance.

Overview
Bumps the locked transitive seroval dependency from 1.5.0 to 1.5.6 in yarn.lock (still under the existing ~1.5.0 range pulled in via solid-js). No direct package.json or application code changes.

Documents the upgrade under [Unreleased] → Fixed in CHANGELOG.md, addressing CVE-2026-59940 (vulnerable through 1.5.2; patched from 1.5.3 onward).

^{Reviewed by Cursor Bugbot for commit d597144. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 75235795-bd9a-485c-8238-74256b608f92

📥 Commits

Reviewing files that changed from the base of the PR and between 4312945 and d597144.

📒 Files selected for processing (1)

• CHANGELOG.md

---

Walkthrough

The Unreleased changelog now records the seroval dependency upgrade to ^1.5.6 and includes its associated pull request reference.

Changes

Seroval upgrade documentation

Layer / File(s)	Summary
Document seroval upgrade CHANGELOG.md	Adds an Unreleased → Fixed entry for the seroval upgrade to ^1.5.6, including the pull request reference.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: msukkari, brendan-kellam

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: upgrading seroval to 1.5.6.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/cve/seroval

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

License Audit

⚠️ Status: PASS

Metric	Count
Total packages	2200
Resolved (non-standard)	17
Unresolved	0
Strong copyleft	0
Weak copyleft	28

Weak Copyleft Packages (informational)

Package	Version	License
@img/sharp-libvips-darwin-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-wasm32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
axe-core	4.10.3	MPL-2.0
dompurify	3.4.12	(MPL-2.0 OR Apache-2.0)
lightningcss	1.32.0	MPL-2.0
lightningcss-android-arm64	1.32.0	MPL-2.0
lightningcss-darwin-arm64	1.32.0	MPL-2.0
lightningcss-darwin-x64	1.32.0	MPL-2.0
lightningcss-freebsd-x64	1.32.0	MPL-2.0
lightningcss-linux-arm-gnueabihf	1.32.0	MPL-2.0
lightningcss-linux-arm64-gnu	1.32.0	MPL-2.0
lightningcss-linux-arm64-musl	1.32.0	MPL-2.0
lightningcss-linux-x64-gnu	1.32.0	MPL-2.0
lightningcss-linux-x64-musl	1.32.0	MPL-2.0
lightningcss-win32-arm64-msvc	1.32.0	MPL-2.0
lightningcss-win32-x64-msvc	1.32.0	MPL-2.0

Resolved Packages (17)

Package	Version	Original	Resolved	Source
@sentry/cli	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-darwin	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-i686	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-x64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-arm64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-i686	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-x64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
codemirror-lang-elixir	4.0.0	UNKNOWN	Apache-2.0	GitHub repo (npm metadata has no license field; github.com/livebook-dev/codemirror-lang-elixir LICENSE + GitHub license API report Apache-2.0)
khroma	2.1.0	UNKNOWN	MIT	GitHub repo (npm metadata has no license field; github.com/fabiospampinato/khroma license file + GitHub license API report MIT)
lezer-elixir	1.1.2	UNKNOWN	Apache-2.0	GitHub repo (npm metadata has no license field; github.com/livebook-dev/lezer-elixir LICENSE + GitHub license API report Apache-2.0)
map-stream	0.1.0	UNKNOWN	MIT	GitHub repo (npm metadata has no license field; github.com/dominictarr/map-stream LICENCE + GitHub license API report MIT)
memorystream	0.3.1	UNKNOWN	MIT	extracted from object (package metadata uses legacy licenses:[{"type":"MIT","url":"..."}] form; confirmed by GitHub license API)
pause-stream	0.0.11	["MIT","Apache2"]	(MIT OR Apache-2.0)	extracted from object (license array ["MIT","Apache2"]; LICENSE file states "Dual Licensed MIT and Apache 2" and contains both full texts. "Apache2" normalized to SPDX Apache-2.0)
posthog-js	1.369.0	SEE LICENSE IN LICENSE	Apache-2.0	GitHub repo (LICENSE file is the full Apache-2.0 text, "Licensed under the Apache License, Version 2.0"; no added commercial restrictions. Also bundles MIT-licensed third-party notices)
valid-url	1.0.9	UNKNOWN	MIT	GitHub repo (npm metadata has no license field; LICENSE file is verbatim MIT text, GitHub reports NOASSERTION only because the title line is absent)