[dependabot]

Bumps the dashboard-security group with 1 update in the /apps/presentation/dashboard directory: seroval.

Updates seroval from 1.6.8 to 1.7.3

Release notes

Sourced from seroval's releases.

seroval-plugins@1.7.3

No changes in this release.

seroval@1.7.3

Patch Changes

• 3a60f79: Republish the 1.7.2 changes through CI with npm provenance. 1.7.2 was published manually without an attestation, so pnpm's trustPolicy: no-downgrade refused to install it (#278). No code changes.

seroval-plugins@1.7.1

Patch Changes

• 2d03651: serialize, toJSON, crossSerialize and toCrossJSON now throw when the value contains an async iterable or a ReadableStream, as they do for a promise. Before, they sent a stream that never got its values. Use an async or streaming function to send them.

seroval@1.7.1

Patch Changes

• b703710: createCrossDeserializer no longer causes unhandled rejections. This covers a rejected promise that the caller never reads, and a pending promise that abort rejects. Code that awaits the promise still gets the rejection.
• 2d03651: serialize, toJSON, crossSerialize and toCrossJSON now throw when the value contains an async iterable or a ReadableStream, as they do for a promise. Before, they sent a stream that never got its values. Use an async or streaming function to send them.
• 2c25bf3: serialize, toJSON, crossSerialize and toCrossJSON now send a createStream stream that has ended with all its events. A stream that is still open, or a live stream, now throws. Before, they sent an empty stream that never ended.

seroval-plugins@1.7.0

Minor Changes

• 4c0008f: Add createLiveStream(), a single-consumer stream that holds one event at a time and resolves each producer write only after the serialized record is accepted. crossSerializeStream and toCrossJSONStream callbacks may now return a promise; the next record, and the acceptance of the source event behind it, wait for it to settle. Records discovered while parsing an event are emitted after the record that introduces them, one callback runs at a time, onDone waits for the last callback and is not called after an output failure, and cleanup runs every callback once. Async iterables and ReadableStream values read their next chunk only after the previous record is accepted. Existing streaming plugin lifecycle hooks remain available; parsing a live stream is the preferred way to connect an incremental source.
• f2b7d0c: Raise the supported Node.js floor from >=10 to >=20 in engines, remove the no-op typesVersions from seroval, give seroval-plugins main, module and types fields plus a typesVersions entry that points at the emitted web declarations, and link the plugins package to the workspace copy of seroval.
• 5ab601f: Add plugin context hooks for parsing an async iterable as a stream source. Use them in the ReadableStream plugin to avoid a separate live-stream producer while keeping backpressure, cancellation, and wire format intact. Upgrade both packages together because the plugin requires the new core hooks.

Patch Changes

• c643404: The documentation moved to https://seroval.vercel.app. The READMEs and the package homepages now link to it.
• a1e185a: Build with an explicit ES2020 syntax target so the emitted syntax floor no longer follows engines.node, keeping nullish coalescing and optional chaining as written.
• be1f32b: Improve tree shaking of web namespace imports in ESM builds while preserving the CommonJS export shape.
• 90e8f73: The web plugins that match instances of a built-in class, such as URL, Blob and Headers, now set skipPlainObjects. With a seroval version that supports it, serializing plain objects with these plugins is faster.

seroval@1.7.0

Minor Changes

• 9a75aae: Add the assignSharedRefsOnly option to crossSerialize and crossSerializeAsync. It stores only the values the output reads more than once in $R, which makes shorter output when no later script refers back to it.
• f3f39de: Add createCrossDeserializer, a session for cross-reference JSON records that tracks unsettled promises and open streams, reports how many are still pending, and can abort them with a caller-supplied reason when the transport fails.
• 2324090: Streams serialized from a live stream in streaming mode are rebuilt with a live receiver: it keeps history only until its first listener subscribes, then forwards each value without retaining it and refuses a second listener. Replay streams and existing serialized data are unchanged, and readers that ignore the marker build a replay receiver.
• 4c0008f: Add createLiveStream(), a single-consumer stream that holds one event at a time and resolves each producer write only after the serialized record is accepted. crossSerializeStream and toCrossJSONStream callbacks may now return a promise; the next record, and the acceptance of the source event behind it, wait for it to settle. Records discovered while parsing an event are emitted after the record that introduces them, one callback runs at a time, onDone waits for the last callback and is not called after an output failure, and cleanup runs every callback once. Async iterables and ReadableStream values read their next chunk only after the previous record is accepted. Existing streaming plugin lifecycle hooks remain available; parsing a live stream is the preferred way to connect an incremental source.
• f2b7d0c: Raise the supported Node.js floor from >=10 to >=20 in engines, remove the no-op typesVersions from seroval, give seroval-plugins main, module and types fields plus a typesVersions entry that points at the emitted web declarations, and link the plugins package to the workspace copy of seroval.
• 8a95987: Add the optional skipPlainObjects plugin field. A plugin that sets it to true is not tested against plain objects, which makes parsing faster when most values are plain objects.
• 5ab601f: Add plugin context hooks for parsing an async iterable as a stream source. Use them in the ReadableStream plugin to avoid a separate live-stream producer while keeping backpressure, cancellation, and wire format intact. Upgrade both packages together because the plugin requires the new core hooks.

Patch Changes

• 6d92c38: - Export SerializeOptions, SerializeAsyncOptions, ToJSONOptions and ToJSONAsyncOptions, the option types of serialize, serializeAsync, toJSON and toJSONAsync.
  • Mark Feature.ArrowFunction and SerovalMissingReferenceError as deprecated. Neither has any effect.
• 8b4214f: Reuse the resolved plugin list when the same plugins array is passed again, so each call no longer rebuilds it.

... (truncated)

Commits

• 3bc61b4 chore: version packages (#279)
• 3a60f79 chore: release 1.7.3 with npm provenance
• 5d96663 chore: version packages
• 737afa1 fix: stop unhandled rejections from fromJSON and fromCrossJSON
• 069dfeb chore: version packages (#264)
• 1c5b011 ci: require approval for benchmark runs (#260)
• 2c25bf3 feat: send ended streams in sync modes (#262)
• 2d03651 fix: throw for async iterables in sync modes (#261)
• b703710 fix: stop unhandled rejections from createCrossDeserializer (#258)
• 3a44e4b chore(deps): bump actions/upload-pages-artifact from 3.0.1 to 5.0.0 (#254)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for seroval since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · reasoning_effort=max

动机 / Motivation

维护 dashboard 依赖的开发者，需要在保留现有 React/TanStack Router 入口的同时，移除存在已公开序列化缺陷的间接依赖。序列化在这里是把 JavaScript 值变成可传输或执行的表示；旧版可能把来自输入的内容拼入生成代码，后续消费方式决定它是否成为应用漏洞。

具体反例是：带自有 constructor 属性的 TypedArray 或含 HTML 敏感字符的 RegExp，在 1.6.8 中产生不安全的 JavaScript 输出；同样输入在 1.7.3 中不再带入伪造构造器名或原始小于号。本次升级消除了所验证的两类上游不安全输出，并保持当前 dashboard 的编译产物不变。本 PR 的边界是锁定依赖升级；不新增 SSR、不证明现有应用可被利用，也不承诺完整的跨平台或安装后运行资格。

不升级会继续保留处于公开受影响范围内的锁定版本。这个单节点升级可以独立安装、比较和回滚，交付的是具体依赖维护结果；它无需扩展为另一个前端功能或控制面改造。

改动思路 / Approach

依赖关系是 dashboard → @tanstack/react-router 1.170.10 → @tanstack/router-core 1.171.8 → seroval。router-core 允许 seroval ^1.5.4；保留的 seroval-plugins 1.5.4 也声明支持 seroval ^1.0。新版本仍处于这两个约束内，但范围兼容不能代替执行验证。

这里复用现有 npm 锁文件与 TanStack 所有权，不新增包装层、重复状态或降级分支。当前 PR 只升级一个 seroval 锁节点，不新增应用功能、状态或包装层。安装由 npm 的 resolved/integrity 校验负责，类型与打包由原有 build:desktop 负责。实际应用以 createRoot 挂载 RouterProvider，路由配置没有启用 SSR；本次新旧构建的全部 39 个产物名称和字节一致。这证明了当前编译交付边界的保留，不等同于完整的浏览器或原生安装验收。

另沿依赖内的真实 defaultSerovalPlugins 执行了有限流、源流错误和浅 Error 序列化：保留插件组合能够收到两段数据后结束，也能够把源错误传给重建流的读取者。上游关于同步序列化异步值、取消和背压的新规则需要独立区分；当前 SPA 入口没有因此新增调用，不能把未执行的 SSR 场景宣称为通过。

具体改动 / Changes

评审精确头为 7346454，不可变基线为 0a9a3a3。只修改 package-lock.json 的一个包节点，新增四行、删除四行；其他锁节点和 package.json 依赖声明不变。本次没有为该版本升级单独制定的已接受书面规格，因此采用 no_spec；不把发布说明包装成 LoopX 的新增验收协议。

独立依据是公开的 TypedArray 构造器属性公告 与 RegExp 输出公告：1.6.8 位于两者受影响范围，1.7.3 高于对应修复版本。公告给出的是条件性上游风险；代码是否进入 HTML script 等消费路径仍须由应用证据判断。

关键代码讲解

1. 锁定的 seroval 节点 同时更新 version、官方 npm tarball 地址和 integrity。两侧均从各自锁文件执行 npm ci，实际加载到的版本分别为 1.6.8 与 1.7.3；没有仅靠编辑版本文字假定安装成功。
2. 同节点的 engines.node 从 Node >=10 变为 >=20。仓库 既有最低版本 已是 >=22.22.3，因此没有抬高受支持仓库环境的下限。本次执行环境为 Node 24.21.0；最低版本本机未另跑。
3. createRoot/RouterProvider 与 createRouter 是未改动的真实使用入口。不能因为底层包包含 SSR 帮助函数，就声称当前应用已经通过 SSR 方式消费这些值。

对主干的风险 / Risks

没有发现阻塞本次升级的缺陷。最需要防范的是核心包升级后保留插件的异步事件不再完成，或运行时要求超出现有宿主。前者以实际 router-core 导出的插件执行有限流和错误流读回；后者比较新引擎要求与仓库现有约束，并运行真实类型检查及 Vite 构建。上游 1.7.0 发布说明 包含同步异步值、取消回调和流接口变化，不能把此次升级描述成所有 API 完全等价。

验证边界	1.6.8 基线	1.7.3 评审头
锁文件安装与 build:desktop	PASS	PASS；39 个产物逐字节相同
四类 TypedArray × 三种 JS 输出 API	12 个反例均带入伪造名字	PASS；实际类型与内容保留
HTML 敏感 RegExp × 三种 JS 输出 API	3 个反例均包含原始小于号	PASS；源码与 flags 读回保持
Map 回指对象的 JS / crossSerialize 往返	FAIL；self 错误指向 Map	PASS；self 与根对象同一引用
同一富值的 JSON 往返、浅 Error、有限流及错误流	PASS	PASS
conversation-returns 与仓库 premerge	未将主干检查混作安全证明	PASS；含公共边界扫描、双语 diff 与质量回执核验

安全反例分别经过 serialize、crossSerialize 和 compileJSON(toJSON(...))；使用无害标记，未执行旧版不安全生成代码。基线的回环引用失败是另一个实际观察到的行为差异，保留为 FAIL，不能归入“完全兼容”。新版按对象身份这个独立语义要求通过，属于可接受的修正。

当前 required 本地检查没有失败或跳过；构建中两侧相同的“大于 500 kB chunk”提示仍是提示，没有改阈值消除它。没有查询或等待远端 CI。完整 SSR 安装路径、取消/背压、Node 最低版本及其他操作系统仍是未执行范围；若以后启用 SSR，应在该调用入口补充验证。本次没有新增默认关闭功能、权限、调度、持久化协议或文本分类规则，因此也没有用“功能关闭”来回避共享路径验证。

我的整体评价 / Verdict

APPROVE。 这是完整且适量的依赖维护切片：公开缺陷有独立反例，新版本修复了已测不安全输出，现有调用链和构建交付保持，四行锁数据不需要额外架构。兼容层与有价值的现有插件予以保留；没有值得在该 PR 中追加的同域抽象或清理。

long_horizon 判断为 preserved：不改变长程任务、反馈或执行所有权，也没有证明效率收益。user_experience 判断为 preserved：实际 SPA 入口和全部构建产物一致，没有布局改动；未把编译比较升级为浏览器或安装后验收。语义词汇沿用现有外部依赖与引擎约束，没有新增 LoopX 状态词汇。评审结论仅适用于上述精确头；合并就绪资格与维护者合并授权仍需分别判断。

English verdict: APPROVE — the verified security cases improve, the retained router plugins work, and the current SPA build is unchanged; full SSR and platform qualification remain outside this review.