chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940 - #1508

Merged
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval
Jul 29, 2026
Merged

chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940#1508
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval

Conversation

@jsourcebot

@jsourcebotjsourcebot commented Jul 24, 2026•
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Fixes SOU-1628

Summary

  • Refresh the existing seroval@~1.5.0 lockfile resolution from 1.5.0 to 1.5.6.
  • Address CVE-2026-59940, which affects seroval through 1.5.2 and is first patched in 1.5.3.
  • Keep the supported transitive dependency range unchanged, with no forced resolution override.

Verification

  • yarn why seroval --recursive
  • yarn workspace @sourcebot/web test --run (97 files, 1,145 tests)
  • yarn workspace @sourcebot/web lint (0 errors; 4 pre-existing warnings)
  • yarn build:deps
  • yarn test

Summary by CodeRabbit

  • Bug Fixes
    • Updated the changelog to record an upgrade of seroval to version 1.5.6.

Note

Low Risk
Patch-level transitive dependency refresh with no app logic changes; typical low-risk security maintenance.

Overview
Bumps the locked transitiveseroval dependency from 1.5.0 to 1.5.6 in yarn.lock (still under the existing ~1.5.0 range pulled in via solid-js). No direct package.json or application code changes.

Documents the upgrade under [Unreleased] → Fixed in CHANGELOG.md, addressing CVE-2026-59940 (vulnerable through 1.5.2; patched from 1.5.3 onward).

Reviewed by Cursor Bugbot for commit d597144. Bugbot is set up for automated code reviews on this repo. Configure here.

@coderabbitai

coderabbitaiBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 75235795-bd9a-485c-8238-74256b608f92

📥 Commits

Reviewing files that changed from the base of the PR and between 4312945 and d597144.

📒 Files selected for processing (1)
  • CHANGELOG.md

Walkthrough

The Unreleased changelog now records the seroval dependency upgrade to ^1.5.6 and includes its associated pull request reference.

Changes

Seroval upgrade documentation

Layer / File(s)Summary
Document seroval upgrade
CHANGELOG.md		Adds an Unreleased → Fixed entry for the seroval upgrade to ^1.5.6, including the pull request reference.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers:msukkari, brendan-kellam

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely describes the main change: upgrading seroval to 1.5.6.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cursor/cve/seroval

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

This comment has been minimized.

Sign in to view
@jsourcebotjsourcebot changed the title chore: upgrade seroval to 1.5.6chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940Jul 24, 2026
@github-actions

github-actionsBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

License Audit

⚠️Status: PASS

MetricCount
Total packages2200
Resolved (non-standard)17
Unresolved0
Strong copyleft0
Weak copyleft28

Weak Copyleft Packages (informational)

PackageVersionLicense
@img/sharp-libvips-darwin-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-darwin-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x641.3.2LGPL-3.0-or-later
@img/sharp-wasm320.35.3Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm640.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia320.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x640.35.3Apache-2.0 AND LGPL-3.0-or-later
axe-core4.10.3MPL-2.0
dompurify3.4.12(MPL-2.0 OR Apache-2.0)
lightningcss1.32.0MPL-2.0
lightningcss-android-arm641.32.0MPL-2.0
lightningcss-darwin-arm641.32.0MPL-2.0
lightningcss-darwin-x641.32.0MPL-2.0
lightningcss-freebsd-x641.32.0MPL-2.0
lightningcss-linux-arm-gnueabihf1.32.0MPL-2.0
lightningcss-linux-arm64-gnu1.32.0MPL-2.0
lightningcss-linux-arm64-musl1.32.0MPL-2.0
lightningcss-linux-x64-gnu1.32.0MPL-2.0
lightningcss-linux-x64-musl1.32.0MPL-2.0
lightningcss-win32-arm64-msvc1.32.0MPL-2.0
lightningcss-win32-x64-msvc1.32.0MPL-2.0
Resolved Packages (17)
PackageVersionOriginalResolvedSource
@sentry/cli2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-darwin2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
codemirror-lang-elixir4.0.0UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/codemirror-lang-elixir LICENSE + GitHub license API report Apache-2.0)
khroma2.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/fabiospampinato/khroma license file + GitHub license API report MIT)
lezer-elixir1.1.2UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/lezer-elixir LICENSE + GitHub license API report Apache-2.0)
map-stream0.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/dominictarr/map-stream LICENCE + GitHub license API report MIT)
memorystream0.3.1UNKNOWNMITextracted from object (package metadata uses legacy licenses:[{"type":"MIT","url":"..."}] form; confirmed by GitHub license API)
pause-stream0.0.11["MIT","Apache2"](MIT OR Apache-2.0)extracted from object (license array ["MIT","Apache2"]; LICENSE file states "Dual Licensed MIT and Apache 2" and contains both full texts. "Apache2" normalized to SPDX Apache-2.0)
posthog-js1.369.0SEE LICENSE IN LICENSEApache-2.0GitHub repo (LICENSE file is the full Apache-2.0 text, "Licensed under the Apache License, Version 2.0"; no added commercial restrictions. Also bundles MIT-licensed third-party notices)
valid-url1.0.9UNKNOWNMITGitHub repo (npm metadata has no license field; LICENSE file is verbatim MIT text, GitHub reports NOASSERTION only because the title line is absent)

@brendan-kellam
brendan-kellam merged commit 698885c into mainJul 29, 2026
10 of 11 checks passed
@brendan-kellam
brendan-kellam deleted the cursor/cve/seroval branch July 29, 2026 00:17
@github-actionsgithub-actionsBot mentioned this pull request Jul 29, 2026
Open
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jsourcebot@brendan-kellam
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all \u003cpre\u003e\u003ccode\u003e blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks"); } } catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); } })(); (function(){ try { var __m = "github.com"; var __re = new RegExp('^' + "github\\.com" + '
Skip to content

chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940 - #1508

Merged
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval
Jul 29, 2026
Merged

chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940#1508
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval

Conversation

@jsourcebot

@jsourcebotjsourcebot commented Jul 24, 2026•
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Fixes SOU-1628

Summary

  • Refresh the existing seroval@~1.5.0 lockfile resolution from 1.5.0 to 1.5.6.
  • Address CVE-2026-59940, which affects seroval through 1.5.2 and is first patched in 1.5.3.
  • Keep the supported transitive dependency range unchanged, with no forced resolution override.

Verification

  • yarn why seroval --recursive
  • yarn workspace @sourcebot/web test --run (97 files, 1,145 tests)
  • yarn workspace @sourcebot/web lint (0 errors; 4 pre-existing warnings)
  • yarn build:deps
  • yarn test

Summary by CodeRabbit

  • Bug Fixes
    • Updated the changelog to record an upgrade of seroval to version 1.5.6.

Note

Low Risk
Patch-level transitive dependency refresh with no app logic changes; typical low-risk security maintenance.

Overview
Bumps the locked transitiveseroval dependency from 1.5.0 to 1.5.6 in yarn.lock (still under the existing ~1.5.0 range pulled in via solid-js). No direct package.json or application code changes.

Documents the upgrade under [Unreleased] → Fixed in CHANGELOG.md, addressing CVE-2026-59940 (vulnerable through 1.5.2; patched from 1.5.3 onward).

Reviewed by Cursor Bugbot for commit d597144. Bugbot is set up for automated code reviews on this repo. Configure here.

@coderabbitai

coderabbitaiBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 75235795-bd9a-485c-8238-74256b608f92

📥 Commits

Reviewing files that changed from the base of the PR and between 4312945 and d597144.

📒 Files selected for processing (1)
  • CHANGELOG.md

Walkthrough

The Unreleased changelog now records the seroval dependency upgrade to ^1.5.6 and includes its associated pull request reference.

Changes

Seroval upgrade documentation

Layer / File(s)Summary
Document seroval upgrade
CHANGELOG.md		Adds an Unreleased → Fixed entry for the seroval upgrade to ^1.5.6, including the pull request reference.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers:msukkari, brendan-kellam

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely describes the main change: upgrading seroval to 1.5.6.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cursor/cve/seroval

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

This comment has been minimized.

Sign in to view
@jsourcebotjsourcebot changed the title chore: upgrade seroval to 1.5.6chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940Jul 24, 2026
@github-actions

github-actionsBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

License Audit

⚠️Status: PASS

MetricCount
Total packages2200
Resolved (non-standard)17
Unresolved0
Strong copyleft0
Weak copyleft28

Weak Copyleft Packages (informational)

PackageVersionLicense
@img/sharp-libvips-darwin-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-darwin-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x641.3.2LGPL-3.0-or-later
@img/sharp-wasm320.35.3Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm640.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia320.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x640.35.3Apache-2.0 AND LGPL-3.0-or-later
axe-core4.10.3MPL-2.0
dompurify3.4.12(MPL-2.0 OR Apache-2.0)
lightningcss1.32.0MPL-2.0
lightningcss-android-arm641.32.0MPL-2.0
lightningcss-darwin-arm641.32.0MPL-2.0
lightningcss-darwin-x641.32.0MPL-2.0
lightningcss-freebsd-x641.32.0MPL-2.0
lightningcss-linux-arm-gnueabihf1.32.0MPL-2.0
lightningcss-linux-arm64-gnu1.32.0MPL-2.0
lightningcss-linux-arm64-musl1.32.0MPL-2.0
lightningcss-linux-x64-gnu1.32.0MPL-2.0
lightningcss-linux-x64-musl1.32.0MPL-2.0
lightningcss-win32-arm64-msvc1.32.0MPL-2.0
lightningcss-win32-x64-msvc1.32.0MPL-2.0
Resolved Packages (17)
PackageVersionOriginalResolvedSource
@sentry/cli2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-darwin2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
codemirror-lang-elixir4.0.0UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/codemirror-lang-elixir LICENSE + GitHub license API report Apache-2.0)
khroma2.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/fabiospampinato/khroma license file + GitHub license API report MIT)
lezer-elixir1.1.2UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/lezer-elixir LICENSE + GitHub license API report Apache-2.0)
map-stream0.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/dominictarr/map-stream LICENCE + GitHub license API report MIT)
memorystream0.3.1UNKNOWNMITextracted from object (package metadata uses legacy licenses:[{"type":"MIT","url":"..."}] form; confirmed by GitHub license API)
pause-stream0.0.11["MIT","Apache2"](MIT OR Apache-2.0)extracted from object (license array ["MIT","Apache2"]; LICENSE file states "Dual Licensed MIT and Apache 2" and contains both full texts. "Apache2" normalized to SPDX Apache-2.0)
posthog-js1.369.0SEE LICENSE IN LICENSEApache-2.0GitHub repo (LICENSE file is the full Apache-2.0 text, "Licensed under the Apache License, Version 2.0"; no added commercial restrictions. Also bundles MIT-licensed third-party notices)
valid-url1.0.9UNKNOWNMITGitHub repo (npm metadata has no license field; LICENSE file is verbatim MIT text, GitHub reports NOASSERTION only because the title line is absent)

@brendan-kellam
brendan-kellam merged commit 698885c into mainJul 29, 2026
10 of 11 checks passed
@brendan-kellam
brendan-kellam deleted the cursor/cve/seroval branch July 29, 2026 00:17
@github-actionsgithub-actionsBot mentioned this pull request Jul 29, 2026
Open
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jsourcebot@brendan-kellam
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940 - #1508

Merged
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval
Jul 29, 2026
Merged

chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940#1508
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval

Conversation

@jsourcebot

@jsourcebotjsourcebot commented Jul 24, 2026•
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Fixes SOU-1628

Summary

  • Refresh the existing seroval@~1.5.0 lockfile resolution from 1.5.0 to 1.5.6.
  • Address CVE-2026-59940, which affects seroval through 1.5.2 and is first patched in 1.5.3.
  • Keep the supported transitive dependency range unchanged, with no forced resolution override.

Verification

  • yarn why seroval --recursive
  • yarn workspace @sourcebot/web test --run (97 files, 1,145 tests)
  • yarn workspace @sourcebot/web lint (0 errors; 4 pre-existing warnings)
  • yarn build:deps
  • yarn test

Summary by CodeRabbit

  • Bug Fixes
    • Updated the changelog to record an upgrade of seroval to version 1.5.6.

Note

Low Risk
Patch-level transitive dependency refresh with no app logic changes; typical low-risk security maintenance.

Overview
Bumps the locked transitiveseroval dependency from 1.5.0 to 1.5.6 in yarn.lock (still under the existing ~1.5.0 range pulled in via solid-js). No direct package.json or application code changes.

Documents the upgrade under [Unreleased] → Fixed in CHANGELOG.md, addressing CVE-2026-59940 (vulnerable through 1.5.2; patched from 1.5.3 onward).

Reviewed by Cursor Bugbot for commit d597144. Bugbot is set up for automated code reviews on this repo. Configure here.

@coderabbitai

coderabbitaiBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 75235795-bd9a-485c-8238-74256b608f92

📥 Commits

Reviewing files that changed from the base of the PR and between 4312945 and d597144.

📒 Files selected for processing (1)
  • CHANGELOG.md

Walkthrough

The Unreleased changelog now records the seroval dependency upgrade to ^1.5.6 and includes its associated pull request reference.

Changes

Seroval upgrade documentation

Layer / File(s)Summary
Document seroval upgrade
CHANGELOG.md		Adds an Unreleased → Fixed entry for the seroval upgrade to ^1.5.6, including the pull request reference.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers:msukkari, brendan-kellam

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely describes the main change: upgrading seroval to 1.5.6.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cursor/cve/seroval

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

This comment has been minimized.

Sign in to view
@jsourcebotjsourcebot changed the title chore: upgrade seroval to 1.5.6chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940Jul 24, 2026
@github-actions

github-actionsBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

License Audit

⚠️Status: PASS

MetricCount
Total packages2200
Resolved (non-standard)17
Unresolved0
Strong copyleft0
Weak copyleft28

Weak Copyleft Packages (informational)

PackageVersionLicense
@img/sharp-libvips-darwin-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-darwin-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x641.3.2LGPL-3.0-or-later
@img/sharp-wasm320.35.3Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm640.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia320.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x640.35.3Apache-2.0 AND LGPL-3.0-or-later
axe-core4.10.3MPL-2.0
dompurify3.4.12(MPL-2.0 OR Apache-2.0)
lightningcss1.32.0MPL-2.0
lightningcss-android-arm641.32.0MPL-2.0
lightningcss-darwin-arm641.32.0MPL-2.0
lightningcss-darwin-x641.32.0MPL-2.0
lightningcss-freebsd-x641.32.0MPL-2.0
lightningcss-linux-arm-gnueabihf1.32.0MPL-2.0
lightningcss-linux-arm64-gnu1.32.0MPL-2.0
lightningcss-linux-arm64-musl1.32.0MPL-2.0
lightningcss-linux-x64-gnu1.32.0MPL-2.0
lightningcss-linux-x64-musl1.32.0MPL-2.0
lightningcss-win32-arm64-msvc1.32.0MPL-2.0
lightningcss-win32-x64-msvc1.32.0MPL-2.0
Resolved Packages (17)
PackageVersionOriginalResolvedSource
@sentry/cli2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-darwin2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
codemirror-lang-elixir4.0.0UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/codemirror-lang-elixir LICENSE + GitHub license API report Apache-2.0)
khroma2.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/fabiospampinato/khroma license file + GitHub license API report MIT)
lezer-elixir1.1.2UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/lezer-elixir LICENSE + GitHub license API report Apache-2.0)
map-stream0.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/dominictarr/map-stream LICENCE + GitHub license API report MIT)
memorystream0.3.1UNKNOWNMITextracted from object (package metadata uses legacy licenses:[{"type":"MIT","url":"..."}] form; confirmed by GitHub license API)
pause-stream0.0.11["MIT","Apache2"](MIT OR Apache-2.0)extracted from object (license array ["MIT","Apache2"]; LICENSE file states "Dual Licensed MIT and Apache 2" and contains both full texts. "Apache2" normalized to SPDX Apache-2.0)
posthog-js1.369.0SEE LICENSE IN LICENSEApache-2.0GitHub repo (LICENSE file is the full Apache-2.0 text, "Licensed under the Apache License, Version 2.0"; no added commercial restrictions. Also bundles MIT-licensed third-party notices)
valid-url1.0.9UNKNOWNMITGitHub repo (npm metadata has no license field; LICENSE file is verbatim MIT text, GitHub reports NOASSERTION only because the title line is absent)

@brendan-kellam
brendan-kellam merged commit 698885c into mainJul 29, 2026
10 of 11 checks passed
@brendan-kellam
brendan-kellam deleted the cursor/cve/seroval branch July 29, 2026 00:17
@github-actionsgithub-actionsBot mentioned this pull request Jul 29, 2026
Open
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jsourcebot@brendan-kellam
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length \u003e 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940 - #1508

Merged
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval
Jul 29, 2026
Merged

chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940#1508
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval

Conversation

@jsourcebot

@jsourcebotjsourcebot commented Jul 24, 2026•
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Fixes SOU-1628

Summary

  • Refresh the existing seroval@~1.5.0 lockfile resolution from 1.5.0 to 1.5.6.
  • Address CVE-2026-59940, which affects seroval through 1.5.2 and is first patched in 1.5.3.
  • Keep the supported transitive dependency range unchanged, with no forced resolution override.

Verification

  • yarn why seroval --recursive
  • yarn workspace @sourcebot/web test --run (97 files, 1,145 tests)
  • yarn workspace @sourcebot/web lint (0 errors; 4 pre-existing warnings)
  • yarn build:deps
  • yarn test

Summary by CodeRabbit

  • Bug Fixes
    • Updated the changelog to record an upgrade of seroval to version 1.5.6.

Note

Low Risk
Patch-level transitive dependency refresh with no app logic changes; typical low-risk security maintenance.

Overview
Bumps the locked transitiveseroval dependency from 1.5.0 to 1.5.6 in yarn.lock (still under the existing ~1.5.0 range pulled in via solid-js). No direct package.json or application code changes.

Documents the upgrade under [Unreleased] → Fixed in CHANGELOG.md, addressing CVE-2026-59940 (vulnerable through 1.5.2; patched from 1.5.3 onward).

Reviewed by Cursor Bugbot for commit d597144. Bugbot is set up for automated code reviews on this repo. Configure here.

@coderabbitai

coderabbitaiBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 75235795-bd9a-485c-8238-74256b608f92

📥 Commits

Reviewing files that changed from the base of the PR and between 4312945 and d597144.

📒 Files selected for processing (1)
  • CHANGELOG.md

Walkthrough

The Unreleased changelog now records the seroval dependency upgrade to ^1.5.6 and includes its associated pull request reference.

Changes

Seroval upgrade documentation

Layer / File(s)Summary
Document seroval upgrade
CHANGELOG.md		Adds an Unreleased → Fixed entry for the seroval upgrade to ^1.5.6, including the pull request reference.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers:msukkari, brendan-kellam

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely describes the main change: upgrading seroval to 1.5.6.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cursor/cve/seroval

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

This comment has been minimized.

Sign in to view
@jsourcebotjsourcebot changed the title chore: upgrade seroval to 1.5.6chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940Jul 24, 2026
@github-actions

github-actionsBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

License Audit

⚠️Status: PASS

MetricCount
Total packages2200
Resolved (non-standard)17
Unresolved0
Strong copyleft0
Weak copyleft28

Weak Copyleft Packages (informational)

PackageVersionLicense
@img/sharp-libvips-darwin-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-darwin-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x641.3.2LGPL-3.0-or-later
@img/sharp-wasm320.35.3Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm640.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia320.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x640.35.3Apache-2.0 AND LGPL-3.0-or-later
axe-core4.10.3MPL-2.0
dompurify3.4.12(MPL-2.0 OR Apache-2.0)
lightningcss1.32.0MPL-2.0
lightningcss-android-arm641.32.0MPL-2.0
lightningcss-darwin-arm641.32.0MPL-2.0
lightningcss-darwin-x641.32.0MPL-2.0
lightningcss-freebsd-x641.32.0MPL-2.0
lightningcss-linux-arm-gnueabihf1.32.0MPL-2.0
lightningcss-linux-arm64-gnu1.32.0MPL-2.0
lightningcss-linux-arm64-musl1.32.0MPL-2.0
lightningcss-linux-x64-gnu1.32.0MPL-2.0
lightningcss-linux-x64-musl1.32.0MPL-2.0
lightningcss-win32-arm64-msvc1.32.0MPL-2.0
lightningcss-win32-x64-msvc1.32.0MPL-2.0
Resolved Packages (17)
PackageVersionOriginalResolvedSource
@sentry/cli2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-darwin2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
codemirror-lang-elixir4.0.0UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/codemirror-lang-elixir LICENSE + GitHub license API report Apache-2.0)
khroma2.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/fabiospampinato/khroma license file + GitHub license API report MIT)
lezer-elixir1.1.2UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/lezer-elixir LICENSE + GitHub license API report Apache-2.0)
map-stream0.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/dominictarr/map-stream LICENCE + GitHub license API report MIT)
memorystream0.3.1UNKNOWNMITextracted from object (package metadata uses legacy licenses:[{"type":"MIT","url":"..."}] form; confirmed by GitHub license API)
pause-stream0.0.11["MIT","Apache2"](MIT OR Apache-2.0)extracted from object (license array ["MIT","Apache2"]; LICENSE file states "Dual Licensed MIT and Apache 2" and contains both full texts. "Apache2" normalized to SPDX Apache-2.0)
posthog-js1.369.0SEE LICENSE IN LICENSEApache-2.0GitHub repo (LICENSE file is the full Apache-2.0 text, "Licensed under the Apache License, Version 2.0"; no added commercial restrictions. Also bundles MIT-licensed third-party notices)
valid-url1.0.9UNKNOWNMITGitHub repo (npm metadata has no license field; LICENSE file is verbatim MIT text, GitHub reports NOASSERTION only because the title line is absent)

@brendan-kellam
brendan-kellam merged commit 698885c into mainJul 29, 2026
10 of 11 checks passed
@brendan-kellam
brendan-kellam deleted the cursor/cve/seroval branch July 29, 2026 00:17
@github-actionsgithub-actionsBot mentioned this pull request Jul 29, 2026
Open
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jsourcebot@brendan-kellam
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '
Skip to content

chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940 - #1508

Merged
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval
Jul 29, 2026
Merged

chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940#1508
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval

Conversation

@jsourcebot

@jsourcebotjsourcebot commented Jul 24, 2026•
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Fixes SOU-1628

Summary

  • Refresh the existing seroval@~1.5.0 lockfile resolution from 1.5.0 to 1.5.6.
  • Address CVE-2026-59940, which affects seroval through 1.5.2 and is first patched in 1.5.3.
  • Keep the supported transitive dependency range unchanged, with no forced resolution override.

Verification

  • yarn why seroval --recursive
  • yarn workspace @sourcebot/web test --run (97 files, 1,145 tests)
  • yarn workspace @sourcebot/web lint (0 errors; 4 pre-existing warnings)
  • yarn build:deps
  • yarn test

Summary by CodeRabbit

  • Bug Fixes
    • Updated the changelog to record an upgrade of seroval to version 1.5.6.

Note

Low Risk
Patch-level transitive dependency refresh with no app logic changes; typical low-risk security maintenance.

Overview
Bumps the locked transitiveseroval dependency from 1.5.0 to 1.5.6 in yarn.lock (still under the existing ~1.5.0 range pulled in via solid-js). No direct package.json or application code changes.

Documents the upgrade under [Unreleased] → Fixed in CHANGELOG.md, addressing CVE-2026-59940 (vulnerable through 1.5.2; patched from 1.5.3 onward).

Reviewed by Cursor Bugbot for commit d597144. Bugbot is set up for automated code reviews on this repo. Configure here.

@coderabbitai

coderabbitaiBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 75235795-bd9a-485c-8238-74256b608f92

📥 Commits

Reviewing files that changed from the base of the PR and between 4312945 and d597144.

📒 Files selected for processing (1)
  • CHANGELOG.md

Walkthrough

The Unreleased changelog now records the seroval dependency upgrade to ^1.5.6 and includes its associated pull request reference.

Changes

Seroval upgrade documentation

Layer / File(s)Summary
Document seroval upgrade
CHANGELOG.md		Adds an Unreleased → Fixed entry for the seroval upgrade to ^1.5.6, including the pull request reference.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers:msukkari, brendan-kellam

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely describes the main change: upgrading seroval to 1.5.6.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cursor/cve/seroval

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

This comment has been minimized.

Sign in to view
@jsourcebotjsourcebot changed the title chore: upgrade seroval to 1.5.6chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940Jul 24, 2026
@github-actions

github-actionsBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

License Audit

⚠️Status: PASS

MetricCount
Total packages2200
Resolved (non-standard)17
Unresolved0
Strong copyleft0
Weak copyleft28

Weak Copyleft Packages (informational)

PackageVersionLicense
@img/sharp-libvips-darwin-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-darwin-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x641.3.2LGPL-3.0-or-later
@img/sharp-wasm320.35.3Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm640.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia320.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x640.35.3Apache-2.0 AND LGPL-3.0-or-later
axe-core4.10.3MPL-2.0
dompurify3.4.12(MPL-2.0 OR Apache-2.0)
lightningcss1.32.0MPL-2.0
lightningcss-android-arm641.32.0MPL-2.0
lightningcss-darwin-arm641.32.0MPL-2.0
lightningcss-darwin-x641.32.0MPL-2.0
lightningcss-freebsd-x641.32.0MPL-2.0
lightningcss-linux-arm-gnueabihf1.32.0MPL-2.0
lightningcss-linux-arm64-gnu1.32.0MPL-2.0
lightningcss-linux-arm64-musl1.32.0MPL-2.0
lightningcss-linux-x64-gnu1.32.0MPL-2.0
lightningcss-linux-x64-musl1.32.0MPL-2.0
lightningcss-win32-arm64-msvc1.32.0MPL-2.0
lightningcss-win32-x64-msvc1.32.0MPL-2.0
Resolved Packages (17)
PackageVersionOriginalResolvedSource
@sentry/cli2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-darwin2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
codemirror-lang-elixir4.0.0UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/codemirror-lang-elixir LICENSE + GitHub license API report Apache-2.0)
khroma2.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/fabiospampinato/khroma license file + GitHub license API report MIT)
lezer-elixir1.1.2UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/lezer-elixir LICENSE + GitHub license API report Apache-2.0)
map-stream0.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/dominictarr/map-stream LICENCE + GitHub license API report MIT)
memorystream0.3.1UNKNOWNMITextracted from object (package metadata uses legacy licenses:[{"type":"MIT","url":"..."}] form; confirmed by GitHub license API)
pause-stream0.0.11["MIT","Apache2"](MIT OR Apache-2.0)extracted from object (license array ["MIT","Apache2"]; LICENSE file states "Dual Licensed MIT and Apache 2" and contains both full texts. "Apache2" normalized to SPDX Apache-2.0)
posthog-js1.369.0SEE LICENSE IN LICENSEApache-2.0GitHub repo (LICENSE file is the full Apache-2.0 text, "Licensed under the Apache License, Version 2.0"; no added commercial restrictions. Also bundles MIT-licensed third-party notices)
valid-url1.0.9UNKNOWNMITGitHub repo (npm metadata has no license field; LICENSE file is verbatim MIT text, GitHub reports NOASSERTION only because the title line is absent)

@brendan-kellam
brendan-kellam merged commit 698885c into mainJul 29, 2026
10 of 11 checks passed
@brendan-kellam
brendan-kellam deleted the cursor/cve/seroval branch July 29, 2026 00:17
@github-actionsgithub-actionsBot mentioned this pull request Jul 29, 2026
Open
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jsourcebot@brendan-kellam
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940 - #1508

Merged
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval
Jul 29, 2026
Merged

chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940#1508
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval

Conversation

@jsourcebot

@jsourcebotjsourcebot commented Jul 24, 2026•
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Fixes SOU-1628

Summary

  • Refresh the existing seroval@~1.5.0 lockfile resolution from 1.5.0 to 1.5.6.
  • Address CVE-2026-59940, which affects seroval through 1.5.2 and is first patched in 1.5.3.
  • Keep the supported transitive dependency range unchanged, with no forced resolution override.

Verification

  • yarn why seroval --recursive
  • yarn workspace @sourcebot/web test --run (97 files, 1,145 tests)
  • yarn workspace @sourcebot/web lint (0 errors; 4 pre-existing warnings)
  • yarn build:deps
  • yarn test

Summary by CodeRabbit

  • Bug Fixes
    • Updated the changelog to record an upgrade of seroval to version 1.5.6.

Note

Low Risk
Patch-level transitive dependency refresh with no app logic changes; typical low-risk security maintenance.

Overview
Bumps the locked transitiveseroval dependency from 1.5.0 to 1.5.6 in yarn.lock (still under the existing ~1.5.0 range pulled in via solid-js). No direct package.json or application code changes.

Documents the upgrade under [Unreleased] → Fixed in CHANGELOG.md, addressing CVE-2026-59940 (vulnerable through 1.5.2; patched from 1.5.3 onward).

Reviewed by Cursor Bugbot for commit d597144. Bugbot is set up for automated code reviews on this repo. Configure here.

@coderabbitai

coderabbitaiBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 75235795-bd9a-485c-8238-74256b608f92

📥 Commits

Reviewing files that changed from the base of the PR and between 4312945 and d597144.

📒 Files selected for processing (1)
  • CHANGELOG.md

Walkthrough

The Unreleased changelog now records the seroval dependency upgrade to ^1.5.6 and includes its associated pull request reference.

Changes

Seroval upgrade documentation

Layer / File(s)Summary
Document seroval upgrade
CHANGELOG.md		Adds an Unreleased → Fixed entry for the seroval upgrade to ^1.5.6, including the pull request reference.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers:msukkari, brendan-kellam

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely describes the main change: upgrading seroval to 1.5.6.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cursor/cve/seroval

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

This comment has been minimized.

Sign in to view
@jsourcebotjsourcebot changed the title chore: upgrade seroval to 1.5.6chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940Jul 24, 2026
@github-actions

github-actionsBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

License Audit

⚠️Status: PASS

MetricCount
Total packages2200
Resolved (non-standard)17
Unresolved0
Strong copyleft0
Weak copyleft28

Weak Copyleft Packages (informational)

PackageVersionLicense
@img/sharp-libvips-darwin-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-darwin-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x641.3.2LGPL-3.0-or-later
@img/sharp-wasm320.35.3Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm640.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia320.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x640.35.3Apache-2.0 AND LGPL-3.0-or-later
axe-core4.10.3MPL-2.0
dompurify3.4.12(MPL-2.0 OR Apache-2.0)
lightningcss1.32.0MPL-2.0
lightningcss-android-arm641.32.0MPL-2.0
lightningcss-darwin-arm641.32.0MPL-2.0
lightningcss-darwin-x641.32.0MPL-2.0
lightningcss-freebsd-x641.32.0MPL-2.0
lightningcss-linux-arm-gnueabihf1.32.0MPL-2.0
lightningcss-linux-arm64-gnu1.32.0MPL-2.0
lightningcss-linux-arm64-musl1.32.0MPL-2.0
lightningcss-linux-x64-gnu1.32.0MPL-2.0
lightningcss-linux-x64-musl1.32.0MPL-2.0
lightningcss-win32-arm64-msvc1.32.0MPL-2.0
lightningcss-win32-x64-msvc1.32.0MPL-2.0
Resolved Packages (17)
PackageVersionOriginalResolvedSource
@sentry/cli2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-darwin2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
codemirror-lang-elixir4.0.0UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/codemirror-lang-elixir LICENSE + GitHub license API report Apache-2.0)
khroma2.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/fabiospampinato/khroma license file + GitHub license API report MIT)
lezer-elixir1.1.2UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/lezer-elixir LICENSE + GitHub license API report Apache-2.0)
map-stream0.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/dominictarr/map-stream LICENCE + GitHub license API report MIT)
memorystream0.3.1UNKNOWNMITextracted from object (package metadata uses legacy licenses:[{"type":"MIT","url":"..."}] form; confirmed by GitHub license API)
pause-stream0.0.11["MIT","Apache2"](MIT OR Apache-2.0)extracted from object (license array ["MIT","Apache2"]; LICENSE file states "Dual Licensed MIT and Apache 2" and contains both full texts. "Apache2" normalized to SPDX Apache-2.0)
posthog-js1.369.0SEE LICENSE IN LICENSEApache-2.0GitHub repo (LICENSE file is the full Apache-2.0 text, "Licensed under the Apache License, Version 2.0"; no added commercial restrictions. Also bundles MIT-licensed third-party notices)
valid-url1.0.9UNKNOWNMITGitHub repo (npm metadata has no license field; LICENSE file is verbatim MIT text, GitHub reports NOASSERTION only because the title line is absent)

@brendan-kellam
brendan-kellam merged commit 698885c into mainJul 29, 2026
10 of 11 checks passed
@brendan-kellam
brendan-kellam deleted the cursor/cve/seroval branch July 29, 2026 00:17
@github-actionsgithub-actionsBot mentioned this pull request Jul 29, 2026
Open
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jsourcebot@brendan-kellam
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '
Skip to content

chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940 - #1508

Merged
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval
Jul 29, 2026
Merged

chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940#1508
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval

Conversation

@jsourcebot

@jsourcebotjsourcebot commented Jul 24, 2026•
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Fixes SOU-1628

Summary

  • Refresh the existing seroval@~1.5.0 lockfile resolution from 1.5.0 to 1.5.6.
  • Address CVE-2026-59940, which affects seroval through 1.5.2 and is first patched in 1.5.3.
  • Keep the supported transitive dependency range unchanged, with no forced resolution override.

Verification

  • yarn why seroval --recursive
  • yarn workspace @sourcebot/web test --run (97 files, 1,145 tests)
  • yarn workspace @sourcebot/web lint (0 errors; 4 pre-existing warnings)
  • yarn build:deps
  • yarn test

Summary by CodeRabbit

  • Bug Fixes
    • Updated the changelog to record an upgrade of seroval to version 1.5.6.

Note

Low Risk
Patch-level transitive dependency refresh with no app logic changes; typical low-risk security maintenance.

Overview
Bumps the locked transitiveseroval dependency from 1.5.0 to 1.5.6 in yarn.lock (still under the existing ~1.5.0 range pulled in via solid-js). No direct package.json or application code changes.

Documents the upgrade under [Unreleased] → Fixed in CHANGELOG.md, addressing CVE-2026-59940 (vulnerable through 1.5.2; patched from 1.5.3 onward).

Reviewed by Cursor Bugbot for commit d597144. Bugbot is set up for automated code reviews on this repo. Configure here.

@coderabbitai

coderabbitaiBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 75235795-bd9a-485c-8238-74256b608f92

📥 Commits

Reviewing files that changed from the base of the PR and between 4312945 and d597144.

📒 Files selected for processing (1)
  • CHANGELOG.md

Walkthrough

The Unreleased changelog now records the seroval dependency upgrade to ^1.5.6 and includes its associated pull request reference.

Changes

Seroval upgrade documentation

Layer / File(s)Summary
Document seroval upgrade
CHANGELOG.md		Adds an Unreleased → Fixed entry for the seroval upgrade to ^1.5.6, including the pull request reference.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers:msukkari, brendan-kellam

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely describes the main change: upgrading seroval to 1.5.6.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cursor/cve/seroval

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

This comment has been minimized.

Sign in to view
@jsourcebotjsourcebot changed the title chore: upgrade seroval to 1.5.6chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940Jul 24, 2026
@github-actions

github-actionsBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

License Audit

⚠️Status: PASS

MetricCount
Total packages2200
Resolved (non-standard)17
Unresolved0
Strong copyleft0
Weak copyleft28

Weak Copyleft Packages (informational)

PackageVersionLicense
@img/sharp-libvips-darwin-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-darwin-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x641.3.2LGPL-3.0-or-later
@img/sharp-wasm320.35.3Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm640.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia320.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x640.35.3Apache-2.0 AND LGPL-3.0-or-later
axe-core4.10.3MPL-2.0
dompurify3.4.12(MPL-2.0 OR Apache-2.0)
lightningcss1.32.0MPL-2.0
lightningcss-android-arm641.32.0MPL-2.0
lightningcss-darwin-arm641.32.0MPL-2.0
lightningcss-darwin-x641.32.0MPL-2.0
lightningcss-freebsd-x641.32.0MPL-2.0
lightningcss-linux-arm-gnueabihf1.32.0MPL-2.0
lightningcss-linux-arm64-gnu1.32.0MPL-2.0
lightningcss-linux-arm64-musl1.32.0MPL-2.0
lightningcss-linux-x64-gnu1.32.0MPL-2.0
lightningcss-linux-x64-musl1.32.0MPL-2.0
lightningcss-win32-arm64-msvc1.32.0MPL-2.0
lightningcss-win32-x64-msvc1.32.0MPL-2.0
Resolved Packages (17)
PackageVersionOriginalResolvedSource
@sentry/cli2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-darwin2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
codemirror-lang-elixir4.0.0UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/codemirror-lang-elixir LICENSE + GitHub license API report Apache-2.0)
khroma2.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/fabiospampinato/khroma license file + GitHub license API report MIT)
lezer-elixir1.1.2UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/lezer-elixir LICENSE + GitHub license API report Apache-2.0)
map-stream0.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/dominictarr/map-stream LICENCE + GitHub license API report MIT)
memorystream0.3.1UNKNOWNMITextracted from object (package metadata uses legacy licenses:[{"type":"MIT","url":"..."}] form; confirmed by GitHub license API)
pause-stream0.0.11["MIT","Apache2"](MIT OR Apache-2.0)extracted from object (license array ["MIT","Apache2"]; LICENSE file states "Dual Licensed MIT and Apache 2" and contains both full texts. "Apache2" normalized to SPDX Apache-2.0)
posthog-js1.369.0SEE LICENSE IN LICENSEApache-2.0GitHub repo (LICENSE file is the full Apache-2.0 text, "Licensed under the Apache License, Version 2.0"; no added commercial restrictions. Also bundles MIT-licensed third-party notices)
valid-url1.0.9UNKNOWNMITGitHub repo (npm metadata has no license field; LICENSE file is verbatim MIT text, GitHub reports NOASSERTION only because the title line is absent)

@brendan-kellam
brendan-kellam merged commit 698885c into mainJul 29, 2026
10 of 11 checks passed
@brendan-kellam
brendan-kellam deleted the cursor/cve/seroval branch July 29, 2026 00:17
@github-actionsgithub-actionsBot mentioned this pull request Jul 29, 2026
Open
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jsourcebot@brendan-kellam
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();
Skip to content

chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940 - #1508

Merged
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval
Jul 29, 2026
Merged

chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940#1508
brendan-kellam merged 3 commits into
mainfrom
cursor/cve/seroval

Conversation

@jsourcebot

@jsourcebotjsourcebot commented Jul 24, 2026•
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Fixes SOU-1628

Summary

  • Refresh the existing seroval@~1.5.0 lockfile resolution from 1.5.0 to 1.5.6.
  • Address CVE-2026-59940, which affects seroval through 1.5.2 and is first patched in 1.5.3.
  • Keep the supported transitive dependency range unchanged, with no forced resolution override.

Verification

  • yarn why seroval --recursive
  • yarn workspace @sourcebot/web test --run (97 files, 1,145 tests)
  • yarn workspace @sourcebot/web lint (0 errors; 4 pre-existing warnings)
  • yarn build:deps
  • yarn test

Summary by CodeRabbit

  • Bug Fixes
    • Updated the changelog to record an upgrade of seroval to version 1.5.6.

Note

Low Risk
Patch-level transitive dependency refresh with no app logic changes; typical low-risk security maintenance.

Overview
Bumps the locked transitiveseroval dependency from 1.5.0 to 1.5.6 in yarn.lock (still under the existing ~1.5.0 range pulled in via solid-js). No direct package.json or application code changes.

Documents the upgrade under [Unreleased] → Fixed in CHANGELOG.md, addressing CVE-2026-59940 (vulnerable through 1.5.2; patched from 1.5.3 onward).

Reviewed by Cursor Bugbot for commit d597144. Bugbot is set up for automated code reviews on this repo. Configure here.

@coderabbitai

coderabbitaiBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 75235795-bd9a-485c-8238-74256b608f92

📥 Commits

Reviewing files that changed from the base of the PR and between 4312945 and d597144.

📒 Files selected for processing (1)
  • CHANGELOG.md

Walkthrough

The Unreleased changelog now records the seroval dependency upgrade to ^1.5.6 and includes its associated pull request reference.

Changes

Seroval upgrade documentation

Layer / File(s)Summary
Document seroval upgrade
CHANGELOG.md		Adds an Unreleased → Fixed entry for the seroval upgrade to ^1.5.6, including the pull request reference.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers:msukkari, brendan-kellam

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely describes the main change: upgrading seroval to 1.5.6.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cursor/cve/seroval

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

This comment has been minimized.

Sign in to view
@jsourcebotjsourcebot changed the title chore: upgrade seroval to 1.5.6chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940Jul 24, 2026
@github-actions

github-actionsBot commented Jul 24, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

License Audit

⚠️Status: PASS

MetricCount
Total packages2200
Resolved (non-standard)17
Unresolved0
Strong copyleft0
Weak copyleft28

Weak Copyleft Packages (informational)

PackageVersionLicense
@img/sharp-libvips-darwin-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-darwin-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x1.3.2LGPL-3.0-or-later
@img/sharp-libvips-linux-x641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm641.3.2LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x641.3.2LGPL-3.0-or-later
@img/sharp-wasm320.35.3Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm640.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia320.35.3Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x640.35.3Apache-2.0 AND LGPL-3.0-or-later
axe-core4.10.3MPL-2.0
dompurify3.4.12(MPL-2.0 OR Apache-2.0)
lightningcss1.32.0MPL-2.0
lightningcss-android-arm641.32.0MPL-2.0
lightningcss-darwin-arm641.32.0MPL-2.0
lightningcss-darwin-x641.32.0MPL-2.0
lightningcss-freebsd-x641.32.0MPL-2.0
lightningcss-linux-arm-gnueabihf1.32.0MPL-2.0
lightningcss-linux-arm64-gnu1.32.0MPL-2.0
lightningcss-linux-arm64-musl1.32.0MPL-2.0
lightningcss-linux-x64-gnu1.32.0MPL-2.0
lightningcss-linux-x64-musl1.32.0MPL-2.0
lightningcss-win32-arm64-msvc1.32.0MPL-2.0
lightningcss-win32-x64-msvc1.32.0MPL-2.0
Resolved Packages (17)
PackageVersionOriginalResolvedSource
@sentry/cli2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-darwin2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm2.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-linux-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-arm642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-i6862.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
@sentry/cli-win32-x642.58.5FSL-1.1-MITFSL-1.1-MITnpm registry (registry.npmjs.org reports license "FSL-1.1-MIT"; repo LICENSE at tag 2.58.5 is "Functional Source License, Version 1.1, MIT Future License" - source-available, converts to MIT after 2 years. Not an SPDX-registered identifier)
codemirror-lang-elixir4.0.0UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/codemirror-lang-elixir LICENSE + GitHub license API report Apache-2.0)
khroma2.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/fabiospampinato/khroma license file + GitHub license API report MIT)
lezer-elixir1.1.2UNKNOWNApache-2.0GitHub repo (npm metadata has no license field; github.com/livebook-dev/lezer-elixir LICENSE + GitHub license API report Apache-2.0)
map-stream0.1.0UNKNOWNMITGitHub repo (npm metadata has no license field; github.com/dominictarr/map-stream LICENCE + GitHub license API report MIT)
memorystream0.3.1UNKNOWNMITextracted from object (package metadata uses legacy licenses:[{"type":"MIT","url":"..."}] form; confirmed by GitHub license API)
pause-stream0.0.11["MIT","Apache2"](MIT OR Apache-2.0)extracted from object (license array ["MIT","Apache2"]; LICENSE file states "Dual Licensed MIT and Apache 2" and contains both full texts. "Apache2" normalized to SPDX Apache-2.0)
posthog-js1.369.0SEE LICENSE IN LICENSEApache-2.0GitHub repo (LICENSE file is the full Apache-2.0 text, "Licensed under the Apache License, Version 2.0"; no added commercial restrictions. Also bundles MIT-licensed third-party notices)
valid-url1.0.9UNKNOWNMITGitHub repo (npm metadata has no license field; LICENSE file is verbatim MIT text, GitHub reports NOASSERTION only because the title line is absent)

@brendan-kellam
brendan-kellam merged commit 698885c into mainJul 29, 2026
10 of 11 checks passed
@brendan-kellam
brendan-kellam deleted the cursor/cve/seroval branch July 29, 2026 00:17
@github-actionsgithub-actionsBot mentioned this pull request Jul 29, 2026
Open
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jsourcebot@brendan-kellam