Why
Two moderate advisories in seroval, both published 28 Oct 21:17 UTC, affect the Observatory frontend lock:
- GHSA-9wx9-5pv9-3349 — script injection through RegExp sources in serialized output (fixed 1.6.10)
- GHSA-f86p-h4j2-7qgj — code injection through a typed array's own constructor property (fixed 1.6.11)
seroval 1.6.8 is pulled transitively by @tanstack/router-core, @tanstack/start-client-core, @tanstack/start-plugin-core and @tanstack/start-server-core, all of which declare ^1.6.7.
Change
packages/phlo-observatory/src/phlo_observatory/package-lock.json: seroval 1.6.8 -> 1.7.3, resolver output only (npm update seroval --package-lock-only). No manifest edit.
The resolver picked 1.7.3 rather than the minimal 1.6.12 because every parent range is ^1.6.7; npm cannot pin a transitive package to 1.6.12 without adding it as a direct dependency or an override, which this PR deliberately avoids. 1.7.3 is a minor within those ranges, not a major. One side effect to note at review: seroval's engines.node moves from >=10 to >=20, which the frontend toolchain already satisfies.
Verification
npm update seroval --package-lock-only # 1.6.8 -> 1.7.3
npm ci # 588 packages, clean install
npm test # 63 files, 297 tests passed
python3 scripts/dependency_delta.py --base b8fef367 --head 22604ea --mode queue
# introduced 0; both seroval advisories clearedThe assessment still exits 1, but only on msgpack GHSA-j586-36cw-2gc2 (13 locks, tracked by #1205) — a separate advisory that this PR does not claim to fix. The seroval entries are gone and no new vulnerable version was introduced.
Activity
303
github-actions[bot]1d agosecurity(deps): GHSA-9wx9-5pv9-3349 in npm/seroval 1.6.8
Phlo agent owns advisory triage, compatibility analysis and coordination with Renovate. Maintainers own escalation if automation is unavailable. An agent cannot approve an exception or replace the scanner verdict.
Independent assessment: https://github.com/phlohouse/phlo/actions/runs/40831408133
Affected consumer locks:
packages/phlo-observatory/src/phlo_observatory/package-lock.json
github-actions[bot]1d agosecurity(deps): GHSA-f86p-h4j2-7qgj in npm/seroval 1.6.8
Phlo agent owns advisory triage, compatibility analysis and coordination with Renovate. Maintainers own escalation if automation is unavailable. An agent cannot approve an exception or replace the scanner verdict.
Independent assessment: https://github.com/phlohouse/phlo/actions/runs/40831408133
Affected consumer locks:
packages/phlo-observatory/src/phlo_observatory/package-lock.json
coldtea-pr-lens[bot]18h agoNOTE
phlo-agent[bot] opened this pull request, so PR Lens left it undrawn. Comment
@pr-lens drawto draw it
github.comment.notice: false in .github/pr-lens.yml turns this note off
phlo-agent[bot]18h agoReviewed b7e4b2a. No actionable findings.
The diff is a single hunk in package-lock.json L9090-L9098: seroval 1.6.8 -> 1.7.3. The recorded integrity matches the published seroval@1.7.3 artifact, and no manifest change is needed because every parent range is ^1.6.7.
Advisories: GHSA-9wx9-5pv9-3349 is patched at 1.6.10 and GHSA-f86p-h4j2-7qgj at 1.6.11, so 1.7.3 clears both; no seroval advisory published to date covers 1.7.3.
Compatibility: the new engines.node >=20 floor is satisfied by the Observatory Dockerfile (node:24-alpine for build and runtime) and the documented Node 24 development floor. seroval-plugins stays at 1.6.8, whose peer range is seroval: ^1.0. The 1.7.0 plugin hooks are additive and the newer plugin is the side that requires them, so old plugin on new core is the compatible pairing; the only consequence is that the 1.6.8 ReadableStream plugin keeps its pre-1.7 streaming path.
Policy and CI: resolver-only update, security/dependency-risks.json stays empty, and the required PR lanes at the head SHA are green, including security / introduced dependency risk and ci / behaviour / JavaScript. The author's queue-mode assessment reports both seroval advisories cleared, and the diff touches no other lock.
Remaining validation: the merge-queue run on the queue base, which the queue entry at 08:50 UTC triggered. Nothing else is outstanding from this review.
security(deps): GHSA-j586-36cw-2gc2 in PyPI/msgpack 1.2.1
Phlo agent owns advisory triage, compatibility analysis and coordination with Renovate. Maintainers own escalation if automation is unavailable. An agent cannot approve an exception or replace the scanner verdict.
Independent assessment: https://github.com/phlohouse/phlo/actions/runs/40831408133
Affected consumer locks:
examples/lakehouses/clickhouse-ops/uv.lockexamples/lakehouses/customer360/uv.lockexamples/lakehouses/delta-portability/uv.lockexamples/lakehouses/ecommerce-replication/uv.lockexamples/lakehouses/federated-domains/uv.lockexamples/lakehouses/healthcare-claims/uv.lockexamples/lakehouses/iot-telemetry/uv.lockexamples/lakehouses/logistics-control-tower/uv.lockexamples/lakehouses/market-data-fx/uv.lockexamples/lakehouses/public-data-research/uv.lockexamples/lakehouses/saas-product-analytics/uv.lockexamples/lakehouses/wap-failure-lab/uv.lockuv.lock