Repository navigation
fix(security): seroval 1.5.6 -> 1.6.11 (CVE-2026-104846) +77 more - #48
Open
leoisadev1 wants to merge 3 commits into
Open
leoisadev1 wants to merge 3 commits into
leoisadev1 wants to merge 3 commits into
Conversation
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
 [Medium impact] The PR appears safe to merge; no actionable defect was established. SummaryUpdates dependency versions across the web app, docs tooling, and offline iOS model tools.
No actionable issue was established. Tests were not rerun during this review. Acknowledged by Reviews (1) · Last reviewed commit: "fix(security): pin transformers 5.17.0 f..." · Reviewed by Greptile |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Main's
bun.lockand the pinnedtools/ios-modelrequirements carried versions covered by 81 published advisories (worst: seroval, CVSS 9.8). This PR moves every package with a fix to the lowest fixed version. 78 advisories are fully fixed. Two more (minimatch, glob) are fixed in every copy except one or two that can't be moved. One (http-cache-semantics) has no fix yet. The open items are listed at the end.The transitive fixes use override keys that match only the vulnerable range (for example
brace-expansion@>=2.0.0 <2.1.7), so copies on other major lines stay where they are. Two cases needed a different shape:seroval ~1.5.4, so solid-js moves to 1.9.18 (the first release on seroval ~1.6.11) and seroval is overridden to 1.6.11, the lowest version clear of all seven seroval advisories.@vercel/nft.Resolving again also moved some
latest-tagged@tanstack/*packages up one patch, moved rolldown 1.2.8 → 1.2.16 (vite 8.3.3), and moved postcss 8.5.28 → 8.5.32. CVSS comes from cve.now. No advisory here is listed in CISA KEV and cve.now gives no EPSS for any of them. cve.now lists a public PoC for CVE-2025-71329 (image-size), CVE-2026-104850 (@modelcontextprotocol/sdk) and CVE-2026-4372 (transformers).Evidence
bun install --frozen-lockfile,bun run lint,bun run typecheck,bun run test(215 + 114 tests pass),python3 -m unittest discover -s tools/ios-model -p 'test_*.py'(2 tests OK) andbun run buildall pass on bun 1.4.2.After (this branch): the same steps all pass with the same test counts. The build ran with
--forceso no Turbo cache was used.vite previewof the built web app serves/with HTTP 200.bun run test:layout(Playwright, Chromium 153) ran againstvite previewof this branch's build with thecat.webpsample: "11 widths, PNG alpha, download, reset, and invalid input passed".export.py --size 384on Python 3.13 with torch 2.14.0+cpu, using the reviewed checkpoint (safetensors SHA-2564417d897…0815). The deform patch differed from torchvision by 3.0e-5, the patched model from the reference by 5.8e-5 in logits, and the final ONNX from torch by 6.2e-5 in logits and 6.9e-10 in sigmoid. All are inside the script's 1e-3 / 2.5e-4 gates, so the export was published.quantize.py(Python 3.10, onnxruntime 1.19.2) quantized and packaged that real 384px export into.onnxand.ort. Old and new pins also both pass on a synthetic Conv+MatMul model.nodeFileTraceon a fixture with a dynamicrequire(__dirname + '/dir/' + x)gives the same file list on main and on this branch.bun.lock/ requirements.docs/ios-model.mdsays, the conversion versions can change artifact bytes. Nothing in the shipped model files changes here.Fixed advisories
>=0.12.0 <1.6.2bun.lock>=1.1.0 <2.0.8bun.lock>=0 <0.35.5bun.lock>=17.0.0 <21.0.4bun.lock>=1.2.0 <2.0.3bun.lock>=0.6.3 <2.0.3bun.lock>=0 <1.21.0tools/ios-model/requirements-quantize.txt>=1.0.0 <1.2.2bun.lock>=1.24.0 <1.32.0bun.lock>=0 <21.0.0bun.lock>=0 <1.21.0rc1tools/ios-model/requirements-quantize.txt>=0 <1.21.0tools/ios-model/requirements-quantize.txt>=1.8.4 <1.11.0bun.lock>=4.0.0 <4.18.0bun.lock>=0 <=5.2.0tools/ios-model/requirements-export.txt>=0 <=5.0.0-rc0tools/ios-model/requirements-export.txt>=0 <5.3.0tools/ios-model/requirements-export.txt>=4.49.0 <=5.8.1tools/ios-model/requirements-export.txt>=4.0.0 <6.3.0bun.lock>=0 <1.1.19bun.lock>=2.0.0 <2.1.5bun.lock>=4.0.0 <5.0.10bun.lock>=0 <1.1.20bun.lock>=2.0.0 <2.1.6bun.lock>=4.0.0 <5.0.11bun.lock>=0 <1.6.3bun.lock>=1.12.0 <1.31.0bun.lock>=7.18.0 <7.30.1bun.lock>=8.0.0 <8.12.2bun.lock>=0 <2.14.2bun.lock>=0 <1.6.8bun.lock>=0 <1.6.8bun.lock>=1.4.1 <1.6.8bun.lock>=1.4.1 <1.6.8bun.lock>=4.0.0 <6.3.0bun.lock>=7.0.0 <7.30.1bun.lock>=8.0.0 <8.12.2bun.lock>=5.1.0 <5.9.3bun.lock>=7.0.0 <7.30.1bun.lock>=8.0.0 <8.12.2bun.lock>=7.0.0 <7.30.1bun.lock>=8.0.0 <8.12.2bun.lock>=0 <1.6.8bun.lock>=0 <1.6.8bun.lock>=0 <1.21.0tools/ios-model/requirements-quantize.txt>=0 <5.10.0tools/ios-model/requirements-export.txt>=4.12.4 <4.13.11bun.lockdist/node_modules(nitro's tracer)>=9.0.0 <14.0.2>=0 <11.0.1bun.lock>=0 <20.14.6bun.lock>=0 <5.0.0tools/ios-model/requirements-export.txt>=0 <4.18.0bun.lock>=0 <10.7.1bun.lock>=0 <10.7.1bun.lock>=0 <10.7.4bun.lock>=0 <2.14.2bun.lock>=0 <2.14.2bun.lock>=8.3.0 <8.3.3bun.lock>=8.3.0 <8.3.3bun.lock>=9.0.0 <14.0.2bun.lock>=0 <1.22.0tools/ios-model/requirements-quantize.txt>=1.2.1 <1.22.0tools/ios-model/requirements-quantize.txt>=1.4.0 <1.22.0tools/ios-model/requirements-quantize.txt>=0 <1.22.0tools/ios-model/requirements-quantize.txt>=3.0.0 <3.1.9bun.lock>=0 <6.1.5bun.lock>=7.15.0 <7.30.1bun.lock>=8.0.0 <8.12.2bun.lock>=7.0.0 <7.30.1bun.lock>=8.0.0 <8.12.2bun.lock>=7.0.0 <7.30.1bun.lock>=8.0.0 <8.12.2bun.lock>=0 <1.21.0tools/ios-model/requirements-quantize.txt>=1.9.0 <1.22.0tools/ios-model/requirements-quantize.txt>=0 <1.1.21bun.lock>=2.0.0 <2.1.7bun.lock>=4.0.0 <5.0.12bun.lock>=6.7.0 <6.16.1bun.lock>=4.12.4 <4.13.11bun.lock>=1.6.0 <1.6.11bun.lock>=1.19.10 <2.1.3bun.lock>=3.4.13 <3.4.16bun.lock>=0 <3.4.16bun.lock>=0 <3.4.17bun.lock>=0 <3.4.17bun.lock>=3.4.4 <3.4.17bun.lock>=3.1.3 <3.1.9bun.lock>=3.0.0 <3.1.8bun.lock>=1.5.5 <1.6.10bun.lock>=1.5.5 <1.6.10bun.lock>=0 <1.21.0tools/ios-model/requirements-quantize.txt>=3.0.0 <3.1.9bun.lock>=3.0.0 <3.1.9bun.lock>=1.3.0 <1.22.0tools/ios-model/requirements-quantize.txt>=7.1.0 <7.3.3bun.lock>=0.11.0 <0.18.2bun.lock>=8.3.0 <8.3.3bun.lock>=1.10.0 <1.30.1bun.lockLeft open
>=0 <=4.2.0dist/node_modules(nitro's tracer)>=9.0.0 <14.0.2>=0 <11.0.1Merge Danger
Door: two-way. Only dependency versions, the lockfile and one docs line change, and a revert restores the old resolution.
Blast radius: the web build and dev tooling, the docs build, the test environment (happy-dom 21), and the offline iOS model scripts. Nothing changes in
@bg0/browser's own dependencies, so the published package's manifest is unchanged. The riskiest parts are transformers 4 → 5 in the offline export tool, which was exercised end to end above, and the docs' quantize environment moving from Python 3.9 to 3.10.Created with Claude Opus 5.5 in Capy.