chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940

[jsourcebot]

Fixes SOU-1628

Summary

• Refresh the existing seroval@~1.5.0 lockfile resolution from 1.5.0 to 1.5.6.
• Address CVE-2026-59940, which affects seroval through 1.5.2 and is first patched in 1.5.3.
• Keep the supported transitive dependency range unchanged, with no forced resolution override.

Verification

• yarn why seroval --recursive
• yarn workspace @sourcebot/web test --run (97 files, 1,145 tests)
• yarn workspace @sourcebot/web lint (0 errors; 4 pre-existing warnings)
• yarn build:deps
• yarn test

Summary by CodeRabbit

• Bug Fixes
  • Updated the changelog to record the seroval upgrade to version 1.5.6.

[coderabbitai]

Walkthrough

The Unreleased changelog now records the seroval dependency upgrade to ^1.5.6 and includes its associated pull request reference.

Changes

Seroval upgrade documentation

Layer / File(s)	Summary
Document seroval upgrade CHANGELOG.md	Adds an Unreleased → Fixed entry for the seroval upgrade to ^1.5.6, including the pull request reference.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: msukkari, brendan-kellam

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: upgrading seroval to 1.5.6.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/cve/seroval

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

License Audit

⚠️ Status: PASS

Metric	Count
Total packages	2200
Resolved (non-standard)	17
Unresolved	0
Strong copyleft	0
Weak copyleft	28

Weak Copyleft Packages (informational)

Package	Version	License
@img/sharp-libvips-darwin-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-wasm32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
axe-core	4.10.3	MPL-2.0
dompurify	3.4.12	(MPL-2.0 OR Apache-2.0)
lightningcss	1.32.0	MPL-2.0
lightningcss-android-arm64	1.32.0	MPL-2.0
lightningcss-darwin-arm64	1.32.0	MPL-2.0
lightningcss-darwin-x64	1.32.0	MPL-2.0
lightningcss-freebsd-x64	1.32.0	MPL-2.0
lightningcss-linux-arm-gnueabihf	1.32.0	MPL-2.0
lightningcss-linux-arm64-gnu	1.32.0	MPL-2.0
lightningcss-linux-arm64-musl	1.32.0	MPL-2.0
lightningcss-linux-x64-gnu	1.32.0	MPL-2.0
lightningcss-linux-x64-musl	1.32.0	MPL-2.0
lightningcss-win32-arm64-msvc	1.32.0	MPL-2.0
lightningcss-win32-x64-msvc	1.32.0	MPL-2.0

Resolved Packages (17)

Package	Version	Original	Resolved	Source
codemirror-lang-elixir	4.0.0	UNKNOWN	Apache-2.0	bundled LICENSE file in installed package (version-matched) + npm registry metadata
khroma	2.1.0	UNKNOWN	MIT	GitHub repo LICENSE file (fabiospampinato/khroma) + bundled LICENSE file in installed package (version-matched)
lezer-elixir	1.1.2	UNKNOWN	Apache-2.0	bundled LICENSE file in installed package (version-matched) + npm registry metadata
map-stream	0.1.0	UNKNOWN	MIT	bundled LICENSE file in installed package (version-matched) + npm registry metadata
memorystream	0.3.1	UNKNOWN	MIT	extracted from object (legacy licenses array in package.json: type=MIT) + bundled LICENSE file in installed package (version-matched)
valid-url	1.0.9	UNKNOWN	MIT	GitHub repo LICENSE file (ogt/valid-url) + bundled LICENSE file in installed package (version-matched)
pause-stream	0.0.11	MIT,Apache2	(MIT OR Apache-2.0)	extracted from object (license array ["MIT","Apache2"]); bundled LICENSE states "Dual Licensed MIT and Apache 2"
posthog-js	1.369.0	SEE LICENSE IN LICENSE	(Apache-2.0 AND MIT)	bundled LICENSE file in installed package (version-matched): primary grant Apache-2.0 plus MIT notices for vendored files; upstream declares (Apache-2.0 AND MIT) on later versions
@sentry/cli	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry metadata for 2.58.5 + bundled LICENSE file (Functional Source License 1.1, MIT Future License); not an SPDX-registered identifier and not OSI-approved
@sentry/cli-darwin	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry metadata for 2.58.5 + bundled LICENSE file (Functional Source License 1.1, MIT Future License); not an SPDX-registered identifier and not OSI-approved
@sentry/cli-linux-arm	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry metadata for 2.58.5 + bundled LICENSE file (Functional Source License 1.1, MIT Future License); not an SPDX-registered identifier and not OSI-approved
@sentry/cli-linux-arm64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry metadata for 2.58.5 + bundled LICENSE file (Functional Source License 1.1, MIT Future License); not an SPDX-registered identifier and not OSI-approved
@sentry/cli-linux-i686	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry metadata for 2.58.5 + bundled LICENSE file (Functional Source License 1.1, MIT Future License); not an SPDX-registered identifier and not OSI-approved
@sentry/cli-linux-x64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry metadata for 2.58.5 + bundled LICENSE file (Functional Source License 1.1, MIT Future License); not an SPDX-registered identifier and not OSI-approved
@sentry/cli-win32-arm64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry metadata for 2.58.5 + bundled LICENSE file (Functional Source License 1.1, MIT Future License); not an SPDX-registered identifier and not OSI-approved
@sentry/cli-win32-i686	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry metadata for 2.58.5 + bundled LICENSE file (Functional Source License 1.1, MIT Future License); not an SPDX-registered identifier and not OSI-approved
@sentry/cli-win32-x64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	npm registry metadata for 2.58.5 + bundled LICENSE file (Functional Source License 1.1, MIT Future License); not an SPDX-registered identifier and not OSI-approved