Bump seroval to 1.5.6 to resolve fromJSON type confusion alert #299

[wojtekn]

Related issues

• Related to Dependabot alert #299

How AI was used in this PR

Claude Code inspected the open Dependabot alerts, traced seroval through the dependency tree (transitive via @tanstack/react-router), confirmed a clean npm update resolution with no other subtree churn, and verified every resolved copy landed on the patched version. I reviewed the lockfile diff myself.

Proposed Changes

Resolves the critical seroval advisory (seroval.fromJSON() Promise resolver type confusion, which could invoke attacker-controlled methods during deserialization) by bumping seroval from 1.5.2 to 1.5.6. This is a lockfile-only change to a transitive dependency; there is no user-visible behavior change.

Testing Instructions

• npm ci resolves cleanly.
• npm ls seroval reports 1.5.6 for every copy (no lingering 1.5.2).

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

[wpmobilebot]

📊 Performance Test Results

Comparing 436e0b1 vs trunk

app-size

Metric	trunk	436e0b1	Diff	Change
App Size (Mac)	1378.86 MB	1378.86 MB	+0.00 MB	⚪ 0.0%

site-editor

Metric	trunk	436e0b1	Diff	Change
load	751 ms	772 ms	+21 ms	⚪ 0.0%

site-startup

Metric	trunk	436e0b1	Diff	Change
siteCreation	6509 ms	6518 ms	+9 ms	⚪ 0.0%
siteStartup	2379 ms	2373 ms	6 ms	⚪ 0.0%

---

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)