perf(router,start): update Seroval to 1.7.1 by LadyBluenotes · Pull Request #8806 · TanStack/router

LadyBluenotes · 2026-10-24T18:10:27Z

🎯 Changes

Update Router and Start from Seroval 1.6.7 to 1.7.1, and the SSR benchmark dependency to match. Seroval 1.7 cuts per-node allocations in its parsers and streaming serializers, and adds backpressure for streamed async iterables and ReadableStream values (1.7.0 release notes).

Seroval 1.7 deserializes streams as instances of its new Stream class. The RawStream factory tests now build real streams with createStream() and spy on on, instead of typing hand-built objects as Stream.
Disposing crossSerializeStream or toCrossJSONStream no longer calls onDone. The SSR and server-function dispose paths are abort and cleanup paths that close their output themselves, so nothing depended on it.
Seroval now requires Node 20 or later, which Router and Start already require.

Start client bundles built with Vite grow. Most of the growth is the new LiveStream class: isStream checks value instanceof LiveStream, so bundles keep the class even though the client never creates one. A minimal Rolldown entry with Start's client Seroval imports goes from 7,460 B to 8,652 B gzip. Rsbuild bundles shrink, because 1.7 lets Rspack tree-shake Seroval modules it previously kept.

✅ Checklist

I have followed the steps in the Contributing guide.
I have tested code changes locally with the relevant test commands, or tests do not apply to this pull request.
I fully understand the code in this pull request, including any code generated with AI assistance.

🚀 Release Impact

This change affects published code, and I have generated a changeset.
This change is docs/CI/dev-only (no release).

Summary by CodeRabbit

Chores
- Updated the serialization components used across router, client, plugin, and server packages. Server-rendering benchmarks now use the same updated version.
Tests
- Improved coverage of stream cancellation and disposal behavior using real streams. No public API changes are included.

Update seroval and seroval-plugins from 1.6.7 to 1.7.1 in Router, Start, and the SSR benchmarks. Seroval 1.7 rebuilds streams as instances of its new `Stream` class, so the RawStream factory tests build real streams with `createStream()` and spy on `on` instead of typing hand-built objects as `Stream`.

changeset-bot · 2026-10-24T18:10:33Z

🦋 Changeset detected

Latest commit: fb223d5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 23 packages

Name	Type
@tanstack/router-core	Patch
@tanstack/start-client-core	Patch
@tanstack/start-server-core	Patch
@tanstack/start-plugin-core	Patch
@tanstack/start-static-server-functions	Patch
@tanstack/react-router	Patch
@tanstack/react-start-client	Patch
@tanstack/react-start-rsc	Patch
@tanstack/react-start-server	Patch
@tanstack/router-generator	Patch
@tanstack/router-plugin	Patch
@tanstack/solid-router	Patch
@tanstack/solid-start-client	Patch
@tanstack/solid-start-server	Patch
@tanstack/start-storage-context	Patch
@tanstack/vue-router	Patch
@tanstack/vue-start-client	Patch
@tanstack/vue-start-server	Patch
@tanstack/react-start	Patch
@tanstack/solid-start	Patch
@tanstack/vue-start	Patch
@tanstack/router-cli	Patch
@tanstack/router-vite-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

nx-cloud · 2026-10-24T18:10:53Z

View your CI Pipeline Execution ↗ for commit fb223d5

Command	Status	Duration	Result
`nx affected --targets=test:eslint,test:unit,tes...`	✅ Succeeded	10m 37s	View ↗
`nx run-many --target=build --exclude=examples/*...`	✅ Succeeded	1m 50s	View ↗

☁️ Nx Cloud last updated this comment at 2026-10-24 18:22:29 UTC

socket-security · 2026-10-24T18:11:30Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	seroval-plugins@1.6.7 ⏵ 1.7.1			⁺²	⁺¹
	seroval@1.6.7 ⏵ 1.7.1	⁺¹			⁺¹

View full report

github-actions · 2026-10-24T18:12:31Z

🚀 Changeset Version Preview

5 package(s) bumped directly, 18 bumped as dependents.

🟩 Patch bumps

Package	Version	Reason
`@tanstack/router-core`	1.171.39 → 1.171.40	Changeset
`@tanstack/start-client-core`	1.170.39 → 1.170.40	Changeset
`@tanstack/start-plugin-core`	1.171.55 → 1.171.56	Changeset
`@tanstack/start-server-core`	1.169.45 → 1.169.46	Changeset
`@tanstack/start-static-server-functions`	1.167.44 → 1.167.45	Changeset
`@tanstack/react-router`	1.170.46 → 1.170.47	Dependent
`@tanstack/react-start`	1.169.4 → 1.169.5	Dependent
`@tanstack/react-start-client`	1.168.44 → 1.168.45	Dependent
`@tanstack/react-start-rsc`	0.1.65 → 0.1.66	Dependent
`@tanstack/react-start-server`	1.167.52 → 1.167.53	Dependent
`@tanstack/router-cli`	1.167.46 → 1.167.47	Dependent
`@tanstack/router-generator`	1.167.46 → 1.167.47	Dependent
`@tanstack/router-plugin`	1.168.48 → 1.168.49	Dependent
`@tanstack/router-vite-plugin`	1.167.48 → 1.167.49	Dependent
`@tanstack/solid-router`	1.170.43 → 1.170.44	Dependent
`@tanstack/solid-start`	1.169.4 → 1.169.5	Dependent
`@tanstack/solid-start-client`	1.168.42 → 1.168.43	Dependent
`@tanstack/solid-start-server`	1.167.50 → 1.167.51	Dependent
`@tanstack/start-storage-context`	1.167.41 → 1.167.42	Dependent
`@tanstack/vue-router`	1.170.42 → 1.170.43	Dependent
`@tanstack/vue-start`	1.169.4 → 1.169.5	Dependent
`@tanstack/vue-start-client`	1.167.45 → 1.167.46	Dependent
`@tanstack/vue-start-server`	1.167.50 → 1.167.51	Dependent

coderabbitai · 2026-10-24T18:12:54Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: TanStack/router
Branch: chore/update-seroval-1.7.1
File: .coderabbit.yaml
Commit: fb223d5
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: e93fb2f0-ee13-45df-9c17-f107ec3b73d2

Commits

Reviewing files that changed from the base of the PR and between 6b9fe6d and fb223d5.

Files ignored due to path filters: 1

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 8

.changeset/bump-seroval-1-7-1.md
benchmarks/ssr/package.json
packages/router-core/package.json
packages/router-core/tests/RawStream.test.ts
packages/start-client-core/package.json
packages/start-plugin-core/package.json
packages/start-server-core/package.json
packages/start-static-server-functions/package.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The pull request updates Seroval dependency ranges to 1.7.1 across TanStack packages and the SSR benchmark. It adds a patch changeset and revises RawStream tests to use real streams and a shared subscription spy.

Changes: Seroval dependency upgrade

Layer / File(s)	Summary
Update Seroval dependency ranges `packages/router-core/package.json`, `packages/start-client-core/package.json`, `packages/start-plugin-core/package.json`, `packages/start-server-core/package.json`, `packages/start-static-server-functions/package.json`, `benchmarks/ssr/package.json`, `.changeset/bump-seroval-1-7-1.md`	The package manifests and SSR benchmark now specify Seroval 1.7.1. The changeset records the package updates and describes upstream changes.
Revise RawStream test streams `packages/router-core/tests/RawStream.test.ts`	The tests use real streams and a shared subscription spy to check cancellation and terminal-disposal behavior.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Possibly related issues

TanStack/router#7706 — The dependency upgrade affects serialization dependencies used by Start, but the available summary does not establish that it fixes the reported deserialization error.

Suggested reviewers: schiller-manuel, sheraff

Merge Risk: Minimal · up to fb223

This is a routine dependency upgrade with matching test updates. No concrete merge-blocking risk was identified. The author reports a modest client bundle size increase under Vite, which was an accepted tradeoff.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (7 skipped: 7…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly summarizes the main change: updating Seroval to 1.7.1 in Router and Start.
Description check		The description includes the required Changes, Checklist, and Release Impact sections. It explains the dependency update, motivation, test changes, and reported bundle-size effects. The testing and ch…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description includes the required Changes, Checklist, and Release Impact sections. It explains the dependency update, motivation, test changes, and reported bundle-size effects. The testing and changeset checklist items are checked; the contributing-guide and code-understanding items remain unchecked.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (7 skipped: 7 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches: 💡 1

📝 Generate docstrings: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-24T18:13:26Z

Bundle Size Benchmarks

Commit: 05a8b9257f0f
Measured at: 2026-10-24T18:12:54.764Z
Baseline source: history:6b9fe6d29552
Dashboard: bundle-size history

The following scenarios have bundle-size changes compared with the baseline:

Scenario	Current (gzip)	Initial (gzip)	Raw	Brotli	Trend
`react-start.minimal`	97.9 KiB +1.1 KiB	97.8 KiB +1.1 KiB	303.9 KiB +1.5 KiB	85.1 KiB +1,002 B	▁▁▁▁▁▁▁▁▁▁▁█
`react-start.query-integration`	105.3 KiB +1.1 KiB	105.2 KiB +1.1 KiB	330.5 KiB +1.5 KiB	91.5 KiB +1.0 KiB	▁▁▁▁▁▁▁▁▁▁▁█
`react-start.deferred-hydration`	98.6 KiB +1.1 KiB	97.8 KiB +1.1 KiB	305.3 KiB +1.5 KiB	85.7 KiB +1.0 KiB	▁▁▁▁▁▁▁▁▁▁▁█
`react-start.full`	101.0 KiB +1.1 KiB	100.8 KiB +1.1 KiB	313.2 KiB +1.5 KiB	87.7 KiB +1.1 KiB	▁▁▁▁▁▁▁▁▁▁▁█
`react-start.rsbuild.minimal`	97.8 KiB -2.5 KiB	97.7 KiB -2.5 KiB	300.9 KiB -12.3 KiB	84.6 KiB -2.0 KiB	███████████▁
`react-start.rsbuild.minimal-iife`	98.2 KiB -2.5 KiB	98.1 KiB -2.5 KiB	301.9 KiB -12.3 KiB	85.0 KiB -2.0 KiB	███████████▁
`react-start.rsbuild.full`	101.0 KiB -2.5 KiB	100.9 KiB -2.5 KiB	310.6 KiB -12.3 KiB	87.3 KiB -2.1 KiB	███████████▁
`solid-start.minimal`	47.3 KiB +1.1 KiB	47.2 KiB +1.1 KiB	136.6 KiB +1.6 KiB	42.3 KiB +1.1 KiB	▁▁▁▁▁▁▁▁▁▁▁█
`solid-start.deferred-hydration`	50.4 KiB +1.2 KiB	47.3 KiB +1.2 KiB	143.9 KiB +1.6 KiB	45.0 KiB +1.1 KiB	▁▁▁▁▁▁▁▁▁▁▁█
`solid-start.full`	52.3 KiB +1.2 KiB	52.2 KiB +1.2 KiB	151.6 KiB +1.6 KiB	46.5 KiB +1.0 KiB	▁▁▁▁▁▁▁▁▁▁▁█
`vue-start.minimal`	66.5 KiB +1.1 KiB	66.4 KiB +1.1 KiB	187.2 KiB +1.6 KiB	59.4 KiB +1,004 B	▁▁▁▁▁▁▁▁▁▁▁█
`vue-start.full`	70.3 KiB +1.2 KiB	70.1 KiB +1.2 KiB	199.1 KiB +1.6 KiB	62.7 KiB +1.0 KiB	▁▁▁▁▁▁▁▁▁▁▁█

Current gzip tracks all emitted client JS chunks. Initial gzip tracks only the entry/import graph. Trend sparkline is historical current gzip ending with this PR measurement; lower is better.

pkg-pr-new · 2026-10-24T18:16:00Z

More templates

@tanstack/arktype-adapter

npm i https://pkg.pr.new/@tanstack/arktype-adapter@8806

@tanstack/eslint-plugin-router

npm i https://pkg.pr.new/@tanstack/eslint-plugin-router@8806

@tanstack/eslint-plugin-start

npm i https://pkg.pr.new/@tanstack/eslint-plugin-start@8806

@tanstack/history

npm i https://pkg.pr.new/@tanstack/history@8806

@tanstack/react-router

npm i https://pkg.pr.new/@tanstack/react-router@8806

@tanstack/react-router-devtools

npm i https://pkg.pr.new/@tanstack/react-router-devtools@8806

@tanstack/react-router-ssr-query

npm i https://pkg.pr.new/@tanstack/react-router-ssr-query@8806

@tanstack/react-start

npm i https://pkg.pr.new/@tanstack/react-start@8806

@tanstack/react-start-client

npm i https://pkg.pr.new/@tanstack/react-start-client@8806

@tanstack/react-start-rsc

npm i https://pkg.pr.new/@tanstack/react-start-rsc@8806

@tanstack/react-start-server

npm i https://pkg.pr.new/@tanstack/react-start-server@8806

@tanstack/router-cli

npm i https://pkg.pr.new/@tanstack/router-cli@8806

@tanstack/router-core

npm i https://pkg.pr.new/@tanstack/router-core@8806

@tanstack/router-devtools

npm i https://pkg.pr.new/@tanstack/router-devtools@8806

@tanstack/router-devtools-core

npm i https://pkg.pr.new/@tanstack/router-devtools-core@8806

@tanstack/router-generator

npm i https://pkg.pr.new/@tanstack/router-generator@8806

@tanstack/router-plugin

npm i https://pkg.pr.new/@tanstack/router-plugin@8806

@tanstack/router-ssr-query-core

npm i https://pkg.pr.new/@tanstack/router-ssr-query-core@8806

@tanstack/router-utils

npm i https://pkg.pr.new/@tanstack/router-utils@8806

@tanstack/router-vite-plugin

npm i https://pkg.pr.new/@tanstack/router-vite-plugin@8806

@tanstack/solid-router

npm i https://pkg.pr.new/@tanstack/solid-router@8806

@tanstack/solid-router-devtools

npm i https://pkg.pr.new/@tanstack/solid-router-devtools@8806

@tanstack/solid-router-ssr-query

npm i https://pkg.pr.new/@tanstack/solid-router-ssr-query@8806

@tanstack/solid-start

npm i https://pkg.pr.new/@tanstack/solid-start@8806

@tanstack/solid-start-client

npm i https://pkg.pr.new/@tanstack/solid-start-client@8806

@tanstack/solid-start-server

npm i https://pkg.pr.new/@tanstack/solid-start-server@8806

@tanstack/start-client-core

npm i https://pkg.pr.new/@tanstack/start-client-core@8806

@tanstack/start-fn-stubs

npm i https://pkg.pr.new/@tanstack/start-fn-stubs@8806

@tanstack/start-plugin-core

npm i https://pkg.pr.new/@tanstack/start-plugin-core@8806

@tanstack/start-server-core

npm i https://pkg.pr.new/@tanstack/start-server-core@8806

@tanstack/start-static-server-functions

npm i https://pkg.pr.new/@tanstack/start-static-server-functions@8806

@tanstack/start-storage-context

npm i https://pkg.pr.new/@tanstack/start-storage-context@8806

@tanstack/valibot-adapter

npm i https://pkg.pr.new/@tanstack/valibot-adapter@8806

@tanstack/virtual-file-routes

npm i https://pkg.pr.new/@tanstack/virtual-file-routes@8806

@tanstack/vue-router

npm i https://pkg.pr.new/@tanstack/vue-router@8806

@tanstack/vue-router-devtools

npm i https://pkg.pr.new/@tanstack/vue-router-devtools@8806

@tanstack/vue-router-ssr-query

npm i https://pkg.pr.new/@tanstack/vue-router-ssr-query@8806

@tanstack/vue-start

npm i https://pkg.pr.new/@tanstack/vue-start@8806

@tanstack/vue-start-client

npm i https://pkg.pr.new/@tanstack/vue-start-client@8806

@tanstack/vue-start-server

npm i https://pkg.pr.new/@tanstack/vue-start-server@8806

@tanstack/zod-adapter

npm i https://pkg.pr.new/@tanstack/zod-adapter@8806

commit: fb223d5

codspeed · 2026-10-24T18:28:37Z

Merging this PR will regress 11 benchmarks

2 warnings

⚠️ 39 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

⚠️ Base and head ran on different runner types

Some benchmarks with significant performance changes were compared across different runner types, so the changes might not come from the code. Run base and head on the same runner type, or use CodSpeed Macro Runners for more stable results.

Learn more about Macro Runners

Open the report in CodSpeed to investigate

⚡ 65 improved benchmarks
❌ 11 regressed benchmarks
✅ 118 untouched benchmarks
⏩ 3 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	`BASE`	`HEAD`	Efficiency
❌	Memory	`mem server streaming-peak chunked (vue)`	221.4 KB	322.5 KB	-31.35%
❌	Memory	`mem server streaming-peak chunked (solid)`	350.6 KB	482.4 KB	-27.32%
❌	Memory	`mem server error-paths error (vue)`	131.8 KB	141.1 KB	-6.53%
❌	Memory	`mem server request-churn (vue)`	139.2 KB	148.9 KB	-6.51%
❌	Memory	`mem server error-paths redirect (solid)`	11.4 KB	12.1 KB	-6.31%
❌	Memory	`mem server aborted-requests (vue)`	116.1 KB	123.5 KB	-5.98%
❌	Memory	`mem client navigation-churn (solid)`	107.4 KB	113.6 KB	-5.51%
❌	Memory	`mem server request-churn (react)`	255.2 KB	269.6 KB	-5.34%
❌	Memory	`mem server error-paths unmatched (solid)`	50.8 KB	53 KB	-4.1%
❌	Memory	`mem server error-paths not-found (solid)`	63.4 KB	66.1 KB	-4.04%
❌	Memory	`mem server error-paths error (solid)`	63.3 KB	65.6 KB	-3.48%
⚡	CPU Simulation	`ssr selective (react)`	509.2 ms	338.4 ms	+50.49%
⚡	CPU Simulation	`ssr selective (solid)`	515.9 ms	343.6 ms	+50.17%
⚡	CPU Simulation	`ssr loaders (react)`	324.8 ms	225 ms	+44.34%
⚡	CPU Simulation	`ssr loaders (solid)`	317.1 ms	227.2 ms	+39.54%
⚡	CPU Simulation	`ssr selective (vue)`	634.7 ms	462.1 ms	+37.35%
⚡	CPU Simulation	`ssr dehydrate plain control (react)`	202.7 ms	156.9 ms	+29.21%
⚡	CPU Simulation	`ssr dehydrate rich types (react)`	205 ms	158.9 ms	+28.96%
⚡	CPU Simulation	`ssr loaders (vue)`	403.7 ms	315.1 ms	+28.1%
⚡	CPU Simulation	`ssr global-mw server-fn (react)`	179.3 ms	141 ms	+27.21%
...	...	...	...	...	...

ℹ️ Only the first 20 benchmarks are displayed. Go to the app to view all benchmarks.

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

_{Comparing chore/update-seroval-1.7.1 (fb223d5) with main (6b9fe6d)}

3 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

….14 (#357) GitHub's dependency graph does not read bun.lock, so these never became Dependabot alerts. `bun audit` listed 22 (1 critical, 13 high, 7 moderate, 1 low); it now lists none. **What moved (package.json ranges unchanged)** - seroval and seroval-plugins 1.5.4 -> 1.6.12 (@tanstack/router-core 1.171.15 asks ^1.5.4): clears critical GHSA-p6vx-979v-rg4c and four highs. Held at 1.6.12 rather than 1.7.x, which changes how streams serialize and which TanStack's own lockfile does not test yet (their move to 1.7.1 is TanStack/router#8806). The desktop bundle contains no seroval code either way: it only serves SSR hydration. - vite 8.1.5 -> 8.3.5 (apps/desktop ^8.1.5, apps/site ^8), with rolldown 1.2.15 nested under it, lightningcss 1.33.0 (1.32.0 stays nested under @tailwindcss/node), postcss 8.5.20 -> 8.5.32 (vite asks ^8.5.30) and nanoid 3.3.16 -> 3.3.20 (postcss asks ^3.3.20). - colord 2.9.3 -> 2.10.0 (apps/desktop ^2.9.3): GHSA-2wm5-q62r-hmrv. The color picker's `colord(fill).lighten(x).toRgbString()` is unaffected by the 2.9.5 hue normalization, which only changes hue numbers, not RGB output. - browserslist 4.28.4 -> 4.29.5 (@babel/helper-compilation-targets ^4.24.0), with the data packages its ranges require: baseline-browser-mapping 2.11.34, caniuse-lite 1.0.30001819, electron-to-chromium 1.5.467, node-releases 2.0.60, update-browserslist-db 1.3.4. - brace-expansion 5.0.7 -> 5.0.12 (minimatch ^5.0.5) and zod 4.4.3 -> 4.6.7 (@tanstack/router-generator ^4.4.3, eslint-plugin-react-hooks). - apps/desktop's `@types/bun` goes from `latest` to `^1.3.14`, the version already locked with bun-types 1.3.14, so relocks stop moving it (the Node 26 PR hit this). The lock's desktop workspace `version` also catches up to package.json (1.12.0 -> 1.18.3); every bun 1.3.3 relock writes that. Everything here except colord is build or dev tooling: vite, postcss, browserslist and the babel chain build the frontend, brace-expansion sits under eslint, and zod under the router generator and the lint plugin. **GHSAs cleared** - baseline-browser-mapping: GHSA-w5vr-8v7q-w6rv moderate - brace-expansion: GHSA-mh99-v99m-4gvg high, GHSA-rgw5-rvv9-x895 high, GHSA-qhr7-859c-m2p7 high, GHSA-6j4f-fj2g-mc7p high, GHSA-q2hr-2g5m-vwhr moderate - browserslist: GHSA-c83g-rgw3-j3cx high, GHSA-73wf-gq98-2v4g high - colord: GHSA-2wm5-q62r-hmrv moderate - nanoid: GHSA-2v37-7h3g-55p8 high - postcss: GHSA-fxqj-rqcc-2cmp moderate - seroval: GHSA-p6vx-979v-rg4c critical, GHSA-jp82-f5mq-hwhp high, GHSA-97r2-qh9m-474h high, GHSA-wp97-x4hv-qvhp high, GHSA-7rv5-mrxv-xcr9 high - vite: GHSA-587h-7wmj-h5pm high, GHSA-rq7h-c2jc-7f22 moderate, GHSA-698v-4r3x-3vcv moderate, GHSA-r825-w8mm-5pxw moderate, GHSA-9jrq-w75r-8gcw low - zod: GHSA-mrhx-c7xc-m3w5 high **How** The lock was written with the pinned bun 1.3.3 except for the browserslist set, zod and brace-expansion, whose entries were spliced in from a bun 1.4.4 update (1.3.3's `update` adds transitive names to package.json, and 1.4.4's own lockfile also re-hoisted rolldown and babel copies, which this leaves alone). New releases had to be at least 24 hours old; those under three days old (postcss 8.5.32, browserslist 4.29.5, baseline-browser-mapping 2.11.34, electron-to-chromium 1.5.467) were diffed against their previous release: no install scripts and no new network, exec, eval or env reads. **Verification (bun 1.3.3)** - `install --lockfile-only` leaves the lockfile byte-identical, and `install --frozen-lockfile` passes. - apps/desktop: `check:tauri-versions`, `build`, `typecheck`, `lint` and `bun test` (20 pass). - apps/site: `typecheck` and `build`. - desktop.yml's pull_request paths include bun.lock and apps/desktop/**, so the required checks run on this PR.

) GitHub's dependency graph does not read bun.lock, so none of these became Dependabot alerts. `bun audit` listed 98 in web/ (2 critical, 40 high, 47 moderate, 9 low); it now lists one. **What moved (package.json ranges unchanged)** - shadcn 4.13.0 -> 4.23.0 (^4.13.0). 4.23 replaces @modelcontextprotocol/sdk 1.x with @modelcontextprotocol/server 2.4 and uses zod 4, which takes express, body-parser, proxy-addr (critical GHSA-jqcg-44mw-7w3h), qs, hono, @hono/node-server and shadcn's zod 3 copy out of the tree. The SPA only imports shadcn/tailwind.css. - seroval and seroval-plugins 1.5.4 -> 1.6.12 (@tanstack/router-core asks ^1.5.4): critical GHSA-p6vx-979v-rg4c and four highs. Held at 1.6.12 rather than 1.7.x, which changes how streams serialize and which TanStack's own lockfile does not test yet (TanStack/router#8806). The built SPA contains no seroval code either way. - vite 8.1.3 -> 8.3.5 (^8.1.3), with rolldown 1.2.15 nested under it, lightningcss 1.33.0 (1.32.0 stays nested under @tailwindcss/node), postcss 8.5.16 -> 8.5.32, nanoid 3.3.12 -> 3.3.20 and source-map-js 1.2.1 -> 1.2.2. - browserslist 4.28.2 -> 4.29.5 with the data packages its ranges require (baseline-browser-mapping 2.11.34, caniuse-lite, electron-to-chromium, node-releases, update-browserslist-db); the nested browserslist 4.28.2 copies under each @babel/core are gone. - brace-expansion 5.0.6 -> 5.0.12, ip-address 10.2.0 -> 10.7.5 (now under socks), zod 4.4.3 -> 4.6.7, postcss-selector-parser 7.1.4 -> 7.1.7 and undici 7.28.0 -> 7.30.1. open, default-browser, wsl-utils and powershell-utils move because shadcn 4.23 asks for them. Left: deepmerge 4.3.1 (GHSA-gcqx-w48m-w2h4, low), which has no fixed release and sits only under the shadcn CLI. **What a merge ships** release.yml runs on web/** changes: it builds the SPA, compiles it into the Lambda with `--features embed-web` and deploys accept-payments. The Rust sources and Cargo.lock do not change. The built web/dist has the same files as main's; the CSS differs only in lightningcss 1.33's spelling of rounded-full's infinite radius (2147483647px for 3.40282e38px), and the JS chunks differ only by rolldown 1.2.15's minifier rewrites, a few dozen bytes each. Every package moved here is build tooling; the runtime packages in the bundle (React, TanStack Router) are unchanged. **GHSAs cleared** - @hono/node-server: GHSA-frvp-7c67-39w9 moderate, GHSA-rmxm-3fg6-px4f moderate - @modelcontextprotocol/sdk: GHSA-6qxp-vccf-f47h high, GHSA-22jm-h49p-29qw high, GHSA-46jr-4wx8-v453 high, GHSA-f897-62hf-6gxq high, GHSA-6prh-2h8m-c8cw moderate, GHSA-rvq5-wwqv-78pq moderate - baseline-browser-mapping: GHSA-w5vr-8v7q-w6rv moderate - body-parser: GHSA-27r3-jxmh-p828 high, GHSA-v422-hmwv-36x6 low - brace-expansion: GHSA-mh99-v99m-4gvg high, GHSA-rgw5-rvv9-x895 high, GHSA-3jxr-9vmj-r5cp high, GHSA-qhr7-859c-m2p7 high, GHSA-6j4f-fj2g-mc7p high, GHSA-q2hr-2g5m-vwhr moderate - browserslist: GHSA-c83g-rgw3-j3cx high, GHSA-73wf-gq98-2v4g high - fast-uri: GHSA-f65p-4m7j-42xc high, GHSA-fph4-wmhf-6fwf high, GHSA-jqff-g426-hqxp high, GHSA-7p8r-x3mc-p8w7 high, GHSA-v2hh-gcrm-f6hx high, GHSA-4c8g-83qw-93j6 high, GHSA-qw65-cvwx-89v3 high, GHSA-hrr3-gc8f-f4qj moderate, GHSA-w74x-v6f9-j3xg moderate, GHSA-xhq7-xmqj-769h low, GHSA-333x-w4r6-6crp low - hono: GHSA-8j4g-w8fx-2239 moderate, GHSA-xgm2-5f3f-mvvc moderate, GHSA-hvrm-45r6-mjfj moderate, GHSA-w62v-xxxg-mg59 moderate, GHSA-f23p-vx2j-j53r moderate, GHSA-54fx-42gc-7vw4 moderate, GHSA-gqvv-2mrq-wpjv moderate, GHSA-g6gw-c38x-mqfc moderate, GHSA-crvj-82cr-hjcx moderate, GHSA-hxh3-vqpv-xpqv moderate, GHSA-5r4p-p66f-jhc7 moderate, GHSA-79qm-7rj5-m7r9 low - ip-address: GHSA-mwp4-54f8-5fhr high, GHSA-4xrf-jv44-h6hh moderate, GHSA-22jq-vg5j-6vgg moderate, GHSA-rpw4-54j3-4h4q moderate, GHSA-2vr4-cq9g-pvrc moderate, GHSA-j6r3-76f7-8jcv moderate, GHSA-h3mg-xc3c-68pw moderate, GHSA-rxp7-6hxx-x8q5 moderate - js-yaml: GHSA-52cp-r559-cp3m high, GHSA-5p4m-2wfm-xmqj high, GHSA-2883-xcg3-v3hh high - nanoid: GHSA-28wg-ghj8-5hjv high, GHSA-2v37-7h3g-55p8 high - postcss: GHSA-r28c-9q8g-f849 high, GHSA-fxqj-rqcc-2cmp moderate - postcss-selector-parser: GHSA-rj75-hqrm-r3gf moderate - proxy-addr: GHSA-jqcg-44mw-7w3h critical - qs: GHSA-x5fp-wj9c-mxmx moderate, GHSA-4mjr-xmp4-gh2g moderate, GHSA-6pq8-jhm2-2vcw moderate - seroval: GHSA-p6vx-979v-rg4c critical, GHSA-jp82-f5mq-hwhp high, GHSA-97r2-qh9m-474h high, GHSA-wp97-x4hv-qvhp high, GHSA-7rv5-mrxv-xcr9 high - source-map-js: GHSA-68fv-2mgg-jv7q high - undici: GHSA-4cwx-7wf7-3272 high, GHSA-rfgv-xxqx-mfg5 high, GHSA-w293-vg96-wgc3 high, GHSA-xjj6-f33q-929c high, GHSA-4w7w-5xrc-9h26 high, GHSA-2m5v-pch6-74hx high, GHSA-qrxm-fqhp-jwvm high, GHSA-8xcm-r25x-g524 moderate, GHSA-m8rv-5g2x-5cg5 moderate, GHSA-jr45-8vmc-qm54 moderate, GHSA-v3r7-h72x-cjcm moderate, GHSA-3wwx-pv8p-q78v moderate, GHSA-pmjh-fq2x-6v4x moderate, GHSA-3xpg-4rpp-hhhm moderate, GHSA-2jfj-6hjv-fm6j moderate, GHSA-rx4f-c7p8-82vq moderate, GHSA-4qv8-2p9j-2685 moderate, GHSA-f72v-6w45-q472 moderate, GHSA-9fm3-97px-rjf6 moderate, GHSA-55wc-3pg8-jfw6 moderate, GHSA-r53p-7pc4-xj5r low, GHSA-2gqq-gqf2-x968 low, GHSA-8436-99hf-9mmv low - vite: GHSA-587h-7wmj-h5pm high, GHSA-rq7h-c2jc-7f22 moderate, GHSA-698v-4r3x-3vcv moderate, GHSA-r825-w8mm-5pxw moderate, GHSA-9jrq-w75r-8gcw low - zod: GHSA-mrhx-c7xc-m3w5 high **How** shadcn and vite were updated with the bun CI runs (1.3.4), and their ranges put back. The transitive fixes are bun's own entries spliced in, with the vulnerable nested copies dropped, which leaves the rest of the tree where it was. New releases had to be at least 24 hours old, and those under three days old (shadcn 4.23.0, @shadcn/registry 0.2.1, postcss 8.5.32, baseline-browser-mapping 2.11.34, electron-to-chromium 1.5.467) were diffed against their previous release: no install scripts and no new network, exec, eval or env reads. **Verification (bun 1.3.4)** - `install --lockfile-only` leaves the lockfile byte-identical, and `install --frozen-lockfile` passes. - `bun run lint` and `bun run build`, plus the same build on main for the comparison above.

github-actions Bot added package: router-core package: start-plugin-core package: start-server-core package: start-client-core package: start-static-server-functions labels Oct 24, 2026

coderabbitai Bot mentioned this pull request Oct 24, 2026

docs: extend agent performance and Webpack guidance #8267

Open

4 of 5 tasks

This was referenced Oct 24, 2026

Tracking: open Router and Start PRs by problem area #8810

Open

perf(router-core): serialize SSR RawStreams through a Seroval live stream #8813

Open

This was referenced Oct 29, 2026

build(deps): clear the bun.lock advisories and pin @types/bun to ^1.3.14 johncarmack1984/lux#357

Merged

web: bump shadcn, vite and seroval to clear the bun.lock advisories johncarmack1984/accept-payments#31

Merged

Navigation Menu

Repository navigation

perf(router,start): update Seroval to 1.7.1 - #8806

perf(router,start): update Seroval to 1.7.1#8806
LadyBluenotes wants to merge 1 commit into
mainfrom
chore/update-seroval-1.7.1

LadyBluenotes commented Oct 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

changeset-bot Bot commented Oct 24, 2026

Uh oh!

nx-cloud Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 24, 2026

Uh oh!

github-actions Bot commented Oct 24, 2026

Uh oh!

coderabbitai Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 24, 2026

Uh oh!

pkg-pr-new Bot commented Oct 24, 2026

Uh oh!

codspeed Bot commented Oct 24, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

LadyBluenotes commented Oct 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎯 Changes

✅ Checklist

🚀 Release Impact

Summary by CodeRabbit

Uh oh!

changeset-bot Bot commented Oct 24, 2026

🦋 Changeset detected

Uh oh!

nx-cloud Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Oct 24, 2026

Uh oh!

github-actions Bot commented Oct 24, 2026

🚀 Changeset Version Preview

🟩 Patch bumps

Uh oh!

coderabbitai Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 24, 2026

Bundle Size Benchmarks

Uh oh!

pkg-pr-new Bot commented Oct 24, 2026

Uh oh!

codspeed Bot commented Oct 24, 2026

Merging this PR will regress 11 benchmarks

Performance Changes

Footnotes

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

LadyBluenotes commented Oct 24, 2026 •

edited by coderabbitai Bot

Loading

nx-cloud Bot commented Oct 24, 2026 •

edited

Loading

coderabbitai Bot commented Oct 24, 2026 •

edited

Loading