fix(deps): Bump seroval to patch critical deserialization vuln

[oioki]

Bumps the transitive seroval dependency from 1.5.0 to 1.5.6, patching a critical deserialization type confusion in seroval.fromJSON() (GHSA-mv8w-475r-vwqw, CVSS 9.8) where attacker-controlled JSON could invoke unintended methods during deserialization.

seroval is pulled in transitively via solid-js, which several TanStack devtools packages (react-devtools, react-form-devtools, react-pacer-devtools) depend on. solid-js's existing dependency range already permitted the patched version, so this is a lockfile-only refresh (pnpm update seroval seroval-plugins --lockfile-only) — no package.json changes.

Fixes GHSA-mv8w-475r-vwqw

[socket-security]

Warning

Socket is a new tool Security team is testing out, feel free to ignore this alert for now but we encourage you to act on it.
Please provide any feedback you have in #discuss-security slack channel ❤️

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm seroval is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@tanstack/react-devtools@0.9.9 → npm/@tanstack/react-pacer-devtools@0.5.3 → npm/@tanstack/react-form-devtools@0.2.20 → npm/seroval@1.5.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/seroval@1.5.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[oioki]

Obfuscated code: npm seroval is 90.0% likely obfuscated
Confidence: 0.90

Location: Package overview

This was the case since the beginning of time, seems like it is a core function of that package:
lxsmnsyc/seroval@d9eefed