solid-js 1.9.10 pulls in seroval@1.3.2, affected by CVE-2026-59940 (Critical)

Description

The workspace catalog pins solid-js at 1.9.10, which constrains its seroval dependency to ~1.3.0 (resolves to seroval@1.3.2) and seroval-plugins@1.3.3.

seroval@1.3.2 is affected by a public, Critical severity CVE: CVE-2026-59940 (GHSA-mv8w-475r-vwqw, CVSS 3.1 score 9.8) — a type-confusion issue in seroval.fromJSON() during deserialization. It's fixed upstream in seroval@1.5.3.

Since seroval ships in opencode's production bundle via the Solid.js / @solidjs/start stack (not a dev-only dependency), the vulnerable version is present in the shipped app today.

A private security advisory with full technical/impact detail has been filed through this repo's Security tab (GHSA-vxv8-v7jx-pcgr) for maintainers to review. This issue exists to track the fix per the issue-first policy — see the linked advisory for the full writeup.

Fix: bumping solid-js to 1.9.15 pulls in seroval ~1.5.4 (patched, no manual override needed). Fix is up in #45916.

OpenCode version

dev (also affects v1.18.4 through the current release)

Steps to reproduce

1. Check bun.lock for the resolved seroval version under the solid-js@1.9.10 entry — it resolves to 1.3.2.
2. Compare against the fixed range in GHSA-mv8w-475r-vwqw (seroval < 1.5.3).