[dependabot]

Bumps the npm_and_yarn group with 1 update in the /starters/minimal directory: seroval.

Updates seroval from 1.6.8 to 1.7.5

Release notes

Sourced from seroval's releases.

seroval-plugins@1.7.5

Patch Changes

• Check the FormData, Headers, Response and Request fields during deserialization.

seroval@1.7.5

Patch Changes

• d85ec3f: Keep two round-trip cases intact. An object whose own constructor key holds a falsy value, such as { constructor: undefined }, now keeps Object.prototype instead of coming back with a null prototype. A null-prototype object with an own __proto__ key, or any object serialized with Feature.ObjectAssign disabled, no longer turns equal-looking values such as two new Set() into one shared object in serialize, crossSerialize and compileJSON output.

seroval-plugins@1.7.4

Patch Changes

• Check that a ReadableStream's stream source is a seroval Stream before deserializing it.

seroval@1.7.4

No changes in this release.

seroval-plugins@1.7.3

No changes in this release.

seroval@1.7.3

Patch Changes

• 3a60f79: Republish the 1.7.2 changes through CI with npm provenance. 1.7.2 was published manually without an attestation, so pnpm's trustPolicy: no-downgrade refused to install it (#278). No code changes.

seroval-plugins@1.7.1

Patch Changes

• 2d03651: serialize, toJSON, crossSerialize and toCrossJSON now throw when the value contains an async iterable or a ReadableStream, as they do for a promise. Before, they sent a stream that never got its values. Use an async or streaming function to send them.

seroval@1.7.1

Patch Changes

• b703710: createCrossDeserializer no longer causes unhandled rejections. This covers a rejected promise that the caller never reads, and a pending promise that abort rejects. Code that awaits the promise still gets the rejection.
• 2d03651: serialize, toJSON, crossSerialize and toCrossJSON now throw when the value contains an async iterable or a ReadableStream, as they do for a promise. Before, they sent a stream that never got its values. Use an async or streaming function to send them.
• 2c25bf3: serialize, toJSON, crossSerialize and toCrossJSON now send a createStream stream that has ended with all its events. A stream that is still open, or a live stream, now throws. Before, they sent an empty stream that never ended.

seroval-plugins@1.7.0

Minor Changes

• 4c0008f: Add createLiveStream(), a single-consumer stream that holds one event at a time and resolves each producer write only after the serialized record is accepted. crossSerializeStream and toCrossJSONStream callbacks may now return a promise; the next record, and the acceptance of the source event behind it, wait for it to settle. Records discovered while parsing an event are emitted after the record that introduces them, one callback runs at a time, onDone waits for the last callback and is not called after an output failure, and cleanup runs every callback once. Async iterables and ReadableStream values read their next chunk only after the previous record is accepted. Existing streaming plugin lifecycle hooks remain available; parsing a live stream is the preferred way to connect an incremental source.
• f2b7d0c: Raise the supported Node.js floor from >=10 to >=20 in engines, remove the no-op typesVersions from seroval, give seroval-plugins main, module and types fields plus a typesVersions entry that points at the emitted web declarations, and link the plugins package to the workspace copy of seroval.
• 5ab601f: Add plugin context hooks for parsing an async iterable as a stream source. Use them in the ReadableStream plugin to avoid a separate live-stream producer while keeping backpressure, cancellation, and wire format intact. Upgrade both packages together because the plugin requires the new core hooks.

Patch Changes

• c643404: The documentation moved to https://seroval.vercel.app. The READMEs and the package homepages now link to it.
• a1e185a: Build with an explicit ES2020 syntax target so the emitted syntax floor no longer follows engines.node, keeping nullish coalescing and optional chaining as written.
• be1f32b: Improve tree shaking of web namespace imports in ESM builds while preserving the CommonJS export shape.

... (truncated)

Commits

• 7ccb00a fix: check web plugin fields during deserialization
• b32106c Merge pull request #290 from lxsmnsyc/fix/object-key-round-trip
• d85ec3f fix: keep objects with shadowed constructor and proto keys intact
• a5dcc4f fix: check the ReadableStream source type
• 1035502 Merge pull request #288 from lxsmnsyc/ci/dependabot-security-only
• 6e8a794 ci: limit Dependabot to security updates
• ec0ac81 Merge pull request #266 from lxsmnsyc/dependabot/npm_and_yarn/codemirror/view...
• 07b357f Merge pull request #265 from lxsmnsyc/dependabot/npm_and_yarn/oxfmt-0.74.0
• 6279ff7 Merge pull request #273 from lxsmnsyc/dependabot/npm_and_yarn/solidjs/vite-pl...
• 3a433fb Merge pull request #269 from lxsmnsyc/dependabot/github_actions/actions/setup...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for seroval since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.