Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Evidence record / opencode

A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.

2026-10-24-opencode-dependency-hardening-removes-nested-seroval-1-3-2-but-does-not-establish-complete-remediat

Dependency hardening removes nested Seroval 1.3.2, but does not establish complete remediation. Commit d93568f3344e1a93297d56bc1dc71892104856d0 removes @solidjs/start/seroval 1.3.2 and its nested plugin resolution from bun.lock; first v2.1.4, absent from v2.1.3. The newest stable lockfile still resolves root Seroval 1.5.6. Do not summarize this as all Seroval issues fixed. The older CVE-2026-59940 / GHSA-mv8w-475r-vwqw concerns malicious serialized JSON invoking unintended functions when an application exposes suitable plugin callables; patched Seroval is 1.5.3. Separately, CVE-2026-104845 / GHSA-jp82-f5mq-hwhp covers small JSON inputs causing CPU/memory exhaustion through unchecked typed-array allocation, lists <=1.6.2 as affected and 1.6.3 as patched.

Channel: tagged-release. Half: defect. Date: 2026-10-23.

Operator consequence: These dependency records require a reachable deserialization-path audit; I did not establish an exploitable OpenCode CLI or hosted endpoint. Review the deployed web/server-function dependency graph separately from bundled Bun.

Receipt

Finding metadata

Confidence
high

Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0

Finding ID: 2026-10-24-opencode-dependency-hardening-removes-nested-seroval-1-3-2-but-does-not-establish-complete-remediat

Profile citations

Source links

Primary links, including exact changelog lines when available.

  1. OpenCode
    commit2026-10-24-opencode-dependency-hardening-removes-nested-seroval-1-3-2-but-does-not-establish-complete-remediatgithub.com/anomalyco/opencode/commit/d93568f3344e1a93297d56bc1dc71892104856d0tagged commit file2026-10-24-opencode-dependency-hardening-removes-nested-seroval-1-3-2-but-does-not-establish-complete-remediatanomalyco/opencode / bun.lockofficial docs2026-10-24-opencode-dependency-hardening-removes-nested-seroval-1-3-2-but-does-not-establish-complete-remediatgithub.com/advisories/GHSA-mv8w-475r-vwqwofficial docs2026-10-24-opencode-dependency-hardening-removes-nested-seroval-1-3-2-but-does-not-establish-complete-remediatgithub.com/advisories/GHSA-jp82-f5mq-hwhp

Versioned source: run artifact