Fix: Update solid-js to patch seroval prototype pollution vulnerability (CVE-2026-23736)

[carpe-diem]

Summary

Updates solid-js from ^1.9.2 to ^1.9.11 across all packages that depend on it, which bumps the transitive dependency seroval from 1.3.2 to 1.5.0.

This resolves https://advisories.gitlab.com/pkg/npm/seroval/, a prototype pollution vulnerability in seroval's JSON deserialization. Due to improper input validation, a malicious object key could lead to prototype pollution during deserialization. There is no known workaround other than upgrading.

Changes

• apps/vite-solid-project/package.json - solid-js ^1.9.2 → ^1.9.11
• packages/runtime/package.json - solid-js ^1.9.2 → ^1.9.11
• apps/extension/package.json - solid-js ^1.9.2 → ^1.9.11
• pnpm-lock.yaml — updated accordingly

Resolved versions

• solid-js: 1.9.9 → 1.9.11
• seroval: 1.3.2 → 1.5.0
• seroval-plugins: 1.3.3 → 1.5.0

[vercel]

@carpe-diem is attempting to deploy a commit to the Michael Musil's projects Team on Vercel.

A member of the Team first needs to authorize it.