npm / seroval
seroval
What changed in seroval 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-28.
8 breaking1 security2 deprecations8 new APIs and options3 behavior and defaults11 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initseroval 133 changes
Breaking changes 8
serialize,toJSON,crossSerializeandtoCrossJSONnow throw for values containing an async iterable or aReadableStream; use an async or streaming function to send them.serialize,toJSON,crossSerializeandtoCrossJSONnow send an endedcreateStreamstream with all its events; open or live streams throw.Now throws when the value contains a promise, like serialize already did; use an async or streaming function to send promises.
Disposing the stream no longer invokes onDone; disposal abandons output, so callers that close a response in onDone must also close it when disposing.
Raise the supported Node.js floor from >=10 to >=20.
Streams serialized from a live stream in streaming mode now use a receiver that retains history only until its first listener subscribes, then forwards values without retaining them and refuses a second listener.
Now throws when the value contains a promise, like serialize already did; use an async or streaming function to send promises.
Now throws when the value contains a promise, like serialize already did; use an async or streaming function to send promises.
Security 1
Honor depthLimit in every serializer entry point and in fromJSON.
Deprecations 2
Mark as deprecated; it has no effect.
Mark as deprecated; it has no effect.
New APIs and options 8
Add this option to crossSerialize and crossSerializeAsync to store only values read more than once in $R, shortening output when no later script refers back to them.
Add a session for cross-reference JSON records that tracks unsettled promises and open streams, reports pending counts, and can abort them with a caller-supplied reason.
Add a single-consumer stream that holds one event at a time and resolves producer writes only after the serialized record is accepted.
Export the option type for serializeAsync.
Export the option type for serialize.
Add an optional plugin field; when true, the plugin is not tested against plain objects, speeding parsing when most values are plain objects.
Export the option type for toJSONAsync.
Export the option type for toJSON.
Behavior and default changes 3
Async iterables and ReadableStream values read the next chunk only after the previous record is accepted.
Callbacks may return promises; records are emitted in order with one callback at a time, and completion waits for the last callback. Output failure prevents onDone, while cleanup runs every callback once.
Callbacks may return promises; records are emitted in order with one callback at a time, and completion waits for the last callback. Output failure prevents onDone, while cleanup runs every callback once.
Fixes and other changes 11
Rejected promises that the caller never reads, including promises rejected by abort, no longer cause unhandled rejections; awaiting the promise still receives the rejection.
serialize and serializeAsync no longer add an unused placeholder variable to every payload containing a Map; a plain Map serializes to new Map([...]).
Preserve reserved own property names in cyclic objects and retain Error __proto__ data properties without changing their prototypes.
A failed write stops only that write; sibling streams and subsequent writes remain active.
Report a node id assigned twice with SerovalConflictedNodeIdError.
Failures raised while emitting output are now wrapped in SerovalSerializationError.
Uses the element length for bigint typed array views.
Preserves own __proto__ properties through serialization.
Preserves circular own __proto__ properties through deferred assignment.
Unescapes regexp source in the serialized output.
Fixes cleanup during streaming serialization.