chore(deps): update dependency @builder.io/qwik to v1.19.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@builder.io/qwik (source)	1.8.0 → 1.19.1

---

Qwik vulnerable to Unauthenticated RCE via server$ Deserialization

CVE-2026-27971 / GHSA-p9x5-jp3h-96mm

More information

Details

Summary

qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime.

Impact

• Remote Code Execution

Severity

• CVSS Score: 9.2 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/QwikDev/qwik/security/advisories/GHSA-p9x5-jp3h-96mm
• https://github.com/QwikDev/qwik/releases/tag/%40builder.io%2Fqwik%401.19.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-27971
• https://github.com/advisories/GHSA-p9x5-jp3h-96mm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

QwikDev/qwik (@​builder.io/qwik)

v1.19.1

Compare Source

Patch Changes

• 🐞🩹 support Deno as package manager for production builds. The Vite plugin now recognizes Deno as a Node-compatible runtime for manifest passing, and SSG delegates to the Node implementation instead of stubbing out. (by @​ianlet in #​8385)

• 🐞🩹 the optimizer was not using the binary builds (by @​wmertens in #​8360)

• 🐞🩹 resolve 404 error for virtual CSS modules during dev SSR (by @​jantimon in #​8351)

v1.19.0

Compare Source

Minor Changes

• ✨ untrack() now accepts signals and stores directly, as well as accepting arguments when you pass a function. This makes retrieving values without subscribing to them more efficient. (by @​wmertens in #​8247)

Patch Changes

• 🐞🩹 we now prevent merging useVisibleTask$ code together with other segments to prevent overpreloading when their entry contains a lot of transitive imports. (by @​maiieul in #​8275)

• 🐞🩹 duplicated preload bundles in SSR preload (by @​chebanenko in #​8248)

• ⚡️: the core.js and preloader.js references in q-manifest and bundle-graph are now filtered out for smaller outputs. (by @​maiieul in #​8278)

v1.18.0

Compare Source

Minor Changes

• PERF: Computed signals now only trigger listeners if their value has changed (by @​wmertens in #​8148)

Patch Changes

• execute cleanup cb for all component tree while calling dispose.cleanup method returned by render fn (by @​sashkashishka in #​8164)

• 🐞🩹 useResource's onRejected now catches errors again; preventing unhandled errors in test environments. (by @​maiieul in #​8197)

• ✨ qwik add compiled-i18 now adds easy i18n to your app. (by @​wmertens in #​8177)

v1.17.2

Compare Source

v1.17.1

Compare Source

Patch Changes

• 🐞🩹 the bunding won't lead to circular dependencies in qwik-astro apps anymore. (by @​maiieul in #​8052)

• ✨ The optimizer is now built with a recent Rust toolchain. Fresher bits! (by @​wmertens in #​8040)

v1.17.0

Compare Source

Minor Changes

• 🐞🩹 Qwik now leverages Rollup's new output.onlyExplicitManualChunks feature, which improves preloading performance and reduces cache invalidation for a snappier user experience. (by @​maiieul in #​7982)

• ✨ the qwikloader can now be inlined again if required (for testing or specific network conditions). Pass qwikLoader: 'inline' to the render options. (by @​wmertens in #​8008)

Patch Changes

• 🐞🩹 The Deno integration now builds successfully with version v2.4.3 and above. (by @​gioboa in #​7913)

• TEST: qwik react mount and unmount (by @​sashkashishka in #​7950)

• 🐞🩹 solve type error when using async _resolved function (by @​JerryWu1234 in #​7426)

• 🐞🩹 Click-to-Component is now more reliable across platforms (by @​wmertens in #​7923)

• 🛠 add qwik react e2e test runs to ci (by @​sashkashishka in #​7952)

v1.16.1

Compare Source

Patch Changes

• 🐞🩹 The entry.ssr renderToStream preloader.preloadProbability option is now deprecated because this could cause performance issues with bundles fetched on click instead of being preloaded ahead of time. (The preloader still relies on probabilities to know preload the most likely bundles first) (by @​maiieul in #​7847)

• 🐞🩹 Link prefetch now always preloads Link prefetch bundles on monorepos (by @​maiieul in #​7835)

• 🐞🩹 Rollup's hoistTranstiveImports is now set to false because the hoisting added unnecessary bundles to be preloaded to the bundle-graph static imports graph. This could lead to a suboptimal preloading experience. (by @​maiieul in #​7850)

• 🛠 Add check-client command to verify bundle freshness (by @​JerryWu1234 in #​7517)

• ✨ All qwik packages are now marked as side effect free in their package.json. This should remove a few unecessary empty imports added by rollup and then not tree-shaken like import "./preloader.js". (by @​maiieul in #​7908)

• 🐞🩹 unmount qwikify react root alongside with qwik component (by @​sashkashishka in #​7864)

• 🐞🩹 preloader now preloads bundles as long as they are part of the current viewport's bundles graph, even if their probability is very small (by @​maiieul in #​7836)

• ✨ maxIdlePreloads is now constant over time so you know for sure how many bundles will be preloaded concurrently during idle. (by @​maiieul in #​7846)

• 🛠 use patched domino instead of qwik-dom (by @​gioboa in #​7842)

• 🐞🩹 Qwik is now smarter at bundling non QRL source files and qwik libraries modules (e.g. helpers, enums, inline components, etc.) together. (by @​maiieul in #​7888)

v1.16.0

Compare Source

Minor Changes

• ✨ bump Vite to v7 (by @​gioboa in #​7762)

Patch Changes

• 🐞🩹 Keeping the service worker components now properly unregisters them. (by @​maiieul in #​7781)

• 🛠 remove a grace period before unregistering events from qwikloader (by @​Varixo in #​7818)

• 🐞🩹 Keeping the service worker components now also removes their associated Cache storage. (by @​maiieul in #​7782)

• 🐞🩹 fix up open in editor feature (by @​LazyClicks in #​7785)

• 🐞🩹 SSR was missing some places with nonce for CSP. Now CSP should work even when strict-dynamic (by @​wmertens in #​7776)

v1.15.0

Compare Source

Minor Changes

• 🐞🩹 the preloader bundle graph file is now built as an asset. This is cleaner and avoids i18n translation of the file. (by @​wmertens in #​7650)

Patch Changes

• 🐞🩹 Use correct working directory for Deno environment (by @​siguici in #​7699)

• ⚡ the qwikloader is no longer embedded in the SSR results. Instead, the same techniques are used as for the preloader to ensure that the qwikloader is active as soon as possible, loaded from a separate bundle. This reduces SSR page size by several kB end ensures that subsequent qwikloader loads are nearly instant. (by @​wmertens in #​7613)

• 🐞🩹 Removed backdrop-filter of vite-error-overlay to prevent perf issues with multiple errors (by @​intellix in #​7676)

• 🐞🩹 assetsDir and debug:true will no longer break your application. (by @​maiieul in #​7638)

• 🐞🩹 We now also output the preloader as .cjs for non esm environments (e.g. jest 29 and below). (by @​maiieul in #​7736)

• 🐞🩹 cypress component tests became slow in 1.9.1. This is now fixed. (by @​maiieul in #​7736)

• ✨ q-manifest.json now also includes the generated assets (by @​wmertens in #​7650)

• 🐞🩹 support q-manifest resolution under Bun runtime (#​7565) (by @​siguici in #​7669)

• 🐞🩹 set correct script type for qwik loader (by @​Varixo in #​7710)

• 🛠 update devDependencies and configurations (by @​JerryWu1234 in #​7695)

v1.14.1

Compare Source

v1.14.0

Compare Source

Minor Changes

• ✨ Major improvements to prefetching with automatic bundle preloading (by @​wmertens in #​7453)

  • This removes the need for service workers, and instead utilize modulepreload link tags for better browser integration.
  • Improves initial load performance by including dynamic imports in the prefetch
  • Reduces complexity while maintaining similar (and even better) functionality
  • Enables some preloading capabilities in dev mode (SSR result only)
  • Includes path-to-bundle mapping in bundle graph (this improves the experience using the <Link> component, AKA "single page app" mode)
  • Server now has built-in manifest support (so no need to pass manifest around)
  • Moves insights-related build code to insights plugin

  ---

  ⚠️ ATTENTION:

  • Keep your service worker code as is (either <ServiceWorkerRegister/> or <PrefetchServiceWorker/>).
  • Configure your server to provide long caching headers.

  Service Worker:

  This new implementation will use it to uninstall the current service worker to reduce the unnecessary duplication.

  The builtin service workers components are deprecated but still exist for backwards compatibility.

  ⚠️ IMPORTANT: Caching Headers:

  The files under build/ and assets/ are named with their content hash and may therefore be cached indefinitely. Typically you should serve build/* and assets/* with Cache-Control: public, max-age=31536000, immutable.

  However, if you changed the rollup configuration for output filenames, you will have to adjust the caching configuration accordingly.

  ---

  You can configure the preload behavior in your SSR configuration:

  // entry.ssr.ts
  export default function (opts: RenderToStreamOptions) {
    return renderToStream(<Root />, {
      preload: {
        // Enable debug logging for preload operations
        debug: true,
        // Maximum simultaneous preload links
        maxIdlePreloads: 5,
        // Minimum probability threshold for preloading
        preloadProbability: 0.25
        // ...and more, see the type JSDoc on hover
      },
      ...opts,
    });
  }

Optional for legacy apps:

For legacy apps that still need service worker functionality, you can add it back using:

npm run qwik add service-worker

This will add a basic service worker setup that you can customize for specific caching strategies, offline support, or other PWA features beyond just prefetching.

Patch Changes

• 🐞🩹 linting errors which were previously being ignored across the monorepo. (by @​better-salmon in #​7418)

• 🐞🩹 now qwikloader is loaded only once in all cases (by @​wmertens in #​7506)

v1.13.0

Compare Source

Minor Changes

• The useTask# @​builder.io/qwik function's eagerness` option is deprecated and will be removed in version 2. (by @​sreeisalso in #​7345)

Patch Changes

• 🐞🩹 Error boundary ErrorBoundary and fix useErrorBoundary (by @​damianpumar in #​7342)

• 🐞 🩹 The qwik-city ServiceWorkerRegister and qwik PrefetchServiceWorker now prefetch all their qrls to prevent under-prefetching (by @​maiieul in #​7417)

• 🐞🩹 When csr is true, it causes a crash because resolve cannot be null as the second parameter (by @​JerryWu1234 in #​7420)

• updated drizzle to latest version (by @​sreeisalso in #​7288)

• 🐞 fix(rollup): improve manualChunks logic to minimize over-prefetching (by @​maiieul in #​7362)

• ✨ Add the ability to see chunks names in preview/production environments to facilitate debugging of production-only bugs (by @​maiieul in #​7293)

• Emit an CustomEvent qviewTransition when view transition starts. (by @​GrandSchtroumpf in #​7237)

• ✨ Ability to keep using tailwind v3 through the cli (by @​maiieul in #​7403)

• dev server now correctly handles css and js importers, also hmr persistence (by @​thejackshelton in #​7389)

• 🐞🩹 set default value of lint to false to improve the execution performance (by @​JerryWu1234 in #​7425)

• 🐞🩹 manual QRL grouping now works again. This is needed for Insights to work. (by @​wmertens in #​7444)

v1.12.1

Compare Source

Patch Changes

• 📃 update turso integration keywords, add contributor (by @​A2-NieR in #​7215)

• ✨ tailwindcss v4 integration (by @​sreeisalso in #​7274)

• 🐞🩹 remove usage of computedStyleMap (by @​Varixo in #​7252)

• 📃 remove shop (by @​gioboa in #​7221)

• 🐞🩹 error in the middleware occurs 404 (by @​JerryWu1234 in #​6951)

• 🐞🩹 changed turso createClient import to work with file urls, updated docs note with info & link to the corresponding section in the turso docs (by @​A2-NieR in #​7211)

• 📃 add Qwik blog + articles (by @​gioboa in #​7214)

• 🐞🩹 input's value is string when passing number (by @​JerryWu1234 in #​7249)

v1.12.0

Compare Source

Minor Changes

• ✨ The build constants isDev, isBrowser and isServer are now exported from @builder.io/qwik directly, so they are more discoverable and easier to add. @builder.io/qwik/build still remains. (by @​wmertens in #​7138)

Patch Changes

• 🐞🩹 add subscription when doing "prop" in store (by @​revintec in #​7071)

• 🐞🩹 stoppropagation functionality (by @​shairez in #​7102)

v1.11.0

Compare Source

Minor Changes

• CHORE: Prepare backwards compatibility for V1 libraries in V2. (by @​wmertens in #​7044)

  We move internal fields immutableProps and flags out of JSXNode as they are not meant for public use.

  This will allow projects using older V1 libraries to continue to work with the Qwik V2 by adding the following package.json changes:

  {
    "dependencies": {
      "@​builder.io/qwik": "^1.11.0",
      "@​qwik.dev/core": "^2.0.0"
    }
  }

  And will prevent typescript errors when using libraries which haven't upgraded to V2 yet.

• ✨ add monorepo support to the qwik add command by adding a projectDir param (by @​shairez in #​7059)

  That way you can run qwik add --projectDir=packages/my-package and it will add the feature to the specified project/package (sub) folder, instead of the root folder.

v1.10.0

Compare Source

Minor Changes

• Async functions in useComputed are deprecated. (by @​wmertens in #​7013)

  Why?

  • Qwik can't track used signals after the first await, which leads to subtle bugs.
  • When calculating the first time, it will see it's a promise and it will restart the render function.
  • Both useTask and useResource are available, without these problems.

  In v2, async functions won't work.

  Again, to get the same functionality use useTask or useResource instead, or this function:

  export const useAsyncComputed$ = (qrlFn: QRL<() => Promise<any>>) => {
    const sig = useSignal();
    useTask(({ track }) => {
      const result = track(qrlFn);
      if (result && 'then' in result) {
        result.then(
          (val) => (sig.value = val),
          (err) => {
            console.error('async computed function threw!', err);
            throw error;
          }
        );
      } else {
        sig.value = result;
      }
    });
    return sig;
  };

• ✨ Expose unwrapStore as a low level AP (by @​GrandSchtroumpf in #​6960)

  This enables developers to clone the content of a useStore() using structureClone or IndexedDB

Patch Changes

• 📃 fix useResource docs example & remove unused demo (by @​ianlet in #​6893)

• 🐞🩹 QRL segment filenames are no longer lowercased. This was giving trouble with parent lookups in dev mode and there was no good reason for it. (by @​wmertens in #​7003)

• 🐞🩹 the type for <textarea> now accepts text children, as per spec. (by @​wmertens in #​7016)

• 🐞🩹 dev-mode QRL paths are now handled by Vite so they are the same as the parent paths. You can see this in the Sources section of the browser devtools, where the segments are now always next to their parents (when the parent is loaded). (by @​wmertens in #​7037)

• 🐞🩹 vite is now a peer dependency of qwik, qwik-city, qwik-react and qwik-labs, so that there can be no duplicate imports. This should not have consequences, since all apps also directly depend on vite. (by @​wmertens in #​6945)

• ✨ sync$ QRLs will now be serialized into the HTML in a shorter form (by @​wmertens in #​6944)

• 🐞🩹 cli build command appearing to "hang" on errors (by @​shairez in #​6943)

• ✨ Allow setting linkFetchPriority for modulepreload links in the prefetch strategy. Also fix the links in dev mode (by @​GrandSchtroumpf in #​6947)

v1.9.1

Compare Source

Patch Changes

• ✨ showing qrl parent names. (by @​wmertens in #​6881)
  in dev mode, qrl segments now start with their parent filename so it's easy to see where they came from. Furthermore, in production builds these filenames are also used so that origins in q-manifest.json are easy to understand.

• 🐞🩹 Optimizer now ignores unknown deps in graph that caused crashes during build (by @​wmertens in #​6888)

• 🐞🩹 Do not allow object methods to be serialized with style prop (by @​jakovljevic-mladen in #​6932)

• 🐞🩹 In dev mode, changes to QRLs now explicitly invalidate the segment so that the browser will reload it (by @​wmertens in #​6938)

v1.9.0

Compare Source

Patch Changes

• ✨ Introducing the experimental[] option to the Vite plugin. This allows you to opt in to features that are not guaranteed to have a stable API. (by @​wmertens in #​6880)

• 🐞🩹 fix typo in using useStore() (by @​zaynet in #​6875)

• 🐞🩹 gracefully handle image dimensions service errors (by @​JerryWu1234 in #​6855)

• ✨ Lib builds no longer perform qwik transformation. (by @​wmertens in #​6850)

  This prevents using unstable internal APIs, and doesn't make a difference for the end user. Library authors are strongly urged to push a new library patch version built with this qwik version, and to add | ^2.0.0 to their accepted qwik version range.

• 🐞🩹 SSG Link component strips search parameters (by @​JerryWu1234 in #​6778)

• 🐞🩹 The PrefetchServiceWorker now has a more efficient graph and only prefetches direct imports and, at a lower priority, task QRL segments. This greatly improves its load performance. (by @​wmertens in #​6853)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks

[cloudflare-workers-and-pages]

Deploying cuex with    Cloudflare Pages

Latest commit:	8a8cd8e
Status:	🚫  Build failed.

View logs