Skip to content

Bump devalue from 5.1.1 to 5.9.4 - #2292

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/devalue-5.9.4
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/devalue-5.9.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor

Bumps devalue from 5.1.1 to 5.9.4.

Release notes

Sourced from devalue's releases.

v5.9.4

Patch Changes

  • 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

  • 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
  • 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
  • dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
  • 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
  • 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
  • 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
  • 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

v5.9.2

Patch Changes

  • 8b2a456: fix: reject out-of-bounds indices

v5.9.1

Patch Changes

  • 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
  • 686e379: fix: emit valid JS for Node Buffer in uneval
  • 376b65c: fix: preserve -0 in float typed arrays in uneval

v5.9.0

Minor Changes

  • 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
  • 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
  • 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

v5.8.2

Patch Changes

  • 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
  • cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
  • 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
  • 8c0db06: fix: serialize Temporal values referenced more than once in uneval
  • 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
  • 756265a: fix: preserve shared-reference identity for Map keys in uneval
  • faa8a05: fix: emit uneval reconstructions before the statements that reference them
  • 06129ad: fix: do not grow sparse arrays by one slot in uneval

v5.8.1

Patch Changes

... (truncated)

Changelog

Sourced from devalue's changelog.

5.9.4

Patch Changes

  • 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

  • 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
  • 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
  • dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
  • 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
  • 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
  • 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
  • 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

5.9.2

Patch Changes

  • 8b2a456: fix: reject out-of-bounds indices

5.9.1

Patch Changes

  • 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
  • 686e379: fix: emit valid JS for Node Buffer in uneval
  • 376b65c: fix: preserve -0 in float typed arrays in uneval

5.9.0

Minor Changes

  • 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
  • 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
  • 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

5.8.2

Patch Changes

  • 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
  • cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
  • 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
  • 8c0db06: fix: serialize Temporal values referenced more than once in uneval
  • 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
  • 756265a: fix: preserve shared-reference identity for Map keys in uneval
  • faa8a05: fix: emit uneval reconstructions before the statements that reference them
  • 06129ad: fix: do not grow sparse arrays by one slot in uneval

5.8.1

Patch Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for devalue since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [devalue](https://github.com/sveltejs/devalue) from 5.1.1 to 5.9.4.
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.1.1...v5.9.4)

---
updated-dependencies:
- dependency-name: devalue
  dependency-version: 5.9.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 12, 2026
@vercel

vercel Bot commented Oct 12, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
syntax-website Ready Ready Preview Oct 12, 2026 2:24pm UTC

Request Review

@codecov

codecov Bot commented Oct 12, 2026

Copy link
Copy Markdown

Bundle Report

Changes will increase total bundle size by 16.92kB (0.2%) ⬆️. This is within the configured threshold ✅

Detailed changes
Bundle name Size Change
website-client-esm 2.3MB 2.44kB (0.11%) ⬆️
website-server-esm 6.01MB 14.48kB (0.24%) ⬆️

Affected Assets, Files, and Routes:

view changes for bundle: website-server-esm

Assets Changed:

Asset Name Size Change Total Size Change (%)
index.js 14.48kB 130.15kB 12.52% ⚠️
view changes for bundle: website-client-esm

Assets Changed:

Asset Name Size Change Total Size Change (%)
_app/immutable/chunks/entry.DL_W8WBt.js (New) 32.66kB 32.66kB 100.0% 🚀
_app/immutable/chunks/Icon.*.js (New) 32.52kB 32.52kB 100.0% 🚀
_app/immutable/chunks/SelectMenu.*.js (New) 14.41kB 14.41kB 100.0% 🚀
_app/immutable/chunks/AlbumArt.*.js (New) 6.2kB 6.2kB 100.0% 🚀
_app/immutable/chunks/Logo.*.js (New) 5.09kB 5.09kB 100.0% 🚀
_app/immutable/nodes/22.Di_WnKra.js (New) 3.01kB 3.01kB 100.0% 🚀
_app/immutable/nodes/44.*.js (New) 2.52kB 2.52kB 100.0% 🚀
_app/immutable/chunks/30.Cgx_VMYb.js (New) 2.31kB 2.31kB 100.0% 🚀
_app/immutable/nodes/19.DFfvIAE_.js (New) 2.23kB 2.23kB 100.0% 🚀
_app/immutable/nodes/46.C39Hiy_l.js (New) 1.94kB 1.94kB 100.0% 🚀
_app/immutable/nodes/4.*.js (New) 1.62kB 1.62kB 100.0% 🚀
_app/immutable/nodes/21.*.js (New) 1.57kB 1.57kB 100.0% 🚀
_app/immutable/nodes/1.*.js (New) 1.47kB 1.47kB 100.0% 🚀
_app/immutable/nodes/41.aa1CLvG_.js (New) 1.45kB 1.45kB 100.0% 🚀
_app/immutable/chunks/variable_color_svg.*.js (New) 778 bytes 778 bytes 100.0% 🚀
_app/immutable/nodes/2.*.js (New) 736 bytes 736 bytes 100.0% 🚀
_app/immutable/nodes/7.*.js (New) 651 bytes 651 bytes 100.0% 🚀
_app/immutable/chunks/Icon.B_ivZW2L.js (Deleted) -32.52kB 0 bytes -100.0% 🗑️
_app/immutable/chunks/entry.*.js (Deleted) -30.22kB 0 bytes -100.0% 🗑️
_app/immutable/chunks/SelectMenu.DeQcy_q0.js (Deleted) -14.41kB 0 bytes -100.0% 🗑️
_app/immutable/chunks/AlbumArt.DvINH_-o.js (Deleted) -6.2kB 0 bytes -100.0% 🗑️
_app/immutable/chunks/Logo.CVeu_Dnc.js (Deleted) -5.09kB 0 bytes -100.0% 🗑️
_app/immutable/nodes/22.*.js (Deleted) -3.01kB 0 bytes -100.0% 🗑️
_app/immutable/nodes/44.DV_zvjYm.js (Deleted) -2.52kB 0 bytes -100.0% 🗑️
_app/immutable/chunks/30.*.js (Deleted) -2.31kB 0 bytes -100.0% 🗑️
_app/immutable/nodes/19.*.js (Deleted) -2.23kB 0 bytes -100.0% 🗑️
_app/immutable/nodes/46.*.js (Deleted) -1.94kB 0 bytes -100.0% 🗑️
_app/immutable/nodes/4.C0bX_AkX.js (Deleted) -1.62kB 0 bytes -100.0% 🗑️
_app/immutable/nodes/21.B6_t6CkD.js (Deleted) -1.57kB 0 bytes -100.0% 🗑️
_app/immutable/nodes/1.DsnJK_4-.js (Deleted) -1.47kB 0 bytes -100.0% 🗑️
_app/immutable/nodes/41.*.js (Deleted) -1.45kB 0 bytes -100.0% 🗑️
_app/immutable/chunks/variable_color_svg.B76-jb_Y.js (Deleted) -778 bytes 0 bytes -100.0% 🗑️
_app/immutable/nodes/2.VAINLnr_.js (Deleted) -736 bytes 0 bytes -100.0% 🗑️
_app/immutable/nodes/7.C4L5NeX_.js (Deleted) -651 bytes 0 bytes -100.0% 🗑️

This branch was successfully deployed

1 active deployment
Preview — 3d45876e Deployed Oct 12, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants