Skip to content

Bump devalue from 5.9.0 to 5.9.4 in /docs-site - #355

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/docs-site/devalue-5.8.1
Closed

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/docs-site/devalue-5.8.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 14, 2026 •

Copy link
Copy Markdown
Contributor

Bumps devalue from 5.9.0 to 5.9.4.

Release notes

Sourced from devalue's releases.

v5.9.4

Patch Changes

  • 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

  • 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
  • 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
  • dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
  • 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
  • 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
  • 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
  • 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

v5.9.2

Patch Changes

  • 8b2a456: fix: reject out-of-bounds indices

v5.9.1

Patch Changes

  • 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
  • 686e379: fix: emit valid JS for Node Buffer in uneval
  • 376b65c: fix: preserve -0 in float typed arrays in uneval
Changelog

Sourced from devalue's changelog.

5.9.4

Patch Changes

  • 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

  • 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
  • 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
  • dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
  • 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
  • 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
  • 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
  • 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

5.9.2

Patch Changes

  • 8b2a456: fix: reject out-of-bounds indices

5.9.1

Patch Changes

  • 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
  • 686e379: fix: emit valid JS for Node Buffer in uneval
  • 376b65c: fix: preserve -0 in float typed arrays in uneval
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 14, 2026
@vercel

vercel Bot commented May 14, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
essential-eth Ready Ready Preview Sep 22, 2026 6:27am UTC

@dawsbot

dawsbot commented Sep 22, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

Bumps [devalue](https://github.com/sveltejs/devalue) from 5.9.0 to 5.9.4.
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.9.0...v5.9.4)

---
updated-dependencies:
- dependency-name: devalue
  dependency-version: 5.8.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump devalue from 5.6.2 to 5.8.1 in /docs-site Bump devalue from 5.9.0 to 5.9.4 in /docs-site Sep 22, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/docs-site/devalue-5.8.1 branch from c55caf6 to b7d029b Compare September 22, 2026 06:17
@dependabot @github

dependabot Bot commented on behalf of github Sep 22, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #366.

@dependabot dependabot Bot closed this Sep 22, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/docs-site/devalue-5.8.1 branch September 22, 2026 20:32

This branch was successfully deployed

1 active deployment
Preview — b7d029b8 Deployed Sep 22, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant