diff --git a/package-lock.json b/package-lock.json
index a4b3525..302d9eb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5196,9 +5196,9 @@
       }
     },
     "node_modules/devalue": {
-      "version": "5.8.2",
-      "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.8.2.tgz",
-      "integrity": "sha512-DObPPAfdtFbXjxLqK8s2Xk9ZuWz5+ZoFEhC7J76es4GU/rEiXwHTmbImoCdyoCOcBH1UF3+Cz6Z2sYD4hyl5TA==",
+      "version": "5.9.2",
+      "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.9.2.tgz",
+      "integrity": "sha512-po4PAY5c53tw5XMocSnf8A/5OHhbbUftpr93aEN6BBoAdntUmK7vu7wOATqvt7cXO7m1Cl4gMVn6p7n6n4mj0w==",
       "license": "MIT"
     },
     "node_modules/devlop": {
diff --git a/package.json b/package.json
index abff845..cef08a9 100644
--- a/package.json
+++ b/package.json
@@ -62,7 +62,8 @@
     "@babel/core": "7.29.6",
     "ws": "8.21.0",
     "smol-toml": "1.7.1",
-    "yaml": "2.8.3"
+    "yaml": "2.8.3",
+    "devalue": "5.9.2"
   },
   "devDependencies": {
     "@changesets/cli": "^2.29.7",
diff --git a/test/integration/dependency-security.test.ts b/test/integration/dependency-security.test.ts
index 3523d24..9162539 100644
--- a/test/integration/dependency-security.test.ts
+++ b/test/integration/dependency-security.test.ts
@@ -154,6 +154,10 @@ function isVulnerableVersion(name: string, version: string): boolean {
     return false;
   }
 
+  if (name === "devalue") {
+    return compareSemver(version, "5.9.2") < 0;
+  }
+
   if (name === "yaml" && major === 2) {
     return compareSemver(version, "2.8.3") < 0;
   }
@@ -233,6 +237,13 @@ describe("dependency security", () => {
     expect(isVulnerableVersion(name, version)).toBe(vulnerable);
   });
 
+  it.each([
+    { name: "devalue", version: "5.9.1", vulnerable: true },
+    { name: "devalue", version: "5.9.2", vulnerable: false }
+  ])("classifies the devalue advisory boundary", ({ name, version, vulnerable }) => {
+    expect(isVulnerableVersion(name, version)).toBe(vulnerable);
+  });
+
   it("does not leave known vulnerable dependency versions in the lockfile", () => {
     const lockfile = readLockfile();
     const packages = lockfile.packages ?? {};
@@ -244,6 +255,7 @@ describe("dependency security", () => {
       "baseline-browser-mapping",
       "browserslist",
       "brace-expansion",
+      "devalue",
       "defu",
       "esbuild",
       "js-yaml",