Skip to content

build(deps): bump devalue from 5.9.2 to 5.9.4 in /examples/demo-site - #116

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/examples/demo-site/devalue-5.9.4
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/examples/demo-site/devalue-5.9.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026 •

Copy link
Copy Markdown
Contributor

Bumps devalue from 5.9.2 to 5.9.4.

Release notes

Sourced from devalue's releases.

v5.9.4

Patch Changes

  • 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

  • 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
  • 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
  • dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
  • 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
  • 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
  • 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
  • 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool
Changelog

Sourced from devalue's changelog.

5.9.4

Patch Changes

  • 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

  • 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
  • 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
  • dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
  • 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
  • 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
  • 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
  • 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool
Commits

@dependabot dependabot Bot added dependencies javascript Pull requests that update javascript code labels Oct 12, 2026
Bumps [devalue](https://github.com/sveltejs/devalue) from 5.9.2 to 5.9.4.
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.9.2...v5.9.4)

---
updated-dependencies:
- dependency-name: devalue
  dependency-version: 5.9.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/examples/demo-site/devalue-5.9.4 branch from 7369d49 to d48b230 Compare October 19, 2026 05:54
izo pushed a commit that referenced this pull request Oct 20, 2026
…n attente

Lockfiles seuls, package.json inchangés : racine undici 8.12.3 et sharp
0.35.5 ; demo-site astro 7.4.1, undici 8.12.3, smol-toml 1.9.1, devalue,
source-map-js 1.2.2 et sharp 0.35.5. Huit PR qui touchaient les deux mêmes
lockfiles se seraient mises en conflit l'une après l'autre.

Vérifié : npm audit à 0 sur les deux ; typecheck ; fixtures:check
(207 fichiers) ; npm test : 604 unitaires + 64 e2e verts.

Remplace #103, #107, #109, #114, #115, #116, #117 et #120.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UUSDjd6BkMUR1HavjW3qsD

izo commented Oct 20, 2026

Copy link
Copy Markdown
Owner

Remplacée par #128, fusionnée : les huit mises à jour y sont regroupées dans les deux lockfiles. Résultat : audit à 0, 604 tests unitaires et 64 e2e verts.


Generated by Claude Code

@izo izo closed this Oct 20, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 20, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/examples/demo-site/devalue-5.9.4 branch October 20, 2026 15:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant