[dependabot]

Bumps devalue from 5.9.2 to 5.9.4.

Release notes

Sourced from devalue's releases.

v5.9.4

Patch Changes

• 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

• 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
• 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
• dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
• 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
• 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
• 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
• 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

Changelog

Sourced from devalue's changelog.

5.9.4

Patch Changes

• 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

• 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
• 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
• dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
• 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
• 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
• 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
• 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

Commits

• 434358a Version Packages (#202)
• 067b125 perf: annotate module-level Object.freeze calls as pure (#200)
• 53cd3db Version Packages (#201)
• 46dc877 Merge commit from fork
• 84f6f67 Merge commit from fork
• 6861dbb Merge commit from fork
• 8f8d78e Merge commit from fork
• dae8153 Merge commit from fork
• 9ec5130 Merge commit from fork
• 8ade61d chore: fix bench:compare script (#198)
• See full diff in compare view

[github-actions]

🟢 Impact Analysis — PR #2135

Risk tier: 🟢 LOW

📊 Summary

Metric	Count
Files changed	1
Files added	0
Files modified	1
Files deleted	0
Modules touched	1

🎯 Risk Factors

• 1 files changed (≤5 → LOW)
• 1 module(s) touched (≤1 → LOW)

📦 Modules Affected

docs (1 file)

• docs/package-lock.json

---

This report is generated automatically for every PR. See #733 for details.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit 3a48b2b

PR Scope: 🔧 Infrastructure

⚠️ 4 item(s) to address before review

Status	Check	Details
❌	Single commit	2 commits — consider squashing before review
✅	Not in draft	Ready for review
❌	Branch up to date	dev is 1 commit(s) ahead — rebase recommended
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	Merge status unknown — GitHub is still computing
✅	Copilot threads resolved	No Copilot review threads
❌	CI passing	1 check(s) still running

Files Changed (1 file, +3 −3)

File	+/−
docs/package-lock.json	+3 −3

Total: +3 −3

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.