chore(deps): update dependency devalue to ^5.8.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
devalue	^5.6.4 → ^5.8.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Svelte devalue: DoS via sparse array deserialization

CVE-2026-42570 / GHSA-77vg-94rm-hx3p

More information

Details

devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/sveltejs/devalue/security/advisories/GHSA-77vg-94rm-hx3p
• https://github.com/sveltejs/devalue/commit/206ca6712fbc380a4571c59de9ab04b91110792d
• https://github.com/sveltejs/devalue/releases/tag/v5.8.1
• https://nvd.nist.gov/vuln/detail/CVE-2026-42570
• https://github.com/advisories/GHSA-77vg-94rm-hx3p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

sveltejs/devalue (devalue)

v5.8.1

Compare Source

Patch Changes

• 206ca67: fix: force sparse arrays to allocate sparsely

v5.8.0

Compare Source

Minor Changes

• c5115b0: feat: add stringifyAsync for async serialization

v5.7.1

Compare Source

Patch Changes

• 8becc7c: fix: handle regexes consistently in uneval's value and reference formats

v5.7.0

Compare Source

Minor Changes

• df2e284: feat: use native alternatives to encode/decode base64
• 498656e: feat: add DataView support
• a210130: feat: whitelist Float16Array
• df2e284: feat: simplify TypedArray slices

Patch Changes

• 5590634: fix: get uneval type handling up to parity with stringify
• 57f73fc: fix: correctly support boxed bigints and sentinel values

---

Configuration

📅 Schedule: (in timezone America/Havana)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "before 4am on the first day of the month"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

[WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.overrides". See https://pnpm.io/settings for the new home of each setting.

[cloudflare-workers-and-pages]

Deploying corvus with    Cloudflare Pages

Latest commit:	fbd368d
Status:	✅  Deploy successful!
Preview URL:	https://98b4622a.corvus-42x.pages.dev
Branch Preview URL:	https://renovate-npm-devalue-vulnera.corvus-42x.pages.dev

View logs

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud