[dependabot]

Bumps devalue from 2.0.1 to 6.0.2.

Release notes

Sourced from devalue's releases.

v6.0.2

Patch Changes

• 12ad9d6: chore: remove dts-buddy

v6.0.1

Patch Changes

• c13cf6a: fix: populate error.path for values reached through a promise in stringifyAsync
• 6156b2e: perf: stringify and uneval skip per-character escaping for strings with nothing to escape
• e7a9a73: fix: throw Invalid input instead of a raw TypeError for malformed typed array and boxed primitive payloads
• 6156b2e: perf: only format path when an error is raised
• 6156b2e: perf: cache quoted property names
• 9e44253: Fix uneval for typed array views whose backing buffer ends with a partial element

v6.0.0

Major Changes

• afb3cb4: breaking: use tagged template js for uneval replacers instead of nested uneval
• 3100507: breaking: require Node 22.17 or newer

Minor Changes

• afb3cb4: feat: support cyclic custom objects

Patch Changes

• ac295fb: fix: escape unpaired surrogates so uneval/stringify output survives UTF-8 transport

v5.9.4

Patch Changes

• 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Patch Changes

• 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
• 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
• dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
• 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
• 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
• 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
• 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

v5.9.2

Patch Changes

• 8b2a456: fix: reject out-of-bounds indices

... (truncated)

Changelog

Sourced from devalue's changelog.

6.0.2

Patch Changes

• 12ad9d6: chore: remove dts-buddy

6.0.1

Patch Changes

• c13cf6a: fix: populate error.path for values reached through a promise in stringifyAsync
• 6156b2e: perf: stringify and uneval skip per-character escaping for strings with nothing to escape
• e7a9a73: fix: throw Invalid input instead of a raw TypeError for malformed typed array and boxed primitive payloads
• 6156b2e: perf: only format path when an error is raised
• 6156b2e: perf: cache quoted property names
• 9e44253: Fix uneval for typed array views whose backing buffer ends with a partial element

6.0.0

Major Changes

• afb3cb4: breaking: use tagged template js for uneval replacers instead of nested uneval
• 3100507: breaking: require Node 22.17 or newer

Minor Changes

• afb3cb4: feat: support cyclic custom objects

Patch Changes

• ac295fb: fix: escape unpaired surrogates so uneval/stringify output survives UTF-8 transport

5.9.4

Patch Changes

• 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

5.9.3

Patch Changes

• 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
• 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
• dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
• 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
• 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
• 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
• 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

5.9.2

Patch Changes

• 8b2a456: fix: reject out-of-bounds indices

... (truncated)

Commits

• b36fdee Version Packages (#210)
• 12ad9d6 chore: remove dts-buddy (#209)
• d763272 Version Packages (#206)
• 24ecda3 chore: tidy up (#208)
• 6156b2e perf: cheaper stringify for plain data and strings (#190)
• 42fd8a2 perf: add stringify/uneval benchmarks (#207)
• c6b650d Make deserialization more explicit in usage example (#37)
• c13cf6a fix: populate error.path for values inside promises in stringifyAsync (#189)
• e7a9a73 fix(parse): validate indices before dereferencing malformed payloads (#191)
• 9e44253 fix: serialize typed arrays with partial backing elements (#204)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for devalue since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/bridge@1923

npm i https://pkg.pr.new/@nuxt/bridge-schema@1923

commit: 81a5183