unstale

npm / devalue

devalue

What changed in devalue 5 to 6, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-26.

3 breaking17 security6 performance2 behavior and defaults4 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.8 on npm

devalue 612 changes

Breaking changes 2

  • Uneval replacers now use the tagged template js instead of nested uneval.

    6.0.0release notes

  • Node 22.17 or newer is required.

    6.0.0release notes

Performance 4

  • Uses native JSON.stringify for strings that need escaping instead of a per-character loop.

    6.0.3release notes

  • Formats paths only when an error is raised.

    6.0.1release notes

  • Caches quoted property names.

    6.0.1release notes

  • Skips per-character escaping for strings with nothing to escape.

    6.0.1release notes

Behavior and default changes 2

Fixes and other changes 4

  • Populates error.path for values reached through a promise.

    6.0.1release notes

  • Malformed payloads throw Invalid input instead of a raw TypeError.

    6.0.1release notes

  • Handles typed array views whose backing buffer ends with a partial element.

    6.0.1release notes

  • Uneval and stringify output now escapes unpaired surrogates so it survives UTF-8 transport.

    6.0.0release notes

devalue 520 changes

Breaking changes 1

Security 17

  • Serializes only visible Node Buffer bytes in stringify, stringifyAsync, and uneval, preventing disclosure of unrelated data from the shared allocation pool.

    5.9.3release notes

  • devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

    5.9.3security advisoryrelease notes

  • devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion

    5.9.3security advisoryrelease notes

  • devalue: Repeated primitive strings cause quadratic expansion in uneval

    5.9.3security advisory

  • devalue: Residual sparse-array CPU amplification in uneval

    5.9.3security advisoryrelease notes

  • devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

    5.9.3security advisoryrelease notes

  • devalue: stringify/uneval serialize shared memory

    5.9.3security advisory

  • devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

    5.9.3security advisoryrelease notes

  • Rejects non-string keys on null-prototype objects, preventing a bypass of the __proto__ check.

    5.9.3release notes

  • Svelte devalue: DoS via malformed input

    5.9.2security advisory

  • Svelte devalue: DoS via sparse array deserialization

    5.8.1security advisory

  • devalue has prototype pollution in devalue.parse and devalue.unflatten

    5.6.4security advisory

  • Sveltejs devalue's devalue.parse and devalue.unflatten emit objects with __proto__ own properties

    5.6.4security advisory

  • devalue affected by CPU and memory amplification from sparse arrays

    5.6.3security advisory

  • devalue unevaled code can create objects with polluted prototypes when evaled

    5.6.3security advisory

  • Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse

    5.6.2security advisory

  • devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

    5.6.2security advisory

Performance 2

  • Module-level Object.freeze calls are annotated as pure so unused operation tables can be tree-shaken.

    5.9.4release notes

  • Prevents quadratic output expansion for repeated strings and bigints.

    5.9.3release notes