# What changed in devalue

> 32 changes in devalue 5 to 6 from its official release notes, upgrade guides and advisories: 3 breaking, 17 security. Each one cited. Sources checked 2026-10-26. HTML: https://unstale.sh/npm/devalue/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## devalue 6

### Breaking changes

- Uneval replacers now use the tagged template js instead of nested uneval. (6.0.0) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v6.0.0)
- Node 22.17 or newer is required. (6.0.0) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v6.0.0)

### Performance

- Uses native JSON.stringify for strings that need escaping instead of a per-character loop. (6.0.3) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v6.0.3)
- Formats paths only when an error is raised. (6.0.1) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v6.0.1)
- Caches quoted property names. (6.0.1) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v6.0.1)
- Skips per-character escaping for strings with nothing to escape. (6.0.1) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v6.0.1)

### Behavior and default changes

- Lowers the required Node.js version to >=18. (6.0.3) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v6.0.3)
- Cyclic custom objects are now supported. (6.0.0) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v6.0.0)

### Fixes and other changes

- Populates error.path for values reached through a promise. (6.0.1) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v6.0.1)
- Malformed payloads throw `Invalid input` instead of a raw `TypeError`. (6.0.1) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v6.0.1)
- Handles typed array views whose backing buffer ends with a partial element. (6.0.1) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v6.0.1)
- Uneval and stringify output now escapes unpaired surrogates so it survives UTF-8 transport. (6.0.0) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v6.0.0)

## devalue 5

### Breaking changes

- Non-enumerable symbolic keys are ignored. (5.0.0) — [release notes](https://github.com/sveltejs/devalue/blob/HEAD/CHANGELOG.md)

### Security

- Serializes only visible Node Buffer bytes in `stringify`, `stringifyAsync`, and `uneval`, preventing disclosure of unrelated data from the shared allocation pool. (5.9.3) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v5.9.3)
- devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation (5.9.3) — [security advisory](https://github.com/advisories/GHSA-R9W8-H9R3-54W4), [release notes](https://github.com/sveltejs/devalue/releases/tag/v5.9.3)
- devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion (5.9.3) — [security advisory](https://github.com/advisories/GHSA-4Q55-J62X-FR9H), [release notes](https://github.com/sveltejs/devalue/releases/tag/v5.9.3)
- devalue: Repeated primitive strings cause quadratic expansion in uneval (5.9.3) — [security advisory](https://github.com/advisories/GHSA-MCM9-63F2-9J32)
- devalue: Residual sparse-array CPU amplification in uneval (5.9.3) — [security advisory](https://github.com/advisories/GHSA-HX4R-W6WJ-J8FG), [release notes](https://github.com/sveltejs/devalue/releases/tag/v5.9.3)
- devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated (5.9.3) — [security advisory](https://github.com/advisories/GHSA-WF3X-273G-MVXV), [release notes](https://github.com/sveltejs/devalue/releases/tag/v5.9.3)
- devalue: `stringify`/`uneval` serialize shared memory (5.9.3) — [security advisory](https://github.com/advisories/GHSA-J22F-VQ7H-C4QM)
- devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise (5.9.3) — [security advisory](https://github.com/advisories/GHSA-X5RW-Q4PP-HG5G), [release notes](https://github.com/sveltejs/devalue/releases/tag/v5.9.3)
- Rejects non-string keys on null-prototype objects, preventing a bypass of the `__proto__` check. (5.9.3) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v5.9.3)
- Svelte devalue: DoS via malformed input (5.9.2) — [security advisory](https://github.com/advisories/GHSA-9RGM-9G3H-6X36)
- Svelte devalue: DoS via sparse array deserialization (5.8.1) — [security advisory](https://github.com/advisories/GHSA-77VG-94RM-HX3P)
- devalue has prototype pollution in devalue.parse and devalue.unflatten (5.6.4) — [security advisory](https://github.com/advisories/GHSA-CFW5-2VXH-HR84)
- Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties (5.6.4) — [security advisory](https://github.com/advisories/GHSA-MWV9-GP5H-FRR4)
- devalue affected by CPU and memory amplification from sparse arrays (5.6.3) — [security advisory](https://github.com/advisories/GHSA-33HQ-FVWR-56PM)
- devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed (5.6.3) — [security advisory](https://github.com/advisories/GHSA-8QM3-746X-R74R)
- Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse (5.6.2) — [security advisory](https://github.com/advisories/GHSA-VW5P-8CQ8-M7MV)
- devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse (5.6.2) — [security advisory](https://github.com/advisories/GHSA-G2PG-6438-JWPF)

### Performance

- Module-level Object.freeze calls are annotated as pure so unused operation tables can be tree-shaken. (5.9.4) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v5.9.4)
- Prevents quadratic output expansion for repeated strings and bigints. (5.9.3) — [release notes](https://github.com/sveltejs/devalue/releases/tag/v5.9.3)