An open index of dependabot pull requests across open source projects.

devalue

Ecosystem:
npm
Package URL:
pkg:npm/devalue
Total PRs:
3,943 Dependabot PRs
Latest PR:
4 days ago
Unique Repositories:
3,211 repositories
Unique Repos (30 days):
276 repositories
Security Advisories
Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties
GHSA-mwv9-gp5h-frr4 LOW published 3 months ago • updated 21 days ago
In some circumstances, `devalue.parse` and `devalue.unflatten` could emit objects with `__proto__` own properties. This in and of itself is not a s...
devalue affected by CPU and memory amplification from sparse arrays
GHSA-33hq-fvwr-56pm LOW published 3 months ago • updated 17 days ago
Under certain circumstances, serializing sparse arrays using `uneval` or `stringify` could cause CPU and/or memory exhaustion. When this occurs on ...
devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed
GHSA-8qm3-746x-r74r LOW published 3 months ago • updated 17 days ago
Under certain circumstances, `uneval`ing untrusted data can produce output code that will create objects with polluted prototypes when later `eval`...
devalue has prototype pollution in devalue.parse and devalue.unflatten
GHSA-cfw5-2vxh-hr84 CVE-2026-30226 MODERATE published 3 months ago • updated 16 days ago
In devalue v5.6.3, `devalue.parse` and `devalue.unflatten` were susceptible to prototype pollution via maliciously crafted payloads. Successful exp...
Svelte devalue: DoS via sparse array deserialization
GHSA-77vg-94rm-hx3p CVE-2026-42570 HIGH published 21 days ago • updated 19 days ago
`devalue.parse` could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing spars...
Recent PRs
Package Details
Name: devalue
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/devalue
JSON API: View JSON
Security Advisories

8

Active advisories
HIGH 4
MODERATE 1
LOW 3
View All npm Advisories
Package Information
Description:

Gets the job done when JSON.stringify can't

Repository: https://github.com/sveltejs/devalue
Homepage: https://github.com/sveltejs/devalue#readme
Latest Release: 5.3.2
9 months ago
Dependent Repos: 52,279
Dependent Packages: 247
Downloads: 10,245,902
Ranking: Top 0.142% by dependent repos Top 0.1609% by downloads Top 0.2265% by dependent pkgs
PR Status
Open 2,091 (53.0%)
Merged 545 (13.8%)
Closed 1,307 (33.1%)
PR Types
Major 285 (7.2%)
Minor 2,667 (67.6%)
Patch 977 (24.8%)
Removal 13 (0.3%)