An open index of dependabot pull requests across open source projects.

devalue

Ecosystem:
npm
Package URL:
pkg:npm/devalue
Total PRs:
3,979 Dependabot PRs
Latest PR:
13 days ago
Unique Repositories:
3,236 repositories
Unique Repos (30 days):
2 repositories
Security Advisories
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
GHSA-g2pg-6438-jwpf CVE-2026-22775 HIGH published 6 months ago • updated 1 day ago
## Summary Certain inputs can cause `devalue.parse` to consume excessive CPU time and/or memory, potentially leading to denial of service in syste...
Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse
GHSA-vw5p-8cq8-m7mv CVE-2026-22774 HIGH published 6 months ago • updated 1 day ago
## Summary Certain inputs can cause `devalue.parse` to consume excessive CPU time and/or memory, potentially leading to denial of service in syste...
Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties
GHSA-mwv9-gp5h-frr4 LOW published 4 months ago • updated 27 days ago
In some circumstances, `devalue.parse` and `devalue.unflatten` could emit objects with `__proto__` own properties. This in and of itself is not a s...
devalue affected by CPU and memory amplification from sparse arrays
GHSA-33hq-fvwr-56pm LOW published 5 months ago • updated 2 months ago
Under certain circumstances, serializing sparse arrays using `uneval` or `stringify` could cause CPU and/or memory exhaustion. When this occurs on ...
devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed
GHSA-8qm3-746x-r74r LOW published 5 months ago • updated 2 months ago
Under certain circumstances, `uneval`ing untrusted data can produce output code that will create objects with polluted prototypes when later `eval`...
Recent PRs
Package Details
Name: devalue
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/devalue
JSON API: View JSON
Security Advisories

8

Active advisories
HIGH 4
MODERATE 1
LOW 3
View All npm Advisories
Package Information
Description:

Gets the job done when JSON.stringify can't

Repository: https://github.com/sveltejs/devalue
Homepage: https://github.com/sveltejs/devalue#readme
Latest Release: 5.3.2
11 months ago
Dependent Repos: 52,279
Dependent Packages: 247
Downloads: 10,245,902
Ranking: Top 0.142% by dependent repos Top 0.1609% by downloads Top 0.2265% by dependent pkgs
PR Status
Open 2,097 (52.7%)
Merged 545 (13.7%)
Closed 1,337 (33.6%)
PR Types
Major 286 (7.2%)
Minor 2,698 (67.8%)
Patch 980 (24.6%)
Removal 14 (0.4%)