skills/vercel__workflow
1
0
Fork 0
mirror of https://github.com/vercel/workflow.git synced 2026-09-14 19:59:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

Bump devalue dependency (#3843)

Browse Source
This commit is contained in:
Rich Harris
2026-09-11 02:56:16 +02:00
committed by GitHub
parent ec57aff3be
commit 938c7ffb07
4 changed files with 29 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/forty-maps-sleep.md
+5
View File
@@ -0,0 +1,5 @@
---
'@workflow/core': patch
---
Bump `devalue` to 5.9.2 to address published security advisory.
packages/core/package.json
+1 -1
View File
@@ -102,7 +102,7 @@
"@workflow/world-local": "workspace:*",
"@workflow/world-vercel": "workspace:*",
"debug": "4.4.3",
"devalue": "5.9.0",
"devalue": "5.9.2",
"ms": "2.1.3",
"nanoid": "5.1.6",
"quickjs-wasi": "3.4.0",
pnpm-lock.yaml
Generated
+21 -21
View File
@@ -65,7 +65,7 @@ overrides:
'@vercel/queue>@vercel/oidc': 3.2.0
'@opentelemetry/api': 1.9.1
rfc6902: 5.1.2
devalue: 5.9.0
devalue: 5.9.2
'@sveltejs/acorn-typescript': 1.0.10
postcss@<8.5.18: 8.5.22
@@ -575,8 +575,8 @@ importers:
specifier: 4.4.3
version: 4.4.3(supports-color@8.1.1)
devalue:
specifier: 5.9.0
version: 5.9.0
specifier: 5.9.2
version: 5.9.2
ms:
specifier: 2.1.3
version: 2.1.3
@@ -11937,8 +11937,8 @@ packages:
detect-node-es@1.1.0:
resolution: {integrity: sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ==}
devalue@5.9.0:
resolution: {integrity: sha512-RWrqdArjvPbsATEhOPUo6Wndc/iWnkWKlhIrdlF3zMMYo/c3CVtoaVAyLtWxz5h8nSlkHzxnzV2uLydPXmtF+A==}
devalue@5.9.2:
resolution: {integrity: sha512-po4PAY5c53tw5XMocSnf8A/5OHhbbUftpr93aEN6BBoAdntUmK7vu7wOATqvt7cXO7m1Cl4gMVn6p7n6n4mj0w==}
devlop@1.1.0:
resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==}
@@ -20522,7 +20522,7 @@ snapshots:
'@nuxt/cli@3.35.2(@nuxt/schema@4.4.8)(cac@6.7.14)(magicast@0.5.2)(supports-color@10.2.2)':
dependencies:
'@bomb.sh/tab': 0.0.15(cac@6.7.14)(citty@0.2.2)
'@clack/prompts': 1.5.1
'@clack/prompts': 1.7.0
c12: 3.3.4(magicast@0.5.2)
citty: 0.2.2
confbox: 0.2.4
@@ -20546,7 +20546,7 @@ snapshots:
srvx: 0.11.21
std-env: 4.1.0
tinyclip: 0.1.12
tinyexec: 1.2.4
tinyexec: 1.3.1
ufo: 1.6.4
youch: 4.1.1
optionalDependencies:
@@ -20727,7 +20727,7 @@ snapshots:
consola: 3.4.2
defu: 6.1.7
destr: 2.0.5
devalue: 5.9.0
devalue: 5.9.2
errx: 0.1.0
escape-string-regexp: 5.0.0
exsolve: 1.0.8
@@ -20796,7 +20796,7 @@ snapshots:
consola: 3.4.2
defu: 6.1.7
destr: 2.0.5
devalue: 5.9.0
devalue: 5.9.2
errx: 0.1.0
escape-string-regexp: 5.0.0
exsolve: 1.0.8
@@ -20865,7 +20865,7 @@ snapshots:
consola: 3.4.2
defu: 6.1.7
destr: 2.0.5
devalue: 5.9.0
devalue: 5.9.2
errx: 0.1.0
escape-string-regexp: 5.0.0
exsolve: 1.0.8
@@ -25871,7 +25871,7 @@ snapshots:
'@types/cookie': 0.6.0
acorn: 8.16.0
cookie: 0.6.0
devalue: 5.9.0
devalue: 5.9.2
esm-env: 1.2.2
kleur: 4.1.5
magic-string: 0.30.21
@@ -25893,7 +25893,7 @@ snapshots:
'@types/cookie': 0.6.0
acorn: 8.16.0
cookie: 0.6.0
devalue: 5.9.0
devalue: 5.9.2
esm-env: 1.2.2
kleur: 4.1.5
magic-string: 0.30.21
@@ -25915,7 +25915,7 @@ snapshots:
'@types/cookie': 0.6.0
acorn: 8.16.0
cookie: 0.6.0
devalue: 5.9.0
devalue: 5.9.2
esm-env: 1.2.2
kleur: 4.1.5
magic-string: 0.30.21
@@ -27994,7 +27994,7 @@ snapshots:
clsx: 2.1.1
common-ancestor-path: 2.0.0
cookie: 1.1.1
devalue: 5.9.0
devalue: 5.9.2
diff: 8.0.3
dset: 3.1.4
es-module-lexer: 2.0.0
@@ -28086,7 +28086,7 @@ snapshots:
clsx: 2.1.1
common-ancestor-path: 2.0.0
cookie: 1.1.1
devalue: 5.9.0
devalue: 5.9.2
diff: 8.0.3
dset: 3.1.4
es-module-lexer: 2.0.0
@@ -29326,7 +29326,7 @@ snapshots:
detect-node-es@1.1.0: {}
devalue@5.9.0: {}
devalue@5.9.2: {}
devlop@1.1.0:
dependencies:
@@ -32858,7 +32858,7 @@ snapshots:
consola: 3.4.2
cookie-es: 3.1.1
defu: 6.1.7
devalue: 5.9.0
devalue: 5.9.2
errx: 0.1.0
escape-string-regexp: 5.0.0
exsolve: 1.0.8
@@ -32986,7 +32986,7 @@ snapshots:
consola: 3.4.2
cookie-es: 3.1.1
defu: 6.1.7
devalue: 5.9.0
devalue: 5.9.2
errx: 0.1.0
escape-string-regexp: 5.0.0
exsolve: 1.0.8
@@ -33114,7 +33114,7 @@ snapshots:
consola: 3.4.2
cookie-es: 3.1.1
defu: 6.1.7
devalue: 5.9.0
devalue: 5.9.2
errx: 0.1.0
escape-string-regexp: 5.0.0
exsolve: 1.0.8
@@ -33232,7 +33232,7 @@ snapshots:
dependencies:
citty: 0.2.2
pathe: 2.0.3
tinyexec: 1.2.4
tinyexec: 1.3.1
object-assign@4.1.1: {}
@@ -35982,7 +35982,7 @@ snapshots:
aria-query: 5.3.1
axobject-query: 4.1.0
clsx: 2.1.1
devalue: 5.9.0
devalue: 5.9.2
esm-env: 1.2.2
esrap: 2.2.13(@typescript-eslint/types@8.46.4)
is-reference: 3.0.3
pnpm-workspace.yaml
+2 -1
View File
@@ -40,7 +40,7 @@ overrides:
# spans were silently dropped this way while core's flowed (#2900).
'@opentelemetry/api': 1.9.1
rfc6902: 5.1.2
devalue: 5.9.0
devalue: 5.9.2
'@sveltejs/acorn-typescript': 1.0.10
# postcss < 8.5.18 is vulnerable to CVE-2026-45623 and GHSA-r28c-9q8g-f849
# (arbitrary file read / .map disclosure via attacker-controlled
@@ -69,6 +69,7 @@ minimumReleaseAgeExclude:
- '@esbuild/*'
- '@sveltejs/load-config'
- 'quickjs-wasi'
- 'devalue'
# The CI canary lanes pin `next` to a fresh canary at install time
# (see "Setup canary" in .github/workflows/tests.yml); canaries are
# usually younger than the 48h gate, and next and its @next/* companion