fix(deps): bump devalue to 5.8.1 to resolve GHSA-77vg-94rm-hx3p

[kanywst]

Summary

• npm audit fix to bump devalue 5.7.1 → 5.8.1 in package-lock.json
• Resolves GHSA-77vg-94rm-hx3p (high severity, Svelte devalue DoS via sparse array deserialization)
• devalue is a transitive dep of astro / @astrojs/react; only the lockfile needs updating
• Without this, npm run audit (CI step) fails on every open PR — e.g. chore(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.3.5 to 2.3.8 #11

Test plan

• npm audit → found 0 vulnerabilities
• npm run lint
• npm run typecheck
• npm run test
• npm run build

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 34e378c9-62d1-45e0-ba0d-381298ca1a93

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/audit-devalue-advisory

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request updates the devalue dependency in package-lock.json from version 5.7.1 to 5.8.1. The reviewer recommends adding this dependency to the overrides section in package.json to ensure the security fix for GHSA-77vg-94rm-hx3p remains persistent and to prevent potential regressions during future lockfile regenerations.

[gemini-code-assist]

To ensure the security fix for devalue (GHSA-77vg-94rm-hx3p) is robust and persistent, consider adding it to the overrides section in package.json. This aligns with the existing project pattern of using overrides for transitive dependencies like yaml and vite, preventing accidental regressions if the lockfile is regenerated or if upstream dependencies are updated in the future.