chore(deps): bump the npm_and_yarn group across 2 directories with 1 update

[dependabot]

Bumps the npm_and_yarn group with 1 update in the /examples/nextjs-ai-agent directory: devalue.
Bumps the npm_and_yarn group with 1 update in the /examples/nuxt directory: devalue.

Updates devalue from 5.8.1 to 5.9.2

Release notes

Sourced from devalue's releases.

v5.9.2

Patch Changes

• 8b2a456: fix: reject out-of-bounds indices

v5.9.1

Patch Changes

• 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
• 686e379: fix: emit valid JS for Node Buffer in uneval
• 376b65c: fix: preserve -0 in float typed arrays in uneval

v5.9.0

Minor Changes

• 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
• 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
• 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

v5.8.2

Patch Changes

• 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
• cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
• 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
• 8c0db06: fix: serialize Temporal values referenced more than once in uneval
• 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
• 756265a: fix: preserve shared-reference identity for Map keys in uneval
• faa8a05: fix: emit uneval reconstructions before the statements that reference them
• 06129ad: fix: do not grow sparse arrays by one slot in uneval

Changelog

Sourced from devalue's changelog.

5.9.2

Patch Changes

• 8b2a456: fix: reject out-of-bounds indices

5.9.1

Patch Changes

• 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
• 686e379: fix: emit valid JS for Node Buffer in uneval
• 376b65c: fix: preserve -0 in float typed arrays in uneval

5.9.0

Minor Changes

• 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
• 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
• 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

5.8.2

Patch Changes

• 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
• cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
• 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
• 8c0db06: fix: serialize Temporal values referenced more than once in uneval
• 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
• 756265a: fix: preserve shared-reference identity for Map keys in uneval
• faa8a05: fix: emit uneval reconstructions before the statements that reference them
• 06129ad: fix: do not grow sparse arrays by one slot in uneval

Commits

• a3d30d9 Version Packages (#180)
• 8b2a456 Merge commit from fork
• 3e01a6c Version Packages (#179)
• 686e379 fix: emit valid JS for Node Buffer in uneval (#175)
• 39457ce fix: uneval emits valid JS for graphs with more than 65534 repeated reference...
• 376b65c fix: preserve -0 in float typed arrays in uneval (#178)
• e82bc08 Version Packages (#174)
• 07d6a38 feat: pluggable operations for parse (#173)
• 5b53532 feat: pluggable operations for stringify (#172)
• d4e10da Version Packages (#167)
• Additional commits viewable in compare view

Updates devalue from 5.9.0 to 5.9.4

Release notes

Sourced from devalue's releases.

v5.9.2

Patch Changes

• 8b2a456: fix: reject out-of-bounds indices

v5.9.1

Patch Changes

• 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
• 686e379: fix: emit valid JS for Node Buffer in uneval
• 376b65c: fix: preserve -0 in float typed arrays in uneval

v5.9.0

Minor Changes

• 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
• 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
• 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

v5.8.2

Patch Changes

• 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
• cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
• 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
• 8c0db06: fix: serialize Temporal values referenced more than once in uneval
• 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
• 756265a: fix: preserve shared-reference identity for Map keys in uneval
• faa8a05: fix: emit uneval reconstructions before the statements that reference them
• 06129ad: fix: do not grow sparse arrays by one slot in uneval

Changelog

Sourced from devalue's changelog.

5.9.2

Patch Changes

• 8b2a456: fix: reject out-of-bounds indices

5.9.1

Patch Changes

• 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
• 686e379: fix: emit valid JS for Node Buffer in uneval
• 376b65c: fix: preserve -0 in float typed arrays in uneval

5.9.0

Minor Changes

• 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
• 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
• 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

5.8.2

Patch Changes

• 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
• cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
• 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
• 8c0db06: fix: serialize Temporal values referenced more than once in uneval
• 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
• 756265a: fix: preserve shared-reference identity for Map keys in uneval
• faa8a05: fix: emit uneval reconstructions before the statements that reference them
• 06129ad: fix: do not grow sparse arrays by one slot in uneval

Commits

• a3d30d9 Version Packages (#180)
• 8b2a456 Merge commit from fork
• 3e01a6c Version Packages (#179)
• 686e379 fix: emit valid JS for Node Buffer in uneval (#175)
• 39457ce fix: uneval emits valid JS for graphs with more than 65534 repeated reference...
• 376b65c fix: preserve -0 in float typed arrays in uneval (#178)
• e82bc08 Version Packages (#174)
• 07d6a38 feat: pluggable operations for parse (#173)
• 5b53532 feat: pluggable operations for stringify (#172)
• d4e10da Version Packages (#167)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​workflow@​4.8.3 ⏵ 4.8.9	+1		+1	+1

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Potential security risk (AI signal): npm @workflow/core is 96.0% likely risky Notes: The fragment appears to be legitimate workflow serialization and stream infrastructure, not malware. It contains one significant security risk: the v1 compatibility revive() function executes serialized input with eval. This is safe only when the serialized string is fully trusted; otherwise it can lead to arbitrary code execution. Custom deserializers, step-function resolution, and cross-run stream forwarding are expected mechanisms but require trusted registries and authorization checks outside this fragment. Confidence: 0.96 Severity: 0.72 From: examples/nextjs-ai-agent/package-lock.json → npm/workflow@4.8.9 → npm/@workflow/core@4.8.9 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@workflow/core@4.8.9. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm @smithy/core is 65.0% likely to have a medium risk anomaly Notes: The code implements a conventional, well-structured event-stream unmarshalling pipeline with explicit handling for error, exception, and event message types. The primary security considerations are: potential exposure of header/body content through thrown errors, reliance on the deserializer contract (notably the $unknown flag), and ensuring that downstream consumers appropriately trust the deserialized payloads. In a supply-chain context, ensure that eventStreamCodec, deserializer implementations, and error handling are trusted and audited to avoid leaking sensitive metadata, and consider sanitizing error messages in production. Confidence: 0.65 Severity: 0.60 From: examples/nextjs-ai-agent/package-lock.json → npm/workflow@4.8.9 → npm/@smithy/core@3.34.1 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@smithy/core@3.34.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm @workflow/nest is 62.0% likely to have a medium risk anomaly Notes: This module contains no direct malicious payload indicators, but it dynamically imports and executes server-side .mjs handlers from a runtime-configured filesystem directory and then forwards all handler-produced response headers and body to clients. The security outcome therefore hinges on the integrity and immutability of configuredOutDir and the generated artifacts it contains; if those can be tampered with, the risk escalates to serious server-side code execution and client-facing response manipulation. Confidence: 0.62 Severity: 0.55 From: examples/nextjs-ai-agent/package-lock.json → npm/workflow@4.8.9 → npm/@workflow/nest@4.0.25 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@workflow/nest@4.0.25. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm piscina is 72.0% likely to have a medium risk anomaly Notes: This module is designed to execute dynamically loaded handler code in a worker thread. The presence of new Function-wrapped dynamic import and the use of message-provided filename/name create a high-impact risk of arbitrary code execution within the worker if those inputs are not strictly constrained/validated by the parent application. No explicit network/data exfiltration or persistence behavior is present in the shown code, but supply-chain-style or runtime code injection risk is significant due to dynamic importing and execution. Confidence: 0.72 Severity: 0.60 From: examples/nextjs-ai-agent/package-lock.json → npm/workflow@4.8.9 → npm/piscina@4.9.4 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/piscina@4.9.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Potential code anomaly (AI signal): npm piscina is 80.0% likely to have a medium risk anomaly Notes: This module is a thin wrapper around Node's vm.Script and runInNewContext that compiles and runs a provided code string in a caller-supplied context. The pattern itself is powerful and legitimate for controlled use, but as implemented it lacks essential safeguards: it accepts unvalidated payloads, uses a caller-provided context that may expose powerful capabilities, and applies no execution limits. If payload or context are derived from untrusted sources, this presents a high security risk (arbitrary code execution, data leakage, DoS). Remediation: only execute trusted payloads; construct a minimal, immutable context exposing no host capabilities (no require/process/fs); deep-clone and freeze context values; run code in a restricted environment or separate process/container; enforce execution time and memory caps; validate or limit allowed operations (e.g., use SES or other hardened sandboxes). Confidence: 0.80 Severity: 0.75 From: examples/nextjs-ai-agent/package-lock.json → npm/workflow@4.8.9 → npm/piscina@4.9.4 ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/piscina@4.9.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Debug access: npm @nestjs/common in module module Module: module Location: Package overview From: examples/nextjs-ai-agent/package-lock.json → npm/workflow@4.8.9 → npm/@nestjs/common@12.0.3 ℹ Read more on: This package | This alert | What is debug access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing the use of debug will reduce the risk of any reflection and dynamic code execution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@nestjs/common@12.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Minified code present: npm @vercel/cli-config with 100.0% likelihood Confidence: 1.00 Location: Package overview From: examples/nextjs-ai-agent/package-lock.json → npm/workflow@4.8.9 → npm/@vercel/cli-config@0.2.7 ℹ Read more on: This package | This alert | What's wrong with minified code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: In many cases minified code is harmless, however minified code can be used to hide a supply chain attack. Consider not shipping minified code on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@vercel/cli-config@0.2.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Minified code present: npm get-east-asian-width with 91.0% likelihood Confidence: 0.91 Location: Package overview From: examples/nextjs-ai-agent/package-lock.json → npm/workflow@4.8.9 → npm/get-east-asian-width@1.7.0 ℹ Read more on: This package | This alert | What's wrong with minified code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: In many cases minified code is harmless, however minified code can be used to hide a supply chain attack. Consider not shipping minified code on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/get-east-asian-width@1.7.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report