[GHSA-9rgm-9g3h-6x36] Svelte devalue: DoS via malformed input

[nikpivkin]

Updates

• Affected products

Comments
The range should end at < 5.9.2, not < 5.9.1.

The fix sveltejs/devalue@8b2a456 is in tag v5.9.2 and not in tag v5.9.1.

So version 5.9.1 is still vulnerable but is outside the current range.

[github]

Hi there @Rich-Harris! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Copilot review overview

🟢 Approval recommended

The advisory now consistently identifies 5.9.2 as the first fixed version.

Review effort: Balanced
Findings: None

What changed in this PR

Corrects the advisory so version 5.9.1 remains affected and 5.9.2 is the first fixed release.

Changes:

• Removes the stale < 5.9.1 range metadata.
• Updates the modification timestamp.

File	Description
GHSA-9rgm-9g3h-6x36.json	Aligns affected-version metadata with the 5.9.2 fix.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.