[DPEDE-1784](deps): Bump devalue from 5.7.1 to 5.8.1

[dependabot]

Bumps devalue from 5.7.1 to 5.8.1.

Release notes

Sourced from devalue's releases.

v5.8.1

Patch Changes

• 206ca67: fix: force sparse arrays to allocate sparsely

v5.8.0

Minor Changes

• c5115b0: feat: add stringifyAsync for async serialization

Changelog

Sourced from devalue's changelog.

5.8.1

Patch Changes

• 206ca67: fix: force sparse arrays to allocate sparsely

5.8.0

Minor Changes

• c5115b0: feat: add stringifyAsync for async serialization

Commits

• 796ea83 Version Packages (#152)
• 206ca67 Merge commit from fork
• 14933f7 Version Packages (#151)
• c5115b0 feat: stringifyAsync (#150)
• 67dad45 docs: update README to reflect serialization stability non-goal (#147)
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[lumen-jenkins-prod]

The CI pipeline did not run successfully in https://jenkinsprod.corp.intranet:8443/job/UX-CHI/job/Productive/job/Chi/job/PR-2055/1/. ❌

[cl-aifel-test]

🔖 aifel-verdict — AiFEL dependency-triage verdict (schema 1.1)

AiFEL verdict — 🚨 Escalate (ci-health) — human review required

Minor bump of devalue 5.7.1 → 5.8.1; no in-repo usage; fixes a high-severity DoS advisory; escalated because critical CI on master is at 64.3% pass rate.

TL;DR

• Merge: 🔍 review, then merge — critical CI on master is failing at 64.3% pass rate; verify the failures are pre-existing and unrelated to this bump before merging.
• Breaks your code? ✅ Most likely not — devalue has no import sites in this repo.
• Security? ✅ this bump fixes GHSA-77vg-94rm-hx3p (CVSS 7.5) — nothing still affects 5.8.1.
• Update: devalue — you have 5.7.1, this PR installs 5.8.1 (minor, spans 2 release(s)). Fixes 1 advisory (CVSS 7.5, DoS via sparse arrays), adds stringifyAsync; no code impact.

Signal	Value	Interpretation
Bump type	minor	y-component incremented (5.7.1 → 5.8.1); backward-compatible per semver. The range covers two releases: v5.8.0 adds stringifyAsync (new export, additive), v5.8.1 patches sparse-array allocation.
Dependency risk	low	Minor bump with no breaking changes in the 5.7.1→5.8.1 range; devalue is not imported anywhere in this repo (0 usage sites), so there is no blast radius.
Security risk	low	This bump exits the vulnerable range of GHSA-77vg-94rm-hx3p (CVE-2026-42570, CVSS 7.5 HIGH — DoS via sparse-array deserialization; affected range ≥ 5.6.3, ≤ 5.8.0; first patched 5.8.1). No advisory affects 5.8.1.
CI health risk	high	Critical checks: pass 64.3%, flaky 0%, 28 runs → ci_confidence: low. Pass rate falls below the 70% threshold required for medium confidence. No informational workflows excluded.
API usage in repo	false	0 import sites across all scanned files. Patterns tried: from ['"]devalue['"], require\(['"]devalue['"], import\(['"]devalue['"], export .* from ['"]devalue['"]. Confirmed absent.
Cross-repo signal	standalone	No publishable root manifest found in this repository.
Data completeness	complete	All 5 signals obtained: bump classification, API usage, release notes, CI health, cascade scan.

📋 Why this route + what AiFEL checked (click to expand)

Why this route?

escalate because: critical CI confidence is low (64.3% pass rate across 28 runs on master).

Escalation category: ci-health

Confidence breakdown — score: 0.85.

• ✅ Minor bump — backward-compatible semver delta.

• ✅ No in-repo usage of devalue — zero blast radius.

• ✅ No advisories affect 5.8.1; this bump fixes GHSA-77vg-94rm-hx3p (CVSS 7.5).

• ✅ No cascade conflicts.

• ✅ Complete data — all 5 signals obtained.

• ⚠️ CI confidence low: critical checks passing at only 64.3% across 28 runs on master (−0.15).

• 💡 To reach a lower route: Bring the critical CI pass rate on master above 70% (and flakiness ≤ 30%) so that ci_confidence rises to medium, which would route this bump to spot_check. Fixing informational workflows will NOT change the route — only the critical checks matter.

What AiFEL checked

1. Triage — classified minor (devalue 5.7.1→5.8.1).
2. Symbol extraction — none found (0 import sites across all scanned files).
3. Release-notes comparator — changelog available for 5.7.1→5.8.1: v5.8.0 adds stringifyAsync (additive, not used here); v5.8.1 fixes sparse-array allocation. No breaking changes in range.
4. CI health — 28 critical runs: pass 64.3%, flaky 0% → confidence low; no informational workflows excluded.
5. Cascade coordinator — 0 conflicts.
6. Data completeness — obtained 5/5 signals; missing: none.

Will merging break your code?

✅ Per AiFEL analysis, most likely won't impact your code. devalue is not imported in this repo's source, so no code paths are affected by this bump.

Security advisories

✅ Nothing still affects 5.8.1

✅ Resolved by this bump (1): GHSA-77vg-94rm-hx3p — no action needed (highest was CVSS 7.5).

✅ This bump resolves 1 known advisory and none affect 5.8.1 — clear on the security axis.

Packages — what you have vs what this PR installs

Ecosystem	Package	You have	This PR installs	What changes for you
npm	devalue	5.7.1	5.8.1	Fixes GHSA-77vg-94rm-hx3p (CVSS 7.5, DoS via sparse arrays); no code impact — package is not used in source.

---

Machine-readable verdict

{
  "schema_version": "1.1",
  "classification": "minor",
  "risk_band": "low",
  "ci_confidence": "low",
  "decision_route": "escalate",
  "data_completeness": "complete",
  "escalate_reason": "risk",
  "missing_signals": [],
  "confidence": 0.85,
  "packages": [{"ecosystem": "npm", "name": "devalue", "old_version": "5.7.1", "new_version": "5.8.1"}],
  "breaking_changes": [],
  "cascade_conflicts": [],
  "summary": "Minor bump of devalue 5.7.1→5.8.1; no in-repo usage; fixes GHSA-77vg-94rm-hx3p (CVSS 7.5 DoS); escalated due to low CI confidence (64.3% pass rate, 28 critical runs on master).",
  "upgrade_risk_note": null,
  "cross_repo_signal": "standalone",
  "api_usage_found": false,
  "advisory_ids": [],
  "max_cvss": null,
  "feedback_capture_marker": "aifel-CenturyLink-Chi-2055",
  "agent_version": "1.1.1-aw"
}

🤖 Generated by AiFEL — AI-assisted Dependabot triage. Advisory only; a human reviewer still decides and merges.
📝 Share your AiFEL experience