From c51bbc9c6a016d1fddfadc55728d8816a8481958 Mon Sep 17 00:00:00 2001
From: Chris Simpson <6144684+SimmoDev@users.noreply.github.com>
Date: Mon, 21 Sep 2026 00:20:37 +0100
Subject: [PATCH] Bump devalue to 5.9.4 to clear npm audit advisory

Resolves GHSA-9rgm-9g3h-6x36 (DoS via malformed input) in the transitive
devalue dependency pulled in by svelte. The lockfile moves from 5.8.1 to
5.9.4, inside svelte's ^5.8.1 range, so package.json is unchanged.
---
 webui/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/webui/package-lock.json b/webui/package-lock.json
index 5964278..9d51bd2 100644
--- a/webui/package-lock.json
+++ b/webui/package-lock.json
@@ -727,9 +727,9 @@
       }
     },
     "node_modules/devalue": {
-      "version": "5.8.1",
-      "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.8.1.tgz",
-      "integrity": "sha512-4CXDYRBGqN+57wVJkuXBYmpAVUSg3L6JAQa/DFqm238G73E1wuyc/JhGQJzN7vUf/CMphYau2zXbfWzDR5aTEw==",
+      "version": "5.9.4",
+      "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.9.4.tgz",
+      "integrity": "sha512-sPAT4pztbu6586/hrhOnMKS17IJrvg12mXiSPSS3W5qDeN2RGgvZ0diZCm31dBbnevfVmujNO3IM2wrS4Y2Rhg==",
       "dev": true,
       "license": "MIT"
     },