fix: update devalue to resolve CVE-2026-42570

[dannyneira]

Summary

• Updates the transitive devalue npm dependency from 5.7.1 to 5.8.1 in package-lock.json.
• Resolves CVE-2026-42570 / GHSA-77vg-94rm-hx3p for sparse array deserialization DoS in Svelte devalue.
• This is a lockfile-only transitive dependency update; no source changes or overrides were needed.

Security context

• Advisory: GHSA-77vg-94rm-hx3p
• Release: https://github.com/sveltejs/devalue/releases/tag/v5.8.1
• Dependabot alert: https://github.com/warpdotdev/docs/security/dependabot/9
• Dependency relationship: transitive runtime dependency
• Manifest: package-lock.json

Verification

• npm audit --json confirms devalue_present=false; remaining audit findings are unrelated existing alerts.
• npm run build
• npm run typecheck (0 errors; existing hints only)

Conversation: https://staging.warp.dev/conversation/a53b4723-b805-4dc6-b28c-a0d226156c20
Run: https://oz.staging.warp.dev/runs/019e2c5d-c6c2-79b5-bc29-b0c2d63f16f6
This PR was generated with Oz.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	May 15, 2026 7:47pm