Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties

Description

In some circumstances, devalue.parse and devalue.unflatten could emit objects with __proto__ own properties. This in and of itself is not a security vulnerability (and is possible with, for example, JSON.parse as well), but it can result in prototype injection if downstream code handles it incorrectly:

Recommendation

Update the devalue package to the latest compatible version. Followings are version details:

• Affected version(s): >= 4.0.0, < 5.6.4
• Patched version(s): 5.6.4

References

• GHSA-mwv9-gp5h-frr4
• CWE-1321