chore: bump devalue to v6

[GauBen]

Contains a few security fixes and we are not affected by the breaking change

[github-actions]

🦜 Chachalog

javascript-modules minor

• Bumped embedded dependencies. (fix(deps): update patch #658, chore: bump devalue from 5.6.4 to 5.8.1 #664, chore: bump dependencies #793)

  Dependency	From (JSM 1.2.0)	To (JSM 1.3.0)
  devalue	5.6.4	6.0.0
  i18next	25.7.3	26.4.2
  react	19.2.3	19.3.0
  react-dom	19.2.3	19.3.0
  react-i18next	16.5.0	17.0.14

  We decided to upgrade i18next and react-i18next in a minor version because, as far as we're aware, the breaking changes remove deprecated features that were never put in place in recent codebases. If this assumption is incorrect, please reach out to us.

Create a new entry online or run npx chachalog@0.5.6 prompt to create a new entry locally.

[pkg-pr-new]

Open in StackBlitz

yarn add https://pkg.pr.new/@jahia/create-module@797.tgz

yarn add https://pkg.pr.new/@jahia/javascript-modules-library@797.tgz

yarn add https://pkg.pr.new/@jahia/vite-plugin@797.tgz

commit: 21a3052

[Copilot]

Copilot review overview

🟢 Approval recommended

The remaining changelog feedback is a non-blocking nit.

Review effort: Lite
Findings: 1

Open (1)

• Changelog omits customer-facing security fixes and upgrade impact · New

What changed in this PR

Updates devalue to v6.0.0 for security fixes, with no expected impact from its breaking change.

Changes:

• Bumps devalue in the library and engine manifests.
• Refreshes yarn.lock.
• Updates the dependency changelog entry.

File	Description
yarn.lock	Resolves devalue at 6.0.0.
javascript-modules-library/​package.json	Updates the library dependency.
javascript-modules-engine/​package.json	Updates the engine dependency.
.chachalog/​oFKFbxW6.md	Records the dependency version change.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.