devalue: crafted input injects __proto__ into parsed objects

Applications that use devalue to deserialize data it did not produce itself, especially data that reaches devalue.parse or devalue.unflatten from a request or other untrusted source, and then merge the result into other objects with Object.assign. Projects that only serialize their own trusted data, or do not use devalue directly, are less exposed. unknown whether SvelteKit's default behavior exposes applications; the sources do not say.