fix: escape custom reducer names

[feritcemkahraman]

Custom reducer names containing quotes, backslashes, or newlines currently produce malformed serialized JSON, so parse(stringify(value, reducers), revivers) fails even with the matching reviver. Use the existing stringify_string helper for reducer names, as for other serialized strings. This also keeps reducer names consistent with the package's script-safe string escaping.

The shared path covers both stringify and stringifyAsync; uneval has a separate custom-source API. Includes a patch changeset and round-trip regressions for four names.

Validation:

• All four new cases fail on the original source.
• pnpm test: 12 files / 1280 tests pass.
• pnpm run test:types, pnpm run build, pnpm exec publint: pass.
• Changed-file Prettier check and git diff --check: pass.
• Tested on Windows/Node 22.20.0; the complete Linux/Node 24/26 matrix was not run locally.

[pkg-svelte-dev]

Install the latest version of devalue from 0158c41:

pnpm add https://pkg.svelte.dev/devalue/c/0158c4194606b509b2e474d1c3148e655d8799e8

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/devalue/pr/228

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[changeset-bot]

🦋 Changeset detected

Latest commit: 0158c41

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
devalue	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR