Skip to content

chore(deps): update dependency @sveltejs/kit to v2.57.1 [security]#366

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-sveltejs-kit-vulnerability
Open

chore(deps): update dependency @sveltejs/kit to v2.57.1 [security]#366
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-sveltejs-kit-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Mar 26, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
@sveltejs/kit (source) 2.49.5 → 2.57.1 age confidence

Memory exhaustion in SvelteKit remote form deserialization (experimental only)

GHSA-vrhm-gvg7-fpcf

More information

Details

Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to crash due to excessive memory allocation, resulting in denial of service.

Only applications using both experimental.remoteFunctions and form are vulnerable.

Severity

  • CVSS Score: 4.6 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

CPU exhaustion in SvelteKit remote form deserialization (experimental only)

GHSA-88qp-p4qg-rqm6

More information

Details

Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the server to become unresponsive while processing a request, resulting in denial of service.

Only applications using both experimental.remoteFunctions and form are vulnerable.

Severity

  • CVSS Score: 6.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

SvelteKit has deserialization expansion in unvalidated form remote function leading to Denial of Service (experimental only)

GHSA-fpg4-jhqr-589c

More information

Details

Some relatively small inputs can cause very large files arrays in form handlers. If the SvelteKit application code doesn't check files.length or individual files' sizes and performs expensive processing with them, it can result in Denial of Service.

Only users with experimental.remoteFunctions: true who are using the form function and are processing the files array without validation are vulnerable.

Severity

  • CVSS Score: 1.7 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

@​sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service

CVE-2026-40074 / GHSA-3f6h-2hrp-w5wx

More information

Details

redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input.

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

@​sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass

CVE-2026-40073 / GHSA-2crg-3p73-43xp

More information

Details

Under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

sveltejs/kit (@​sveltejs/kit)

v2.57.1

Compare Source

Patch Changes

  • fix: better validation for redirect inputs (10d7b44)

  • fix: enforce BODY_SIZE_LIMIT on chunked requests (3202ed6)

  • fix: use default values as fallbacks (#​15680)

  • fix: relax form typings for union types (#​15687)

v2.57.0

Compare Source

Minor Changes
  • feat: return boolean from submit to indicate submission validity for enhanced form remote functions (#​15530)
Patch Changes

  • fix: use array type for select fields that accept multiple values (#​15591)

  • fix: silently 404 Chrome DevTools workspaces request in dev and preview (#​15656)

  • fix: config.kit.csp.directives['trusted-types'] requires 'svelte-trusted-html' (and 'sveltekit-trusted-url' when a service worker is automatically registered) if it is configured (#​15323)

  • fix: avoid inlineDynamicImports ignored with codeSplitting warning when using Vite 8 (#​15647)

  • fix: reimplement treeshaking non-dynamic prerendered remote functions (#​15447)

v2.56.1

Compare Source

Patch Changes

v2.56.0

Compare Source

Minor Changes

  • breaking: rework client-driven refreshes (#​15562)

  • breaking: stabilize remote function caching by sorting object keys (#​15570)

  • breaking: add run() method to queries, disallow awaiting queries outside render (#​15533)

  • feat: support TypeScript 6.0 (#​15595)

  • breaking: isolate command-triggered query refresh failures per-query (#​15562)

  • feat: use hydratable for remote function transport (#​15533)

  • feat: allow form fields to specify a default value (field.as(type, value)) (#​15577)

Patch Changes

  • fix: don't request new data when .refresh is called on a query with no cache entry (#​15533)

  • fix: allow using multiple remote functions within one async derived (#​15561)

  • fix: avoid false-positive overridden Vite base setting warning when setting a paths.base in svelte.config.js (#​15623)

  • fix: manage queries in their own $effect.root (#​15533)

  • fix: avoid inlineDynamicImports deprecation warning when building the service worker with Vite 8 (#​15550)

  • fix: correctly escape backticks when precomputing CSS (#​15593)

  • fix: discard obsolete forks before finishing navigation (#​15634)

  • chore: tighten up override implementation (#​15562)

  • fix: ensure the default Svelte 5 error.svelte file uses runes mode (#​15609)

  • fix: deduplicate same-cache-key batch calls during SSR (#​15533)

  • fix: decrement pending_count when form callback doesn't call submit() (#​15520)

v2.55.0

Compare Source

Minor Changes
  • feat: page and layout params with matchers are now type narrowed in $app/types, leading to better type safety when working with params in $app/types, $app/state, and hooks. (#​15502)

v2.54.0

Compare Source

Minor Changes
  • feat: allow error boundaries to catch errors on the server (#​15308)
Patch Changes

  • chore: upgrade devalue (#​15535)

  • fix: don't wait for remote functions that are not awaited in the template (#​15280)

  • feat: allow resolve() to accept pathnames with a search string and/or hash (#​15458)

  • chore: remove deprecation warnings for config.kit.files.* options when validating the Svelte config file (#​15482)

  • fix: handles form target attribute in remote form redirects (#​15457)

v2.53.4

Compare Source

Patch Changes
  • fix: avoid Vite warning about unknown codeSplitting option (#​15451)

v2.53.3

Compare Source

Patch Changes
  • fix: prevent overlapping file metadata in remote functions form (faba869)

v2.53.2

Compare Source

Patch Changes

  • fix: server-render nested form value sets (#​15378)

  • fix: use deep partial types for form remote functions .value() and .set(...) (#​14837)

  • fix: provide correct url info to remote functions (#​15418)

  • fix: allow optional types for remote query/command/prerender functions (#​15293)

  • fix: allow commands in more places (#​15288)

v2.53.1

Compare Source

Patch Changes
  • fix: address warning about inlineDynamicImports when using Vite 8 (#​15403)

v2.53.0

Compare Source

Minor Changes
Patch Changes

  • fix: remove event listeners on form attachment cleanup (#​15286)

  • fix: apply queries refreshed in a form remote function when a redirect is thrown (#​15362)

v2.52.2

Compare Source

Patch Changes

  • fix: validate form file information to prevent amplification attacks (3e607b3)

  • chore: upgrade devalue and svelte (#​15339)

  • fix: parse file offset table more strictly (f47c01b)

v2.52.0

Compare Source

Minor Changes
  • feat: match function to map a path back to a route id and params (#​14997)
Patch Changes

  • fix: respect scroll-margin when navigating to a url-supplied anchor (#​15246)

  • fix: resolve will narrow types to follow trailing slash page settings (#​15027)

v2.51.0

Compare Source

Minor Changes

  • feat: add scroll property to NavigationTarget in navigation callbacks (#​15248)

    Navigation callbacks (beforeNavigate, onNavigate, and afterNavigate) now include scroll position information via the scroll property on from and to targets:

    • from.scroll: The scroll position at the moment navigation was triggered
    • to.scroll: In beforeNavigate and onNavigate, this is populated for popstate navigations (back/forward) with the scroll position that will be restored, and null for other navigation types. In afterNavigate, this is always the final scroll position after navigation completed.

    This enables use cases like animating transitions based on the target scroll position when using browser back/forward navigation.

  • feat: hydratable's injected script now works with CSP (#​15048)

Patch Changes

  • fix: put preloads before styles (#​15232)

  • fix: suppress false-positive inner content warning when children prop is forwarded to a child component (#​15269)

  • fix: fetch not working when URL is same host but different than paths.base (#​15291)

  • fix: navigate to hash link when base element is present (#​15236)

  • fix: avoid triggering handleError when redirecting in a remote function (#​15222)

  • fix: include test directory in generated tsconfig.json alongside existing tests entry (#​15254)

  • fix: generate tsconfig.json using the value of kit.files.src (#​15253)

v2.50.2

Compare Source

Patch Changes

  • fix: ensure inlined CSS follows paths.assets and paths.relative settings (#​15153)

  • fix: emit script CSP nonces when unsafe-inline is present if strict-dynamic is also present (#​15221)

  • fix: re-export browser/dev from esm-env (#​15206)

  • fix: use validated args in batch resolver in both csr and ssr (#​15215)

  • fix: ensure CSS inlining includes components that are conditionally rendered (#​15153)

  • fix: only match rest params with matchers when the matcher matches (#​15216)

  • fix: properly handle percent-encoded anchors (e.g. <a href="#sparkles-%E2%9C%A8">) during prerendering. (#​15231)

v2.50.1

Compare Source

Patch Changes

  • fix: include hooks.server and hooks.universal as explicit Vite build inputs to ensure assets imported by hooks files are correctly discovered (#​15178)

  • fix: improves fields type for generic components (#​14974)

  • fix: preload links if href changes (#​15191)

v2.50.0

Compare Source

Minor Changes
  • breaking: remove buttonProps from experimental remote form functions; use e.g. <button {...myForm.fields.action.as('submit', 'register')}>Register</button> button instead (#​15144)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the internal label Mar 26, 2026
@netlify
Copy link
Copy Markdown

netlify Bot commented Mar 26, 2026 •
edited
Loading

✅ Deploy Preview for sheepdog ready!

Name Link
🔨 Latest commit 91b9b7b
🔍 Latest deploy log https://app.netlify.com/projects/sheepdog/deploys/69eff3c23c78410008d60751
😎 Deploy Preview https://deploy-preview-366--sheepdog.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented Mar 26, 2026 •
edited
Loading 

npm i https://pkg.pr.new/@sheepdog/core@366

npm i https://pkg.pr.new/@sheepdog/svelte@366

npm i https://pkg.pr.new/@sheepdog/vanilla@366

commit: 5692986

@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from b86d49e to 2d146fe Compare April 1, 2026 17:51
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from 2d146fe to 0481487 Compare April 8, 2026 20:35
@renovate renovate Bot changed the title chore(deps): update dependency @sveltejs/kit to v2.53.3 [security] chore(deps): update dependency @sveltejs/kit to v2.57.1 [security] Apr 10, 2026
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from 0481487 to 5692986 Compare April 10, 2026 20:49
@renovate renovate Bot changed the title chore(deps): update dependency @sveltejs/kit to v2.57.1 [security] chore(deps): update dependency @sveltejs/kit to v2.57.1 [security] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot deleted the renovate/npm-sveltejs-kit-vulnerability branch April 27, 2026 17:58
@renovate renovate Bot changed the title chore(deps): update dependency @sveltejs/kit to v2.57.1 [security] - autoclosed chore(deps): update dependency @sveltejs/kit to v2.57.1 [security] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch 2 times, most recently from 5692986 to 91b9b7b Compare April 27, 2026 23:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

internal

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants