chore(deps): update dependency @sveltejs/kit to v2.57.1 [security]#3075
Merged
segunadebayo merged 1 commit intomainfrom Apr 11, 2026
Merged
chore(deps): update dependency @sveltejs/kit to v2.57.1 [security]#3075segunadebayo merged 1 commit intomainfrom
segunadebayo merged 1 commit intomainfrom
Conversation
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.55.0→2.57.1GitHub Vulnerability Alerts
CVE-2026-40073
Under certain circumstances, requests could bypass the
BODY_SIZE_LIMITon SvelteKit applications running withadapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected.CVE-2026-40074
redirect, when called from inside thehandleserver hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandledTypeError. This could result in DoS on some platforms, especially if the location passed toredirectcontains unsanitized user input.Release Notes
sveltejs/kit (@sveltejs/kit)
v2.57.1Compare Source
Patch Changes
fix: better validation for
redirectinputs (10d7b44)fix: enforce
BODY_SIZE_LIMITon chunked requests (3202ed6)fix: use default values as fallbacks (#15680)
fix: relax form typings for union types (#15687)
v2.57.0Compare Source
Minor Changes
submitto indicate submission validity for enhancedformremote functions (#15530)Patch Changes
fix: use array type for select fields that accept multiple values (#15591)
fix: silently 404 Chrome DevTools workspaces request in dev and preview (#15656)
fix:
config.kit.csp.directives['trusted-types']requires'svelte-trusted-html'(and'sveltekit-trusted-url'when a service worker is automatically registered) if it is configured (#15323)fix: avoid inlineDynamicImports ignored with codeSplitting warning when using Vite 8 (#15647)
fix: reimplement treeshaking non-dynamic prerendered remote functions (#15447)
v2.56.1Compare Source
Patch Changes
v2.56.0Compare Source
Minor Changes
breaking: rework client-driven refreshes (#15562)
breaking: stabilize remote function caching by sorting object keys (#15570)
breaking: add
run()method to queries, disallow awaiting queries outside render (#15533)feat: support TypeScript 6.0 (#15595)
breaking: isolate command-triggered query refresh failures per-query (#15562)
feat: use
hydratablefor remote function transport (#15533)feat: allow
formfields to specify a default value (field.as(type, value)) (#15577)Patch Changes
fix: don't request new data when
.refreshis called on a query with no cache entry (#15533)fix: allow using multiple remote functions within one async derived (#15561)
fix: avoid false-positive overridden Vite
basesetting warning when setting apaths.baseinsvelte.config.js(#15623)fix: manage queries in their own
$effect.root(#15533)fix: avoid
inlineDynamicImportsdeprecation warning when building the service worker with Vite 8 (#15550)fix: correctly escape backticks when precomputing CSS (#15593)
fix: discard obsolete forks before finishing navigation (#15634)
chore: tighten up override implementation (#15562)
fix: ensure the default Svelte 5
error.sveltefile uses runes mode (#15609)fix: deduplicate same-cache-key
batchcalls during SSR (#15533)fix: decrement pending_count when form callback doesn't call submit() (#15520)
Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.