chore(deps): update dependency @sveltejs/kit to v2.60.1 [security]#140
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update dependency @sveltejs/kit to v2.60.1 [security]#140renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
itemsim | 110296f | May 21 2026, 07:14 PM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.52.2→2.60.1@sveltejs/kit:
query.batchcross-talkGHSA-hgv7-v322-mmgr
More information
Details
query.batch()could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
sveltejs/kit (@sveltejs/kit)
v2.60.1Compare Source
Patch Changes
chore: bump
svelteanddevalue(#15836)fix: prevent
query.batchcross-talk (dadaefc)v2.60.0Compare Source
Minor Changes
feat: allow 'submit' and 'hidden' form fields to accept numbers and booleans (#15802)
feat: warn on unread
formremote function validation issues (#15653)Patch Changes
fix: abort navigation after async rendering if obsolete (#15811)
fix: skip refreshing queries on full-page reload form submissions (#15803)
v2.59.1Compare Source
Patch Changes
v2.59.0Compare Source
Minor Changes
feat: support
query.batchinrequested(...)(#15751)breaking: on the server, make the promise returned from
refreshrepresent adding the refresh to the map, not the time it takes to run the remote function (#15705)feat: experimental
query.livefunction (#15705)Patch Changes
fix: unwrap
PromiseinRemoteCommandoutput type (#15771)fix: empty call to
.updates()on a command/form invocation means "don't update anything" (#15705)fix:
form.fields.foo.as('checkbox', default_value)now works (#15752)fix: remote forms with default values defined by
field.as('text', defaultValue)now correctly reset to the provided default values once submitted (#15753)fix: make sure queries always get started correctly (#15705)
fix: allow plain functions as overrides in
updates(#15705)v2.58.0Compare Source
Minor Changes
breaking: require
limitinrequested(as originally intended) (#15739)feat:
RemoteQueryFunctiongains an optional third generic parameterValidated(defaulting toInput) that represents the argument type after schema validation/transformation (#15739)breaking:
requestednow yields{ arg, query }entries instead of the validated argument (#15739)Patch Changes
fix: allow
query().current,.error,.loading, and.readyto work in non-reactive contexts (#15699)fix: prevent
deep_setcrash on nullish nested values (#15600)fix: restore correct
RemoteFormFieldstyping for nullable array fields (e.g. when a schema uses.default([])), so.as('checkbox')and friends work again (#15723)fix: don't warn about removed SSI comments in
transformPageChunk(#15695)Server-side include (SSI) directives like
<!--#include virtual="..." -->are HTML comments that are replaced by servers such as nginx. Previously, removing them intransformPageChunkwould trigger a false positive warning about breaking Svelte's hydration. Since SSI comments always start with<!--#and Svelte's hydration comments never do, they can be safely excluded from the check.Change enhance function return type from void to MaybePromise. (#15710)
fix: throw an error when
resolveis called with an external URL (#15733)fix: avoid FOUC for CSR-only pages by loading styles and fonts before CSR starts (#15718)
fix: reset form result on redirect (#15724)
v2.57.1Compare Source
Patch Changes
fix: better validation for
redirectinputs (10d7b44)fix: enforce
BODY_SIZE_LIMITon chunked requests (3202ed6)fix: use default values as fallbacks (#15680)
fix: relax form typings for union types (#15687)
v2.57.0Compare Source
Minor Changes
submitto indicate submission validity for enhancedformremote functions (#15530)Patch Changes
fix: use array type for select fields that accept multiple values (#15591)
fix: silently 404 Chrome DevTools workspaces request in dev and preview (#15656)
fix:
config.kit.csp.directives['trusted-types']requires'svelte-trusted-html'(and'sveltekit-trusted-url'when a service worker is automatically registered) if it is configured (#15323)fix: avoid inlineDynamicImports ignored with codeSplitting warning when using Vite 8 (#15647)
fix: reimplement treeshaking non-dynamic prerendered remote functions (#15447)
v2.56.1Compare Source
Patch Changes
v2.56.0Compare Source
Minor Changes
breaking: rework client-driven refreshes (#15562)
breaking: stabilize remote function caching by sorting object keys (#15570)
breaking: add
run()method to queries, disallow awaiting queries outside render (#15533)feat: support TypeScript 6.0 (#15595)
breaking: isolate command-triggered query refresh failures per-query (#15562)
feat: use
hydratablefor remote function transport (#15533)feat: allow
formfields to specify a default value (field.as(type, value)) (#15577)Patch Changes
fix: don't request new data when
.refreshis called on a query with no cache entry (#15533)fix: allow using multiple remote functions within one async derived (#15561)
fix: avoid false-positive overridden Vite
basesetting warning when setting apaths.baseinsvelte.config.js(#15623)fix: manage queries in their own
$effect.root(#15533)fix: avoid
inlineDynamicImportsdeprecation warning when building the service worker with Vite 8 (#15550)fix: correctly escape backticks when precomputing CSS (#15593)
fix: discard obsolete forks before finishing navigation (#15634)
chore: tighten up override implementation (#15562)
fix: ensure the default Svelte 5
error.sveltefile uses runes mode (#15609)fix: deduplicate same-cache-key
batchcalls during SSR (#15533)fix: decrement pending_count when form callback doesn't call submit() (#15520)
v2.55.0Compare Source
Minor Changes
$app/types, leading to better type safety when working with params in$app/types,$app/state, and hooks. (#15502)v2.54.0Compare Source
Minor Changes
Patch Changes
chore: upgrade
devalue(#15535)fix: don't wait for remote functions that are not awaited in the template (#15280)
feat: allow
resolve()to accept pathnames with a search string and/or hash (#15458)chore: remove deprecation warnings for
config.kit.files.*options when validating the Svelte config file (#15482)fix: handles form target attribute in remote form redirects (#15457)
v2.53.4Compare Source
Patch Changes
codeSplittingoption (#15451)v2.53.3Compare Source
Patch Changes
form(faba869)v2.53.2Compare Source
Patch Changes
fix: server-render nested form value sets (#15378)
fix: use deep partial types for form remote functions
.value()and.set(...)(#14837)fix: provide correct url info to remote functions (#15418)
fix: allow optional types for remote query/command/prerender functions (#15293)
fix: allow commands in more places (#15288)
v2.53.1Compare Source
Patch Changes
inlineDynamicImportswhen using Vite 8 (#15403)v2.53.0Compare Source
Minor Changes
Patch Changes
fix: remove event listeners on form attachment cleanup (#15286)
fix: apply queries refreshed in a form remote function when a redirect is thrown (#15362)
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.