Skip to content

chore(deps): update dependency @sveltejs/kit to v3 [security] - #12557

Open
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/npm-sveltejs-kit-vulnerability
Open

chore(deps): update dependency @sveltejs/kit to v3 [security]#12557
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/npm-sveltejs-kit-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@sveltejs/kit (source) ^2.70.3 → ^3.0.0 age confidence

SvelteKit : XSS via untrusted cache-control header in prerendered page

CVE-2026-114061 / GHSA-27mw-82g8-phjj

More information

Details

Impact

Applications that prerender pages and use setHeaders to set a cache-control header from an untrusted source are vulnerable to cross-site scripting (XSS).

SvelteKit inserts the header value into a <meta http-equiv="cache-control"> tag without escaping it. An attacker who can influence this value at prerender time can break out of the content attribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.

Patches

The fix escapes the header value before inserting it into the generated HTML. Upgrade to @sveltejs/kit version 3.0.0 or later.

Workarounds

Avoid forwarding untrusted cache-control header values with setHeaders on prerendered pages. Use a fixed, trusted cache policy instead.

Severity

  • CVSS Score: 0.0 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

SvelteKit: URL redirection to untrusted site via enhanced form submission

CVE-2026-114060 / GHSA-pfhg-q3qv-9q6r

More information

Details

Impact

Applications using enhanced form actions (use:enhance) on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect.

Patches

A fix has been prepared for @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later.

The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.

Workarounds

Reject requests whose parsed URL pathname begins with // before route resolution, for example in a reverse proxy or a SvelteKit handle hook.

Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:

<form method="POST" use:enhance={() => ({ update }) => update({ navigate: false })}>
  <!-- form fields -->
</form>

This applies non-redirect results to the current page instead of navigating to the action location.

Severity

  • CVSS Score: 2.1 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

sveltejs/kit (@​sveltejs/kit)

v3.0.0

Compare Source

Major Changes

  • breaking: move remote function types to $app/server (#​16740)

  • breaking: remove experimental.handleRenderingErrors flag (#​16265)

  • breaking: make getRequest and setResponse synchronous (#​16280)

  • breaking: TypeScript 6 is now the minimum required version (#​15930)

  • breaking: refresh all load functions/queries when clicking a link to the current URL (#​16572)

  • breaking: move remote function types to $app/server (#​16764)

  • breaking: upgrade to cookie v2. Cookie names must now contain only ASCII characters (#​13386)

  • breaking: require Node 22 or newer (#​12548)

  • major: error when a client-requested single-flight mutation isn't respected by the server, allow the server to explicitly ignore refreshes (#​16892)

  • breaking: remove the preloadStrategy option. modulepreload will always be used (#​15256)

  • breaking: default the cookie path option to '/' (#​15398)

  • breaking: remove @sveltejs/kit/node/polyfills (#​15430)

  • breaking: add config.kit.output.linkHeaderPreload to preload using the Link header (#​15939)

  • breaking: require @sveltejs/vite-plugin-svelte v7 (#​15371)

  • breaking: make page.url immutable on a type level (#​16256)

  • breaking: remove base, assets, and resolveRoute from $app/paths (#​15507)

  • breaking: remove createEntries from the Builder object passed to adapter functions (#​15509)

  • breaking: return no content for 204 responses (#​16200)

  • breaking: rename Pathname type to Path and Asset to AssetPath (#​16430)
    breaking: remove leading / from Path and AssetPath

  • breaking: handle's resolve is now typed to always return a Promise (#​16352)

  • breaking: remove Server constructor and SSRManifest from public types (#​16876)

  • breaking: require Svelte config options to be passed through the Vite plugin (#​16007)

  • breaking: form action responses now use the HTTP status code returned from fail (#​16200)

  • breaking: write tsconfig to node_modules/$app/tsconfig (#​16458)

  • breaking: move defineParams and associated types to @sveltejs/kit/params (#​16716)

  • breaking: remove the deprecated CSRF checkOrigin option in favor of trustedOrigins (#​15437)

  • breaking: the delta property now only exists for popstate navigation events (#​15522)

  • breaking: change form.error type from any to App.Error | undefined (#​16245)

  • breaking: remove deprecated pragma header in version polling for improved CORS support (#​15428)

  • breaking: goto now rejects when called with a URL that does not resolve to a route within the app, matching the existing behaviour for external URLs (#​16164)

  • breaking: run all errors through the handleError hook (#​16664)

  • breaking: require Svelte 5.56.4 or newer (#​15371)

  • breaking: error on event.url, event.params and event.route access inside queries (#​16452)

  • breaking: enhanced cross-page form actions now navigate to the action page on success and failure, matching native form behavior (#​16684)

  • breaking: delete $service-worker module (#​16450)

  • breaking: move defineEnvVars to @sveltejs/kit/env (#​16375)

  • breaking: nested server-only directories (#​15685)

  • feat: allow adapters to provide additional Vite plugins (#​16206)

  • breaking: replace the $lib alias with #lib and remove files.lib config. (#​16360)

  • breaking: remove #lib definition from paths; requires explicit module extensions as a result (#​16736)

  • chore: change error, isHttpError, redirect, and isRedirect to refer to public type instead of internal class (#​13036)

  • breaking: move hooks-related types to @sveltejs/kit/hooks (#​16737)

  • breaking: add 'error' result type to preloadData (#​12579)

  • breaking: detect new deployments on data, remote, and form action responses, tab focus, and visibility change, and default version.pollInterval to 1 hour (#​16496)

  • breaking: disallow cross-origin form submissions without a Content-Type header (#​16347)

  • breaking: Server-only directories (/server/ in the path) are now treated as server-only everywhere inside the project (except src/routes and the assets directory) (#​16360)

  • breaking: config exported from a universal route file takes precedence over a server one (#​16400)

  • breaking: require Vite 8. Provides new functionality even for existing Vite 8 users such as faster builds with Vite hook filters and more powerful SvelteKit adapters with the Vite environment API (#​15371)

  • breaking: remove data-sveltekit-* option 'off' in favour of false (#​15907)

  • breaking: move tracing out of the experimental namespace and remove the instrumentation flag (#​16260)

  • breaking: add kit.paths.origin config option, remove kit.prerender.origin and the adapter-node ORIGIN environment variable (#​16161)

  • breaking: move Page, ReadonlyURL and ReadonlyURLSearchParams from @sveltejs/kit to $app/state (#​16694)

  • breaking: remove $app/stores (#​15499)

  • breaking: add refreshAll and deprecate invalidateAll (#​16289)

  • breaking: reject query parameters beginning with x-sveltekit- (#​17125)

  • breaking: disallow *.remote.ts/js files unless experimental.remoteFunctions is enabled (#​16247)

  • breaking: replace the noScroll and keepFocus options of goto with a single reset option, and the data-sveltekit-noscroll and data-sveltekit-keepfocus attributes with data-sveltekit-reset (#​16558)

  • breaking: don't abort navigation when calling invalidate(All) during navigation (#​16188)

  • breaking: consistent special filename patterns (#​16382)

  • breaking: allow handleError to influence status code (#​16162)

  • breaking: delegate CORS handling to Vite for static directory requests during development (#​16357)

  • breaking: require vite@^8.0.12, the first Vite 8 release bundling stable rolldown 1.0.0 (#​16134)

  • breaking: only include routes with a +page or +server in RouteId (#​16580)

  • breaking: require Node 22.17 (#​16597)

  • breaking: deprecate error(status, {...}) in favour of error(status, message, {...}) (#​16540)

  • breaking: replace the builder.generateManifest with builder.generateServerInstance and builder.manifest (#​16875)

  • breaking: forbid external redirects by default (#​16198)

  • breaking: separate adapter Vite plugins into pre and post (#​16711)

  • breaking: remove param files in folder in favor of params.js/ts file (#​16189)

  • breaking: move env-related types to @sveltejs/kit/env (#​16739)

  • breaking: preloadCode now takes a route ID (e.g. /blog/[slug]) instead of a pathname. Route IDs are not prefixed with paths.base (#​16576)

  • breaking: move BeforeNavigate, OnNavigate, AfterNavigate, Navigation, NavigationTarget, NavigationType, GotoOptions and the Navigation* variant types from @sveltejs/kit to $app/navigation (#​16694)

  • breaking: move ActionResult and SubmitFunction from @sveltejs/kit to $app/forms (#​16694)

  • breaking: remove handleValidationError and pass remote function validation errors to handleError with kind: 'validation' (#​16672)

  • breaking: remove deprecated .run() method from live queries (#​16573)

Minor Changes

  • feat: allow hyphens in param and matcher names (#​16284)

  • feat: add $app/manifest module with immutable, assets, prerendered, and routes exports (#​16372)

  • feat: ignore files with + prefix if they contain test/spec/stories (#​16715)

  • feat: add ErrorProps to generated types (#​16272)

  • feat: support sourcemaps in production (#​16412)

  • feat: return the list of compressed files from builder.compress (#​16566)

  • feat: better response logging (#​16744)

  • feat: warn when tsconfig doesn't exclude service worker (#​16645)

  • feat: validate that all remote form fields were created with form.fields.foo.as(...) (#​16331)

  • feat: support function validators for environment variables (#​16402)

  • feat: use type: 'module' for service worker registrations (#​16169)

  • feat: allow adapters to receive the Svelte config as a function argument when adding Vite plugins (#​16986)

  • feat: add shallow routing to goto and deprecate pushState and replaceState (#​16449)

  • feat: abort request.signal when the response closes prematurely, via a new response option for getRequest (#​16793)

  • feat: make $app/paths importable in service workers (#​16441)

  • feat: pass the project-relative source filename to the preload filter for fonts (#​16443)

  • feat: preserve page state set through goto(..., { state, persistState: true }) across reloads (#​16449)

  • feat: reinstate $env/static/private, $env/dynamic/private, $env/static/public, $env/dynamic/public and $app/environment as deprecated aliases for $app/env/private $app/env/public and $app/env (#​16334)

  • feat: add page and endpoint booleans to $app/manifest's routes, and export a ManifestRoute type (#​16594)

  • feat: $app/service-worker module (#​16458)

  • feat: resolve paths using the Vite config root option instead of process.cwd() to better support monorepo configurations such as Vitest workspaces (#​15469)

  • feat: better error logging (#​16374)

  • feat: add PageRouteId and EndpointRouteId to $app/types (#​16594)

  • feat: better tsconfig validation (#​16458)

  • feat: add dirty() property to form fields (#​16208)

  • feat: support the QUERY HTTP method in +server.js (#​16782)

  • feat: allow adapters to override getRequest and setResponse during vite dev and vite preview (#​16753)

  • chore: deprecate Response helpers in favor of platform-provided alternatives (#​15448)

  • feat: add cookies.parse method (#​16203)

  • chore: deprecate export const snapshot in favour of the snapshot helper (#​16687)

  • feat: add snapshot helper to $app/navigation (#​16685)

  • feat: support custom values in page.state via transport hook (#​16662)

  • fix: default cookies to secure to false during development (#​16462)

  • feat: warn when naively proxying requests that result in responses with a content-encoding header (#​16633)

  • feat: accept the checked state as a third argument to .as('radio', ...) and .as('checkbox', ...) so that these inputs reset to it after a submission (#​16926)

  • feat: add an applyReroute helper for adapters that support split serverless function deployments (#​16665)

Patch Changes

  • fix: prevent scheme-like path segments from causing off-site trailing-slash redirects (#​17294)

  • chore: share the action error result between form actions and remote forms (#​16835)

  • fix: persist global app state across module graph reloads (#​16663)

  • fix: generate valid Path types for routes with optional or rest params, several params in one segment, or escape sequences (#​16577)

  • fix: coerce values typed into remote form fields, and only apply the default given to .as() until the field is edited (#​16939)

  • fix: blur focused SVG elements before the DOM update on navigation (#​16983)

  • fix: support bigint params in server-side route resolution (#​17130)

  • chore: build streamed responses from async generators (#​16847)

  • fix: generate types when dev server starts (#​17034)

  • fix: allow undefined values to be passed to form field .as(...) where applicable (#​15681)

  • fix: respect paths.relative during development for client files (#​17053)

  • fix: validate prerender concurrency (#​17145)

  • chore: deprecate builder.rimraf and builder.mkdirp in favour of node:fs methods (#​16610)

  • fix: manipulate stack trace for errors that happen while generating prerender inputs (#​17113)

  • fix: don't treat callable standard schemas as function param matchers (#​16403)

  • fix: prevent non-redirect enhanced form results from navigating to another origin (#​17293)

  • fix: clarify circular imports from src/env (#​17014)

  • fix: keep memory flat when precompressing many files (#​16993)

  • fix: render remote form actions while prerendering (#​17139)

  • fix: ignore Vitest browser loader HTML transforms (#​17092)

  • fix: prevent failed link preloads from causing unhandled promise rejections in production (#​17181)

  • fix: resolve generated rootDirs from the project root (#​17242)

  • fix: generate route resolution modules as siblings of .html pages (#​16674)

  • perf: parse large streamed frames in linear time (#​16489)

  • fix: keep at most one pending body read at a time when deserializing binary forms (#​16783)

  • fix: escape cache-control headers in prerendered HTML (#​17293)

  • fix: decode all numeric character references, including above ffff, when crawling prerendered pages (#​16611)

  • fix: enforce request body size limits when Content-Type is absent (#​17127)

  • fix: include queries refreshed from within another query in the serialized response (#​16461)

  • fix: reject malformed streamed data encoding (#​16423)

  • perf: cache the default cookie header parse and avoid allocations in cookies.get (#​16341)

  • fix: exclude deleted cookies from cookies.getAll() so it stays consistent with cookies.get() (#​16297)

  • fix: hide stack traces for internal errors like 404s (#​16411)

  • chore: deduplicate repeated CSP directive handling (#​16498)

  • fix: render the nearest error page when a form submission receives a non-ActionResult error response (#​16308)

  • chore: bump mrmime to 2.0.1 (#​16745)

  • fix: correctly implement Vite plugin hook filters (#​16760)

  • fix: ignore nested outDir files outside generated (#​17150)

  • fix: defer query.refresh() in server commands until after the command body completes (#​16225)

  • fix: drain unconsumed request bodies so keep-alive connections don't hang (#​16170)

  • fix: keep history.scrollRestoration set to manual when leaving the page, so a document restored from the back/forward cache does not fall back to browser scroll restoration (#​17244)

  • fix: resolve service worker and tsconfig.json based on Vite root setting (#​16229)

  • fix: rebuild the dev manifest when route files disappear during an incremental update (#​16643)

  • breaking: populate env vars before instrumentation.server.js is evaluated and update the adapter instrumentation API (#​16303)

  • fix: only print prerender progress newline when necessary (#​16766)

  • perf: match only unpaired surrogates when escaping HTML (#​16407)

  • fix: treat data: protocol URLs as external for redirect (#​16392)

  • chore: deduplicate request hashing for serialized fetch responses (#​16499)

  • fix: don't treat Object.prototype members as param matchers during validation (#​16612)

  • fix: generate a never Path type when there are no routes (#​17228)

  • fix: follow HTTP redirects from authentication proxies when enhancing form submissions (#​17106)

  • fix: don't report empty environment variables as missing (#​16401)

  • chore: generate the env modules in a single pass (#​16833)

  • fix: externalize @opentelemetry/api to prevent bundler chunk colocation between instrumentation.server.js and application code (#​16302)

  • fix: support form fields named after Object prototype properties (#​17136)

  • fix: exclude routes without a page or endpoint from routes in $app/manifest, and remove directories with no route files from LayoutParams (#​16588)

  • fix: record a history traversal before resolving its route (#​16959)

  • fix: avoid Vite dev server reload on initial page request (#​16553)

  • fix: don't set a null accept-language header on internal fetch sub-requests when the incoming request has none (#​16527)

  • fix: reuse SSR-cached fetch responses during hydration when a cross-origin URL is not in canonical form (#​16339)

  • fix: correctly detect prerendered paths in server fetch when paths.base is set (#​16525)

  • chore: say what a valid remote form field name looks like when rejecting one (#​16938)

  • chore: warn when remote form fields are enumerated in dev (#​16940)

  • fix: populate $app/env/* dynamic variables in contexts that don't run the dev server, such as vite-node (#​16223)

  • fix: resolve client manifest imports against the Vite root (#​16803)

  • fix: properly handle Date objects in form.fields.set (#​16168)

  • fix: return 404 for form actions and remote functions whose name is an Object.prototype member (#​16072)

  • fix: no longer throw "An impossible situation occurred" when a server-only module is imported by both server and client code (#​16257)

  • fix: respect Vite default log level (#​16767)

  • fix: set the focus starting point without a fragment navigation, which leaked a hashchange to app listeners (#​16992)

  • fix: keep a form.for instance registered when the derived that holds it disconnects and reconnects (#​17230)

  • fix: make cookie options optional (#​17201)

  • fix: don't duplicate remote modules in the generated manifest (#​16532)

  • fix: evict hashed fetch cache entries after mutations (#​17146)

  • chore: reuse base64 and text decoding helpers (#​16608)

  • fix: explain the removal of $lib and $service-worker when their imports fail to resolve (#​16635)

  • fix: tweak response logging for remote requests (#​16865)

  • fix: correctly massage stack traces with async frames (#​16633)

  • fix: mark RequestEvent properties as readonly (#​16661)

  • fix: render the nearest +error.svelte at the depth it occupies when an error is thrown during rendering (#​16526)

  • fix: support coordinate objects from image inputs in remote forms (#​16944)

  • fix: revert route metadata caching to regenerate missing root-route types during sync (#​17281)

  • chore: bump @sveltejs/acorn-typescript to 1.0.12 (#​16745)

  • fix: update match parameter type (#​16636)

  • fix: generate sourcemaps for remote modules (#​16440)

  • fix: keep hash-router links on the current document when resolving paths (#​17107)

  • fix: avoid empty getElementById() call on hash routing navigation (#​16448)

  • fix: resolve every module entry point using kit.moduleExtensions (#​17043)

  • fix: serve .ico files with image/x-icon Content-Type (#​16234)

  • chore: bump magic-string to 1.1.0 (#​16745)

  • fix: exclude inlined files from the page's $app/manifest immutable list (#​16531)

  • fix: discard invalidation results when a navigation completes while they load (#​16852)

  • fix: avoid client-side code being bundled by Cloudflare Wrangler (#​16364)

  • fix: wait for the redirect navigation before remote form submissions resolve (#​16765)

  • fix: record the mime types of prerendered paths in the server manifest (#​16564)

  • fix: only require the svelte-trusted-html trusted-types policy when client-side code is shipped, allowing builds where all pages have csr: false (#​16928)

  • chore: clarify which hooks run during server route resolution (#​16397)

  • fix: yield to allow prerender updates to be visible (#​16748)

  • fix: make paths.origin type looser (#​16215)

  • chore: bump devalue to 5.9.0 (#​16745)

  • feat: send periodic keep-alive SSE comments from query.live to prevent idle-timeout errors (#​16063)

  • fix: send an explicit SSE Accept header for query.live requests to avoid buffering by proxies (#​17104)

  • fix: don't touch the query.live stream controller after teardown, and make response cancellation observable via the generator's request.signal (#​16790)

  • fix: print builder.log.warn messages to stderr, as documented (#​17253)

  • fix: warn if hook files are spelled as "hook" instead of "hooks" (#​16483)

  • fix: only suggest a + prefix for route filenames that are valid with the file's extension (#​16837)

  • chore: only generate each route's resolution module once when prerendering (#​16576)

  • fix: don't throw from remote form validate() if the form unmounts while it is waiting for a tick (#​16720)

  • chore: share navigation completion between navigate and shallow routing (#​16838)

  • fix: route dev-server response logging through Vite's logger so it respects logLevel and customLogger (#​16858)

  • fix: skip clean fields when programmatically validating forms (#​16208)

  • perf: skip import graph collection outside client environments (#​16383)

  • breaking: experimental remote form validate({ includeUntouched }) option is now all (#​16208)

  • fix: rerun load functions when the number of values of a tracked search parameter changes (#​16495)

  • chore: read build-time config from defines on the server instead of carrying it in options (#​16873)

  • fix: avoid client build warning about externalising node:async_hooks (#​16244)

  • chore: stop externalizing cookie dependency during build (#​16936)

  • fix: reinstate $app/environment as an alias for $app/env, in case dependencies import it (#​15964)

  • fix: preserve paths.base when vite preview redirects a prerendered page to the correct trailing slash (#​16836)

  • fix: error when reading non-serialized set-cookie headers via getSetCookie in load (#​16614)

  • fix: walk and copy directories without a stat per file (#​16995)

  • perf: avoid quadratic remote form issue merging (#​16493)

  • fix: widen remote form fields for union schemas and string enums (#​16937)

  • chore: deprecate the alias option (#​16470)

  • fix: don't attempt to serialize fetch responses when the request body is not a string or TypedArray (#​16501)

  • fix: respond to HEAD requests without a body (#​17036)

  • chore: replace deprecated Vite dev server APIs (#​16961)

  • chore: iterate the query cache maps through a single generator (#​16846)

  • fix: handle rejected streamed server data after delayed loads (#​16268)

  • fix: don't crash on interactions inside a form whose controls shadow nodeName (#​16769)

  • fix: don't replay a preloaded redirect when a later hop of the navigation returns to the route (#​16955)

  • fix: prevent path traversal when previewing prerendered pages and data on Windows (#​17293)

  • fix: settle a query's pending request in place when its value arrives through set() (#​16958)

  • fix: render pages over sibling endpoints without GET or HEAD handlers (#​16125)

  • fix: exit build workers after completing their tasks while allowing synchronous exit handlers to run (#​17135)

  • fix: prevent infinite loops when server-side queries refresh each other in a cycle during the single-flight drain (#​16461)

  • fix: populate version in service workers (#​16434)

  • feat: add field.touched() helper to remote form fields (#​14692)

  • fix: respect paths.relative for server-side route resolution imports (#​17056)

  • fix: read the error status of App.Error in the prerender and query.live remote functions (#​16529)

  • fix: resolve remote modules as external during dev prebundling so packages can re-export remote functions (#​16426)

  • chore: standardize remote-function and shared form diagnostics (#​17277)

  • fix: avoid Promise.withResolvers in client remote functions for older browser support (#​16777)

  • fix: propagate errors from prerendered remote responses instead of re-running the function (#​16535)

  • chore: remove unused helpers (#​16834)

  • fix: allow reserved words (e.g. delete, class) as remote function export names (#​16264)

  • fix: reset failed <svelte:boundary> on client navigation so a stale +error.svelte is torn down (#​16296)

  • fix: clear navigating when a shallow popstate aborts an in-flight navigation (#​17118)

  • fix: expand [x+nn] and [u+nnnn] escape sequences when resolving a route id to a pathname (#​16570)

  • fix: respect user-set server.cors and preview.cors config instead of overriding them (#​16924)

  • fix: respect the status returned from handleError on the fallback error page served to error-page sub-requests (#​16528)

  • fix: restore scroll position after back-forward cache returns (#​17255)

  • fix: warn if there are plugins using transformIndexHtml (#​16394)

  • fix: refetch route-tracking server data when navigating away from an error page (#​16381)

  • fix: allow routes to contain [ and ] via the [x+5b] and [x+5d] escapes (#​16569)

  • chore: use Response.json instead of the deprecated json helper in runtime responses (#​16804)

  • fix: recommend safe include and exclude patterns in tsconfig warning (#​17102)

  • chore: remove dependency on kleur (#​12548)

  • fix: prevent server-side self-fetch fallbacks from following redirects (#​17293)

  • fix: serialize query(...).set(...)/query(...).refresh() values into the rendered HTML when called from within a query during SSR (#​16461)

  • chore: configure the server runtime in one place, deprecate Server in favour of the server object written by builder.generateServerInstance (#​17000)

  • chore: derive content-length from fixed response bodies in setResponse (#​16794)

  • fix: correctly read zero-length files at the end of a binary form payload (#​16783)

  • fix: reject fallback handlers on prerendered endpoints (#​17140)

  • fix: don't destroy partial-line app output with the prerender progress line (#​16750)

  • chore: remove virtual modules (#​16813)

  • fix: surface prerender errors during development (#​16507)

  • chore: bump cookie to 2.0.1 (#​16745)

  • fix: detect $app/server and $app/env/private client imports when SvelteKit is installed inside the project root (#​16648)

  • chore: read options from a single module instead of passing it through the server runtime (#​16871)

  • fix: wait for the redirect navigation before prerendered remote functions resolve (#​16765)

  • fix: sort directory entries when building the route manifest so node indices are deterministic across runtimes (e.g. Bun and Node) (#​16074)

  • fix: skip unnecessary version.json checks if updated.current is already true (#​16518)

  • fix: allow generation of $app/tsconfig without TypeScript installed (#​16534)

  • chore: remove dependency on `set-co

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Nov 8, 2026
@coderabbitai

coderabbitai Bot commented Nov 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@changeset-bot

changeset-bot Bot commented Nov 8, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: a1e4b4f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@nx-cloud

nx-cloud Bot commented Nov 8, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Nx Cloud AI Fix Eligible

An automatically generated fix could have helped fix failing tasks for this run, but Self-healing CI is disabled for this workspace. Visit workspace settings to enable it and get automatic fixes in future runs.

To disable these notifications, a workspace admin can disable them in workspace settings.

View your CI Pipeline Execution ↗ for commit a1e4b4f

Command Status Duration Result
nx affected --targets=test:sherif,test:knip,tes... ❌ Failed 8m 44s View ↗
nx run-many --target=build --exclude=examples/*... ✅ Succeeded 30s View ↗

☁️ Nx Cloud last updated this comment at 2026-11-08 11:06:27 UTC

@socket-security

socket-security Bot commented Nov 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​sveltejs/​kit@​2.70.3 ⏵ 3.1.199 +1100 +282 +197 -1100

View full report

@github-actions

github-actions Bot commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

🚀 Changeset Version Preview

No changeset entries found. Merging this PR will not cause a version bump for any packages.

@pkg-pr-new

pkg-pr-new Bot commented Nov 8, 2026

Copy link
Copy Markdown
More templates

@tanstack/angular-query-experimental

npm i https://pkg.pr.new/@tanstack/angular-query-experimental@12557

@tanstack/eslint-plugin-query

npm i https://pkg.pr.new/@tanstack/eslint-plugin-query@12557

@tanstack/lit-query

npm i https://pkg.pr.new/@tanstack/lit-query@12557

@tanstack/preact-query

npm i https://pkg.pr.new/@tanstack/preact-query@12557

@tanstack/preact-query-devtools

npm i https://pkg.pr.new/@tanstack/preact-query-devtools@12557

@tanstack/preact-query-persist-client

npm i https://pkg.pr.new/@tanstack/preact-query-persist-client@12557

@tanstack/query-async-storage-persister

npm i https://pkg.pr.new/@tanstack/query-async-storage-persister@12557

@tanstack/query-broadcast-client-experimental

npm i https://pkg.pr.new/@tanstack/query-broadcast-client-experimental@12557

@tanstack/query-core

npm i https://pkg.pr.new/@tanstack/query-core@12557

@tanstack/query-devtools

npm i https://pkg.pr.new/@tanstack/query-devtools@12557

@tanstack/query-persist-client-core

npm i https://pkg.pr.new/@tanstack/query-persist-client-core@12557

@tanstack/query-sync-storage-persister

npm i https://pkg.pr.new/@tanstack/query-sync-storage-persister@12557

@tanstack/react-query

npm i https://pkg.pr.new/@tanstack/react-query@12557

@tanstack/react-query-devtools

npm i https://pkg.pr.new/@tanstack/react-query-devtools@12557

@tanstack/react-query-next-experimental

npm i https://pkg.pr.new/@tanstack/react-query-next-experimental@12557

@tanstack/react-query-persist-client

npm i https://pkg.pr.new/@tanstack/react-query-persist-client@12557

@tanstack/solid-query

npm i https://pkg.pr.new/@tanstack/solid-query@12557

@tanstack/solid-query-devtools

npm i https://pkg.pr.new/@tanstack/solid-query-devtools@12557

@tanstack/solid-query-persist-client

npm i https://pkg.pr.new/@tanstack/solid-query-persist-client@12557

@tanstack/svelte-query

npm i https://pkg.pr.new/@tanstack/svelte-query@12557

@tanstack/svelte-query-devtools

npm i https://pkg.pr.new/@tanstack/svelte-query-devtools@12557

@tanstack/svelte-query-persist-client

npm i https://pkg.pr.new/@tanstack/svelte-query-persist-client@12557

@tanstack/vue-query

npm i https://pkg.pr.new/@tanstack/vue-query@12557

@tanstack/vue-query-devtools

npm i https://pkg.pr.new/@tanstack/vue-query-devtools@12557

commit: a1e4b4f

@github-actions

github-actions Bot commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

size-limit report 📦

Path Size
react full 11.85 KB (0%)
react minimal 8.67 KB (0%)

@renovate

renovate Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants