Skip to content

chore(deps): update dependency @sveltejs/kit to v2.57.1 [security]#403

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-sveltejs-kit-vulnerability
Open

chore(deps): update dependency @sveltejs/kit to v2.57.1 [security]#403
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-sveltejs-kit-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 14, 2025 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@sveltejs/kit (source) 2.5.18 → 2.57.1 age confidence

@​sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params

CVE-2025-32388 / GHSA-6q87-84jw-cjhp

More information

Details

Summary

Unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL.

Details

SvelteKit tracks which parameters in event.url.searchParams are read inside server load functions. If the application iterates over the these parameters, the uses.search_params array included in the boot script (embedded in the server-rendered HTML) will have any search param name included in unsanitized form.

packages/kit/src/runtime/server/utils.js:150 has the stringify_uses(node) function which prints these out.

Reproduction

In a +page.server.js or +layout.server.js:

/** @​type {import('@​sveltejs/kit').Load} */
export function load(event) {
  const values = {};

  for (const key of event.url.searchParams.keys()) {
    values[key] = event.url.searchParams.get(key);
  }
}

If a user visits the page in question via a link containing ?</script/><script>window.pwned%3D1</script/>, the </script> will be included verbatim in the payload, causing the embedded script to be executed.

It is not necessary to return the parameter value from load or render it in the page, only to read it (which causes it to be tracked as a dependency) while load is running.

Impact

Any application that iterates over all values in event.url.searchParams in a load function in +page.server.js or +layout.server.js (directly or indirectly) is vulnerable to XSS.

Severity

  • CVSS Score: 5.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

@​sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service

CVE-2026-40074 / GHSA-3f6h-2hrp-w5wx

More information

Details

redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input.

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

@​sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass

CVE-2026-40073 / GHSA-2crg-3p73-43xp

More information

Details

Under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

sveltejs/kit (@​sveltejs/kit)

v2.57.1

Compare Source

Patch Changes

  • fix: better validation for redirect inputs (10d7b44)

  • fix: enforce BODY_SIZE_LIMIT on chunked requests (3202ed6)

  • fix: use default values as fallbacks (#​15680)

  • fix: relax form typings for union types (#​15687)

v2.57.0

Compare Source

Minor Changes
  • feat: return boolean from submit to indicate submission validity for enhanced form remote functions (#​15530)
Patch Changes

  • fix: use array type for select fields that accept multiple values (#​15591)

  • fix: silently 404 Chrome DevTools workspaces request in dev and preview (#​15656)

  • fix: config.kit.csp.directives['trusted-types'] requires 'svelte-trusted-html' (and 'sveltekit-trusted-url' when a service worker is automatically registered) if it is configured (#​15323)

  • fix: avoid inlineDynamicImports ignored with codeSplitting warning when using Vite 8 (#​15647)

  • fix: reimplement treeshaking non-dynamic prerendered remote functions (#​15447)

v2.56.1

Compare Source

Patch Changes

v2.56.0

Compare Source

Minor Changes

  • breaking: rework client-driven refreshes (#​15562)

  • breaking: stabilize remote function caching by sorting object keys (#​15570)

  • breaking: add run() method to queries, disallow awaiting queries outside render (#​15533)

  • feat: support TypeScript 6.0 (#​15595)

  • breaking: isolate command-triggered query refresh failures per-query (#​15562)

  • feat: use hydratable for remote function transport (#​15533)

  • feat: allow form fields to specify a default value (field.as(type, value)) (#​15577)

Patch Changes

  • fix: don't request new data when .refresh is called on a query with no cache entry (#​15533)

  • fix: allow using multiple remote functions within one async derived (#​15561)

  • fix: avoid false-positive overridden Vite base setting warning when setting a paths.base in svelte.config.js (#​15623)

  • fix: manage queries in their own $effect.root (#​15533)

  • fix: avoid inlineDynamicImports deprecation warning when building the service worker with Vite 8 (#​15550)

  • fix: correctly escape backticks when precomputing CSS (#​15593)

  • fix: discard obsolete forks before finishing navigation (#​15634)

  • chore: tighten up override implementation (#​15562)

  • fix: ensure the default Svelte 5 error.svelte file uses runes mode (#​15609)

  • fix: deduplicate same-cache-key batch calls during SSR (#​15533)

  • fix: decrement pending_count when form callback doesn't call submit() (#​15520)

v2.55.0

Compare Source

Minor Changes
  • feat: page and layout params with matchers are now type narrowed in $app/types, leading to better type safety when working with params in $app/types, $app/state, and hooks. (#​15502)

v2.54.0

Compare Source

Minor Changes
  • feat: allow error boundaries to catch errors on the server (#​15308)
Patch Changes

  • chore: upgrade devalue (#​15535)

  • fix: don't wait for remote functions that are not awaited in the template (#​15280)

  • feat: allow resolve() to accept pathnames with a search string and/or hash (#​15458)

  • chore: remove deprecation warnings for config.kit.files.* options when validating the Svelte config file (#​15482)

  • fix: handles form target attribute in remote form redirects (#​15457)

v2.53.4

Compare Source

Patch Changes
  • fix: avoid Vite warning about unknown codeSplitting option (#​15451)

v2.53.3

Compare Source

Patch Changes
  • fix: prevent overlapping file metadata in remote functions form (faba869)

v2.53.2

Compare Source

Patch Changes

  • fix: server-render nested form value sets (#​15378)

  • fix: use deep partial types for form remote functions .value() and .set(...) (#​14837)

  • fix: provide correct url info to remote functions (#​15418)

  • fix: allow optional types for remote query/command/prerender functions (#​15293)

  • fix: allow commands in more places (#​15288)

v2.53.1

Compare Source

Patch Changes
  • fix: address warning about inlineDynamicImports when using Vite 8 (#​15403)

v2.53.0

Compare Source

Minor Changes
Patch Changes

  • fix: remove event listeners on form attachment cleanup (#​15286)

  • fix: apply queries refreshed in a form remote function when a redirect is thrown (#​15362)

v2.52.2

Compare Source

Patch Changes

  • fix: validate form file information to prevent amplification attacks (3e607b3)

  • chore: upgrade devalue and svelte (#​15339)

  • fix: parse file offset table more strictly (f47c01b)

v2.52.0

Compare Source

Minor Changes
  • feat: match function to map a path back to a route id and params (#​14997)
Patch Changes

  • fix: respect scroll-margin when navigating to a url-supplied anchor (#​15246)

  • fix: resolve will narrow types to follow trailing slash page settings (#​15027)

v2.51.0

Compare Source

Minor Changes

  • feat: add scroll property to NavigationTarget in navigation callbacks (#​15248)

    Navigation callbacks (beforeNavigate, onNavigate, and afterNavigate) now include scroll position information via the scroll property on from and to targets:

    • from.scroll: The scroll position at the moment navigation was triggered
    • to.scroll: In beforeNavigate and onNavigate, this is populated for popstate navigations (back/forward) with the scroll position that will be restored, and null for other navigation types. In afterNavigate, this is always the final scroll position after navigation completed.

    This enables use cases like animating transitions based on the target scroll position when using browser back/forward navigation.

  • feat: hydratable's injected script now works with CSP (#​15048)

Patch Changes

  • fix: put preloads before styles (#​15232)

  • fix: suppress false-positive inner content warning when children prop is forwarded to a child component (#​15269)

  • fix: fetch not working when URL is same host but different than paths.base (#​15291)

  • fix: navigate to hash link when base element is present (#​15236)

  • fix: avoid triggering handleError when redirecting in a remote function (#​15222)

  • fix: include test directory in generated tsconfig.json alongside existing tests entry (#​15254)

  • fix: generate tsconfig.json using the value of kit.files.src (#​15253)

v2.50.2

Compare Source

Patch Changes

  • fix: ensure inlined CSS follows paths.assets and paths.relative settings (#​15153)

  • fix: emit script CSP nonces when unsafe-inline is present if strict-dynamic is also present (#​15221)

  • fix: re-export browser/dev from esm-env (#​15206)

  • fix: use validated args in batch resolver in both csr and ssr (#​15215)

  • fix: ensure CSS inlining includes components that are conditionally rendered (#​15153)

  • fix: only match rest params with matchers when the matcher matches (#​15216)

  • fix: properly handle percent-encoded anchors (e.g. <a href="#sparkles-%E2%9C%A8">) during prerendering. (#​15231)

v2.50.1

Compare Source

Patch Changes

  • fix: include hooks.server and hooks.universal as explicit Vite build inputs to ensure assets imported by hooks files are correctly discovered (#​15178)

  • fix: improves fields type for generic components (#​14974)

  • fix: preload links if href changes (#​15191)

v2.50.0

Compare Source

Minor Changes
  • breaking: remove buttonProps from experimental remote form functions; use e.g. <button {...myForm.fields.action.as('submit', 'register')}>Register</button> button instead (#​15144)

v2.49.5

Compare Source

Patch Changes

  • fix: avoid overriding Vite default base when running Vitest 4 (#​14866)

  • fix: ensure url decoded pathnames are not mistaken as rerouted requests (d9ae9b0)

  • fix: add length checks to remote forms (8ed8155)

v2.49.4

Compare Source

Patch Changes

  • fix: support instrumentation for vite preview (#​15105)

  • fix: support for URLSearchParams.has(name, value) overload (#​15076)

  • fix: put forking behind experimental.forkPreloads (#​15135)

v2.49.3

Compare Source

Patch Changes

  • fix: avoid false-positive Vite config overridden warning when using Vitest 4 (#​15121)

  • fix: add typescript as an optional peer dependency (#​15074)

  • fix: use hasOwn check when deep-setting object properties (#​15127)

v2.49.2

Compare Source

Patch Changes

  • fix: Stop re-loading already-loaded CSS during server-side route resolution (#​15014)

  • fix: posixify the instrumentation file import on Windows (#​14993)

  • fix: Correctly handle shared memory when decoding binary form data (#​15028)

v2.49.1

Compare Source

Patch Changes

  • fix: suppress state_referenced_locally warnings in .svelte-kit/generated/root.svelte (#​15013)

  • fix: TypeError when doing response.clone() in page load (#​15005)

v2.49.0

Compare Source

Minor Changes
  • feat: stream file uploads inside form remote functions allowing form data to be accessed before large files finish uploading (#​14775)

v2.48.8

Compare Source

Patch Changes

  • breaking: invalid now must be imported from @sveltejs/kit (#​14768)

  • breaking: remove submitter option from experimental form validate() method, always provide default submitter (#​14762)

v2.48.7

Compare Source

Patch Changes

  • fix: allow multiple server-timing headers (#​14700)

  • fix: allow access to root-level issues in schema-less forms (#​14893)

  • fix: allow hosting hash-based apps from non-index.html files (#​14825)

v2.48.6

Compare Source

Patch Changes

  • fix: clear issues upon passing validation (#​14683)

  • fix: don't use fork of unrelated route (#​14947)

  • fix: prevent type errors when optional @opentelemetry/api dependency isn't installed (#​14949)

  • fix: preserve this when invoking standard validator (#​14943)

  • fix: treat client/universal hooks as entrypoints for illegal server import detection (#​14876)

  • fix: correct query .set and .refresh behavior in commands (#​14877)

  • fix: improved the accuracy of the types of the output of field.as('...') (#​14908)

v2.48.5

Compare Source

Patch Changes

  • fix: wait an extra microtask in dev before calling $_init_$ (#​14799)

  • fix: discard preload fork before creating a new one (#​14865)

  • fix: delete RemoteFormAllIssue, add path to RemoteFormIssue (#​14864)

v2.48.4

Compare Source

Patch Changes

  • fix: adjust query's promise implementation to properly allow chaining (#​14859)

  • fix: make prerender cache work, including in development (#​14860)

v2.48.3

Compare Source

Patch Changes

  • fix: include hash when using resolve with hash routing enabled (#​14786)

  • fix: afterNavigate callback not running after hydration when experimental async is enabled (#​14644)
    fix: Snapshot restore method not called after reload when experimental async is enabled

  • fix: expose issue.path in .allIssues() (#​14784)

v2.48.2

Compare Source

Patch Changes
  • fix: update DOM before running navigate callbacks (#​14829)

v2.48.1

Compare Source

Patch Changes
  • fix: wait for commit promise instead of settled (#​14818)

v2.48.0

Compare Source

Minor Changes
  • feat: use experimental fork API when available (#​14793)
Patch Changes
  • fix: await for settled instead of tick in navigate (#​14800)

v2.47.3

Compare Source

Patch Changes

  • fix: avoid hanging when error() is used while streaming promises from a server load function (#​14722)

  • chore: treeshake load function code if we know it's unused (#​14764)

  • fix: RecursiveFormFields type for recursive or unknown schemas (#​14734)

  • fix: rework internal representation of form value to be $state (#​14771)

v2.47.2

Compare Source

Patch Changes

  • fix: streamed promise not resolving when another load function returns a fast resolving promise (#​14753)

  • chore: allow to run preflight validation only (#​14744)

  • fix: update overload to set invalid type to schema input (#​14748)

v2.47.1

Compare Source

Patch Changes

  • fix: allow read to be used at the top-level of remote function files (#​14672)

  • fix: more robust remote files generation (#​14682)

v2.47.0

Compare Source

Minor Changes
Patch Changes
  • fix: resolve remote module syntax errors with trailing expressions (#​14728)

v2.46.5

Compare Source

Patch Changes
  • fix: ensure form remote functions' fields.set triggers reactivity (#​14661)

v2.46.4

Compare Source

Patch Changes
  • fix: prevent access of Svelte 5-only untrack function (#​14658)

v2.46.3

Compare Source

Patch Changes

  • fix: merge field.set(...) calls (#​14651)

  • fix: don't automatically reset form after an enhanced submission (#​14626)

  • fix: normalize path strings when updating field values (#​14649)

v2.46.2

Compare Source

Patch Changes
  • fix: prevent code execution order issues around SvelteKit's env modules (#​14637)

v2.46.1

Compare Source

Patch Changes

  • fix: use $derived for form fields (#​14621)

  • docs: remove @example blocks to allow docs to deploy (#​14636)

  • fix: require a value with submit and hidden fields (#​14635)

  • fix: delete hydration cache on effect teardown (#​14611)

v2.46.0

Compare Source

Minor Changes
  • feat: imperative form validation (#​14624)
Patch Changes

  • fix: wait a tick before collecting form data for validation (#​14631)

  • fix: prevent code execution order issues around SvelteKit's env modules (#​14632)

v2.45.0

Compare Source

Minor Changes
  • feat: form.for(id) now implicitly sets id on form object (#​14623)
Patch Changes
  • fix: allow fetch in remote function without emitting a warning (#​14610)

v2.44.0

Compare Source

Minor Changes

  • feat: expose event.route and event.url to remote functions (#​14606)

  • breaking: update experimental form API (#​14481)

Patch Changes
  • fix: don't crawl error responses during prerendering (#​14596)

v2.43.8

Compare Source

Patch Changes

  • fix: HMR for query (#​14587)

  • fix: avoid client modules while traversing dependencies to prevent FOUC during dev (#​14577)

  • fix: skip prebundling of .remote.js files (#​14583)

  • fix: more robust remote file pattern matching (#​14578)

v2.43.7

Compare Source

Patch Changes

  • fix: correctly type the result of form remote functions that do not accept data (#​14573)

  • fix: force remote module chunks to isolate themselves (#​14571)

v2.43.6

Compare Source

Patch Changes

  • fix: ensure cache key is consistent between client/server (#​14563)

  • fix: keep resolve relative to initial base during prerender (#​14533)

  • fix: avoid including HEAD twice when an unhandled HTTP method is used in a request to a +server handler that has both a GET handler and a HEAD handler (#​14564)

  • fix: smoothscroll to deep link (#​14569)

v2.43.5

Compare Source

Patch Changes
  • fix: fall back to non-relative resolution when calling resolve(...) outside an event context (#​14532)

v2.43.4

Compare Source

Patch Changes
  • fix: Webcontainer AsyncLocalStorage workaround (#​14526)

v2.43.3

Compare Source

Patch Changes

  • fix: Webcontainer AsyncLocalStorage workaround (#​14521)

  • fix: include the value of form submitters on form remote functions (#​14475)

v2.43.2

Compare Source

Patch Changes

  • fix: ensure rendering starts off synchronously (#​14517)

  • fix: keep serialized remote data alive until navigation (#​14508)

v2.43.1

Compare Source

Patch Changes
  • fix: consistently use bare import for internals (#​14506)

v2.43.0

Compare Source

Minor Changes
Patch Changes

  • fix: ensure __SVELTEKIT_PAYLOAD__.data is accessed safely (#​14491)

  • fix: create separate cache entries for non-exported remote function queries (#​14499)

v2.42.2

Compare Source

Patch Changes

  • fix: prevent loops in postbuild analysis phase (#​14450)

  • fix: handle nested object fields in form data (#​14469)

  • fix: robustify form helper types (#​14463)

  • fix: avoid running the init hook during builds if there's nothing to prerender (#​14464)

  • fix: ensure SSR rendering gets request store context (#​14476)

v2.42.1

Compare Source

Patch Changes
  • fix: ensure environment setup is in its own chunk (#​14441)

v2.42.0

Compare Source

Minor Changes

  • feat: enhance remote form functions with schema support, input and issues properties (#​14383)

  • breaking: remote form functions get passed a parsed POJO instead of a FormData object now (#​14383)

v2.41.0

Compare Source

Minor Changes
  • feat: add %sveltekit.version% to app.html (#​12132)
Patch Changes

  • fix: allow remote functions to return custom types serialized with transport hooks (#​14435)

  • fix: fulfil beforeNavigate complete when redirected (#​12896)

v2.40.0

Compare Source

Minor Changes
  • feat: include event property on popstate/link/form navigation (#​14307)
Patch Changes

  • fix: respect replaceState/keepFocus/noScroll when a navigation results in a redirect (#​14424)

  • fix: invalidate preload cache when invalidateAll is true (#​14420)

v2.39.1

Compare Source

Patch Changes
  • fix: more robust remote function code transformation (#​14418)

v2.39.0

Compare Source

Minor Changes
  • feat: lazy discovery of remote functions (#​14293)
Patch Changes

  • fix: layout load data not serialized on error page (#​14395)

  • fix: fail prerendering when remote function fails (#​14365)

  • fix: treat handle hook redirect as part of remote function call as json redirect (#​14362)

v2.38.1

Compare Source

Patch Changes

  • fix: enable redirects from queries (#​14400)

  • fix: remove empty nodes from serialized server load data (#​14404)

  • fix: allow commands from within endpoints (#​14343)

v2.38.0

Compare Source

Minor Changes
  • feat: add new remote function query.batch (#​14272)

v2.37.1

Compare Source

Patch Changes

  • fix: serialize server load data before passing to universal load, to handle mutations and promises (#​14298)

  • fix: resolve_route prevent dropping a trailing slash of id (#​14294)

  • fix: assign correct status code to form submission error on the client (#​14345)

  • fix: un-proxy form.result (#​14346)

v2.37.0

Compare Source

Minor Changes

  • feat: automatically resolve query.refresh() promises on the server (#​14332)

  • feat: allow query.set() to be called on the server (#​14304)

Patch Changes

  • fix: disable CSRF checks in dev (#​14335)

  • fix: allow redirects to external URLs from within form functions (#​14329)

  • fix: add type definitions for query.set() method to override the value of a remote query function (#​14303)

  • fix: ensure uniqueness of form.for(...) across form functions (#​14327)

v2.36.3

Compare Source

Patch Changes

  • fix: bump devalue (#​14323)

  • chore: consolidate dev checks to use esm-env instead of a __SVELTEKIT_DEV__ global (#​14308)

  • fix: reset form inputs by default when using remote form functions (#​14322)

v2.36.2

Compare Source

Patch Changes

  • chore: make config deprecation warnings more visible (#​14281)

  • chore: remove redundant Not Found error message (#​14289)

  • chore: deprecate csrf.checkOrigin in favour of csrf.trustedOrigins: ['*'] (#​14281)

v2.36.1

Compare Source

Patch Changes
  • fix: ensure importing from $app/navigation works in test files (#​14195)

v2.36.0

Compare Source

Minor Changes
  • feat: add csrf.trustedOrigins configuration (#​14021)
Patch Changes

  • fix: correctly decode custom types streamed from a server load function (#​14261)

  • fix: add trailing slash pathname when generating typed routes (#​14065)

v2.35.0

Compare Source

Minor Changes
  • feat: better server-side error logging (#​13990)
Patch Changes
  • fix: ensure static error page is loaded correctly for custom user errors (#​13952)

v2.34.1

Compare Source

Patch Changes

  • fix: support multiple cookies with the same name across different paths and domains (b2c5d02)

  • fix: add link header when preloading font (#​14200)

  • fix: cookies.get(...) returns undefined for a just-deleted cookie (b2c5d02)

  • fix: load env before prerender (c5f7139)

v2.34.0

Compare Source

Minor Changes
  • feat: allow dynamic env access during prerender (#​14243)
Patch Changes

  • fix: clone fetch responses so that headers are mutable (#​13942)

  • fix: serialize server load data before passing to universal load, to handle mutations (#​14268)

  • fix: allow asset(...) to be used with imported assets (#​14270)

v2.33.1

Compare Source

Patch Changes

  • fix: make paths in .css assets relative (#​14262)

  • fix: avoid copying SSR stylesheets to client assets (#​13069)

v2.33.0

Compare Source

Minor Changes
  • feat: configure error reporting when routes marked as prerendable were not prerendered (#​11702)
Patch Changes

  • fix: use correct flag for server tracing (#​14250)

  • fix: correct type names for new handleUnseenRoutes option (#​14254)

  • chore: Better docs and error message for missing @opentelemetry/api dependency (#​14250)

v2.32.0

Compare Source

Minor Changes
  • feat: inline load fetch response.body stream data as base64 in page (#​11473)
Patch Changes
  • fix: better error when .remote.ts files are used without the experimental.remoteFunctions flag (#​14225)

v2.31.1

Compare Source

Patch Changes
  • fix: pass options to resolve in resolveId hook ([#​14223](htt

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 14, 2025 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
hellobart Ready Ready Preview Apr 27, 2026 9:51pm

@renovate renovate Bot requested a review from bartvdbraak April 14, 2025 21:56
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 14, 2025

⚡️ Lighthouse report

loading

@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from 756f2a9 to 08ffeaa Compare April 24, 2025 07:00
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from 08ffeaa to ef6bf00 Compare May 19, 2025 20:07
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from ef6bf00 to 4acbd55 Compare May 28, 2025 07:46
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from 4acbd55 to 894b37d Compare June 4, 2025 06:44
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from 894b37d to 56d71f2 Compare June 22, 2025 15:10
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from 56d71f2 to b61d83d Compare July 2, 2025 15:38
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Jul 2, 2025

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from b61d83d to 3c9fdcd Compare August 13, 2025 14:05
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from 3c9fdcd to 8be9445 Compare August 31, 2025 09:49
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from 8be9445 to 4b29e40 Compare September 25, 2025 20:45
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from 4b29e40 to 7b0fbf6 Compare October 21, 2025 11:13
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from 7b0fbf6 to c1fafb7 Compare November 10, 2025 17:36
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from c1fafb7 to 1cc1bb5 Compare November 18, 2025 22:37
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from 1cc1bb5 to 1f562dd Compare December 31, 2025 14:31
@renovate renovate Bot reopened this Feb 2, 2026
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch 2 times, most recently from d691797 to 107b501 Compare February 2, 2026 23:46
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from 107b501 to 229dc44 Compare February 12, 2026 16:05
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from 229dc44 to c0d659f Compare March 5, 2026 19:48
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from c0d659f to 22b34f3 Compare March 13, 2026 11:32
@renovate renovate Bot changed the title chore(deps): update dependency @sveltejs/kit to v2.20.6 [security] chore(deps): update dependency @sveltejs/kit to v2.20.6 [security] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate renovate Bot changed the title chore(deps): update dependency @sveltejs/kit to v2.20.6 [security] - autoclosed chore(deps): update dependency @sveltejs/kit to v2.20.6 [security] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch 2 times, most recently from 22b34f3 to d51193f Compare March 30, 2026 21:45
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from d51193f to a4cc7b1 Compare April 8, 2026 21:17
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from a4cc7b1 to d1c9784 Compare April 10, 2026 21:10
@renovate renovate Bot changed the title chore(deps): update dependency @sveltejs/kit to v2.20.6 [security] chore(deps): update dependency @sveltejs/kit to v2.57.1 [security] Apr 10, 2026
@renovate renovate Bot changed the title chore(deps): update dependency @sveltejs/kit to v2.57.1 [security] chore(deps): update dependency @sveltejs/kit to v2.57.1 [security] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot changed the title chore(deps): update dependency @sveltejs/kit to v2.57.1 [security] - autoclosed chore(deps): update dependency @sveltejs/kit to v2.57.1 [security] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate renovate Bot force-pushed the renovate/npm-sveltejs-kit-vulnerability branch from d1c9784 to f9288c7 Compare April 27, 2026 21:49
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Apr 27, 2026

❌ The last analysis has failed.

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bartvdbraak bartvdbraak Awaiting requested review from bartvdbraak

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants