chore(deps): update dependency @sveltejs/kit to v2.49.5 [security]#378
Merged
renovate-sh-app[bot] merged 1 commit intomainfrom Jan 20, 2026
Merged
Conversation
| datasource | package | from | to | | ---------- | ------------- | ------ | ------ | | npm | @sveltejs/kit | 2.37.0 | 2.49.5 | Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
federicotdn
approved these changes
Jan 20, 2026
renovate-sh-app
bot
deleted the
renovate/npm-sveltejs-kit-vulnerability
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.37.0→2.49.5GitHub Vulnerability Alerts
CVE-2025-67647
Summary
Versions of SvelteKit are vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions.
Details
Affected versions from 2.44.0 onwards are vulnerable to DoS if:
export const prerender = true)Affected versions from 2.19.0 onwards are vulnerable to DoS and SSRF if:
export const prerender = true)adapter-nodewithout a configuredORIGINenvironment variable, and you are not using a reverse proxy that implements Host header validationImpact
The DoS causes the running server process to end.
The SSRF allows access to internal services that can be reached without authentication when fetched from SvelteKit's server runtime.
It is also possible to obtain an SXSS via cache poisoning, by forcing a potential CDN to cache an XSS returned by the attacker's server (the latter being able to specify the cache-control of their choice).
Credits
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
CVE-2025-67647 / GHSA-j62c-4x62-9r35
More information
Details
Summary
Versions of SvelteKit are vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions.
Details
Affected versions from 2.44.0 onwards are vulnerable to DoS if:
export const prerender = true)Affected versions from 2.19.0 onwards are vulnerable to DoS and SSRF if:
export const prerender = true)adapter-nodewithout a configuredORIGINenvironment variable, and you are not using a reverse proxy that implements Host header validationImpact
The DoS causes the running server process to end.
The SSRF allows access to internal services that can be reached without authentication when fetched from SvelteKit's server runtime.
It is also possible to obtain an SXSS via cache poisoning, by forcing a potential CDN to cache an XSS returned by the attacker's server (the latter being able to specify the cache-control of their choice).
Credits
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
sveltejs/kit (@sveltejs/kit)
v2.49.5Compare Source
Patch Changes
fix: avoid overriding Vite default
basewhen running Vitest 4 (#14866)fix: ensure url decoded pathnames are not mistaken as rerouted requests (
d9ae9b0)fix: add length checks to remote forms (
8ed8155)v2.49.4Compare Source
Patch Changes
fix: support instrumentation for
vite preview(#15105)fix: support for
URLSearchParams.has(name, value)overload (#15076)fix: put forking behind
experimental.forkPreloads(#15135)v2.49.3Compare Source
Patch Changes
fix: avoid false-positive Vite config overridden warning when using Vitest 4 (#15121)
fix: add
typescriptas an optional peer dependency (#15074)fix: use hasOwn check when deep-setting object properties (#15127)
v2.49.2Compare Source
Patch Changes
fix: Stop re-loading already-loaded CSS during server-side route resolution (#15014)
fix: posixify the instrumentation file import on Windows (#14993)
fix: Correctly handle shared memory when decoding binary form data (#15028)
v2.49.1Compare Source
Patch Changes
fix: suppress
state_referenced_locallywarnings in.svelte-kit/generated/root.svelte(#15013)fix: TypeError when doing response.clone() in page load (#15005)
v2.49.0Compare Source
Minor Changes
formremote functions allowing form data to be accessed before large files finish uploading (#14775)v2.48.8Compare Source
Patch Changes
breaking:
invalidnow must be imported from@sveltejs/kit(#14768)breaking: remove
submitteroption from experimental formvalidate()method, always provide default submitter (#14762)v2.48.7Compare Source
Patch Changes
fix: allow multiple
server-timingheaders (#14700)fix: allow access to root-level issues in schema-less forms (#14893)
fix: allow hosting hash-based apps from non-index.html files (#14825)
v2.48.6Compare Source
Patch Changes
fix: clear issues upon passing validation (#14683)
fix: don't use fork of unrelated route (#14947)
fix: prevent type errors when optional
@opentelemetry/apidependency isn't installed (#14949)fix: preserve
thiswhen invoking standard validator (#14943)fix: treat client/universal hooks as entrypoints for illegal server import detection (#14876)
fix: correct query
.setand.refreshbehavior in commands (#14877)fix: improved the accuracy of the types of the output of
field.as('...')(#14908)v2.48.5Compare Source
Patch Changes
fix: wait an extra microtask in dev before calling
$_init_$(#14799)fix: discard preload fork before creating a new one (#14865)
fix: delete
RemoteFormAllIssue, addpathtoRemoteFormIssue(#14864)v2.48.4Compare Source
Patch Changes
fix: adjust query's promise implementation to properly allow chaining (#14859)
fix: make prerender cache work, including in development (#14860)
v2.48.3Compare Source
Patch Changes
fix: include hash when using
resolvewith hash routing enabled (#14786)fix:
afterNavigatecallback not running after hydration when experimental async is enabled (#14644)fix: Snapshot
restoremethod not called after reload when experimental async is enabledfix: expose
issue.pathin.allIssues()(#14784)v2.48.2Compare Source
Patch Changes
v2.48.1Compare Source
Patch Changes
settled(#14818)v2.48.0Compare Source
Minor Changes
forkAPI when available (#14793)Patch Changes
settledinstead oftickin navigate (#14800)v2.47.3Compare Source
Patch Changes
fix: avoid hanging when
error()is used while streaming promises from a serverloadfunction (#14722)chore: treeshake load function code if we know it's unused (#14764)
fix:
RecursiveFormFieldstype for recursive or unknown schemas (#14734)fix: rework internal representation of form value to be
$state(#14771)v2.47.2Compare Source
Patch Changes
fix: streamed promise not resolving when another load function returns a fast resolving promise (#14753)
chore: allow to run preflight validation only (#14744)
fix: update overload to set
invalidtype to schema input (#14748)v2.47.1Compare Source
Patch Changes
fix: allow
readto be used at the top-level of remote function files (#14672)fix: more robust remote files generation (#14682)
v2.47.0Compare Source
Minor Changes
signalproperty to request (#14715)Patch Changes
v2.46.5Compare Source
Patch Changes
formremote functions'fields.settriggers reactivity (#14661)v2.46.4Compare Source
Patch Changes
untrackfunction (#14658)v2.46.3Compare Source
Patch Changes
fix: merge
field.set(...)calls (#14651)fix: don't automatically reset form after an enhanced submission (#14626)
fix: normalize path strings when updating field values (#14649)
v2.46.2Compare Source
Patch Changes
envmodules (#14637)v2.46.1Compare Source
Patch Changes
fix: use
$derivedfor form fields (#14621)docs: remove
@exampleblocks to allow docs to deploy (#14636)fix: require a value with
submitandhiddenfields (#14635)fix: delete hydration cache on effect teardown (#14611)
v2.46.0Compare Source
Minor Changes
Patch Changes
fix: wait a tick before collecting form data for validation (#14631)
fix: prevent code execution order issues around SvelteKit's
envmodules (#14632)v2.45.0Compare Source
Minor Changes
form.for(id)now implicitly sets id on form object (#14623)Patch Changes
fetchin remote function without emitting a warning (#14610)v2.44.0Compare Source
Minor Changes
feat: expose
event.routeandevent.urlto remote functions (#14606)breaking: update experimental
formAPI (#14481)Patch Changes
v2.43.8Compare Source
Patch Changes
fix: HMR for
query(#14587)fix: avoid client modules while traversing dependencies to prevent FOUC during dev (#14577)
fix: skip prebundling of .remote.js files (#14583)
fix: more robust remote file pattern matching (#14578)
v2.43.7Compare Source
Patch Changes
fix: correctly type the
resultofformremote functions that do not accept data (#14573)fix: force remote module chunks to isolate themselves (#14571)
v2.43.6Compare Source
Patch Changes
fix: ensure cache key is consistent between client/server (#14563)
fix: keep resolve relative to initial base during prerender (#14533)
fix: avoid including
HEADtwice when an unhandled HTTP method is used in a request to a+serverhandler that has both aGEThandler and aHEADhandler (#14564)fix: smoothscroll to deep link (#14569)
v2.43.5Compare Source
Patch Changes
resolve(...)outside an event context (#14532)v2.43.4Compare Source
Patch Changes
v2.43.3Compare Source
Patch Changes
fix: Webcontainer AsyncLocalStorage workaround (#14521)
fix: include the value of form submitters on
formremote functions (#14475)v2.43.2Compare Source
Patch Changes
fix: ensure rendering starts off synchronously (#14517)
fix: keep serialized remote data alive until navigation (#14508)
v2.43.1Compare Source
Patch Changes
v2.43.0Compare Source
Minor Changes
Patch Changes
fix: ensure
__SVELTEKIT_PAYLOAD__.datais accessed safely (#14491)fix: create separate cache entries for non-exported remote function queries (#14499)
v2.42.2Compare Source
Patch Changes
fix: prevent loops in postbuild analysis phase (#14450)
fix: handle nested object fields in form data (#14469)
fix: robustify form helper types (#14463)
fix: avoid running the
inithook during builds if there's nothing to prerender (#14464)fix: ensure SSR rendering gets request store context (#14476)
v2.42.1Compare Source
Patch Changes
v2.42.0Compare Source
Minor Changes
feat: enhance remote form functions with schema support,
inputandissuesproperties (#14383)breaking: remote form functions get passed a parsed POJO instead of a
FormDataobject now (#14383)v2.41.0Compare Source
Minor Changes
%sveltekit.version%toapp.html(#12132)Patch Changes
fix: allow remote functions to return custom types serialized with
transporthooks (#14435)fix: fulfil
beforeNavigatecompletewhen redirected (#12896)v2.40.0Compare Source
Minor Changes
eventproperty on popstate/link/form navigation (#14307)Patch Changes
fix: respect
replaceState/keepFocus/noScrollwhen a navigation results in a redirect (#14424)fix: invalidate preload cache when invalidateAll is true (#14420)
v2.39.1Compare Source
Patch Changes
v2.39.0Compare Source
Minor Changes
Patch Changes
fix: layout load data not serialized on error page (#14395)
fix: fail prerendering when remote function fails (#14365)
fix: treat handle hook redirect as part of remote function call as json redirect (#14362)
v2.38.1Compare Source
Patch Changes
fix: enable redirects from queries (#14400)
fix: remove empty nodes from serialized server load data (#14404)
fix: allow commands from within endpoints (#14343)
v2.38.0Compare Source
Minor Changes
query.batch(#14272)v2.37.1Compare Source
Patch Changes
fix: serialize server
loaddata before passing to universalload, to handle mutations and promises (#14298)fix: resolve_route prevent dropping a trailing slash of id (#14294)
fix: assign correct status code to form submission error on the client (#14345)
fix: un-proxy
form.result(#14346)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
Need help?
You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.