chore(deps): update dependency @sveltejs/kit to v2.69.1 [security] - #3236
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update dependency @sveltejs/kit to v2.69.1 [security]#3236renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.66.0→2.69.1SvelteKit: Big remote form function payloads can cause Node process to crash
GHSA-wqjv-9729-c5q2
More information
Details
Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
GHSA-866w-xmhq-wj7x
More information
Details
If you use remote form functions, have an input field of type
file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
sveltejs/kit (@sveltejs/kit)
v2.69.1Compare Source
Patch Changes
fix: prevent prototype pollution when deleting file inputs (#16218)
fix: prevent unhandled promise rejection (#16219)
v2.69.0Compare Source
Minor Changes
submittedproperty of remote forms (#14811)Patch Changes
fix: clear issues and touched states on form reset (#16163)
fix: return
undefinedfromfields.branch.issues()when onlyfields.branch.leafhas issues (#16187)v2.68.0Compare Source
Minor Changes
feat: expose
RemoteFormEnhanceInstanceandRemoteFormEnhanceCallbacktypes (#15816)feat: set value of
submitfields when form is submitted (#15979)Patch Changes
fix: skip
native_navigationwhen__data.jsonreturns 404 on a static fallback page (#16135)fix: ignore third-party monkeypatches in
pushState/replaceStatewarning detection (#15267)fix: snapshot form fields on read (#16150)
fix: strip field prefix before erroring on duplicates (#16151)
fix: call reset function via prototype (#16138)
chore: fix navigation
typehover info (#16147)v2.67.0Compare Source
Minor Changes
prerender.handleInvalidUrloption for invalid URLs discovered while crawling (#16088)Patch Changes
fix: support
exactOptionalPropertyTypesfor optional form schema fields (#15866)fix: avoid unnecessarily overriding a user's Vite 8
codeSplittingsetting (#16118)Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.