Bump @sveltejs/kit from 2.53.4 to 2.57.1

[dependabot]

Bumps @sveltejs/kit from 2.53.4 to 2.57.1.

Release notes

Sourced from @​sveltejs/kit's releases.

@​sveltejs/kit@​2.57.1

Patch Changes

• fix: better validation for redirect inputs (10d7b44)

• fix: enforce BODY_SIZE_LIMIT on chunked requests (3202ed6)

• fix: use default values as fallbacks (#15680)

• fix: relax form typings for union types (#15687)

@​sveltejs/kit@​2.57.0

Minor Changes

• feat: return boolean from submit to indicate submission validity for enhanced form remote functions (#15530)

Patch Changes

• fix: use array type for select fields that accept multiple values (#15591)

• fix: silently 404 Chrome DevTools workspaces request in dev and preview (#15656)

• fix: config.kit.csp.directives['trusted-types'] requires 'svelte-trusted-html' (and 'sveltekit-trusted-url' when a service worker is automatically registered) if it is configured (#15323)

• fix: avoid inlineDynamicImports ignored with codeSplitting warning when using Vite 8 (#15647)

• fix: reimplement treeshaking non-dynamic prerendered remote functions (#15447)

@​sveltejs/kit@​2.56.1

Patch Changes

• chore: update JSDoc (#15640)

@​sveltejs/kit@​2.56.0

Minor Changes

• breaking: rework client-driven refreshes (#15562)

• breaking: stabilize remote function caching by sorting object keys (#15570)

• breaking: add run() method to queries, disallow awaiting queries outside render (#15533)

... (truncated)

Changelog

Sourced from @​sveltejs/kit's changelog.

2.57.1

Patch Changes

• fix: better validation for redirect inputs (10d7b44)

• fix: enforce BODY_SIZE_LIMIT on chunked requests (3202ed6)

• fix: use default values as fallbacks (#15680)

• fix: relax form typings for union types (#15687)

2.57.0

Minor Changes

• feat: return boolean from submit to indicate submission validity for enhanced form remote functions (#15530)

Patch Changes

• fix: use array type for select fields that accept multiple values (#15591)

• fix: silently 404 Chrome DevTools workspaces request in dev and preview (#15656)

• fix: config.kit.csp.directives['trusted-types'] requires 'svelte-trusted-html' (and 'sveltekit-trusted-url' when a service worker is automatically registered) if it is configured (#15323)

• fix: avoid inlineDynamicImports ignored with codeSplitting warning when using Vite 8 (#15647)

• fix: reimplement treeshaking non-dynamic prerendered remote functions (#15447)

2.56.1

Patch Changes

• chore: update JSDoc (#15640)

2.56.0

Minor Changes

• breaking: rework client-driven refreshes (#15562)

... (truncated)

Commits

• 75147d4 Version Packages (#15684)
• 10d7b44 Merge commit from fork
• 3202ed6 Merge commit from fork
• 24d7e76 chore: fix reuse wording in client comment (#15679)
• 6a9cdaa fix: relax form typings for union types (#15687)
• ab8b2f1 fix: use default values as fallbacks (#15680)
• 3ccb33b Version Packages (#15651)
• 7f8aef7 chore: reduce use of any types (#15659)
• be1c95f chore: avoid importing types directly from Rollup (#15668)
• 1615af7 chore: centralize noops (#15662)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[greptile-apps]

Greptile Summary

This PR is a Dependabot bump of @sveltejs/kit from 2.53.4 to 2.57.1, updating package.json and pnpm-lock.yaml. The lockfile also reflects transitive bumps of devalue (5.6.3 → 5.7.1) and set-cookie-parser (3.0.1 → 3.1.0).

Key changes included in the version range:

• 2.57.1 (patch): Security hardening — BODY_SIZE_LIMIT is now enforced on chunked requests; better validation for redirect inputs; default-value fallback fixes.
• 2.57.0 (minor): submit now returns a boolean from enhanced-form remote functions.
• 2.56.0 (minor, three breaking changes): Reworked client-driven refreshes, stabilized remote-function cache key sorting, and added a run() method to queries while disallowing await-ing queries outside render.
• 2.55.x / 2.54.x: Various bug fixes and tree-shaking improvements.

The breaking changes introduced in 2.56.0 are scoped exclusively to SvelteKit's remote functions / queries feature. A scan of the application shows no usage of remote functions or the query API — the codebase uses conventional load functions and form actions — so none of the breaking changes apply here. The 2.57.1 security fixes (BODY_SIZE_LIMIT enforcement and stricter redirect validation) are a net positive.

Confidence Score: 5/5

Safe to merge — the project does not use the remote functions/queries API that changed in 2.56.0, and the security fixes in 2.57.1 are beneficial.

The only breaking changes in this version range (2.56.0) are confined to SvelteKit's remote functions and query API. This codebase uses conventional load functions and form actions exclusively, so none of the breaking changes apply. The 2.57.1 security fixes (BODY_SIZE_LIMIT enforcement, stricter redirect validation) are improvements. Transitive dep bumps (devalue, set-cookie-parser) are minor.

No files in the PR changeset require special attention. A pre-existing bug (missing throw on redirect in src/routes/events/[slug]/+page.server.ts) was noticed during review and is worth fixing separately.

Important Files Changed

Filename	Overview
package.json	Minimum version pin for @sveltejs/kit bumped from ^2.50.2 to ^2.57.1; all other dependencies unchanged.
pnpm-lock.yaml	Resolved @sveltejs/kit version updated from 2.53.4 to 2.57.1 throughout; transitive deps devalue (5.6.3→5.7.1) and set-cookie-parser (3.0.1→3.1.0) also bumped.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["@sveltejs/kit 2.53.4\n(previously installed)"] --> B["2.54.x\nBug fixes"]
    B --> C["2.55.x\nBug fixes & tree-shaking"]
    C --> D["2.56.0\n⚠️ 3 breaking changes\n(remote functions / queries only)"]
    D --> E["2.56.1\nJSDoc update"]
    E --> F["2.57.0\nEnhanced form submit returns boolean"]
    F --> G["@sveltejs/kit 2.57.1\n✅ Security: BODY_SIZE_LIMIT on chunked requests\n✅ Security: stricter redirect validation\n✅ Default value fallbacks fix"]

    style D fill:#fff3cd,stroke:#ffc107
    style G fill:#d4edda,stroke:#28a745
    style A fill:#f8d7da,stroke:#dc3545

Loading

Comments Outside Diff (1)

1. src/routes/events/[slug]/+page.server.ts, line 10 (link)

   Missing throw makes the redirect a no-op

   redirect() returns a Response-like object but does not interrupt execution on its own inside a load function — it must be thrown. Without throw, control falls through to throw error(404, 'Event not found'), so any event slug that has been renamed will silently return a 404 instead of redirecting the visitor to the new slug.

   This is a pre-existing bug, not introduced by this PR, but it is worth fixing alongside this upgrade.

_{Reviews (1): Last reviewed commit: "Bump @sveltejs/kit from 2.53.4 to 2.57.1" | Re-trigger Greptile}

[dependabot]

Superseded by #19.