Skip to content

chore(deps): bump the security-updates group across 1 directory with 5 updates - #12

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/security-updates-4257055a07
Open

chore(deps): bump the security-updates group across 1 directory with 5 updates#12
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/security-updates-4257055a07

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 26, 2026

Copy link
Copy Markdown

Bumps the security-updates group with 4 updates in the / directory: @sveltejs/kit, postcss, svelte and vite.

Updates @sveltejs/kit from 2.56.1 to 2.61.1

Release notes

Sourced from @​sveltejs/kit's releases.

@​sveltejs/kit@​2.61.1

Patch Changes

  • fix: regression where routes starting and ending with a route group are not matched correctly (#15903)

@​sveltejs/kit@​2.61.0

Minor Changes

  • breaking: the .run() method has been removed from remote queries on both the client and the server. Use await query() directly instead — it now works everywhere (#15779)

  • feat: remote queries can now be awaited in any context (event handlers, module scope, async callbacks), not just inside reactive contexts. The cache is shared across reactive and non-reactive subscribers, so awaiting a query in an event handler will dedupe with components that have already subscribed to the same query. (#15779)

  • feat: live query instances are now themselves async-iterable (#15878)

  • feat: add programmatic submit method to form remote function instances (#15657)

  • feat: pass form remote function instance into enhance callback (#15657)

Patch Changes

  • fix: resolve the app payload without using process.env.NODE_ENV (#15852)

  • fix: support exactOptionalPropertyTypes for optional route params (#15825)

  • fix: correctly send true value to the server for 'submit' and 'hidden' form fields (#15858)

  • fix: avoid build warnings about undefined universal hooks (#15895)

  • fix: prefer default error page when failing to decode the URL pathname (#15744)

  • fix: disable link prefetching on slow internet connections (#15885)

  • fix: allow routes ending with optional parameters next to more specific routes (#15861)

  • fix: remove reliance on Content-Length header in deserialize_binary_form, which caused failures when proxies (e.g. Vercel, Azure) strip the header and use chunked transfer encoding (#15796)

@​sveltejs/kit@​2.60.1

Patch Changes

... (truncated)

Changelog

Sourced from @​sveltejs/kit's changelog.

2.61.1

Patch Changes

  • fix: regression where routes starting and ending with a route group are not matched correctly (#15903)

2.61.0

Minor Changes

  • breaking: the .run() method has been removed from remote queries on both the client and the server. Use await query() directly instead — it now works everywhere (#15779)

  • feat: remote queries can now be awaited in any context (event handlers, module scope, async callbacks), not just inside reactive contexts. The cache is shared across reactive and non-reactive subscribers, so awaiting a query in an event handler will dedupe with components that have already subscribed to the same query. (#15779)

  • feat: live query instances are now themselves async-iterable (#15878)

  • feat: add programmatic submit method to form remote function instances (#15657)

  • feat: pass form remote function instance into enhance callback (#15657)

Patch Changes

  • fix: resolve the app payload without using process.env.NODE_ENV (#15852)

  • fix: support exactOptionalPropertyTypes for optional route params (#15825)

  • fix: correctly send true value to the server for 'submit' and 'hidden' form fields (#15858)

  • fix: avoid build warnings about undefined universal hooks (#15895)

  • fix: prefer default error page when failing to decode the URL pathname (#15744)

  • fix: disable link prefetching on slow internet connections (#15885)

  • fix: allow routes ending with optional parameters next to more specific routes (#15861)

  • fix: remove reliance on Content-Length header in deserialize_binary_form, which caused failures when proxies (e.g. Vercel, Azure) strip the header and use chunked transfer encoding (#15796)

... (truncated)

Commits
  • b714743 Version Packages (#15904)
  • 131fdc7 fix: regression where routes starting and ending with a route group are not f...
  • 4f961ab Version Packages (#15853)
  • 1817da0 fix: support exactOptionalPropertyTypes for optional route params (#15825)
  • 8feb2af chore: dedupe replacer code (#15877)
  • 95ca921 fix: remove Content-Length dependency in binary form deserialization (#15796)
  • e75024c feat: LiveQuery self-iterability (#15878)
  • 0cc67d9 fix: avoid build warnings about undefined hooks on Windows (#15895)
  • 1949057 chore(prefetch): disable link prefetching on slow internet connections (#15885)
  • 69b5787 fix: prefer the default error page when failing to decode the URL pathname (#...
  • Additional commits viewable in compare view

Updates postcss from 8.5.8 to 8.5.15

Release notes

Sourced from postcss's releases.

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.
Changelog

Sourced from postcss's changelog.

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.
  • Added opts.unsafeMap to disable checks.

8.5.11

  • Fixed nested brackets parsing performance (by @​offset).

8.5.10

  • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

  • Speed up source map encoding paring in case of the error.
Commits
  • eae46db Release 8.5.15 version
  • 79508ff Update CI actions
  • b128e21 Speed up declaration parsing by avoiding creating new array on each token
  • 9825dca Fix code format
  • 55789c8 Update dependencies
  • 84fbbe9 Install older pnpm action for old Node.js
  • 9f860bd Revert pnpm action for old Node.js
  • 0877198 Update CI actions
  • b2d1a33 Fix linter warnings
  • 0700dac Merge pull request #2088 from rootvector2/add-oss-fuzz-harness
  • Additional commits viewable in compare view

Updates svelte from 5.55.1 to 5.55.9

Release notes

Sourced from svelte's releases.

svelte@5.55.9

Patch Changes

  • fix: don't unset batch when calling {#await ...} promise (#18243)

  • fix: promise-ify {#await await ...} expressions on the server and correctly hydrate them on the client (#18243)

  • fix: deduplicate dependencies that are added outside the init/update cycle (#18243)

  • fix: avoid false-positive batch invariant error (#18246)

  • fix: inline primitive constants in attribute values during SSR (#18232)

svelte@5.55.8

Patch Changes

  • fix(print): handle svelte:body and fix keyframe percentage double-printing (#18234)

  • fix: execute uninitialized derived even if it's destroyed (#18228)

  • fix: use named symbols everywhere (#18238)

  • fix: don't run teardown effects when deriveds are unfreezed (#18227)

  • fix: unset context synchronously in run (#18236)

svelte@5.55.7

Patch Changes

svelte@5.55.6

Patch Changes

  • fix: leave stale promises to wait for a later resolution, instead of rejecting (#18180)

  • fix: keep dependencies of $state.eager/pending (#18218)

  • fix: reapply context after transforming error during SSR (#18099)

  • fix: don't rebase just-created batches (#18117)

... (truncated)

Changelog

Sourced from svelte's changelog.

5.55.9

Patch Changes

  • fix: don't unset batch when calling {#await ...} promise (#18243)

  • fix: promise-ify {#await await ...} expressions on the server and correctly hydrate them on the client (#18243)

  • fix: deduplicate dependencies that are added outside the init/update cycle (#18243)

  • fix: avoid false-positive batch invariant error (#18246)

  • fix: inline primitive constants in attribute values during SSR (#18232)

5.55.8

Patch Changes

  • fix(print): handle svelte:body and fix keyframe percentage double-printing (#18234)

  • fix: execute uninitialized derived even if it's destroyed (#18228)

  • fix: use named symbols everywhere (#18238)

  • fix: don't run teardown effects when deriveds are unfreezed (#18227)

  • fix: unset context synchronously in run (#18236)

5.55.7

Patch Changes

5.55.6

Patch Changes

  • fix: leave stale promises to wait for a later resolution, instead of rejecting (#18180)

  • fix: keep dependencies of $state.eager/pending (#18218)

... (truncated)

Commits

Updates vite from 6.4.1 to 6.4.2

Release notes

Sourced from vite's releases.

v6.4.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.2 (2026-04-06)

Commits

Updates devalue from 5.6.4 to 5.8.1

Release notes

Sourced from devalue's releases.

v5.8.1

Patch Changes

  • 206ca67: fix: force sparse arrays to allocate sparsely

v5.8.0

Minor Changes

  • c5115b0: feat: add stringifyAsync for async serialization

v5.7.1

Patch Changes

  • 8becc7c: fix: handle regexes consistently in uneval's value and reference formats

v5.7.0

Minor Changes

  • df2e284: feat: use native alternatives to encode/decode base64
  • 498656e: feat: add DataView support
  • a210130: feat: whitelist Float16Array
  • df2e284: feat: simplify TypedArray slices

Patch Changes

  • 5590634: fix: get uneval type handling up to parity with stringify
  • 57f73fc: fix: correctly support boxed bigints and sentinel values
Changelog

Sourced from devalue's changelog.

5.8.1

Patch Changes

  • 206ca67: fix: force sparse arrays to allocate sparsely

5.8.0

Minor Changes

  • c5115b0: feat: add stringifyAsync for async serialization

5.7.1

Patch Changes

  • 8becc7c: fix: handle regexes consistently in uneval's value and reference formats

5.7.0

Minor Changes

  • df2e284: feat: use native alternatives to encode/decode base64
  • 498656e: feat: add DataView support
  • a210130: feat: whitelist Float16Array
  • df2e284: feat: simplify TypedArray slices

Patch Changes

  • 5590634: fix: get uneval type handling up to parity with stringify
  • 57f73fc: fix: correctly support boxed bigints and sentinel values
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the security-updates group across 1 directory with …
5e3d39c 
…5 updates

Bumps the security-updates group with 4 updates in the / directory: [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit), [postcss](https://github.com/postcss/postcss), [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `@sveltejs/kit` from 2.56.1 to 2.61.1
- [Release notes](https://github.com/sveltejs/kit/releases)
- [Changelog](https://github.com/sveltejs/kit/blob/main/packages/kit/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/kit@2.61.1/packages/kit)

Updates `postcss` from 8.5.8 to 8.5.15
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.8...8.5.15)

Updates `svelte` from 5.55.1 to 5.55.9
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.55.9/packages/svelte)

Updates `vite` from 6.4.1 to 6.4.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.2/packages/vite)

Updates `devalue` from 5.6.4 to 5.8.1
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.6.4...v5.8.1)

---
updated-dependencies:
- dependency-name: "@sveltejs/kit"
  dependency-version: 2.61.1
  dependency-type: direct:development
  dependency-group: security-updates
- dependency-name: postcss
  dependency-version: 8.5.15
  dependency-type: direct:development
  dependency-group: security-updates
- dependency-name: svelte
  dependency-version: 5.55.9
  dependency-type: direct:development
  dependency-group: security-updates
- dependency-name: vite
  dependency-version: 6.4.2
  dependency-type: direct:development
  dependency-group: security-updates
- dependency-name: devalue
  dependency-version: 5.8.1
  dependency-type: indirect
  dependency-group: security-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants