chore(deps): update dependency @sveltejs/kit to v2.8.3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@sveltejs/kit (source)	2.0.0 -> 2.8.3

GitHub Vulnerability Alerts

CVE-2024-23641

Summary

In SvelteKit 2 sending a GET request with a body eg {} to a SvelteKit app in preview or with adapter-node throws Request with GET/HEAD method cannot have body. and crashes the app.

node:internal/deps/undici/undici:6066
          throw new TypeError("Request with GET/HEAD method cannot have body.");
                ^

TypeError: Request with GET/HEAD method cannot have body.
    at new Request (node:internal/deps/undici/undici:6066:17)
    at getRequest (file:///C:/Users/admin/Desktop/reproduction/node_modules/@​sveltejs/kit/src/exports/node/index.js:107:9)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@​sveltejs/kit/src/exports/vite/preview/index.js:181:26
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
    at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@​sveltejs/kit/src/exports/vite/preview/index.js:172:6
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)
    at next (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44739:5)
    at file:///C:/Users/admin/Desktop/reproduction/node_modules/@​sveltejs/kit/src/exports/vite/preview/index.js:211:27
    at call (file:///C:/Users/admin/Desktop/reproduction/node_modules/vite/dist/node/chunks/dep-9A4-l-43.js:44795:7)

Node.js v20.11.0

TRACE requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected.

PoC

First do a fresh install of SvelteKit 2 with the example app. Typescript.

1. npm run build
2. npm run preview
3. Go to http://localhost:4173 (works)
4. curl -X GET -d "{}" http://localhost:4173/bye
5. Application crashes and http://localhost:4173 is down

Impact

Denial of Service for apps using adapter-node

CVE-2024-53262

Summary

The static error.html template for errors contains placeholders that are replaced without escaping the content first.

Details

From https://kit.svelte.dev/docs/errors:

error.html is the page that is rendered when everything else fails. It can contain the following placeholders:
%sveltekit.status% — the HTTP status
%sveltekit.error.message% — the error message

This leads to possible injection if an app explicitly creates an error with a message that contains user controlled content that ends up being something like this inside a server handle function:

error(500, '<script>alert("boom")</script>');

Uncaught errors cannot be exploited like this, as they always render the message "Internal error".

Escaping the message string in the function that creates the html output can be done to improve safety for applications that are using custom errors on the server.

PoC

None provided

Impact

Only applications where user provided input is used in the Error message will be vulnerable, so the vast majority of applications will not be vulnerable

CVE-2024-53261

Summary

"Unsanitized input from the request URL flows into end, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS)."

Details

Source of potentially tainted data is in packages/kit/src/exports/vite/dev/index.js, line 437. This potentially tainted data is passed through a number of steps (which I could detail if you'd like) all the way down to line 91 in packages/kit/src/exports/vite/utils.js, which performs an operation that Snyk believes an attacker shouldn't be allowed to manipulate.

Another source of potentially tainted data (according to Snyk) comes from ‎packages/kit/src/exports/vite/utils.js, line 30, col 30 (i.e., the url property of req). This potentially tainted data is passed through a number of steps (which I could detail if you'd like) all the way down line 91 in packages/kit/src/exports/vite/utils.js, which performs an operation that Snyk believes an attacker shouldn't be allowed to manipulate.

PoC

Not provided

Impact

Little to none. The Vite development is not exposed to the network by default. And even if someone were able to trick a developer into executing an XSS against themselves, a development database should not have any sensitive data.

---

Release Notes

sveltejs/kit (@​sveltejs/kit)

v2.8.3

Compare Source

Patch Changes

• fix: ensure error messages are escaped (#​13050)

• fix: escape values included in dev 404 page (#​13039)

v2.8.2

Compare Source

Patch Changes

• fix: prevent duplicate fetch request when using Request with load function's fetch (#​13023)

• fix: do not override default cookie decoder to allow users to override the cookie library version (#​13037)

v2.8.1

Compare Source

Patch Changes

• fix: only add nonce to script-src-elem, style-src-attr and style-src-elem CSP directives when unsafe-inline is not present (#​11613)

• fix: support HTTP/2 in dev and production. Revert the changes from #​12907 to downgrade HTTP/2 to TLS as now being unnecessary (#​12989)

v2.8.0

Compare Source

Minor Changes

• feat: add helper to identify ActionFailure objects (#​12878)

v2.7.7

Compare Source

Patch Changes

• fix: update link in JSDoc (#​12963)

v2.7.6

Compare Source

Patch Changes

• fix: update broken links in JSDoc (#​12960)

v2.7.5

Compare Source

Patch Changes

• fix: warn on invalid cookie name characters (#​12806)

• fix: when using @vitejs/plugin-basic-ssl, set a no-op proxy config to downgrade from HTTP/2 to TLS since undici does not yet enable HTTP/2 by default (#​12907)

v2.7.4

Compare Source

Patch Changes

• fix: ensure element is focused after subsequent clicks of the same hash link (#​12866)

• fix: avoid preload if event default was prevented for touchstart and mousedown events (#​12887)

• fix: avoid reloading behaviour for hash links with data-sveltekit-reload if the hash is on the same page (#​12866)

v2.7.3

Compare Source

Patch Changes

• fix: include importer in illegal import error message (#​12820)

• fix: don't try reading assets directly that aren't present (#​12876)

• fix: decode non-latin characters when previewing prerendered pages (#​12874)

• fix: better error message when a Result is returned from a form action (#​12829)

• docs: update URLs for new svelte.dev site (#​12857)

v2.7.2

Compare Source

Patch Changes

• fix: use absolute links in JSDoc comments (#​12718)

v2.7.1

Compare Source

Patch Changes

• chore: upgrade to sirv 3.0 (#​12796)

• fix: warn when form action responses are lost because SSR is off (#​12063)

v2.7.0

Compare Source

Minor Changes

• feat: update service worker when new version is detected (#​12448)

Patch Changes

• fix: correctly handle relative paths when fetching assets on the server (#​12113)

• fix: decode non ASCII anchor hashes when scrolling into view (#​12699)

• fix: page response missing CSP and Link headers when return promise in load (#​12418)

v2.6.4

Compare Source

Patch Changes

• fix: only preload links that have a different URL than the current page (#​12773)

• fix: revert change to replace version in generateBundle (#​12779)

• fix: catch stack trace fixing errors thrown in web containers (#​12775)

• fix: use absolute links in JSDoc comments (#​12772)

v2.6.3

Compare Source

Patch Changes

• fix: ensure a changing version doesn't affect the hashes for chunks without any actual code changes (#​12700)

• fix: prevent crash when logging URL search params in a server load function (#​12763)

• chore: revert update dependency cookie to ^0.7.0 (#​12767)

v2.6.2

Compare Source

Patch Changes

• chore(deps): update dependency cookie to ^0.7.0 (#​12746)

v2.6.1

Compare Source

Patch Changes

• fix: better error message when calling push/replaceState before router is initialized (#​11968)

v2.6.0

Compare Source

Minor Changes

• feat: support typed arrays in load functions (#​12716)

Patch Changes

• fix: open a new tab for <form target="_blank"> and ` submissions (#​11936)

v2.5.28

Compare Source

Patch Changes

• fix: import node:process instead of using globals (#​12641)

v2.5.27

Compare Source

Patch Changes

• fix: asynchronously instantiate components when using Svelte 5 (#​12613)

• fix: use {@​render ...} tag when generating default fallback page for svelte 5 apps (#​12653)

• fix: emulate event.platform even when the route does not exist (#​12513)

v2.5.26

Compare Source

Patch Changes

• fix: exclude service worker directory from tsconfig (#​12196)

v2.5.25

Compare Source

Patch Changes

• chore: upgrade dts-buddy to 0.5.3 (6056ba30e29ac5747c356fbf1a42dd71f2c4aa1f)

v2.5.24

Compare Source

Patch Changes

• extend peer dependency range for @​sveltejs/vite-plugin-svelte to include 4.0.0-next for improved svelte5 support (#​12593)

v2.5.23

Compare Source

Patch Changes

• fix: use dynamic components in root.svelte instead of svelte:component for svelte 5 (#​12584)

v2.5.22

Compare Source

Patch Changes

• chore: configure provenance in a simpler manner (#​12570)

v2.5.21

Compare Source

Patch Changes

• chore: package provenance (#​12567)

v2.5.20

Compare Source

Patch Changes

• fix: set revalidate cache header on 404'd static assets (#​12530)

v2.5.19

Compare Source

Patch Changes

• fix: Svelte 5 - ignore binding_non_reactive warning in generated root component (you also need to update to [email protected]) (#​12524)

v2.5.18

Compare Source

Patch Changes

• fix: respect HTML attributes enctype and formenctype for forms with use:enhance (#​12198)

• fix: prevent client import error when a hooks.server file imports a private environment variable (#​12195)

• fix: set default Content-Type header to application/x-www-form-urlencoded for POST form submissions with use:enhance to align with native form behaviour (#​12198)

v2.5.17

Compare Source

Patch Changes

• chore: update package description (#​11846)

v2.5.16

Compare Source

Patch Changes

• fix: determine local Svelte version more reliably (#​12350)

v2.5.15

Compare Source

Patch Changes

• fix: always decode asset URLs (#​12352)

v2.5.14

Compare Source

Patch Changes

• fix: read non-encoded data URIs (#​12347)

v2.5.13

Compare Source

Patch Changes

• fix: decode asset URLs in dev when reading them, but for real this time (#​12344)

v2.5.12

Compare Source

Patch Changes

• fix: decode asset URLs in dev when reading them (#​12341)

v2.5.11

Compare Source

Patch Changes

• fix: hrefs that start with config.prerender.origin are now crawled (#​12277)

• chore: add keywords for discovery in npm search (#​12330)

• fix: handle whitespace in HTTP Accept header (#​12292)

v2.5.10

Compare Source

Patch Changes

• fix: exclude server files from optimizeDeps.entries (#​12242)

• fix: bump import-meta-resolve to remove deprecation warnings (#​12240)

v2.5.9

Compare Source

Patch Changes

• fix: yield main thread before navigating (#​12225)

• fix: correctly handle aliases to files in the .svelte-kit directory (#​12220)

v2.5.8

Compare Source

Patch Changes

• fix: prevent excessive Vite dependency optimizations on navigation (#​12182)

v2.5.7

Compare Source

Patch Changes

• chore(deps): update devalue to v5 ignore non-enumerable symbols during serialization (#​12141)

v2.5.6

Compare Source

Patch Changes

• fix: avoid incorrectly un- and re-escaping cookies collected during a server-side fetch (#​11904)

v2.5.5

Compare Source

Patch Changes

• fix: only hydrate when page is server-rendered (#​12050)

v2.5.4

Compare Source

Patch Changes

• fix: prevent navigation when data-sveltekit-preload-data fails to fetch due to network error (#​11944)

v2.5.3

Compare Source

Patch Changes

• fix: revert tsconfig change that includes svelte.config.js (#​11908)

• fix: exclude server worker from tsconfig again (#​11727)

v2.5.2

Compare Source

Patch Changes

• fix: tsconfig includes should cover svelte.config.js (#​11886)

v2.5.1

Compare Source

Patch Changes

• fix: prevent stale values after invalidation (#​11870)

• fix: prevent false positive history.pushState and history.replaceState warnings (#​11858)

• fix: relax status code types (#​11781)

• fix: popstate navigations take pushState navigations into account (#​11765)

v2.5.0

Compare Source

Minor Changes

• feat: dev/preview/prerender platform emulation (#​11730)

Patch Changes

• fix: strip /@​fs prefix correctly on Windows when invoking read() in dev mode (#​11728)

v2.4.3

Compare Source

Patch Changes

• fix: only disallow body with GET/HEAD (#​11710)

v2.4.2

Compare Source

Patch Changes

• fix: ignore bodies sent with non-PUT/PATCH/POST requests (#​11708)

v2.4.1

Compare Source

Patch Changes

• fix: use Vite's default value for build.target and respect override supplied by user (#​11688)

• fix: properly decode base64 strings inside read (#​11682)

• fix: default route config to {} for feature checking (#​11685)

• fix: handle onNavigate callbacks correctly (#​11678)

v2.4.0

Compare Source

Minor Changes

• feat: add $app/server module with read function for reading assets from filesystem (#​11649)

v2.3.5

Compare Source

Patch Changes

• fix: log a warning if fallback page overwrites prerendered page (#​11661)

v2.3.4

Compare Source

Patch Changes

• fix: don't stash away original history methods so other libs can monkeypatch it (#​11657)

v2.3.3

Compare Source

Patch Changes

• fix: remove internal __sveltekit/ module declarations from types (#​11620)

v2.3.2

Compare Source

Patch Changes

• fix: return plaintext 404 for anything under appDir (#​11597)

• fix: populate dynamic public env without using top-level await, which fails in Safari (#​11601)

v2.3.1

Compare Source

Patch Changes

• fix: amend onNavigate type (#​11599)

• fix: better error message when peer dependency cannot be found (#​11598)

v2.3.0

Compare Source

Minor Changes

• feat: add reroute hook (#​11537)

v2.2.2

Compare Source

Patch Changes

• fix: only add nonce to style-src CSP directive when unsafe-inline is not present (#​11575)

v2.2.1

Compare Source

Patch Changes

• feat: add CSP support for style-src-elem (#​11562)

• fix: address CSP conflicts with sha/nonce during dev (#​11562)

v2.2.0

Compare Source

Minor Changes

• feat: expose $env/static/public in service workers (#​10994)

Patch Changes

• fix: reload page on startup if document.URL contains credentials (#​11179)

v2.1.2

Compare Source

Patch Changes

• fix: restore invalid route error message during build process (#​11559)

v2.1.1

Compare Source

Patch Changes

• fix: respect the trailing slash option when navigating from the basepath root page (#​11388)

• chore: shrink error messages shipped to client (#​11551)

v2.1.0

Compare Source

Minor Changes

• feat: make client router treeshakeable (#​11340)

Patch Changes

• chore: reduce client bundle size (#​11547)

v2.0.8

Compare Source

Patch Changes

• fix: always scroll to top when clicking a # or #top link (099608c428a49504785eab3afe3b2e76a9317bdf)

• fix: add nonce or hash to "script-src-elem", "style-src-attr" and "style-src-elem" if defined in CSP config (#​11485)

• fix: decode server data with stream: true during client-side navigation (#​11409)

• fix: capture scroll position when using pushState (#​11540)

• chore: use peer dependencies when linked (#​11433)

v2.0.7

Compare Source

Patch Changes

• chore: removed deprecated config.package type (#​11462)

v2.0.6

Compare Source

Patch Changes

• fix: allow dynamic env access when building but not prerendering (#​11436)

v2.0.5

Compare Source

Patch Changes

• fix: render SPA shell when SSR is turned off and there is no server data (#​11405)

• fix: upgrade sirv and mrmime to modernize javascript mime type (#​11419)

v2.0.4

Compare Source

Patch Changes

• chore: update primary branch from master to main (47779436c5f6c4d50011d0ef8b2709a07c0fec5d)

• fix: adjust missing inner content warning (#​11394)

• fix: prevent esbuild adding phantom exports to service worker (#​11400)

• fix: goto type include state (#​11398)

• fix: ensure assets are served gzip in preview (#​11377)

v2.0.3

Compare Source

Patch Changes

• fix: reinstantiate state parameter for goto (#​11342)

v2.0.2

Compare Source

Patch Changes

• fix: prevent endless SPA 404 loop (#​11354)

v2.0.1

Compare Source

Patch Changes

• fix: correctly handle trailing slash redirect when navigating from the root page (#​11357)

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Prague, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.