🚨 [security] Update @sveltejs/kit 2.52.2 → 2.57.1 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ @​sveltejs/kit (2.52.2 → 2.57.1) · Repo · Changelog

Security Advisories 🚨

🚨 @sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass

Under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected.

🚨 @sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service

redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input.

🚨 SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)

Some relatively small inputs can cause very large files arrays in form handlers. If the SvelteKit application code doesn't check files.length or individual files' sizes and performs expensive processing with them, it can result in Denial of Service.

Only users with experimental.remoteFunctions: true who are using the form function and are processing the files array without validation are vulnerable.

Release Notes

2.57.0 (from changelog)

Minor Changes

• feat: return boolean from submit to indicate submission validity for enhanced form remote functions (#15530)

Patch Changes

• fix: use array type for select fields that accept multiple values (#15591)

• fix: silently 404 Chrome DevTools workspaces request in dev and preview (#15656)

• fix: config.kit.csp.directives['trusted-types'] requires 'svelte-trusted-html' (and 'sveltekit-trusted-url' when a service worker is automatically registered) if it is configured (#15323)

• fix: avoid inlineDynamicImports ignored with codeSplitting warning when using Vite 8 (#15647)

• fix: reimplement treeshaking non-dynamic prerendered remote functions (#15447)

2.56.1 (from changelog)

Patch Changes

• chore: update JSDoc (#15640)

2.56.0 (from changelog)

Minor Changes

• breaking: rework client-driven refreshes (#15562)

• breaking: stabilize remote function caching by sorting object keys (#15570)

• breaking: add run() method to queries, disallow awaiting queries outside render (#15533)

• feat: support TypeScript 6.0 (#15595)

• breaking: isolate command-triggered query refresh failures per-query (#15562)

• feat: use hydratable for remote function transport (#15533)

• feat: allow form fields to specify a default value (field.as(type, value)) (#15577)

Patch Changes

• fix: don't request new data when .refresh is called on a query with no cache entry (#15533)

• fix: allow using multiple remote functions within one async derived (#15561)

• fix: avoid false-positive overridden Vite base setting warning when setting a paths.base in svelte.config.js (#15623)

• fix: manage queries in their own $effect.root (#15533)

• fix: avoid inlineDynamicImports deprecation warning when building the service worker with Vite 8 (#15550)

• fix: correctly escape backticks when precomputing CSS (#15593)

• fix: discard obsolete forks before finishing navigation (#15634)

• chore: tighten up override implementation (#15562)

• fix: ensure the default Svelte 5 error.svelte file uses runes mode (#15609)

• fix: deduplicate same-cache-key batch calls during SSR (#15533)

• fix: decrement pending_count when form callback doesn't call submit() (#15520)

2.55.0 (from changelog)

Minor Changes

• feat: page and layout params with matchers are now type narrowed in $app/types, leading to better type safety when working with params in $app/types, $app/state, and hooks. (#15502)

2.54.0 (from changelog)

Minor Changes

• feat: allow error boundaries to catch errors on the server (#15308)

Patch Changes

• chore: upgrade devalue (#15535)

• fix: don't wait for remote functions that are not awaited in the template (#15280)

• feat: allow resolve() to accept pathnames with a search string and/or hash (#15458)

• chore: remove deprecation warnings for config.kit.files.* options when validating the Svelte config file (#15482)

• fix: handles form target attribute in remote form redirects (#15457)

2.53.4 (from changelog)

Patch Changes

• fix: avoid Vite warning about unknown codeSplitting option (#15451)

2.53.3 (from changelog)

Patch Changes

• fix: prevent overlapping file metadata in remote functions form (faba869)

2.53.2 (from changelog)

Patch Changes

• fix: server-render nested form value sets (#15378)

• fix: use deep partial types for form remote functions .value() and .set(...) (#14837)

• fix: provide correct url info to remote functions (#15418)

• fix: allow optional types for remote query/command/prerender functions (#15293)

• fix: allow commands in more places (#15288)

2.53.1 (from changelog)

Patch Changes

• fix: address warning about inlineDynamicImports when using Vite 8 (#15403)

2.53.0 (from changelog)

Minor Changes

• feat: support Vite 8 (#15024)

Patch Changes

• fix: remove event listeners on form attachment cleanup (#15286)

• fix: apply queries refreshed in a form remote function when a redirect is thrown (#15362)

Does any of this look wrong? Please let us know.

↗️ devalue (indirect, 5.6.3 → 5.7.1) · Repo · Changelog

Security Advisories 🚨

🚨 devalue has prototype pollution in devalue.parse and devalue.unflatten

In devalue v5.6.3, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion.

🚨 Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties

In some circumstances, devalue.parse and devalue.unflatten could emit objects with __proto__ own properties. This in and of itself is not a security vulnerability (and is possible with, for example, JSON.parse as well), but it can result in prototype injection if downstream code handles it incorrectly:

const result = devalue.parse(/* input creating an object with a __proto__ property */);
const target = {};
Object.assign(target, result); // target's prototype is now polluted

Release Notes

5.7.1

Patch Changes

• 8becc7c: fix: handle regexes consistently in uneval's value and reference formats

5.7.0

Minor Changes

• df2e284: feat: use native alternatives to encode/decode base64
• 498656e: feat: add DataView support
• a210130: feat: whitelist Float16Array
• df2e284: feat: simplify TypedArray slices

Patch Changes

• 5590634: fix: get uneval type handling up to parity with stringify
• 57f73fc: fix: correctly support boxed bigints and sentinel values

5.6.4

Patch Changes

• 87c1f3c: fix: reject __proto__ keys in malformed Object wrapper payloads

  This validates the "Object" parse path and throws when the wrapped value has an own __proto__ key.

• 40f1db1: fix: ensure sparse array indices are integers

• 87c1f3c: fix: disallow __proto__ keys in null-prototype object parsing

  This disallows __proto__ keys in the "null" parse path so null-prototype object hydration cannot carry that key through parse/unflatten.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 14 commits:

• Version Packages (#146)
• fix: handle regexes consistently in uneval's value and reference formats (#145)
• Version Packages (#144)
• DataView support (#143)
• Improve platform types support (#142)
• fix: support boxed `bigint`s and sentinel values (#141)
• Add prettier configuration (#140)
• feat: whitelist `Float16Array` (#137)
• feat: use native alternatives to encode/decode base64 (#136)
• chore: add simple benchmarks (#135)
• fix: rename test file so uvu picks it up (#134)
• Version Packages (#133)
• Merge commit from fork
• Merge commit from fork

🗑️ @​sveltejs/vite-plugin-svelte (removed)

🗑️ @​sveltejs/vite-plugin-svelte-inspector (removed)

🗑️ deepmerge (removed)

🗑️ vitefu (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ask-hadith	Ready	Preview, Comment	Apr 10, 2026 6:06pm

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}

[depfu]

Closed in favor of #195.