🚨 [security] Update @sveltejs/kit 2.52.2 → 2.70.1 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ @​sveltejs/kit (2.52.2 → 2.70.1) · Repo · Changelog

Security Advisories 🚨

🚨 SvelteKit: Big remote form function payloads can cause Node process to crash

Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.

🚨 SvelteKit: Prototype pollution in file input deletion path in remote-function forms

If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype.

🚨 @sveltejs/kit: `query.batch` cross-talk

query.batch() could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.

🚨 @sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass

Under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected.

🚨 @sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service

redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input.

🚨 SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)

Some relatively small inputs can cause very large files arrays in form handlers. If the SvelteKit application code doesn't check files.length or individual files' sizes and performs expensive processing with them, it can result in Denial of Service.

Only users with experimental.remoteFunctions: true who are using the form function and are processing the files array without validation are vulnerable.

Release Notes

Too many releases to show here. View the full release notes.

↗️ acorn (indirect, 8.15.0 → 8.17.0) · Repo

Commits

See the full diff on Github. The new version differs by 34 commits:

• Mark version 8.17.0
• Make linter happy
• Add a strict option to turn on strict mode for scripts
• Convert stack overflow errors to SyntaxError instances
• Update maintainer email
• Bump test262
• Improve handling of using/await using in for loops
• Upgrade some dev dependencies
• Remove unnecessary test
• Forbid 'new super()'
• Reassure linter
• Disallow arrow functions to be the conditional in a ternary expr
• Mark version 8.16.0
• Mark acorn-walk 8.3.5
• Properly check for presence of node.attributes in walkers
• Bump test262
• Bump Unicode 17, regenerate script values
• Properly throw an error, not a raw string
• More explicit error when walking a tree and a node type isn't registered.
• Rename eslint config file to suppress warning
• Update to ESLint 9
• Add Unicode v17 support
• Use consistent semicolon-less style in readmes
• Docs: Announce both ESM and CommonJS imports are supported, change all examples to ESM imports
• Clean up identifier char handling in keyword lookahead functions
• Increase accuracy of isAsyncFunction when followed by a backslash
• Fix await using double lookahead edge case
• Mark acorn-loose 8.5.2
• Bump dependency on acorn in acorn-loose
• Add support for sourceType: commonjs option
• Reject return statement in static block, even if allowReturnOutsideFunction is used
• Reject using declarations directly in for loop or switch scopes.
• Improve lookahead test for using syntax
• Mark acorn-loose 8.5.1

↗️ devalue (indirect, 5.6.3 → 5.8.2) · Repo · Changelog

Security Advisories 🚨

🚨 Svelte devalue: DoS via sparse array deserialization

devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption.

🚨 devalue has prototype pollution in devalue.parse and devalue.unflatten

In devalue v5.6.3, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion.

🚨 Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties

In some circumstances, devalue.parse and devalue.unflatten could emit objects with __proto__ own properties. This in and of itself is not a security vulnerability (and is possible with, for example, JSON.parse as well), but it can result in prototype injection if downstream code handles it incorrectly:

const result = devalue.parse(/* input creating an object with a __proto__ property */);
const target = {};
Object.assign(target, result); // target's prototype is now polluted

Release Notes

5.8.2

Patch Changes

• 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
• cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
• 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
• 8c0db06: fix: serialize Temporal values referenced more than once in uneval
• 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
• 756265a: fix: preserve shared-reference identity for Map keys in uneval
• faa8a05: fix: emit uneval reconstructions before the statements that reference them
• 06129ad: fix: do not grow sparse arrays by one slot in uneval

5.8.1

Patch Changes

• 206ca67: fix: force sparse arrays to allocate sparsely

5.8.0

Minor Changes

• c5115b0: feat: add stringifyAsync for async serialization

5.7.1

Patch Changes

• 8becc7c: fix: handle regexes consistently in uneval's value and reference formats

5.7.0

Minor Changes

• df2e284: feat: use native alternatives to encode/decode base64
• 498656e: feat: add DataView support
• a210130: feat: whitelist Float16Array
• df2e284: feat: simplify TypedArray slices

Patch Changes

• 5590634: fix: get uneval type handling up to parity with stringify
• 57f73fc: fix: correctly support boxed bigints and sentinel values

5.6.4

Patch Changes

• 87c1f3c: fix: reject __proto__ keys in malformed Object wrapper payloads

  This validates the "Object" parse path and throws when the wrapped value has an own __proto__ key.

• 40f1db1: fix: ensure sparse array indices are integers

• 87c1f3c: fix: disallow __proto__ keys in null-prototype object parsing

  This disallows __proto__ keys in the "null" parse path so null-prototype object hydration cannot carry that key through parse/unflatten.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 30 commits:

• Version Packages (#167)
• fix: uneval loses a repeated typed array/DataView referenced inside a cycle (#163)
• fix: emit valid JS for BigInt64Array and BigUint64Array in uneval (#171)
• chore(ci): set permissions on ci workflow (#157)
• fix: resolve circular references through custom revivers (#154)
• fix: uneval grows sparse arrays by one slot when first hole is past index 0 (#160)
• fix: preserve shared-reference identity for Map keys in uneval (#164)
• fix: serialize Temporal values referenced more than once in uneval (#165)
• fix: uneval emits valid JS for repeated empty Map/Set (#168)
• fix: serialize DataView subviews with correct byte offset and length (#166)
• chore: Supply chain hardening (#155)
• Version Packages (#152)
• Merge commit from fork
• Version Packages (#151)
• feat: `stringifyAsync` (#150)
• docs: update README to reflect serialization stability non-goal (#147)
• Version Packages (#146)
• fix: handle regexes consistently in uneval's value and reference formats (#145)
• Version Packages (#144)
• DataView support (#143)
• Improve platform types support (#142)
• fix: support boxed `bigint`s and sentinel values (#141)
• Add prettier configuration (#140)
• feat: whitelist `Float16Array` (#137)
• feat: use native alternatives to encode/decode base64 (#136)
• chore: add simple benchmarks (#135)
• fix: rename test file so uvu picks it up (#134)
• Version Packages (#133)
• Merge commit from fork
• Merge commit from fork

🗑️ @​sveltejs/vite-plugin-svelte (removed)

🗑️ @​sveltejs/vite-plugin-svelte-inspector (removed)

🗑️ deepmerge (removed)

🗑️ vitefu (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ask-hadith	Ready	Preview, Comment	Jul 24, 2026 4:06pm

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}