chore(deps): update dependency @sveltejs/adapter-vercel to v6 [security]#263
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
chore(deps): update dependency @sveltejs/adapter-vercel to v6 [security]#263renovate[bot] wants to merge 1 commit intomainfrom
renovate[bot] wants to merge 1 commit intomainfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
|
renovate
bot
force-pushed
the
renovate/npm-sveltejs-adapter-vercel-vulnerability
branch
from
9178d33 to
90728ff
Compare
renovate
bot
force-pushed
the
renovate/npm-sveltejs-adapter-vercel-vulnerability
branch
from
90728ff to
87f7aa0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^5.4.7→^6.3.2GitHub Vulnerability Alerts
CVE-2026-27118
Versions of
@sveltejs/adapter-vercelprior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users.Successful exploitation requires a victim to visit an attacker-controlled link while authenticated.
Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible.
Release Notes
sveltejs/kit (@sveltejs/adapter-vercel)
v6.3.2Compare Source
Patch Changes
fix: 404 for immutable assets that don't match static files (
c67da8a)Updated dependencies [
3e607b3,62991c8,f47c01b]:v6.3.1Compare Source
Patch Changes
feat: show remote function calls under the /_app/remote route in observability (#15098)
fix: prevent isr routes from handling remote function calls (#15098)
Updated dependencies [
46c1ebd,2dd74c8,8871b54]:v6.3.0Compare Source
Minor Changes
RequestContextas deprecated and refer to@vercel/functions(#14725)Patch Changes
e67613c,a5c313e,06de550]:v6.2.0Compare Source
Minor Changes
v6.1.2Compare Source
Patch Changes
chore(deps): upgrade to
@vercel/nftversion 1.0.0 to reduce dependencies (#14950)Updated dependencies [
0889a2a,2ff3951,5b30755]:v6.1.1Compare Source
Patch Changes
chore: improve runtime config parsing (#14838)
Updated dependencies [
cd72d94,53b1b73,2ccc638]:v6.1.0Compare Source
Minor Changes
Patch Changes
102aecf]:v6.0.0Compare Source
Major Changes
Minor Changes
Patch Changes
9c933a2,dedda71]:v5.10.3Compare Source
Patch Changes
v5.10.2Compare Source
Patch Changes
fix: ensure
readworks in an edge function that has deployment protection. Protection bypass automation must be enabled (#14147)Updated dependencies [
c8f7ac3,107f767]:v5.10.1Compare Source
Patch Changes
runtimeconfig (#14253)v5.10.0Compare Source
Minor Changes
fetchexport (#14251)Patch Changes
1d04a77,5db4cd4]:v5.9.1Compare Source
Patch Changes
fix: avoid erroring on builder properties that only exist on the latest version of SvelteKit (#14233)
Updated dependencies [
f2db41c]:v5.9.0Compare Source
Minor Changes
instrumentation.server.tsfor tracing and observability setup (#13899)Patch Changes
f635678,f635678]:v5.8.2Compare Source
Patch Changes
chore: add
.gitto the end ofpackage.jsonrepository url (#14134)Updated dependencies [
c968aef]:v5.8.1Compare Source
Patch Changes
v5.8.0Compare Source
Minor Changes
readimported from$app/serverin edge functions (#13859)Patch Changes
e5ce8bb,cf88369]:v5.7.2Compare Source
Patch Changes
v5.7.1Compare Source
Patch Changes
chore(deps): upgrade esbuild to 0.25.2 (#13716)
fix: include the
edge-lightbundling condition when building edge functions (#13720)Updated dependencies [
c51fb554416e0c4a21655c1d79e834f69743d1d5]:v5.7.0Compare Source
Minor Changes
Patch Changes
7fd7bcb7142e7d0d2dd64174fa1a94d56a45d643]:v5.6.3Compare Source
Patch Changes
b1e9781a6dff41841d8e1509311d948421956746)v5.6.2Compare Source
Patch Changes
fix: change server-side route resolution endpoint (#13461)
Updated dependencies [
9612a60a0277aef0ab4723a0e7ed8dd03a7ffb95,3d88ae33fc14b08a1d48c2cb7315739c8cfcd9fd]:v5.6.1Compare Source
Patch Changes
v5.6.0Compare Source
Minor Changes
Patch Changes
09296d0f19c8d1ff57d699e637bd1beabb69d438,d62ed39a431f0db3db4dd90bf6b17ed2a2a2de79,f30352f874790b9de0bd0eba985a21aef23e158e,180fa3467e195065c0a25206c6328a908e6952d7,5906e9708965b848b468d0014999c36272dc8d50,d62ed39a431f0db3db4dd90bf6b17ed2a2a2de79]:v5.5.3Compare Source
Patch Changes
fix: include ambient type declarations (#12088)
Updated dependencies [
d440c68acac67ed64eea4b9bda267e229303db7b,6774ebc34330b12ae8c0cae08e98b577d819fffb,777c8ef11f17d2ab48aee0f2347c051663da5826,f451f6c4a3dbbc73dc86667c6ff89ab2f46ca9d2,34a03ff16af29e917abebb649b31eadfc40a98a0,1c77e283896058084c1cb5752d9ec207987a585e,04958cca5905aaeeff367c9e4a5ce6e90fc64779,9dc5c0e3e01a3c07010e9996688169be68e1dde8,00e1a7621de554054d068e4525a9e505d1c2e588,9fcd1e7574197fa6e7ac000a030378d877cb8837,e541a4057a00f5ab6740fb51b7f88f17776da50a,37f72fbb075b481de8263f62c77125333735f382,b60707ca8e755be95c86490122aa1b792b9bd6be,699f4405c752261cf46c1ad32e4dbadceaffc75b,e2a4538c48295cde06f64fb8c7f0b333fbf95496,a91ba1f326b6e244503de9a010771d942b461dad]:v5.5.2Compare Source
Patch Changes
chore: upgrade
@vercel/nftto 0.27.9 (#13129)Updated dependencies [
9fc5ff3339e543b956f7ce5eb31267fa73ee332a,85b57168189fa16fe966434ec50cc19425cab275]:v5.5.1Compare Source
Patch Changes
chore: upgrade @vercel/nft to 0.27.7 (#13082)
Updated dependencies [
78404dfe1eb346723eefc183278b85f25485b419]:v5.5.0Compare Source
Minor Changes
Patch Changes
d030f4bb285e70844d09b3f0c87809bae43014b8,67dd214863cbc5852eb0e8512efbb7bad5358e8a]:v5.4.8Compare Source
Patch Changes
chore: support building with Node 22 (#13043)
Updated dependencies [
570562b74d9e9f295d9b617478088a650f51e96b,1358cccd52190df3c74bdd8970dbfb06ffc4ec72]:Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.