Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] - autoclosed #948

Closed
wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Apr 17, 2023

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@sveltejs/kit (source) ^1.0.1 -> ^1.15.2 age adoption passing confidence
@sveltejs/kit (source) 1.0.1 -> 1.15.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-29003

Summary

The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods.

SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to it’s users. The protection is implemented at kit/src/runtime/server/respond.js#L52. While the implementation does a sufficient job in mitigating common CSRF attacks, the protection can be bypassed by simply specifying a different Content-Type header value.

Details

The CSRF protection is implemented using the code shown below.

const forbidden =
  // (1)
  request.method === 'POST' &&
  // (2)
  request.headers.get('origin') !== url.origin &&
  // (3)
  is_form_content_type(request);

if (forbidden) {
  // (4)
  const csrf_error = error(403, `Cross-site ${request.method} form submissions are forbidden`);
  if (request.headers.get('accept') === 'application/json') {
    return json(csrf_error.body, { status: csrf_error.status });
  }
  return text(csrf_error.body.message, { status: csrf_error.status });
}

If the incoming request specifies a POST method (1), the protection will compare the server’s origin with the value of the HTTP Origin header (2). A mismatch between these values signals that a potential attack has been detected. The final check is performed on the request’s Content-Type header (3) whether the value is either application/x-www-form-urlencoded or multipart/form-data (kit/src/utils/http.js#L71). If all the previous checks pass, the request will be rejected with an 403 error response (4).

The is_form_content_type validation is not sufficient to mitigate all possible variations of this type of attack. If a CSRF attack is performed with the Content-Type header set to text/plain, the protection will be circumvented and the request will be processed by the endpoint handler.

Impact

If abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users’ accounts.

Remediation

SvelteKit 1.15.1 updates the is_form_content_type function call in the CSRF protection logic to include text/plain.

As additional hardening of the CSRF protection mechanism against potential method overrides, SvelteKit 1.15.1 is now performing validation on PUT, PATCH and DELETE methods as well. This latter hardening is only needed to protect users who have put in some sort of ?_method= override feature themselves in their handle hook, so that the request that resolve sees could be PUT/PATCH/DELETE when the browser issues a POST request.

CVE-2023-29008

Summary

The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods.

SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. The protection is implemented at kit/src/runtime/server/respond.js. While the implementation does a sufficient job of mitigating common CSRF attacks, the protection can be bypassed by simply specifying an upper-cased Content-Type header value. The browser will not send uppercase characters on form submission, but this check does not block all expected cross-site requests: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests

Details

The CSRF protection is implemented using the code shown below.

		const forbidden =
			is_form_content_type(request) &&
			(request.method === 'POST' ||
				request.method === 'PUT' ||
				request.method === 'PATCH' ||
				request.method === 'DELETE') &&
			request.headers.get('origin') !== url.origin;

		if (forbidden) {
			const csrf_error = error(403, `Cross-site ${request.method} form submissions are forbidden`);
			if (request.headers.get('accept') === 'application/json') {
				return json(csrf_error.body, { status: csrf_error.status });
			}
			return text(csrf_error.body.message, { status: csrf_error.status });
		}

If the incoming request specifies a POST/PUT/PATCH/DELETE method, the protection will compare the server’s origin with the value of the HTTP Origin header. A mismatch between these values signals that a potential attack has been detected. The final check is performed on the request’s Content-Type header whether the value is either application/x-www-form-urlencoded, multipart/form-data or text/plain. If all the previous checks pass, the request will be rejected with an 403 error response.
However, is_form_content_type, which is responsible for checking the value of the Content-Type header, is not sufficient to mitigate all possible variations of this type of attack. Since this function is checking Content-Type with lower-cased values, and the browser accepts upper-cased Content-Type header to be sent, a CSRF attack performed with the Content-Type header that contains an upper-cased character (e.g., text/plaiN) can circumvent the protection and the request will be processed by the endpoint handler.

Impact

If abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users’ accounts. This may lead to all POST operations requiring authentication being allowed in the following cases:

  1. If the target site sets SameSite=None on its auth cookie and the user visits a malicious site in a Chromium-based browser
  2. If the target site doesn't set the SameSite attribute explicitly and the user visits a malicious site with Firefox/Safari with tracking protections turned off.
  3. If the user is visiting a malicious site with a very outdated browser.

Remediations

It is preferred to update to SvelteKit 1.15.2. It is also recommended to explicitly set SameSite to a value other than None on authentication cookies especially if the upgrade cannot be done in a timely manner.


Release Notes

sveltejs/kit (@​sveltejs/kit)

v1.15.2

Compare Source

Patch Changes
  • fix: address security advisory CVE-2023-29008 by doing a case-insensitive comparison when checking header value (ba436c66)

v1.15.1

Compare Source

Patch Changes
  • chore: more compact representation for invalidated search param (#​9708)

  • chore: fix import path to app script on windows (#​9743)

  • fix: make $app/navigation more resilient to bundler reordering (#​9808)

  • fix: page load fetch() now accepts the same input types for the body as the native fetch function (#​9801)

  • fix: handle preload and filterSerializedResponseHeaders in sequence function (#​9741)

v1.15.0

Compare Source

Minor Changes
  • feat: expose stronger typed SubmitFunction through ./$types (#​9201)
Patch Changes
  • fix: throw error when file can't be found in Vite manifest (#​9558)

  • fix: make error.message enumerable when sending ssrLoadModule error to client (#​9440)

  • fix: pass publicDir Vite config in SSR (#​9565)

  • fix: balance parentheses in error about wrong content type for action (#​9513)

v1.14.0

Compare Source

Minor Changes
  • feat: add HMR to fallback error pages during dev (#​9497)
Patch Changes
  • fix: add submitter type to SumbitFunction (#​9484)

v1.13.0

Compare Source

Minor Changes
  • feat: add dark mode styles to default error page (#​9460)
Patch Changes
  • fix: recover from errors during dev by reloading (#​9441)

v1.12.0

Compare Source

Minor Changes
  • feat: expose submitter in use:enhance SubmitFunction (#​9425)

  • feat: add data-sveltekit-keepfocus and data-sveltekit-replacestate options to links (requires Svelte version 3.56 for type-checking with svelte-check) (#​9019)

Patch Changes
  • fix: don't start debugger on 404s (#​9424)

  • fix: handle srcset attributes with newline after comma (#​9388)

  • fix: allow tsconfig to extend multiple other tsconfigs (#​9413)

  • chore: update Undici to 5.21.0 (#​9417)

v1.11.0

Compare Source

Minor Changes
  • feat: pause on debugger when falling back to full page reload during development (#​9305)

  • feat: expose base via $service-worker, make paths relative (#​9250)

Patch Changes
  • fix: don't automatically prerender non-SSR'd pages (#​9352)

  • fix: use 308 responses for trailing slash redirects, instead of 301s (#​9351)

  • fix: remove buggy cookie path detection (#​9298)

  • fix: don't prevent beforeNavigate callbacks from running following a cancelled unloading navigation (#​9347)

  • fix: persist DOM state on beforeunload (#​9345)

  • fix: redirect to path with/without trailing slash when previewing prerendered pages (#​9353)

  • fix: avoid FOUC when using CSS modules in dev (#​9323)

  • fix: don't skip required parameters after missing optional parameters (#​9331)

  • fix: account for server-emitted assets when prerenering (#​9349)

  • fix: deal with fast consecutive promise resolutions when streaming (#​9332)

  • chore: replace deprecated property access in preparation for TS 5.0 (#​9361)

v1.10.0

Compare Source

Minor Changes
Patch Changes
  • fix: always include <link rel="stylesheet">, even for stylesheets excluded from Link headers (#​9255)

  • fix: preserve form state when submitting a second time (#​9267)

v1.9.3

Compare Source

Patch Changes
  • fix: successive optional route parameters can now be empty (#​9266)

v1.9.2

Compare Source

Patch Changes
  • fix: correct undefined reference to global var with Vitest (#​9252)

v1.9.1

Compare Source

Patch Changes
  • feat: warn when calling depends(...) with special URI scheme (#​9246)

v1.9.0

Compare Source

Minor Changes
  • feat: add paths.relative option to control interpretation of paths.assets and paths.base (#​9220)

v1.8.8

Compare Source

Patch Changes
  • fix: always add @sveltejs/kit to noExternal for ssr build (#​9242)
  • feat: add api.methods and page.methods to builder.routes (#​9145)

v1.8.7

Compare Source

Patch Changes
  • fix: correct not found message when setting paths.base (#​9232)

v1.8.6

Compare Source

Patch Changes
  • fix: bundle SvelteKit when using Vitest (#​9172)

v1.8.5

Compare Source

Patch Changes
  • fix: allow relative fetch to endpoint outside app from within handle (#​9198)

v1.8.4

Compare Source

Patch Changes
  • fix: include .mjs files in precompression (#​9179)

  • fix: revert mjs extension usage by default, make it an option (#​9179)

  • chore: dummy changeset to force a release (#​9207)

v1.8.3

Compare Source

Patch Changes
  • fix: use a proprietary content-type to ensure response is not buffered (#​9142)

v1.8.2

Compare Source

Patch Changes
  • fix: append newline to trigger script evaluation (#​9139)

v1.8.1

Compare Source

Patch Changes
  • fix: encode streamed chunks (#​9136)

v1.8.0

Compare Source

Minor Changes
  • feat: implement streaming promises for server load functions (#​8901)
Patch Changes
  • fix: set public env before starting app (#​8957)

  • fix: preload modules on Safari (#​8957)

  • fix: make assets work in client when app is served from a subfolder (#​8957)

v1.7.2

Compare Source

Patch Changes
  • fix: return correct asset list from builder.writeClient() (#​9095)

v1.7.1

Compare Source

Patch Changes
  • fix: deploy server assets. Only works with Vite 4.1+ (#​9073)

v1.7.0

Minor Changes
  • feat: richer error message for invalid exports (#​9055)
Patch Changes
  • chore: throw more helpful error when encoding uri fails during prerendering (#​9053)

v1.6.0

Minor Changes
  • feat: add OPTIONS server method (#​8731)
Patch Changes
  • fix: solve missing "./paths" specifier in "@&#8203;sveltejs/kit" package error occurring in all projects (#​9050)

v1.5.7

Patch Changes
  • fix: use internal alias that won't collide with user aliases (#​9022)

v1.5.6

Patch Changes
  • fix: ssr defaults preventing minification for client build (#​9012)

  • fix: client-side trailing slash redirect when preloading data (#​8982)

v1.5.5

Compare Source

Patch Changes
  • fix: warn after failed data preloads in dev (#​8985)

v1.5.3

Compare Source

Patch Changes
  • docs: clarify that version.name should be deterministic (#​8956)

  • fix: correctly include exported http methods in allow header (#​8968)

  • chore: polyfill File from node:buffer (#​8925)

  • fix: provide helpful error/warning when calling fetch during render (#​8551)

  • fix: print useful error when subscribing to SvelteKit's stores at the wrong time during SSR (#​8960)

  • fix: ignore external links when automatically preloading (#​8961)

  • chore: refactor fallback generation (#​8972)

v1.5.2

Compare Source

Patch Changes
  • fix: always default paths.assets to paths.base (#​8928)

v1.5.1

Compare Source

Patch Changes
  • fix: pick up config from endpoints (#​8933)

  • fix: don't reuse previous server load cache when there's no server load function (#​8893)

  • fix: deduplicate paths in tsconfig (#​8880)

  • docs: clarify version management feature (#​8941)

v1.5.0

Compare Source

Minor Changes
  • feat: support route-level configuration (#​8740)

  • feat: add snapshot mechanism for preserving ephemeral DOM state (#​8710)

Patch Changes
  • chore(deps): update dependency undici to v5.18.0 (#​8884)

v1.4.0

Compare Source

Minor Changes
  • feat: allow $app/paths to be used without an app (#​8838)
Patch Changes
  • fix: ensure types of all form actions are accessible even if differing (#​8877)

  • fix: correctly handle HttpErrors on the client side (#​8829)

  • docs: discourage use of goto with external URLs (#​8837)

  • fix: prevent crawling empty urls (<img src="">) (#​8883)

  • fix: correctly serialize request url when using load fetch (#​8876)

  • fix: ensure endpoints can fetch endpoints on the same host but not part of the application (#​8869)

v1.3.10

Compare Source

Patch Changes
  • fix: preserve build error messages (#​8846)

v1.3.9

Compare Source

Patch Changes
  • fix: output errors properly if pages fail to compile (#​8813)

v1.3.8

Compare Source

Patch Changes
  • fix: remove Vite manifest before running adapter (#​8815)

v1.3.7

Compare Source

Patch Changes
  • fix: only show prerendering message when actually prerendering (#​8809)

  • fix: handle anchors with special chars when navigating (#​8806)

  • fix: await finalise hook and run it only once (#​8817)

v1.3.6

Compare Source

Patch Changes
  • fix: allow rest parameters to follow multiple optional - or not - parameters (#​8761)

  • fix: consider headers when constructing request hash (#​8754)

v1.3.5

Compare Source

Patch Changes
  • docs: fix typo (#​8790)

  • fix: build error on layout with missing leaves (#​8792)

  • fix: handle hash links with non-ASCII characters when navigating (#​8767)

v1.3.4

Compare Source

Patch Changes

v1.3.3

Compare Source

Patch Changes
  • fix: forward process.env to child process (#​8777)

v1.3.2

Compare Source

Patch Changes
  • fix: take base path into account when preloading code (#​8748)

v1.3.1

Compare Source

Patch Changes
  • fix: preserve build error messages (#​8846)

v1.3.0

Compare Source

Minor Changes
  • feat: allow generated tsconfig to be modified (#​8606)
Patch Changes
  • fix: skip navigation hooks on popstate events when only hash changed (#​8730)

v1.2.10

Compare Source

Patch Changes
  • chore: restrict methods allowed for POST (#​8721)

  • fix: provide proper error when POSTing to a missing page endpoint (#​8714)

v1.2.9

Compare Source

Patch Changes
  • fix: reapply exports alignment after Vite dependency optimizations (#​8690)

v1.2.8

Compare Source

Patch Changes
  • fix: include base path in path to start script (#​8651)

v1.2.7

Compare Source

Patch Changes
  • fix: set headers when throwing redirect in handle (#​8648)

v1.2.6

Compare Source

Patch Changes
  • fix: allow importing assets while using base path (#​8683)

v1.2.5

Compare Source

Patch Changes
  • fix: check for wrong return values from form actions (#​8553)

v1.2.4

Compare Source

Patch Changes
  • chore: update undici to v5.16.0 (#​8668)

v1.2.3

Compare Source

Patch Changes
  • fix: set environment variables before postbuild analysis (#​8647)

v1.2.2

Compare Source

Patch Changes
  • fix: focus management after navigation (#​8466)

v1.2.1

Compare Source

Patch Changes
  • chore: restrict methods allowed for POST (#​8721)

  • fix: provide proper error when POSTing to a missing page endpoint (#​8714)

v1.2.0

Compare Source

Minor Changes
  • feat: add text(...) helper for generating text responses (#​8371)

  • feat: enable access to public env within app.html (#​8449)

  • fix: add Content-Length header to SvelteKit-generated responses (#​8371)

v1.1.4

Compare Source

Patch Changes
  • fix: squelch unknown prop warning for +error.svelte components (#​8593)

v1.1.3

Compare Source

Patch Changes
  • docs: explain how to add ambient typings (#​8558)

  • fix: ignore target="_blank" links (#​8563)

v1.1.2

Compare Source

Patch Changes
  • fix: correct link in types documentation (#​8557)

  • fix: correctly detect changed data (#​8377)

  • fix: only generate type definitions with sync command (#​8552)

  • fix: remove baseUrl to prevent wrong TypeScript auto imports if possible (#​8568)

v1.1.1

Compare Source

Patch Changes

v1.1.0

Compare Source

Minor Changes
  • feat: warn when usage of page options in .svelte files or missing <slot /> in layout is detected (#​8475)
Patch Changes
  • fix: exit postbuild step with code 0 (#​8514)

  • fix: only run missing page check in dev mode (#​8515)

  • fix: avoid input name clobbering form method check (#​8471)

  • fix: exclude service worker from tsconfig (#​8508)

  • fix: provide better error message in case of missing +page.svelte (#​8478)

v1.0.13

Compare Source

Patch Changes
  • chore: separate generated from non-generated server code (#​8429)

v1.0.12

Compare Source

Patch Changes
  • fix: make prerendered endpoint callable from non-prerendered server load (#​8453)

  • docs: add links to http status codes (#​8480)

  • fix: prerender page when prerender set to 'auto' and ssr set to true (#​8481)

  • fix: prevent false positive warnings for fetch uses in firefox (#​8456)

  • fix: check version on node fetch fail (#​8487)

  • fix: avoid unnecessary $page store updates (#​8457)

v1.0.11

Compare Source

Patch Changes
  • feat: warn that hydration may break if comments are removed from HTML (#​8423)
  • fix: ignore <a> elements with no href attribute when refocusing after navigation (#​8418)
  • fix: invalidate dependencies implicitly added by fetch in server load functions (#​8420)

v1.0.10

Compare Source

Patch Changes
  • fix: skip inline cache when vary header is present (#​8406)

v1.0.9

Compare Source

Patch Changes
  • fix: add assetFileNames to worker rollup options (#​8384)

v1.0.8

Compare Source

Patch Changes
  • feat: error in dev mode if global fetch is used with relative URL (#​8370)
  • fix: disable illegal import detection when running unit tests (#​8365)
  • fix: only prerender a given dependency once (#​8376)
  • fix: updated.check() type changed to Promise<boolean> (#​8400)
  • fix: don't strip body in no-cors mode on the server (#​8412)
  • fix: quote 'script' in CSP directives (#​8372)
  • fix: correctly compare route ids for load change detection (#​8399)
  • fix: don't add nonce attribute to <link> elements (#​8369)

v1.0.7

Compare Source

Patch Changes
  • fix: ignore *.test.js and *.spec.js files in params directory (#​8250)

v1.0.6

Compare Source

Patch Changes
  • fix: guarantee that $page.route has the correct shape (#​8359)

v1.0.5

Compare Source

Patch Changes
  • fix: update typings of event.platform to be possibly undefined (#​8232)

v1.0.3

Compare Source

Patch Changes
  • feat: include submitter's value when progressively enhancing <form method="get"> (#​8273)

v1.0.2

Compare Source

Patch Changes
  • fix: correct filterSerializedResponseHeaders error message (#​8348)
  • fix: correct form action redirect status code (#​8210)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel
Copy link

vercel bot commented Apr 17, 2023

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
graphql-ez ❌ Failed (Inspect) Aug 2, 2024 9:46pm

@changeset-bot
Copy link

changeset-bot bot commented Apr 17, 2023

⚠️ No Changeset found

Latest commit: 9e5c176

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from 2ab9d71 to b57f191 Compare April 17, 2023 16:31
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit [security] chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] Apr 17, 2023
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from b57f191 to e57383f Compare April 26, 2023 17:11
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] chore(deps): update dependency @sveltejs/kit [security] Apr 26, 2023
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from e57383f to 118fad0 Compare April 26, 2023 18:33
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from 118fad0 to 1375464 Compare April 27, 2023 00:14
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit [security] chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] Apr 27, 2023
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from 1375464 to 15d851d Compare April 27, 2023 13:45
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] chore(deps): update dependency @sveltejs/kit [security] Apr 27, 2023
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from 15d851d to a57cf46 Compare April 28, 2023 00:57
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit [security] chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] Apr 28, 2023
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from a57cf46 to d9df3c0 Compare May 1, 2023 15:24
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] chore(deps): update dependency @sveltejs/kit [security] May 1, 2023
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from d9df3c0 to ded92ae Compare May 1, 2023 19:15
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit [security] chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] May 1, 2023
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from ded92ae to 18ecd53 Compare May 3, 2023 10:38
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] chore(deps): update dependency @sveltejs/kit [security] May 3, 2023
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from 18ecd53 to dba8b39 Compare May 3, 2023 15:10
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from 170f2f8 to 571bbe8 Compare July 14, 2024 07:44
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] chore(deps): update dependency @sveltejs/kit [security] Jul 14, 2024
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from 571bbe8 to 3977bd4 Compare July 14, 2024 09:38
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit [security] chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] Jul 14, 2024
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from 3977bd4 to 81ab9a2 Compare July 21, 2024 11:31
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] chore(deps): update dependency @sveltejs/kit [security] Jul 21, 2024
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from 81ab9a2 to 1098fc7 Compare July 21, 2024 14:50
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit [security] chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] Jul 21, 2024
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from 1098fc7 to 1474de9 Compare July 28, 2024 14:08
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] chore(deps): update dependency @sveltejs/kit [security] Jul 28, 2024
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from 1474de9 to 57bfed0 Compare July 28, 2024 16:05
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit [security] chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] Jul 28, 2024
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from 57bfed0 to d5b231c Compare August 2, 2024 19:44
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] chore(deps): update dependency @sveltejs/kit [security] Aug 2, 2024
@renovate renovate bot force-pushed the renovate/npm-@sveltejs/kit-vulnerability branch from d5b231c to 9e5c176 Compare August 2, 2024 21:45
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit [security] chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] Aug 2, 2024
@renovate renovate bot changed the title chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] - autoclosed Aug 6, 2024
@renovate renovate bot closed this Aug 6, 2024
auto-merge was automatically disabled August 6, 2024 06:47

Pull request was closed

@renovate renovate bot deleted the renovate/npm-@sveltejs/kit-vulnerability branch August 6, 2024 06:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants