chore(deps): update dependency @sveltejs/kit to v2.69.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@sveltejs/kit (source)	2.49.1 → 2.69.1

---

@​sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)

CVE-2026-22803 / GHSA-j2f3-wq62-6q46

More information

Details

Summary

The experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion.

Details

When a form is submitted to a remote function endpoint, the SvelteKit client encodes the data using a custom format, and POSTs it to the endpoint as a request with an application/x-sveltekit-formdata content type.

The first few bytes of the request body encode the length of the data. SvelteKit will attempt to read the request body up until the specified offset, but if the body is not yet available then an array buffer of that size will be created eagerly to accommodate it as it arrives.

An attacker can force this code path by sending a small payload that specifies a large data length, then stalling the connection. The resulting array buffer will be held in memory, potentially causing memory exhaustion.

Impact

• Vulnerability type: Availability / memory exhaustion (memory amplification).
• Who is impacted: SvelteKit apps with experimental.remoteFunctions enabled, and that expose a reachable Remote Form endpoint.
• Attack: an unauthenticated attacker can repeatedly open connections, send only the 8-byte header/prefix (with large data_length), and stall the body to hold large allocations, exhausting memory.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/sveltejs/kit/security/advisories/GHSA-j2f3-wq62-6q46
• https://github.com/sveltejs/kit/commit/8ed8155215b9a74012fecffb942ad9a793b274e5
• https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.49.5
• https://nvd.nist.gov/vuln/detail/CVE-2026-22803
• https://github.com/sveltejs/kit/releases/tag/@​sveltejs%2Fadapter-node@5.5.1
• https://github.com/advisories/GHSA-j2f3-wq62-6q46

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering

CVE-2025-67647 / GHSA-j62c-4x62-9r35

More information

Details

Summary

Versions of SvelteKit are vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions.

Details

Affected versions from 2.44.0 onwards are vulnerable to DoS if:

• your app has at least one prerendered route (export const prerender = true)

Affected versions from 2.19.0 onwards are vulnerable to DoS and SSRF if:

• your app has at least one prerendered route (export const prerender = true)
• AND you are using adapter-node without a configured ORIGIN environment variable, and you are not using a reverse proxy that implements Host header validation

Impact

The DoS causes the running server process to end.

The SSRF allows access to internal services that can be reached without authentication when fetched from SvelteKit's server runtime.

It is also possible to obtain an SXSS via cache poisoning, by forcing a potential CDN to cache an XSS returned by the attacker's server (the latter being able to specify the cache-control of their choice).

Credits

• Allam Rachid (zhero;)
• Allam Yasser (inzo)
• d-xuan (wednesday)

Severity

• CVSS Score: 8.4 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:N

References

• https://github.com/sveltejs/kit/security/advisories/GHSA-j62c-4x62-9r35
• https://github.com/sveltejs/kit/commit/d9ae9b00b14f5574d109f3fd548f960594346226
• https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fadapter-node%405.5.1
• https://github.com/sveltejs/kit/releases/tag/%40sveltejs%2Fkit%402.49.5
• https://nvd.nist.gov/vuln/detail/CVE-2025-67647
• https://github.com/advisories/GHSA-j62c-4x62-9r35

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

CPU exhaustion in SvelteKit remote form deserialization (experimental only)

GHSA-88qp-p4qg-rqm6

More information

Details

Versions of @sveltejs/kit prior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the server to become unresponsive while processing a request, resulting in denial of service.

Only applications using both experimental.remoteFunctions and form are vulnerable.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/sveltejs/kit/security/advisories/GHSA-88qp-p4qg-rqm6
• https://github.com/sveltejs/kit/commit/3e607b314aec9e5f278d32847945b8b6323e1cb8
• https://github.com/sveltejs/kit/releases/tag/@​sveltejs/kit@2.52.2
• https://github.com/advisories/GHSA-88qp-p4qg-rqm6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

@​sveltejs/kit: query.batch cross-talk

GHSA-hgv7-v322-mmgr

More information

Details

query.batch() could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/sveltejs/kit/security/advisories/GHSA-hgv7-v322-mmgr
• https://github.com/sveltejs/kit/commit/dadaefc2e647a0a62f49f3ee8bc7aa46f5e27056
• https://github.com/advisories/GHSA-hgv7-v322-mmgr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

SvelteKit: Prototype pollution in file input deletion path in remote-function forms

GHSA-866w-xmhq-wj7x

More information

Details

If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype.

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

References

• https://github.com/sveltejs/kit/security/advisories/GHSA-866w-xmhq-wj7x
• https://github.com/sveltejs/kit/pull/16218
• https://github.com/sveltejs/kit/commit/df32f6fe86cdd0b68b650e3e4631e5896453dcd3
• https://github.com/sveltejs/kit/releases/tag/@​sveltejs/kit@2.69.1
• https://github.com/sveltejs/kit/releases/tag/@​sveltejs/kit@3.0.0-next.7
• https://github.com/advisories/GHSA-866w-xmhq-wj7x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

sveltejs/kit (@​sveltejs/kit)

v2.69.1

Compare Source

Patch Changes

• fix: prevent prototype pollution when deleting file inputs (#​16218)

• fix: prevent unhandled promise rejection (#​16219)

v2.69.0

Compare Source

Minor Changes

• feat: expose submitted property of remote forms (#​14811)

Patch Changes

• fix: clear issues and touched states on form reset (#​16163)

• fix: return undefined from fields.branch.issues() when only fields.branch.leaf has issues (#​16187)

v2.68.0

Compare Source

Minor Changes

• feat: expose RemoteFormEnhanceInstance and RemoteFormEnhanceCallback types (#​15816)

• feat: set value of submit fields when form is submitted (#​15979)

Patch Changes

• fix: skip native_navigation when __data.json returns 404 on a static fallback page (#​16135)

• fix: ignore third-party monkeypatches in pushState/replaceState warning detection (#​15267)

• fix: snapshot form fields on read (#​16150)

• fix: strip field prefix before erroring on duplicates (#​16151)

• fix: call reset function via prototype (#​16138)

• chore: fix navigation type hover info (#​16147)

v2.67.0

Compare Source

Minor Changes

• feat: add prerender.handleInvalidUrl option for invalid URLs discovered while crawling (#​16088)

Patch Changes

• fix: support exactOptionalPropertyTypes for optional form schema fields (#​15866)

• fix: avoid unnecessarily overriding a user's Vite 8 codeSplitting setting (#​16118)

v2.66.0

Compare Source

Minor Changes

• feat: precompress prerendered .md and .mdx files (#​15893)

• feat: warn the user when they forget to make boolean inputs optional in their form schemas (#​15804)

Patch Changes

• fix: blur active element before component update during navigation so that blur/focusout handlers fire while old component data is still valid (#​15452)

• fix: ensure base is available from $service-worker during development (#​15882)

• fix: use correct relative asset paths when rendering an error page for a missing __data.json request (#​15884)

• fix: preserve active for await consumers across query.live reconnects (#​16022)

• fix: settle query.live reconnect promise on all exit paths, preventing invalidateAll() from deadlocking when a live query is offline or interrupted (#​16022)

• fix: preserve last value when a query.live stream completes without yielding on reconnect (#​16022)

• fix: remove types: ['node'] from generated tsconfig to avoid errors when @types/node is not installed (#​15709)

• fix: prefer pages over endpoints when prerendering (#​16076)

• fix: restore snapshots after afterNavigate callbacks (#​16066)

• fix: support ws:/wss: and trusted-types-eval for CSP sources (#​15938)

• fix: omit empty file inputs from remote form data (#​15898)

• fix: fail early if a route with +page and +server is marked as prerenderable (#​16075)

• fix: wait a tick before resetting forms (#​15805)

• fix: preflight schemas apply correctly when chained before for (#​15863)

• fix: blank page in SPA mode when root layout load() throws (#​15798)

• fix: pass all unknown options from the sveltekit Vite plugin through to vite-plugin-svelte (#​16010)

v2.65.2

Compare Source

Patch Changes

• fix: throw an error when prerendering a root +server.js that returns a non-HTML response (#​15994)

• fix: decode base64-serialized fetch bodies before caching them for client-side replay (#​16034)

• fix: correctly access explicit dynamic public environment variables from prerendered pages and service workers (#​16024)

• fix: allow preloadCode to be called during initial page load (#​16028)

• fix: send cache-control: private, no-store on remote function responses so personalized query results can never be cached by shared caches (#​16020)

• fix: preserve the HTTP status and error body when a remote function request fails in transport (e.g. a 401/403 from a handle hook), instead of reporting a generic 500 (#​16021)

• fix: avoid loading universal nodes during build analysis when the app uses a hash router (#​16042)

• fix: correctly serve client entry during development when using the pnpm global virtual store (#​16045)

• fix: normalize path separators when comparing config (#​16037)

• fix: ensure building resolves correctly to allow avoiding build-time explicit environment variable validation (#​16058)

• fix: prevent unhandled promise rejections when remote function failures are consumed via current/error instead of await (#​16018)

v2.65.1

Compare Source

Patch Changes

• fix: avoid importing the Vite development client code into builds with a non-standard NODE_ENV (#​16023)

• fix: don't emit the unused bundle and stylesheet files when using bundleStrategy: 'inline' (#​16025)

• fix: reset queries before navigating when invalidateAll is set (#​16014)

• fix: regression in loading assets for absolute path apps (#​16026)

v2.65.0

Compare Source

Minor Changes

• feat: allow queries to refresh other queries (#​16012)

Patch Changes

• fix: dedupe remote data (#​15991)

• fix: skip client build if all routes have CSR disabled (#​15936)

v2.64.0

Compare Source

Minor Changes

• feat: allow commands to receive File objects (#​15978)

Patch Changes

• fix: avoid server components from being bundled if SSR is turned off for a route (#​15982)

v2.63.1

Compare Source

Patch Changes

• fix: use SSE for query.live (#​15957)

• fix: use forward slashes in the generated env.d.ts import path on Windows (#​15977)

• fix: allow $app/environment with a warning when explicitEnvironmentVariables is enabled (#​15980)

• fix: avoid importing Vite while validating explicit environment variables (#​15953)

• docs: adjust the release version of explicit env vars (#​15968)

• fix: ensure version is defined when importing from $app/env with explicit environment variables (#​15971)

v2.63.0

Compare Source

Minor Changes

• feat: explicit env vars (#​15934)

Patch Changes

• fix: remove check for svelte.config.js before running sync (#​15946)

• fix: generate a placeholder tsconfig.json to squelch sync-time warnings (#​15948)

• fix: allow use of $app/env/public in service workers (#​15950)

v2.62.0

Compare Source

Minor Changes

• feat: support passing Svelte(Kit) config via Vite plugin (#​15944)

Patch Changes

• fix: preserve multiple Set-Cookie headers on 304 responses (#​15902)

• fix: preload for anchor elements that were just previously preloaded (#​15915)

• fix: catch load function streaming errors on the client (#​15929)

• fix: avoid generating the _app/env.js module if public dynamic environment variables are not used by the app (#​15940)

v2.61.1

Compare Source

Patch Changes

• fix: regression where routes starting and ending with a route group are not matched correctly (#​15903)

v2.61.0

Compare Source

Minor Changes

• breaking: the .run() method has been removed from remote queries on both the client and the server. Use await query() directly instead — it now works everywhere (#​15779)

• feat: remote queries can now be awaited in any context (event handlers, module scope, async callbacks), not just inside reactive contexts. The cache is shared across reactive and non-reactive subscribers, so awaiting a query in an event handler will dedupe with components that have already subscribed to the same query. (#​15779)

• feat: live query instances are now themselves async-iterable (#​15878)

• feat: add programmatic submit method to form remote function instances (#​15657)

• feat: pass form remote function instance into enhance callback (#​15657)

Patch Changes

• fix: resolve the app payload without using process.env.NODE_ENV (#​15852)

• fix: support exactOptionalPropertyTypes for optional route params (#​15825)

• fix: correctly send true value to the server for 'submit' and 'hidden' form fields (#​15858)

• fix: avoid build warnings about undefined universal hooks (#​15895)

• fix: prefer default error page when failing to decode the URL pathname (#​15744)

• fix: disable link prefetching on slow internet connections (#​15885)

• fix: allow routes ending with optional parameters next to more specific routes (#​15861)

• fix: remove reliance on Content-Length header in deserialize_binary_form, which caused failures when proxies (e.g. Vercel, Azure) strip the header and use chunked transfer encoding (#​15796)

v2.60.1

Compare Source

Patch Changes

• chore: bump svelte and devalue (#​15836)

• fix: prevent query.batch cross-talk (dadaefc)

v2.60.0

Compare Source

Minor Changes

• feat: allow 'submit' and 'hidden' form fields to accept numbers and booleans (#​15802)

• feat: warn on unread form remote function validation issues (#​15653)

Patch Changes

• fix: abort navigation after async rendering if obsolete (#​15811)

• fix: skip refreshing queries on full-page reload form submissions (#​15803)

v2.59.1

Compare Source

Patch Changes

• fix: resolve paths to route files with the letter drive on Windows (#​15793)

v2.59.0

Compare Source

Minor Changes

• feat: support query.batch in requested(...) (#​15751)

• breaking: on the server, make the promise returned from refresh represent adding the refresh to the map, not the time it takes to run the remote function (#​15705)

• feat: experimental query.live function (#​15705)

Patch Changes

• fix: unwrap Promise in RemoteCommand output type (#​15771)

• fix: empty call to .updates() on a command/form invocation means "don't update anything" (#​15705)

• fix: form.fields.foo.as('checkbox', default_value) now works (#​15752)

• fix: remote forms with default values defined by field.as('text', defaultValue) now correctly reset to the provided default values once submitted (#​15753)

• fix: make sure queries always get started correctly (#​15705)

• fix: allow plain functions as overrides in updates (#​15705)

v2.58.0

Compare Source

Minor Changes

• breaking: require limit in requested (as originally intended) (#​15739)

• feat: RemoteQueryFunction gains an optional third generic parameter Validated (defaulting to Input) that represents the argument type after schema validation/transformation (#​15739)

• breaking: requested now yields { arg, query } entries instead of the validated argument (#​15739)

Patch Changes

• fix: allow query().current, .error, .loading, and .ready to work in non-reactive contexts (#​15699)

• fix: prevent deep_set crash on nullish nested values (#​15600)

• fix: restore correct RemoteFormFields typing for nullable array fields (e.g. when a schema uses .default([])), so .as('checkbox') and friends work again (#​15723)

• fix: don't warn about removed SSI comments in transformPageChunk (#​15695)

  Server-side include (SSI) directives like <!--#include virtual="..." --> are HTML comments that are replaced by servers such as nginx. Previously, removing them in transformPageChunk would trigger a false positive warning about breaking Svelte's hydration. Since SSI comments always start with <!--# and Svelte's hydration comments never do, they can be safely excluded from the check.

• Change enhance function return type from void to MaybePromise. (#​15710)

• fix: throw an error when resolve is called with an external URL (#​15733)

• fix: avoid FOUC for CSR-only pages by loading styles and fonts before CSR starts (#​15718)

• fix: reset form result on redirect (#​15724)

v2.57.1

Compare Source

Patch Changes

• fix: better validation for redirect inputs (10d7b44)

• fix: enforce BODY_SIZE_LIMIT on chunked requests (3202ed6)

• fix: use default values as fallbacks (#​15680)

• fix: relax form typings for union types (#​15687)

v2.57.0

Compare Source

Minor Changes

• feat: return boolean from submit to indicate submission validity for enhanced form remote functions (#​15530)

Patch Changes

• fix: use array type for select fields that accept multiple values (#​15591)

• fix: silently 404 Chrome DevTools workspaces request in dev and preview (#​15656)

• fix: config.kit.csp.directives['trusted-types'] requires 'svelte-trusted-html' (and 'sveltekit-trusted-url' when a service worker is automatically registered) if it is configured (#​15323)

• fix: avoid inlineDynamicImports ignored with codeSplitting warning when using Vite 8 (#​15647)

• fix: reimplement treeshaking non-dynamic prerendered remote functions (#​15447)

v2.56.1

Compare Source

Patch Changes

• chore: update JSDoc (#​15640)

v2.56.0

Compare Source

Minor Changes

• breaking: rework client-driven refreshes (#​15562)

• breaking: stabilize remote function caching by sorting object keys (#​15570)

• breaking: add run() method to queries, disallow awaiting queries outside render (#​15533)

• feat: support TypeScript 6.0 (#​15595)

• breaking: isolate command-triggered query refresh failures per-query (#​15562)

• feat: use hydratable for remote function transport (#​15533)

• feat: allow form fields to specify a default value (field.as(type, value)) (#​15577)

Patch Changes

• fix: don't request new data when .refresh is called on a query with no cache entry (#​15533)

• fix: allow using multiple remote functions within one async derived (#​15561)

• fix: avoid false-positive overridden Vite base setting warning when setting a paths.base in svelte.config.js (#​15623)

• fix: manage queries in their own $effect.root (#​15533)

• fix: avoid inlineDynamicImports deprecation warning when building the service worker with Vite 8 (#​15550)

• fix: correctly escape backticks when precomputing CSS (#​15593)

• fix: discard obsolete forks before finishing navigation (#​15634)

• chore: tighten up override implementation (#​15562)

• fix: ensure the default Svelte 5 error.svelte file uses runes mode (#​15609)

• fix: deduplicate same-cache-key batch calls during SSR (#​15533)

• fix: decrement pending_count when form callback doesn't call submit() (#​15520)

v2.55.0

Compare Source

Minor Changes

• feat: page and layout params with matchers are now type narrowed in $app/types, leading to better type safety when working with params in $app/types, $app/state, and hooks. (#​15502)

v2.54.0

Compare Source

Minor Changes

• feat: allow error boundaries to catch errors on the server (#​15308)

Patch Changes

• chore: upgrade devalue (#​15535)

• fix: don't wait for remote functions that are not awaited in the template (#​15280)

• feat: allow resolve() to accept pathnames with a search string and/or hash (#​15458)

• chore: remove deprecation warnings for config.kit.files.* options when validating the Svelte config file (#​15482)

• fix: handles form target attribute in remote form redirects (#​15457)

v2.53.4

Compare Source

Patch Changes

• fix: avoid Vite warning about unknown codeSplitting option (#​15451)

v2.53.3

Compare Source

Patch Changes

• fix: prevent overlapping file metadata in remote functions form (faba869)

v2.53.2

Compare Source

Patch Changes

• fix: server-render nested form value sets (#​15378)

• fix: use deep partial types for form remote functions .value() and .set(...) (#​14837)

• fix: provide correct url info to remote functions (#​15418)

• fix: allow optional types for remote query/command/prerender functions (#​15293)

• fix: allow commands in more places (#​15288)

v2.53.1

Compare Source

Patch Changes

• fix: address warning about inlineDynamicImports when using Vite 8 (#​15403)

v2.53.0

Compare Source

Minor Changes

• feat: support Vite 8 (#​15024)

Patch Changes

• fix: remove event listeners on form attachment cleanup (#​15286)

• fix: apply queries refreshed in a form remote function when a redirect is thrown (#​15362)

v2.52.2

Compare Source

Patch Changes

• fix: validate form file information to prevent amplification attacks (3e607b3)

• chore: upgrade devalue and svelte (#​15339)

• fix: parse file offset table more strictly (f47c01b)

v2.52.0

Compare Source

Minor Changes

• feat: match function to map a path back to a route id and params (#​14997)

Patch Changes

• fix: respect scroll-margin when navigating to a url-supplied anchor (#​15246)

• fix: resolve will narrow types to follow trailing slash page settings (#​15027)

v2.51.0

Compare Source

Minor Changes

• feat: add scroll property to NavigationTarget in navigation callbacks (#​15248)

  Navigation callbacks (beforeNavigate, onNavigate, and afterNavigate) now include scroll position information via the scroll property on from and to targets:

  • from.scroll: The scroll position at the moment navigation was triggered
  • to.scroll: In beforeNavigate and onNavigate, this is populated for popstate navigations (back/forward) with the scroll position that will be restored, and null for other navigation types. In afterNavigate, this is always the final scroll position after navigation completed.

  This enables use cases like animating transitions based on the target scroll position when using browser back/forward navigation.

• feat: hydratable's injected script now works with CSP (#​15048)

Patch Changes

• fix: put preloads before styles (#​15232)

• fix: suppress false-positive inner content warning when children prop is forwarded to a child component (#​15269)

• fix: fetch not working when URL is same host but different than paths.base (#​15291)

• fix: navigate to hash link when base element is present (#​15236)

• fix: avoid triggering handleError when redirecting in a remote function (#​15222)

• fix: include test directory in generated tsconfig.json alongside existing tests entry (#​15254)

• fix: generate tsconfig.json using the value of kit.files.src (#​15253)

v2.50.2

Compare Source

Patch Changes

• fix: ensure inlined CSS follows paths.assets and paths.relative settings (#​15153)

• fix: emit script CSP nonces when unsafe-inline is present if strict-dynamic is also present (#​15221)

• fix: re-export browser/dev from esm-env (#​15206)

• fix: use validated args in batch resolver in both csr and ssr (#​15215)

• fix: ensure CSS inlining includes components that are conditionally rendered (#​15153)

• fix: only match rest params with matchers when the matcher matches (#​15216)

• fix: properly handle percent-encoded anchors (e.g. <a href="#sparkles-%E2%9C%A8">) during prerendering. (#​15231)

v2.50.1

Compare Source

Patch Changes

• fix: include hooks.server and hooks.universal as explicit Vite build inputs to ensure assets imported by hooks files are correctly discovered (#​15178)

• fix: improves fields type for generic components (#​14974)

• fix: preload links if href changes (#​15191)

v2.50.0

Compare Source

Minor Changes

• breaking: remove buttonProps from experimental remote form functions; use e.g. <button {...myForm.fields.action.as('submit', 'register')}>Register</button> button instead (#​15144)

v2.49.5

Compare Source

Patch Changes

• fix: avoid overriding Vite default base when running Vitest 4 (#​14866)

• fix: ensure url decoded pathnames are not mistaken as rerouted requests (d9ae9b0)

• fix: add length checks to remote forms (8ed8155)

v2.49.4

Compare Source

Patch Changes

• fix: support instrumentation for vite preview (#​15105)

• fix: support for URLSearchParams.has(name, value) overload (#​15076)

• fix: put forking behind experimental.forkPreloads (#​15135)

v2.49.3

Compare Source

Patch Changes

• fix: avoid false-positive Vite config overridden warning when using Vitest 4 (#​15121)

• fix: add typescript as an optional peer dependency (#​15074)

• fix: use hasOwn check when deep-setting object properties (#​15127)

v2.49.2

Compare Source

Patch Changes

• fix: Stop re-loading already-loaded CSS during server-side route resolution (#​15014)

• fix: posixify the instrumentation file import on Windows (#​14993)

• fix: Correctly handle shared memory when decoding binary form data (#​15028)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.