search

CloudNativeEntrepreneur / sveltekit-web3auth

Web3 auth via JWTs for Sveltekit
MIT License
29 stars 3 forks source link

chore(deps): update dependency @sveltejs/kit to v1.15.2 [security] - autoclosed #100

Closed renovate[bot] closed 3 months ago

renovate[bot] commented 1 year ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@sveltejs/kit (source) 1.0.0-next.287 -> 1.15.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-29003

Summary

The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods.

SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to it’s users. The protection is implemented at kit/src/runtime/server/respond.js#L52. While the implementation does a sufficient job in mitigating common CSRF attacks, the protection can be bypassed by simply specifying a different Content-Type header value.

Details

The CSRF protection is implemented using the code shown below.

const forbidden =
  // (1)
  request.method === 'POST' &&
  // (2)
  request.headers.get('origin') !== url.origin &&
  // (3)
  is_form_content_type(request);

if (forbidden) {
  // (4)
  const csrf_error = error(403, `Cross-site ${request.method} form submissions are forbidden`);
  if (request.headers.get('accept') === 'application/json') {
    return json(csrf_error.body, { status: csrf_error.status });
  }
  return text(csrf_error.body.message, { status: csrf_error.status });
}

If the incoming request specifies a POST method (1), the protection will compare the server’s origin with the value of the HTTP Origin header (2). A mismatch between these values signals that a potential attack has been detected. The final check is performed on the request’s Content-Type header (3) whether the value is either application/x-www-form-urlencoded or multipart/form-data (kit/src/utils/http.js#L71). If all the previous checks pass, the request will be rejected with an 403 error response (4).

The is_form_content_type validation is not sufficient to mitigate all possible variations of this type of attack. If a CSRF attack is performed with the Content-Type header set to text/plain, the protection will be circumvented and the request will be processed by the endpoint handler.

Impact

If abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users’ accounts.

Remediation

SvelteKit 1.15.1 updates the is_form_content_type function call in the CSRF protection logic to include text/plain.

As additional hardening of the CSRF protection mechanism against potential method overrides, SvelteKit 1.15.1 is now performing validation on PUT, PATCH and DELETE methods as well. This latter hardening is only needed to protect users who have put in some sort of ?_method= override feature themselves in their handle hook, so that the request that resolve sees could be PUT/PATCH/DELETE when the browser issues a POST request.

CVE-2023-29008

Summary

The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods.

SvelteKit provides out-of-the-box cross-site request forgery (CSRF) protection to its users. The protection is implemented at kit/src/runtime/server/respond.js. While the implementation does a sufficient job of mitigating common CSRF attacks, the protection can be bypassed by simply specifying an upper-cased Content-Type header value. The browser will not send uppercase characters on form submission, but this check does not block all expected cross-site requests: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests

Details

The CSRF protection is implemented using the code shown below.

        const forbidden =
            is_form_content_type(request) &&
            (request.method === 'POST' ||
                request.method === 'PUT' ||
                request.method === 'PATCH' ||
                request.method === 'DELETE') &&
            request.headers.get('origin') !== url.origin;

        if (forbidden) {
            const csrf_error = error(403, `Cross-site ${request.method} form submissions are forbidden`);
            if (request.headers.get('accept') === 'application/json') {
                return json(csrf_error.body, { status: csrf_error.status });
            }
            return text(csrf_error.body.message, { status: csrf_error.status });
        }

If the incoming request specifies a POST/PUT/PATCH/DELETE method, the protection will compare the server’s origin with the value of the HTTP Origin header. A mismatch between these values signals that a potential attack has been detected. The final check is performed on the request’s Content-Type header whether the value is either application/x-www-form-urlencoded, multipart/form-data or text/plain. If all the previous checks pass, the request will be rejected with an 403 error response. However, is_form_content_type, which is responsible for checking the value of the Content-Type header, is not sufficient to mitigate all possible variations of this type of attack. Since this function is checking Content-Type with lower-cased values, and the browser accepts upper-cased Content-Type header to be sent, a CSRF attack performed with the Content-Type header that contains an upper-cased character (e.g., text/plaiN) can circumvent the protection and the request will be processed by the endpoint handler.

Impact

If abused, this issue will allow malicious requests to be submitted from third-party domains, which can allow execution of operations within the context of the victim's session, and in extreme scenarios can lead to unauthorized access to users’ accounts. This may lead to all POST operations requiring authentication being allowed in the following cases:

  1. If the target site sets SameSite=None on its auth cookie and the user visits a malicious site in a Chromium-based browser
  2. If the target site doesn't set the SameSite attribute explicitly and the user visits a malicious site with Firefox/Safari with tracking protections turned off.
  3. If the user is visiting a malicious site with a very outdated browser.

Remediations

It is preferred to update to SvelteKit 1.15.2. It is also recommended to explicitly set SameSite to a value other than None on authentication cookies especially if the upgrade cannot be done in a timely manner.

Release Notes

sveltejs/kit (@​sveltejs/kit) ### [`v1.15.2`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1152) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.15.1...@sveltejs/kit@1.15.2) ##### Patch Changes - fix: address security advisory [CVE-2023-29008](https://togithub.com/sveltejs/kit/security/advisories/GHSA-gv7g-x59x-wf8f) by doing a case-insensitive comparison when checking header value ([`ba436c66`](https://togithub.com/sveltejs/kit/commit/ba436c6685e751d968a960fbda65f24cf7a82e9f)) ### [`v1.15.1`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#11511) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.15.0...@sveltejs/kit@1.15.1) ##### Patch Changes - chore: more compact representation for invalidated search param ([#​9708](https://togithub.com/sveltejs/kit/pull/9708)) - chore: fix import path to app script on windows ([#​9743](https://togithub.com/sveltejs/kit/pull/9743)) - fix: make $app/navigation more resilient to bundler reordering ([#​9808](https://togithub.com/sveltejs/kit/pull/9808)) - fix: page load `fetch()` now accepts the same input types for the body as the native fetch function ([#​9801](https://togithub.com/sveltejs/kit/pull/9801)) - fix: handle preload and filterSerializedResponseHeaders in sequence function ([#​9741](https://togithub.com/sveltejs/kit/pull/9741)) ### [`v1.15.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1150) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.14.0...@sveltejs/kit@1.15.0) ##### Minor Changes - feat: expose stronger typed `SubmitFunction` through `./$types` ([#​9201](https://togithub.com/sveltejs/kit/pull/9201)) ##### Patch Changes - fix: throw error when file can't be found in Vite manifest ([#​9558](https://togithub.com/sveltejs/kit/pull/9558)) - fix: make `error.message` enumerable when sending `ssrLoadModule` error to client ([#​9440](https://togithub.com/sveltejs/kit/pull/9440)) - fix: pass `publicDir` Vite config in SSR ([#​9565](https://togithub.com/sveltejs/kit/pull/9565)) - fix: balance parentheses in error about wrong content type for action ([#​9513](https://togithub.com/sveltejs/kit/pull/9513)) ### [`v1.14.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1140) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.13.0...@sveltejs/kit@1.14.0) ##### Minor Changes - feat: add HMR to fallback error pages during dev ([#​9497](https://togithub.com/sveltejs/kit/pull/9497)) ##### Patch Changes - fix: add `submitter` type to `SumbitFunction` ([#​9484](https://togithub.com/sveltejs/kit/pull/9484)) ### [`v1.13.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1130) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.12.0...@sveltejs/kit@1.13.0) ##### Minor Changes - feat: add dark mode styles to default error page ([#​9460](https://togithub.com/sveltejs/kit/pull/9460)) ##### Patch Changes - fix: recover from errors during dev by reloading ([#​9441](https://togithub.com/sveltejs/kit/pull/9441)) ### [`v1.12.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1120) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.11.0...@sveltejs/kit@1.12.0) ##### Minor Changes - feat: expose submitter in use:enhance SubmitFunction ([#​9425](https://togithub.com/sveltejs/kit/pull/9425)) - feat: add data-sveltekit-keepfocus and data-sveltekit-replacestate options to links (requires Svelte version 3.56 for type-checking with `svelte-check`) ([#​9019](https://togithub.com/sveltejs/kit/pull/9019)) ##### Patch Changes - fix: don't start debugger on 404s ([#​9424](https://togithub.com/sveltejs/kit/pull/9424)) - fix: handle srcset attributes with newline after comma ([#​9388](https://togithub.com/sveltejs/kit/pull/9388)) - fix: allow tsconfig to extend multiple other tsconfigs ([#​9413](https://togithub.com/sveltejs/kit/pull/9413)) - chore: update Undici to 5.21.0 ([#​9417](https://togithub.com/sveltejs/kit/pull/9417)) ### [`v1.11.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1110) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.10.0...@sveltejs/kit@1.11.0) ##### Minor Changes - feat: pause on debugger when falling back to full page reload during development ([#​9305](https://togithub.com/sveltejs/kit/pull/9305)) - feat: expose `base` via `$service-worker`, make paths relative ([#​9250](https://togithub.com/sveltejs/kit/pull/9250)) ##### Patch Changes - fix: don't automatically prerender non-SSR'd pages ([#​9352](https://togithub.com/sveltejs/kit/pull/9352)) - fix: use 308 responses for trailing slash redirects, instead of 301s ([#​9351](https://togithub.com/sveltejs/kit/pull/9351)) - fix: remove buggy cookie path detection ([#​9298](https://togithub.com/sveltejs/kit/pull/9298)) - fix: don't prevent `beforeNavigate` callbacks from running following a cancelled unloading navigation ([#​9347](https://togithub.com/sveltejs/kit/pull/9347)) - fix: persist DOM state on beforeunload ([#​9345](https://togithub.com/sveltejs/kit/pull/9345)) - fix: redirect to path with/without trailing slash when previewing prerendered pages ([#​9353](https://togithub.com/sveltejs/kit/pull/9353)) - fix: avoid FOUC when using CSS modules in dev ([#​9323](https://togithub.com/sveltejs/kit/pull/9323)) - fix: don't skip required parameters after missing optional parameters ([#​9331](https://togithub.com/sveltejs/kit/pull/9331)) - fix: account for server-emitted assets when prerenering ([#​9349](https://togithub.com/sveltejs/kit/pull/9349)) - fix: deal with fast consecutive promise resolutions when streaming ([#​9332](https://togithub.com/sveltejs/kit/pull/9332)) - chore: replace deprecated property access in preparation for TS 5.0 ([#​9361](https://togithub.com/sveltejs/kit/pull/9361)) ### [`v1.10.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1100) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.9.3...@sveltejs/kit@1.10.0) ##### Minor Changes - feat: add `cookies.getAll` ([#​9287](https://togithub.com/sveltejs/kit/pull/9287)) ##### Patch Changes - fix: always include ``, even for stylesheets excluded from Link headers ([#​9255](https://togithub.com/sveltejs/kit/pull/9255)) - fix: preserve form state when submitting a second time ([#​9267](https://togithub.com/sveltejs/kit/pull/9267)) ### [`v1.9.3`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#193) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.9.2...@sveltejs/kit@1.9.3) ##### Patch Changes - fix: successive optional route parameters can now be empty ([#​9266](https://togithub.com/sveltejs/kit/pull/9266)) ### [`v1.9.2`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#192) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.9.1...@sveltejs/kit@1.9.2) ##### Patch Changes - fix: correct undefined reference to global var with Vitest ([#​9252](https://togithub.com/sveltejs/kit/pull/9252)) ### [`v1.9.1`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#191) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.9.0...@sveltejs/kit@1.9.1) ##### Patch Changes - feat: warn when calling depends(...) with special URI scheme ([#​9246](https://togithub.com/sveltejs/kit/pull/9246)) ### [`v1.9.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#190) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.8.8...@sveltejs/kit@1.9.0) ##### Minor Changes - feat: add `paths.relative` option to control interpretation of `paths.assets` and `paths.base` ([#​9220](https://togithub.com/sveltejs/kit/pull/9220)) ### [`v1.8.8`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#188) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.8.7...@sveltejs/kit@1.8.8) ##### Patch Changes - fix: always add `@sveltejs/kit` to `noExternal` for ssr build ([#​9242](https://togithub.com/sveltejs/kit/pull/9242)) - feat: add `api.methods` and `page.methods` to `builder.routes` ([#​9145](https://togithub.com/sveltejs/kit/pull/9145)) ### [`v1.8.7`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#187) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.8.6...@sveltejs/kit@1.8.7) ##### Patch Changes - fix: correct not found message when setting `paths.base` ([#​9232](https://togithub.com/sveltejs/kit/pull/9232)) ### [`v1.8.6`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#186) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.8.5...@sveltejs/kit@1.8.6) ##### Patch Changes - fix: bundle SvelteKit when using Vitest ([#​9172](https://togithub.com/sveltejs/kit/pull/9172)) ### [`v1.8.5`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#185) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.8.4...@sveltejs/kit@1.8.5) ##### Patch Changes - fix: allow relative fetch to endpoint outside app from within `handle` ([#​9198](https://togithub.com/sveltejs/kit/pull/9198)) ### [`v1.8.4`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#184) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.8.3...@sveltejs/kit@1.8.4) ##### Patch Changes - fix: include .mjs files in precompression ([#​9179](https://togithub.com/sveltejs/kit/pull/9179)) - fix: revert mjs extension usage by default, make it an option ([#​9179](https://togithub.com/sveltejs/kit/pull/9179)) - chore: dummy changeset to force a release ([#​9207](https://togithub.com/sveltejs/kit/pull/9207)) ### [`v1.8.3`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#183) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.8.2...@sveltejs/kit@1.8.3) ##### Patch Changes - fix: use a proprietary content-type to ensure response is not buffered ([#​9142](https://togithub.com/sveltejs/kit/pull/9142)) ### [`v1.8.2`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#182) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.8.1...@sveltejs/kit@1.8.2) ##### Patch Changes - fix: append newline to trigger script evaluation ([#​9139](https://togithub.com/sveltejs/kit/pull/9139)) ### [`v1.8.1`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#181) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.8.0...@sveltejs/kit@1.8.1) ##### Patch Changes - fix: encode streamed chunks ([#​9136](https://togithub.com/sveltejs/kit/pull/9136)) ### [`v1.8.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#180) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.7.2...@sveltejs/kit@1.8.0) ##### Minor Changes - feat: implement streaming promises for server load functions ([#​8901](https://togithub.com/sveltejs/kit/pull/8901)) ##### Patch Changes - fix: set public env before starting app ([#​8957](https://togithub.com/sveltejs/kit/pull/8957)) - fix: preload modules on Safari ([#​8957](https://togithub.com/sveltejs/kit/pull/8957)) - fix: make `assets` work in client when app is served from a subfolder ([#​8957](https://togithub.com/sveltejs/kit/pull/8957)) ### [`v1.7.2`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#172) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.7.1...@sveltejs/kit@1.7.2) ##### Patch Changes - fix: return correct asset list from `builder.writeClient()` ([#​9095](https://togithub.com/sveltejs/kit/pull/9095)) ### [`v1.7.1`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#171) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.7.0...@sveltejs/kit@1.7.1) ##### Patch Changes - fix: deploy server assets. Only works with Vite 4.1+ ([#​9073](https://togithub.com/sveltejs/kit/pull/9073)) ### [`v1.7.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#170) ##### Minor Changes - feat: richer error message for invalid exports ([#​9055](https://togithub.com/sveltejs/kit/pull/9055)) ##### Patch Changes - chore: throw more helpful error when encoding uri fails during prerendering ([#​9053](https://togithub.com/sveltejs/kit/pull/9053)) ### [`v1.6.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#160) ##### Minor Changes - feat: add `OPTIONS` server method ([#​8731](https://togithub.com/sveltejs/kit/pull/8731)) ##### Patch Changes - fix: solve `missing "./paths" specifier in "@​sveltejs/kit" package` error occurring in all projects ([#​9050](https://togithub.com/sveltejs/kit/pull/9050)) ### [`v1.5.7`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#157) ##### Patch Changes - fix: use internal alias that won't collide with user aliases ([#​9022](https://togithub.com/sveltejs/kit/pull/9022)) ### [`v1.5.6`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#156) ##### Patch Changes - fix: ssr defaults preventing minification for client build ([#​9012](https://togithub.com/sveltejs/kit/pull/9012)) - fix: client-side trailing slash redirect when preloading data ([#​8982](https://togithub.com/sveltejs/kit/pull/8982)) ### [`v1.5.5`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#155) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.5.3...@sveltejs/kit@1.5.5) ##### Patch Changes - fix: warn after failed data preloads in dev ([#​8985](https://togithub.com/sveltejs/kit/pull/8985)) ### [`v1.5.3`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#153) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.5.2...@sveltejs/kit@1.5.3) ##### Patch Changes - docs: clarify that `version.name` should be deterministic ([#​8956](https://togithub.com/sveltejs/kit/pull/8956)) - fix: correctly include exported http methods in allow header ([#​8968](https://togithub.com/sveltejs/kit/pull/8968)) - chore: polyfill File from node:buffer ([#​8925](https://togithub.com/sveltejs/kit/pull/8925)) - fix: provide helpful error/warning when calling `fetch` during render ([#​8551](https://togithub.com/sveltejs/kit/pull/8551)) - fix: print useful error when subscribing to SvelteKit's stores at the wrong time during SSR ([#​8960](https://togithub.com/sveltejs/kit/pull/8960)) - fix: ignore external links when automatically preloading ([#​8961](https://togithub.com/sveltejs/kit/pull/8961)) - chore: refactor fallback generation ([#​8972](https://togithub.com/sveltejs/kit/pull/8972)) ### [`v1.5.2`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#152) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.5.1...@sveltejs/kit@1.5.2) ##### Patch Changes - fix: always default `paths.assets` to `paths.base` ([#​8928](https://togithub.com/sveltejs/kit/pull/8928)) ### [`v1.5.1`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#151) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.5.0...@sveltejs/kit@1.5.1) ##### Patch Changes - fix: pick up config from endpoints ([#​8933](https://togithub.com/sveltejs/kit/pull/8933)) - fix: don't reuse previous server load cache when there's no server load function ([#​8893](https://togithub.com/sveltejs/kit/pull/8893)) - fix: deduplicate paths in tsconfig ([#​8880](https://togithub.com/sveltejs/kit/pull/8880)) - docs: clarify version management feature ([#​8941](https://togithub.com/sveltejs/kit/pull/8941)) ### [`v1.5.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#150) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.4.0...@sveltejs/kit@1.5.0) ##### Minor Changes - feat: support route-level configuration ([#​8740](https://togithub.com/sveltejs/kit/pull/8740)) - feat: add snapshot mechanism for preserving ephemeral DOM state ([#​8710](https://togithub.com/sveltejs/kit/pull/8710)) ##### Patch Changes - chore(deps): update dependency undici to v5.18.0 ([#​8884](https://togithub.com/sveltejs/kit/pull/8884)) ### [`v1.4.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#140) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.3.10...@sveltejs/kit@1.4.0) ##### Minor Changes - feat: allow $app/paths to be used without an app ([#​8838](https://togithub.com/sveltejs/kit/pull/8838)) ##### Patch Changes - fix: ensure types of all form actions are accessible even if differing ([#​8877](https://togithub.com/sveltejs/kit/pull/8877)) - fix: correctly handle HttpErrors on the client side ([#​8829](https://togithub.com/sveltejs/kit/pull/8829)) - docs: discourage use of `goto` with external URLs ([#​8837](https://togithub.com/sveltejs/kit/pull/8837)) - fix: prevent crawling empty urls (``) ([#​8883](https://togithub.com/sveltejs/kit/pull/8883)) - fix: correctly serialize request url when using load `fetch` ([#​8876](https://togithub.com/sveltejs/kit/pull/8876)) - fix: ensure endpoints can fetch endpoints on the same host but not part of the application ([#​8869](https://togithub.com/sveltejs/kit/pull/8869)) ### [`v1.3.10`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1310) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.3.9...@sveltejs/kit@1.3.10) ##### Patch Changes - fix: preserve build error messages ([#​8846](https://togithub.com/sveltejs/kit/pull/8846)) ### [`v1.3.9`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#139) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.3.8...@sveltejs/kit@1.3.9) ##### Patch Changes - fix: output errors properly if pages fail to compile ([#​8813](https://togithub.com/sveltejs/kit/pull/8813)) ### [`v1.3.8`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#138) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.3.7...@sveltejs/kit@1.3.8) ##### Patch Changes - fix: remove Vite manifest before running adapter ([#​8815](https://togithub.com/sveltejs/kit/pull/8815)) ### [`v1.3.7`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#137) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.3.6...@sveltejs/kit@1.3.7) ##### Patch Changes - fix: only show prerendering message when actually prerendering ([#​8809](https://togithub.com/sveltejs/kit/pull/8809)) - fix: handle anchors with special chars when navigating ([#​8806](https://togithub.com/sveltejs/kit/pull/8806)) - fix: await finalise hook and run it only once ([#​8817](https://togithub.com/sveltejs/kit/pull/8817)) ### [`v1.3.6`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#136) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.3.5...@sveltejs/kit@1.3.6) ##### Patch Changes - fix: allow rest parameters to follow multiple optional - or not - parameters ([#​8761](https://togithub.com/sveltejs/kit/pull/8761)) - fix: consider headers when constructing request hash ([#​8754](https://togithub.com/sveltejs/kit/pull/8754)) ### [`v1.3.5`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#135) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.3.4...@sveltejs/kit@1.3.5) ##### Patch Changes - docs: fix typo ([#​8790](https://togithub.com/sveltejs/kit/pull/8790)) - fix: build error on layout with missing leaves ([#​8792](https://togithub.com/sveltejs/kit/pull/8792)) - fix: handle hash links with non-ASCII characters when navigating ([#​8767](https://togithub.com/sveltejs/kit/pull/8767)) ### [`v1.3.4`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#134) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.3.3...@sveltejs/kit@1.3.4) ##### Patch Changes - chore: bump devalue ([#​8789](https://togithub.com/sveltejs/kit/pull/8789)) ### [`v1.3.3`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#133) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.3.2...@sveltejs/kit@1.3.3) ##### Patch Changes - fix: forward `process.env` to child process ([#​8777](https://togithub.com/sveltejs/kit/pull/8777)) ### [`v1.3.2`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#132) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.3.1...@sveltejs/kit@1.3.2) ##### Patch Changes - fix: take base path into account when preloading code ([#​8748](https://togithub.com/sveltejs/kit/pull/8748)) ### [`v1.3.1`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1310) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.3.0...@sveltejs/kit@1.3.1) ##### Patch Changes - fix: preserve build error messages ([#​8846](https://togithub.com/sveltejs/kit/pull/8846)) ### [`v1.3.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#130) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.2.10...@sveltejs/kit@1.3.0) ##### Minor Changes - feat: allow generated tsconfig to be modified ([#​8606](https://togithub.com/sveltejs/kit/pull/8606)) ##### Patch Changes - fix: skip navigation hooks on popstate events when only hash changed ([#​8730](https://togithub.com/sveltejs/kit/pull/8730)) ### [`v1.2.10`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1210) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.2.9...@sveltejs/kit@1.2.10) ##### Patch Changes - chore: restrict methods allowed for POST ([#​8721](https://togithub.com/sveltejs/kit/pull/8721)) - fix: provide proper error when POSTing to a missing page endpoint ([#​8714](https://togithub.com/sveltejs/kit/pull/8714)) ### [`v1.2.9`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#129) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.2.8...@sveltejs/kit@1.2.9) ##### Patch Changes - fix: reapply exports alignment after Vite dependency optimizations ([#​8690](https://togithub.com/sveltejs/kit/pull/8690)) ### [`v1.2.8`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#128) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.2.7...@sveltejs/kit@1.2.8) ##### Patch Changes - fix: include base path in path to start script ([#​8651](https://togithub.com/sveltejs/kit/pull/8651)) ### [`v1.2.7`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#127) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.2.6...@sveltejs/kit@1.2.7) ##### Patch Changes - fix: set headers when throwing redirect in handle ([#​8648](https://togithub.com/sveltejs/kit/pull/8648)) ### [`v1.2.6`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#126) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.2.5...@sveltejs/kit@1.2.6) ##### Patch Changes - fix: allow importing assets while using base path ([#​8683](https://togithub.com/sveltejs/kit/pull/8683)) ### [`v1.2.5`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#125) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.2.4...@sveltejs/kit@1.2.5) ##### Patch Changes - fix: check for wrong return values from form actions ([#​8553](https://togithub.com/sveltejs/kit/pull/8553)) ### [`v1.2.4`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#124) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.2.3...@sveltejs/kit@1.2.4) ##### Patch Changes - chore: update undici to v5.16.0 ([#​8668](https://togithub.com/sveltejs/kit/pull/8668)) ### [`v1.2.3`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#123) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.2.2...@sveltejs/kit@1.2.3) ##### Patch Changes - fix: set environment variables before postbuild analysis ([#​8647](https://togithub.com/sveltejs/kit/pull/8647)) ### [`v1.2.2`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#122) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.2.1...@sveltejs/kit@1.2.2) ##### Patch Changes - fix: focus management after navigation ([#​8466](https://togithub.com/sveltejs/kit/pull/8466)) ### [`v1.2.1`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1210) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.2.0...@sveltejs/kit@1.2.1) ##### Patch Changes - chore: restrict methods allowed for POST ([#​8721](https://togithub.com/sveltejs/kit/pull/8721)) - fix: provide proper error when POSTing to a missing page endpoint ([#​8714](https://togithub.com/sveltejs/kit/pull/8714)) ### [`v1.2.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#120) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.1.4...@sveltejs/kit@1.2.0) ##### Minor Changes - feat: add `text(...)` helper for generating text responses ([#​8371](https://togithub.com/sveltejs/kit/pull/8371)) - feat: enable access to public env within app.html ([#​8449](https://togithub.com/sveltejs/kit/pull/8449)) - fix: add `Content-Length` header to SvelteKit-generated responses ([#​8371](https://togithub.com/sveltejs/kit/pull/8371)) ### [`v1.1.4`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#114) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.1.3...@sveltejs/kit@1.1.4) ##### Patch Changes - fix: squelch unknown prop warning for `+error.svelte` components ([#​8593](https://togithub.com/sveltejs/kit/pull/8593)) ### [`v1.1.3`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#113) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.1.2...@sveltejs/kit@1.1.3) ##### Patch Changes - docs: explain how to add ambient typings ([#​8558](https://togithub.com/sveltejs/kit/pull/8558)) - fix: ignore `target="_blank"` links ([#​8563](https://togithub.com/sveltejs/kit/pull/8563)) ### [`v1.1.2`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#112) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.1.1...@sveltejs/kit@1.1.2) ##### Patch Changes - fix: correct link in types documentation ([#​8557](https://togithub.com/sveltejs/kit/pull/8557)) - fix: correctly detect changed data ([#​8377](https://togithub.com/sveltejs/kit/pull/8377)) - fix: only generate type definitions with `sync` command ([#​8552](https://togithub.com/sveltejs/kit/pull/8552)) - fix: remove baseUrl to prevent wrong TypeScript auto imports if possible ([#​8568](https://togithub.com/sveltejs/kit/pull/8568)) ### [`v1.1.1`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#111) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.1.0...@sveltejs/kit@1.1.1) ##### Patch Changes - chore: upgrade devalue ([#​8520](https://togithub.com/sveltejs/kit/pull/8520)) ### [`v1.1.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#110) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.13...@sveltejs/kit@1.1.0) ##### Minor Changes - feat: warn when usage of page options in `.svelte` files or missing `` in layout is detected ([#​8475](https://togithub.com/sveltejs/kit/pull/8475)) ##### Patch Changes - fix: exit postbuild step with code 0 ([#​8514](https://togithub.com/sveltejs/kit/pull/8514)) - fix: only run missing page check in dev mode ([#​8515](https://togithub.com/sveltejs/kit/pull/8515)) - fix: avoid input name clobbering form method check ([#​8471](https://togithub.com/sveltejs/kit/pull/8471)) - fix: exclude service worker from tsconfig ([#​8508](https://togithub.com/sveltejs/kit/pull/8508)) - fix: provide better error message in case of missing `+page.svelte` ([#​8478](https://togithub.com/sveltejs/kit/pull/8478)) ### [`v1.0.13`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1013) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.12...@sveltejs/kit@1.0.13) ##### Patch Changes - chore: separate generated from non-generated server code ([#​8429](https://togithub.com/sveltejs/kit/pull/8429)) ### [`v1.0.12`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1012) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.11...@sveltejs/kit@1.0.12) ##### Patch Changes - fix: make prerendered endpoint callable from non-prerendered server load ([#​8453](https://togithub.com/sveltejs/kit/pull/8453)) - docs: add links to http status codes ([#​8480](https://togithub.com/sveltejs/kit/pull/8480)) - fix: prerender page when prerender set to 'auto' and ssr set to true ([#​8481](https://togithub.com/sveltejs/kit/pull/8481)) - fix: prevent false positive warnings for fetch uses in firefox ([#​8456](https://togithub.com/sveltejs/kit/pull/8456)) - fix: check version on node fetch fail ([#​8487](https://togithub.com/sveltejs/kit/pull/8487)) - fix: avoid unnecessary $page store updates ([#​8457](https://togithub.com/sveltejs/kit/pull/8457)) ### [`v1.0.11`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1011) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.10...@sveltejs/kit@1.0.11) ##### Patch Changes - feat: warn that hydration may break if comments are removed from HTML ([#​8423](https://togithub.com/sveltejs/kit/pull/8423)) - fix: ignore `` elements with no `href` attribute when refocusing after navigation ([#​8418](https://togithub.com/sveltejs/kit/pull/8418)) - fix: invalidate dependencies implicitly added by `fetch` in server load functions ([#​8420](https://togithub.com/sveltejs/kit/pull/8420)) ### [`v1.0.10`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1010) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.9...@sveltejs/kit@1.0.10) ##### Patch Changes - fix: skip inline cache when vary header is present ([#​8406](https://togithub.com/sveltejs/kit/pull/8406)) ### [`v1.0.9`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#109) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.8...@sveltejs/kit@1.0.9) ##### Patch Changes - fix: add `assetFileNames` to worker rollup options ([#​8384](https://togithub.com/sveltejs/kit/pull/8384)) ### [`v1.0.8`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#108) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.7...@sveltejs/kit@1.0.8) ##### Patch Changes - feat: error in dev mode if global `fetch` is used with relative URL ([#​8370](https://togithub.com/sveltejs/kit/pull/8370)) - fix: disable illegal import detection when running unit tests ([#​8365](https://togithub.com/sveltejs/kit/pull/8365)) - fix: only prerender a given dependency once ([#​8376](https://togithub.com/sveltejs/kit/pull/8376)) - fix: `updated.check()` type changed to `Promise` ([#​8400](https://togithub.com/sveltejs/kit/pull/8400)) - fix: don't strip body in no-cors mode on the server ([#​8412](https://togithub.com/sveltejs/kit/pull/8412)) - fix: quote 'script' in CSP directives ([#​8372](https://togithub.com/sveltejs/kit/pull/8372)) - fix: correctly compare route ids for load change detection ([#​8399](https://togithub.com/sveltejs/kit/pull/8399)) - fix: don't add nonce attribute to `` elements ([#​8369](https://togithub.com/sveltejs/kit/pull/8369)) ### [`v1.0.7`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#107) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.6...@sveltejs/kit@1.0.7) ##### Patch Changes - fix: ignore `*.test.js` and `*.spec.js` files in `params` directory ([#​8250](https://togithub.com/sveltejs/kit/pull/8250)) ### [`v1.0.6`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#106) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.5...@sveltejs/kit@1.0.6) ##### Patch Changes - fix: guarantee that `$page.route` has the correct shape ([#​8359](https://togithub.com/sveltejs/kit/pull/8359)) ### [`v1.0.5`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#105) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.3...@sveltejs/kit@1.0.5) ##### Patch Changes - fix: update typings of `event.platform` to be possibly undefined ([#​8232](https://togithub.com/sveltejs/kit/pull/8232)) ### [`v1.0.3`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#103) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.2...@sveltejs/kit@1.0.3) ##### Patch Changes - feat: include submitter's value when progressively enhancing `
` ([#​8273](https://togithub.com/sveltejs/kit/pull/8273)) ### [`v1.0.2`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#102) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.1...@sveltejs/kit@1.0.2) ##### Patch Changes - fix: correct `filterSerializedResponseHeaders` error message ([#​8348](https://togithub.com/sveltejs/kit/pull/8348)) - fix: correct form action redirect status code ([#​8210](https://togithub.com/sveltejs/kit/pull/8210)) ### [`v1.0.1`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#1013) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0...@sveltejs/kit@1.0.1) ##### Patch Changes - chore: separate generated from non-generated server code ([#​8429](https://togithub.com/sveltejs/kit/pull/8429)) ### [`v1.0.0`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.589...@sveltejs/kit@1.0.0) ##### Major Changes First major release, see below for the history of changes that lead up to this. Starting from now all releases follow semver and changes will be listed as Major/Minor/Patch ### [`v1.0.0-next.589`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next589) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.588...@sveltejs/kit@1.0.0-next.589) ##### Patch Changes - breaking: remove warnings/errors about removed/changed APIs ([#​8019](https://togithub.com/sveltejs/kit/pull/8019)) ### [`v1.0.0-next.588`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next588) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.587...@sveltejs/kit@1.0.0-next.588) ##### Patch Changes - fix: remove obsolete generated types correctly ([#​8149](https://togithub.com/sveltejs/kit/pull/8149)) ### [`v1.0.0-next.587`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next587) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.586...@sveltejs/kit@1.0.0-next.587) ##### Patch Changes - breaking: prerender shells when ssr false and prerender not false ([#​8131](https://togithub.com/sveltejs/kit/pull/8131)) ### [`v1.0.0-next.586`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next586) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.585...@sveltejs/kit@1.0.0-next.586) ##### Patch Changes - fix: don't de/encode initial and explicit string headers ([#​8113](https://togithub.com/sveltejs/kit/pull/8113)) ### [`v1.0.0-next.585`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next585) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.584...@sveltejs/kit@1.0.0-next.585) ##### Patch Changes - fix: remove unused elements from default error component ([#​8110](https://togithub.com/sveltejs/kit/pull/8110)) ### [`v1.0.0-next.584`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next584) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.583...@sveltejs/kit@1.0.0-next.584) ##### Patch Changes - fix: load errorTemplate from correct location ([#​8096](https://togithub.com/sveltejs/kit/pull/8096)) - More robust manifest error recovery ([#​8095](https://togithub.com/sveltejs/kit/pull/8095)) ### [`v1.0.0-next.583`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next583) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.582...@sveltejs/kit@1.0.0-next.583) ##### Patch Changes - restart vite dev-server on svelte config change ([#​8087](https://togithub.com/sveltejs/kit/pull/8087)) - Set correct `$page.status` when using `enhance` and result is of type `'error'` ([#​8073](https://togithub.com/sveltejs/kit/pull/8073)) - fix: ensure export conditions are resolve through Vite ([#​8092](https://togithub.com/sveltejs/kit/pull/8092)) - fix: don't crash Vite dev server on manifest error ([#​8093](https://togithub.com/sveltejs/kit/pull/8093)) ### [`v1.0.0-next.582`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next582) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.581...@sveltejs/kit@1.0.0-next.582) ##### Patch Changes - fix: improve split between Vite plugins ([#​8055](https://togithub.com/sveltejs/kit/pull/8055)) - fix: set Vite base URL ([#​8046](https://togithub.com/sveltejs/kit/pull/8046)) - add declaration for vitePreprocess reexport ([#​8053](https://togithub.com/sveltejs/kit/pull/8053)) ### [`v1.0.0-next.581`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next581) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.580...@sveltejs/kit@1.0.0-next.581) ##### Patch Changes - feat: vitePreprocess ([#​8036](https://togithub.com/sveltejs/kit/pull/8036)) ### [`v1.0.0-next.580`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next580) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.579...@sveltejs/kit@1.0.0-next.580) ##### Patch Changes - breaking: throw an error on invalid load response ([#​8003](https://togithub.com/sveltejs/kit/pull/8003)) - fix: allow SvelteKit to be used without bundling ([#​7950](https://togithub.com/sveltejs/kit/pull/7950)) ### [`v1.0.0-next.579`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next579) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.578...@sveltejs/kit@1.0.0-next.579) ##### Patch Changes - breaking: update svelte peerDependency to ^3.54.0 ([#​7543](https://togithub.com/sveltejs/kit/pull/7543)) - update esbuild to ^0.16.3 ([#​7543](https://togithub.com/sveltejs/kit/pull/7543)) - breaking: upgrade to Vite 4 ([#​7543](https://togithub.com/sveltejs/kit/pull/7543)) ### [`v1.0.0-next.578`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next578) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.577...@sveltejs/kit@1.0.0-next.578) ##### Patch Changes - fix: respect fetch cache option ([#​8024](https://togithub.com/sveltejs/kit/pull/8024)) - breaking: rename invalid() to fail() and ValidationError to ActionFailure ([#​8012](https://togithub.com/sveltejs/kit/pull/8012)) - breaking: replace automatic fallback generation with `builder.generateFallback(fallback)` ([#​8013](https://togithub.com/sveltejs/kit/pull/8013)) ### [`v1.0.0-next.577`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next577) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.576...@sveltejs/kit@1.0.0-next.577) ##### Patch Changes - breaking: add embedded option, turned off by default ([#​7969](https://togithub.com/sveltejs/kit/pull/7969)) ### [`v1.0.0-next.576`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next576) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.575...@sveltejs/kit@1.0.0-next.576) ##### Patch Changes - breaking: make `sveltekit()` return a promise of array of Vite plugins ([#​7994](https://togithub.com/sveltejs/kit/pull/7994)) ### [`v1.0.0-next.575`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next575) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.574...@sveltejs/kit@1.0.0-next.575) ##### Patch Changes - fix: throw error when using enhance on GET forms ([#​7948](https://togithub.com/sveltejs/kit/pull/7948)) - breaking: strip `__data.json` from url ([#​7979](https://togithub.com/sveltejs/kit/pull/7979)) ### [`v1.0.0-next.574`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next574) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.573...@sveltejs/kit@1.0.0-next.574) ##### Patch Changes - feat: split Vite plugin in two ([#​7990](https://togithub.com/sveltejs/kit/pull/7990)) ### [`v1.0.0-next.573`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next573) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.572...@sveltejs/kit@1.0.0-next.573) ##### Patch Changes - fix: adjust ActionData type ([#​7962](https://togithub.com/sveltejs/kit/pull/7962)) - breaking: disallow unknown exports (except when starting with an underscore) from `+(layout|page)(.server)?.js` and `+server.js` files ([#​7878](https://togithub.com/sveltejs/kit/pull/7878)) - fix: continuous optionals should not throw conflict error ([#​7939](https://togithub.com/sveltejs/kit/pull/7939)) - fix `enhance` error message when form action doesn't exist or csrf is enabled ([#​7958](https://togithub.com/sveltejs/kit/pull/7958)) ### [`v1.0.0-next.572`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next572) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.571...@sveltejs/kit@1.0.0-next.572) ##### Minor Changes - Checks that element is not null before reading getAttribute ([#​7930](https://togithub.com/sveltejs/kit/pull/7930)) ##### Patch Changes - chore: update `magic-string` ([#​7931](https://togithub.com/sveltejs/kit/pull/7931)) - add $app and $env to optimizeDeps.exclude so that libraries using these work correctly when prebundled ([#​7933](https://togithub.com/sveltejs/kit/pull/7933)) - reload dev page on change of app.html ([#​7944](https://togithub.com/sveltejs/kit/pull/7944)) ### [`v1.0.0-next.571`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next571) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.570...@sveltejs/kit@1.0.0-next.571) ##### Patch Changes - fix: use searchParams for x-sveltekit-invalidated ([#​7912](https://togithub.com/sveltejs/kit/pull/7912)) - fix: correct Vite config merging with force option ([#​7911](https://togithub.com/sveltejs/kit/pull/7911)) - fix: rebuild manifest when client hooks or param matcher file is added/removed ([#​7915](https://togithub.com/sveltejs/kit/pull/7915)) ### [`v1.0.0-next.570`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next570) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.567...@sveltejs/kit@1.0.0-next.570) ##### Patch Changes - Remove prepublishOnly script ([#​7893](https://togithub.com/sveltejs/kit/pull/7893)) ### [`v1.0.0-next.567`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next567) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.566...@sveltejs/kit@1.0.0-next.567) ##### Patch Changes - Co-locate synthetic types with other Kit types ([#​7864](https://togithub.com/sveltejs/kit/pull/7864)) ### [`v1.0.0-next.566`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next566) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.565...@sveltejs/kit@1.0.0-next.566) ##### Patch Changes - Add more type documentation ([#​7003](https://togithub.com/sveltejs/kit/pull/7003)) - breaking: move SubmitFunction into [@​sveltejs/kit](https://togithub.com/sveltejs/kit) ([#​7003](https://togithub.com/sveltejs/kit/pull/7003)) ### [`v1.0.0-next.565`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next565) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.564...@sveltejs/kit@1.0.0-next.565) ##### Patch Changes - breaking: Replace `data-sveltekit-prefetch` with `-preload-code` and `-preload-data` ([#​7776](https://togithub.com/sveltejs/kit/pull/7776)) - breaking: Rename `prefetch` to `preloadData` and `prefetchRoutes` to `preloadCode` ([#​7776](https://togithub.com/sveltejs/kit/pull/7776)) ### [`v1.0.0-next.564`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next564) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.563...@sveltejs/kit@1.0.0-next.564) ##### Patch Changes - chore: upgrade undici ([#​7830](https://togithub.com/sveltejs/kit/pull/7830)) - Make `$page.url` resilient against mutations ([#​7827](https://togithub.com/sveltejs/kit/pull/7827)) ### [`v1.0.0-next.563`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next563) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.562...@sveltejs/kit@1.0.0-next.563) ##### Patch Changes - feat: allow handleError to return a promise ([#​7780](https://togithub.com/sveltejs/kit/pull/7780)) - breaking: remove `format` option from `generateManifest(...)` ([#​7820](https://togithub.com/sveltejs/kit/pull/7820)) ### [`v1.0.0-next.562`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next562) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.561...@sveltejs/kit@1.0.0-next.562) ##### Patch Changes - fix: handle redirects in handle hook while processing data request ([#​7797](https://togithub.com/sveltejs/kit/pull/7797)) - Make touchstart listener passive ([#​7818](https://togithub.com/sveltejs/kit/pull/7818)) - breaking: remove `getStaticDirectory()` from builder API ([#​7809](https://togithub.com/sveltejs/kit/pull/7809)) - Make console.warn wrapper named rather than anonymous ([#​7811](https://togithub.com/sveltejs/kit/pull/7811)) ### [`v1.0.0-next.561`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next561) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.560...@sveltejs/kit@1.0.0-next.561) ##### Patch Changes - Upgrade vite-plugin-svelte to ^1.3.1 ([#​7760](https://togithub.com/sveltejs/kit/pull/7760)) ### [`v1.0.0-next.560`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next560) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.559...@sveltejs/kit@1.0.0-next.560) ##### Patch Changes - breaking: Rename `prerendering` to `building`, remove `config.kit.prerender.enabled` ([#​7762](https://togithub.com/sveltejs/kit/pull/7762)) ### [`v1.0.0-next.559`](https://togithub.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#100-next559) [Compare Source](https://togithub.com/sveltejs/kit/compare/@sveltejs/kit@1.0.0-next.557...@sveltejs/kit@1.0.0-next.559) ##### Patch Changes - Roll over non-matching optional parameters

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • [ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate[bot] commented 1 year ago

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

The artifact failure details are included below:

File name: package-lock.json
npm notice 
npm notice New major version of npm available! 8.19.4 -> 9.6.4
npm notice Changelog: <https://github.com/npm/cli/releases/tag/v9.6.4>
npm notice Run `npm install -g npm@9.6.4` to update!
npm notice 
npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: sveltekit-web3auth@0.0.0-development
npm ERR! Found: svelte@3.46.4
npm ERR! node_modules/svelte
npm ERR!   dev svelte@"3.46.4" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer svelte@"^3.54.0" from @sveltejs/kit@1.15.2
npm ERR! node_modules/@sveltejs/kit
npm ERR!   dev @sveltejs/kit@"1.15.2" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /tmp/worker/da06ff/aeaae3/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/worker/da06ff/aeaae3/cache/others/npm/_logs/2023-04-17T10_48_54_605Z-debug-0.log