chore(deps): update dependency @sveltejs/adapter-vercel to v6 [security]#406
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update dependency @sveltejs/adapter-vercel to v6 [security]#406renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
renovate
Bot
force-pushed
the
renovate/npm-sveltejs-adapter-vercel-vulnerability
branch
from
dc89758 to
f0ddeff
Compare
renovate
Bot
force-pushed
the
renovate/npm-sveltejs-adapter-vercel-vulnerability
branch
from
f0ddeff to
62db4a5
Compare
renovate
Bot
changed the title
renovate
Bot
deleted the
renovate/npm-sveltejs-adapter-vercel-vulnerability
branch
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-sveltejs-adapter-vercel-vulnerability
branch
2 times, most recently
from
62db4a5 to
cf6c42c
Compare
renovate
Bot
force-pushed
the
renovate/npm-sveltejs-adapter-vercel-vulnerability
branch
from
cf6c42c to
005f332
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-sveltejs-adapter-vercel-vulnerability
branch
2 times, most recently
from
005f332 to
2006f49
Compare
|
renovate
Bot
force-pushed
the
renovate/npm-sveltejs-adapter-vercel-vulnerability
branch
from
2006f49 to
6515401
Compare
renovate
Bot
force-pushed
the
renovate/npm-sveltejs-adapter-vercel-vulnerability
branch
from
6515401 to
7a9c00f
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^5.4.0→^6.0.0Cache poisoning in @sveltejs/adapter-vercel
CVE-2026-27118 / GHSA-9pq4-5hcf-288c
More information
Details
Versions of
@sveltejs/adapter-vercelprior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users.Successful exploitation requires a victim to visit an attacker-controlled link while authenticated.
Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
sveltejs/kit (@sveltejs/adapter-vercel)
v6.3.2Compare Source
Patch Changes
fix: 404 for immutable assets that don't match static files (
c67da8a)Updated dependencies [
3e607b3,62991c8,f47c01b]:v6.3.1Compare Source
Patch Changes
feat: show remote function calls under the /_app/remote route in observability (#15098)
fix: prevent isr routes from handling remote function calls (#15098)
Updated dependencies [
46c1ebd,2dd74c8,8871b54]:v6.3.0Compare Source
Minor Changes
RequestContextas deprecated and refer to@vercel/functions(#14725)Patch Changes
e67613c,a5c313e,06de550]:v6.2.0Compare Source
Minor Changes
v6.1.2Compare Source
Patch Changes
chore(deps): upgrade to
@vercel/nftversion 1.0.0 to reduce dependencies (#14950)Updated dependencies [
0889a2a,2ff3951,5b30755]:v6.1.1Compare Source
Patch Changes
chore: improve runtime config parsing (#14838)
Updated dependencies [
cd72d94,53b1b73,2ccc638]:v6.1.0Compare Source
Minor Changes
Patch Changes
102aecf]:v6.0.0Compare Source
Major Changes
Minor Changes
Patch Changes
9c933a2,dedda71]:v5.10.3Compare Source
Patch Changes
v5.10.2Compare Source
Patch Changes
fix: ensure
readworks in an edge function that has deployment protection. Protection bypass automation must be enabled (#14147)Updated dependencies [
c8f7ac3,107f767]:v5.10.1Compare Source
Patch Changes
runtimeconfig (#14253)v5.10.0Compare Source
Minor Changes
fetchexport (#14251)Patch Changes
1d04a77,5db4cd4]:v5.9.1Compare Source
Patch Changes
fix: avoid erroring on builder properties that only exist on the latest version of SvelteKit (#14233)
Updated dependencies [
f2db41c]:v5.9.0Compare Source
Minor Changes
instrumentation.server.tsfor tracing and observability setup (#13899)Patch Changes
f635678,f635678]:v5.8.2Compare Source
Patch Changes
chore: add
.gitto the end ofpackage.jsonrepository url (#14134)Updated dependencies [
c968aef]:v5.8.1Compare Source
Patch Changes
v5.8.0Compare Source
Minor Changes
readimported from$app/serverin edge functions (#13859)Patch Changes
e5ce8bb,cf88369]:v5.7.2Compare Source
Patch Changes
v5.7.1Compare Source
Patch Changes
chore(deps): upgrade esbuild to 0.25.2 (#13716)
fix: include the
edge-lightbundling condition when building edge functions (#13720)Updated dependencies [
c51fb554416e0c4a21655c1d79e834f69743d1d5]:v5.7.0Compare Source
Minor Changes
Patch Changes
7fd7bcb7142e7d0d2dd64174fa1a94d56a45d643]:v5.6.3Compare Source
Patch Changes
b1e9781a6dff41841d8e1509311d948421956746)v5.6.2Compare Source
Patch Changes
fix: change server-side route resolution endpoint (#13461)
Updated dependencies [
9612a60a0277aef0ab4723a0e7ed8dd03a7ffb95,3d88ae33fc14b08a1d48c2cb7315739c8cfcd9fd]:v5.6.1Compare Source
Patch Changes
v5.6.0Compare Source
Minor Changes
Patch Changes
09296d0f19c8d1ff57d699e637bd1beabb69d438,d62ed39a431f0db3db4dd90bf6b17ed2a2a2de79,f30352f874790b9de0bd0eba985a21aef23e158e,180fa3467e195065c0a25206c6328a908e6952d7,5906e9708965b848b468d0014999c36272dc8d50,d62ed39a431f0db3db4dd90bf6b17ed2a2a2de79]:v5.5.3Compare Source
Patch Changes
fix: include ambient type declarations (#12088)
Updated dependencies [
d440c68acac67ed64eea4b9bda267e229303db7b,6774ebc34330b12ae8c0cae08e98b577d819fffb,777c8ef11f17d2ab48aee0f2347c051663da5826,f451f6c4a3dbbc73dc86667c6ff89ab2f46ca9d2,34a03ff16af29e917abebb649b31eadfc40a98a0,1c77e283896058084c1cb5752d9ec207987a585e,04958cca5905aaeeff367c9e4a5ce6e90fc64779,9dc5c0e3e01a3c07010e9996688169be68e1dde8,00e1a7621de554054d068e4525a9e505d1c2e588,9fcd1e7574197fa6e7ac000a030378d877cb8837,e541a4057a00f5ab6740fb51b7f88f17776da50a,37f72fbb075b481de8263f62c77125333735f382,b60707ca8e755be95c86490122aa1b792b9bd6be,699f4405c752261cf46c1ad32e4dbadceaffc75b,e2a4538c48295cde06f64fb8c7f0b333fbf95496,a91ba1f326b6e244503de9a010771d942b461dad]:v5.5.2Compare Source
Patch Changes
chore: upgrade
@vercel/nftto 0.27.9 (#13129)Updated dependencies [
9fc5ff3339e543b956f7ce5eb31267fa73ee332a,85b57168189fa16fe966434ec50cc19425cab275]:v5.5.1Compare Source
Patch Changes
chore: upgrade @vercel/nft to 0.27.7 (#13082)
Updated dependencies [
78404dfe1eb346723eefc183278b85f25485b419]:v5.5.0Compare Source
Minor Changes
Patch Changes
d030f4bb285e70844d09b3f0c87809bae43014b8,67dd214863cbc5852eb0e8512efbb7bad5358e8a]:v5.4.8Compare Source
Patch Changes
chore: support building with Node 22 (#13043)
Updated dependencies [
570562b74d9e9f295d9b617478088a650f51e96b,1358cccd52190df3c74bdd8970dbfb06ffc4ec72]:v5.4.7Compare Source
Patch Changes
fix: disregard presence/absence of trailing slash in prerendered redirect (#12966)
Updated dependencies [
92b2686314a7dbebee1761c3da7719d599f003c7]:v5.4.6Compare Source
Patch Changes
docs: update URLs for new svelte.dev site (#12857)
Updated dependencies [
dcbe4222a194c5f90cfc0fc020cf065f7a4e4c46,4cdbf76fbbf0c0ce7f574ef69c8daddcf954d39d,3a9b78f04786898ca93f6d4b75ab18d26bc45192,723eb8b31e6a22c82f730c30e485386c8676b746,8ec471c875345b751344e67580ff1b772ef2735b]:v5.4.5Compare Source
Patch Changes
fix: updated
@defaultannotation for runtime (#12717)Updated dependencies [
3591411e880ed5337123c66365433afe8c2f747b,2292170ecba27c70600fae0c2adc473ac9d938e8,809983f377f0b18c4651a8a4f3af7b69c0df20ab]:v5.4.4Compare Source
Patch Changes
fix: import
node:processinstead of using globals (#12641)Updated dependencies [
e798ef718f163bed4f93e1918bd8294f765376ad]:v5.4.3Compare Source
Patch Changes
chore: configure provenance in a simpler manner (#12570)
Updated dependencies [
087a43d391fc38b8c008fb39a804dc6988974101]:v5.4.2Compare Source
Patch Changes
chore: package provenance (#12567)
Updated dependencies [
4930a8443caa53bcecee7b690cd28e429b1c8a20]:v5.4.1Compare Source
Patch Changes
.eot,.otf,.ttf,.woff, andwoff2font files when bundling (#12439)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.