Update dependency svelte to v4.2.19 [SECURITY] #123
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
|
|
New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
🚮 Removed packages: npm/[email protected] |
|
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-svelte-vulnerability
branch
from
528bcd8 to
47d8abf
Compare
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.1.1->4.2.19GitHub Vulnerability Alerts
CVE-2024-45047
Summary
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Details
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
"->"&->&<-><&->&The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a
<noscript>tag.PoC
A vulnerable page (
+page.svelte):If a user accesses the following URL,
then,
alert(123)will be executed.Impact
XSS, when using an attribute within a noscript tag
Release Notes
sveltejs/svelte (svelte)
v4.2.19Compare Source
Patch Changes
fix: ensure typings for
<svelte:options>are picked up (#12902)fix: escape
<in attribute strings (#12989)v4.2.18Compare Source
Patch Changes
v4.2.17Compare Source
Patch Changes
v4.2.16Compare Source
Patch Changes
v4.2.15Compare Source
Patch Changes
v4.2.14Compare Source
Patch Changes
v4.2.13Compare Source
Patch Changes
v4.2.12Compare Source
Patch Changes
svelte:componentprops when there are spread props (#10604)v4.2.11Compare Source
Patch Changes
connectedCallback(#10466)v4.2.10Compare Source
Patch Changes
fix: add
scrollendevent type (#10336)fix: add
fetchpriorityattribute type (#10390)fix: Add
miter-clipandarcstostroke-linejoinattribute (#10377)fix: make inline doc links valid (#10366)
v4.2.9Compare Source
Patch Changes
fix: add types for popover attributes and events (#10042)
fix: add
gamepadconnectedandgamepaddisconnectedevents (#9864)fix: make
@types/estreea dependency (#10149)fix: bump
axobject-query(#10167)v4.2.8Compare Source
Patch Changes
v4.2.7Compare Source
Patch Changes
v4.2.6Compare Source
Patch Changes
v4.2.5Compare Source
Patch Changes
v4.2.4Compare Source
Patch Changes
v4.2.3Compare Source
Patch Changes
fix: improve a11y-click-events-have-key-events message (#9358)
fix: more robust hydration of html tag (#9184)
v4.2.2Compare Source
Patch Changes
fix: support camelCase properties on custom elements (#9328)
fix: add missing plaintext-only value to contenteditable type (#9242)
chore: upgrade magic-string to 0.30.4 (#9292)
fix: ignore trailing comments when comparing nodes (#9197)
v4.2.1Compare Source
Patch Changes
fix: update style directive when style attribute is present and is updated via an object prop (#9187)
fix: css sourcemap generation with unicode filenames (#9120)
fix: do not add module declared variables as dependencies (#9122)
fix: handle
svelte:elementwith dynamic this and spread attributes (#9112)fix: silence false positive reactive component warning (#9094)
fix: head duplication when binding is present (#9124)
fix: take custom attribute name into account when reflecting property (#9140)
fix: add
indeterminateto the list of HTMLAttributes (#9180)fix: recognize option value on spread attribute (#9125)
v4.2.0Compare Source
Minor Changes
svelteHTMLfrom language-tools into core to load the correctsvelte/elementtypes (#9070)v4.1.2Compare Source
Patch Changes
fix: allow child element with slot attribute within svelte:element (#9038)
fix: Add data-* to svg attributes (#9036)
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.