chore(deps): bump svelte to v5 + kit to 2.61.x for vulnerability fixes#968
Merged
oskarszoon merged 3 commits intoMay 28, 2026
Merged
Conversation
…eck v4 + vite v7 Closes Dependabot alerts bsv-blockchain#95, bsv-blockchain#94, bsv-blockchain#46, bsv-blockchain#34, bsv-blockchain#31, bsv-blockchain#30 (six svelte CVEs patched in 5.51.5+/5.53.5+/5.55.7+). Migration depth: minimum-to-compile. Tooling bumps required by svelte v5 ecosystem peer requirements: - @sveltejs/vite-plugin-svelte ^3 -> ^6 (v6 requires vite ^6 or ^7, svelte ^5) - vite ^5.4 -> ^7 - svelte-check ^3.6 -> ^4 - @poppanator/sveltekit-svg 4.1.3 -> ^7 (drops legacy `css: "none"` flag) Component changes: - Converted 51 self-closing non-void HTML tags (<div .../> -> <div ...></div>) across 33 files. Required by svelte v5 strict HTML parsing. Done via small Python script; reviewable as one mechanical diff. - svelte:component, svelte:window etc. left as self-closing per Svelte namespace rules. No runes-mode conversion. on:click, $:, export let, slots all unchanged. Verified: npm run build succeeds, npm run test:unit (29 vitest tests) passes.
Closes Dependabot alert bsv-blockchain#14 (SvelteKit SSRF/DoS via prerender host header manipulation, GHSA-j62c-4x62-9r35; patched in 2.49.5). Bumps to latest within v2.x. Pulls devalue 5.8.1 transitively, closing 5 more alerts: - bsv-blockchain#93 __proto__ own-property emission (GHSA-mwv9-gp5h-frr4, fix in 5.6.4) - bsv-blockchain#53 parse/unflatten proto pollution (GHSA-cfw5-2vxh-hr84, fix in 5.6.4) - bsv-blockchain#35 uneval proto pollution (GHSA-8qm3-746x-r74r, fix in 5.6.3) - bsv-blockchain#16 DoS via ArrayBuffer hydration (GHSA-g2pg-6438-jwpf, fix in 5.6.2) - bsv-blockchain#15 DoS via typed array hydration (GHSA-vw5p-8cq8-m7mv, fix in 5.6.2) Verified: npm run build + npm run test:unit pass.
Contributor
|
🤖 Claude Code Review Status: Complete Current Review: No issues found. This is a clean, well-documented security-focused dependency upgrade. Summary:
Minor documentation note: |
Contributor
Benchmark Comparison ReportBaseline: Current: Summary
All benchmark results (sec/op)
Threshold: >10% with p < 0.05 | Generated: 2026-05-28 08:56 UTC |
|
ordishs
approved these changes
May 28, 2026
ordishs
left a comment
Collaborator
There was a problem hiding this comment.
Approving — surgical, well-scoped fix for 12 CVEs. Tag-closing conversions are HTML5-spec-correct and semantically identical; tooling bumps chain together coherently; vite.config.ts already omits the removed css: "none" knob so the @poppanator/sveltekit-svg v4→v7 jump is clean.
One ask before merge: please pin the Node floor in ui/dashboard/package.json — Vite 7 requires Node 20.19+ / 22.12+ and there's no engines field, .nvmrc, or version pin anywhere in the dashboard build path (Makefile:157 just calls npm install inside teranode-base:build-latest). Add:
"engines": { "node": ">=20.19.0" }so npm install fails fast if the base image ever drifts to an older Node, instead of producing a cryptic Vite/Rollup error downstream.
Non-blocking follow-ups:
- File an issue tracking the deferred runes-mode migration so deprecation warnings for
<slot>,$$slots,export let,$:, andon:eventdon't get lost in prod console logs. - Quick
npm ls eslint-plugin-storybookto confirm no peer-dep complaints on Svelte 5.
LGTM otherwise.
icellan
approved these changes
May 28, 2026
Per PR bsv-blockchain#968 review (ordishs): vite 7 requires Node 20.19+ / 22.12+. Adding `engines.node` so `npm install` fails fast if the base image ever drifts to an older Node version, instead of producing a cryptic Vite or Rollup error downstream. Lock file unchanged — only adds the engines declaration.
Contributor
Author
|
Engines pin added in
Filed #977 to track the deferred runes-mode migration so the deprecation warnings don't get lost in prod console logs. |
This was referenced May 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps
ui/dashboardfrom Svelte v4 to Svelte v5 + SvelteKit ≥ 2.61 + matching tooling. Closes 12 Dependabot alerts identified by the 2026-05-21 triage asfix_class=dep-bump-major:Closed by svelte v5 upgrade (6)
<svelte:element>injection (GHSA-m56q-vw4c-c2cp) — patched in 5.51.5Closed by @sveltejs/kit upgrade (1)
Closed transitively via kit (5)
__proto__own-property emission (GHSA-mwv9-gp5h-frr4) — patched in 5.6.4Migration depth
Minimum-to-compile. No runes-mode conversion.
on:click,$:,export let,<slot>syntax all kept. Goal was to ship the CVE fix, not refactor 88 components.Tooling bumps required by svelte v5 peer requirements
@sveltejs/vite-plugin-svelte^3.1 → ^6 (v6 requires vite ^6 or ^7, svelte ^5)vite^5.4 → ^7svelte-check^3.6 → ^4@poppanator/sveltekit-svg4.1.3 → ^7 (drops legacycss: "none"flag which svelte 5 rejects)Component changes
Svelte 5 enforces explicit closing of non-void HTML elements (
<div></div>instead of<div />). Converted 51 self-closing non-void tags across 33 files via a small mechanical pass; svelte-namespace elements (svelte:component,svelte:window, etc.) left as self-closing per Svelte's namespace rules. No semantic changes.Test plan
npm installclean (no peer-dep errors after sveltekit-svg + plugin bumps)npm run build— 1714 modules transformed, warnings only (pre-existing a11y + unused CSS)npm run test:unit -- --run— 29 vitest tests passdocker build -t teranode:latest .succeedsgo build ./...clean (sanity, no Go changes)go vet ./...only flags 4 pre-existing issues intest/utils/Out of scope
Source:
docs/superpowers/specs/2026-05-21-vuln-triage/report.mdanddocs/superpowers/specs/2026-05-27-svelte-v5-upgrade-design.md.