[dependabot]

Bumps the npm_and_yarn group with 2 updates in the /svelte directory: dompurify and @sveltejs/kit.

Updates dompurify from 3.4.16 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

• Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
• Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
• Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
• Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
• Added a purify-edge test runner as a compatibility check, thanks @​anzal1
• Clarified the IN_PLACE documentation in the README about possible risks
• Updated several dependencies

Commits

• a77a3e7 release: 3.4.17 (#1672)
• See full diff in compare view

Updates @sveltejs/kit from 2.70.3 to 3.1.1

Release notes

Sourced from @​sveltejs/kit's releases.

@​sveltejs/kit@​3.1.1

Patch Changes

• fix: return a 400 response instead of throwing when reroute rewrites a malformed pathname (1d21a3b)

• fix: restore function snapshots on reload when SSR is disabled (#17477)

• fix: prevent separate non-exported query.batch functions from sharing a batch (3529813)

• fix: reuse the original fetch across dev server reloads (#17548)

• fix: avoid adding a file watcher while loading src/env (#17502)

• fix: parse remote form submissions in linear time (d593e7e)

• fix: prevent server-side route resolution from loading code from another origin for pathnames starting with // (dd63fd1)

• fix: preserve service worker sourcemaps when injecting env (#17566)

• fix: prevent server-only modules from being imported into browser code via src/params.js (ae07803)

• fix: avoid injecting a non-serializable TypeScript config callback by default (#17512)

• fix: report actionable errors for remote modules in server-only locations (#17567)

@​sveltejs/kit@​3.1.0

Minor Changes

• feat: support report-sha256/report-sha384/report-sha512 CSP hash-reporting keywords (#17398)

• feat: emit a sveltekit.endpoint span for +server handlers when server tracing is enabled (#17325)

Patch Changes

• fix: don't treat every module as server-only when the project is inside a server directory (#17376)

• fix: continue deployment recovery when service worker updates fail (#17440)

• fix: infer prerendered MIME types from generated files (#17381)

• fix: leave generated files alone when their contents are unchanged (#17310)

• fix: leave focus in the parent page when an app in an unfocused iframe starts or navigates (#17297)

• fix: don't warn about Storybook's Vite plugins that use transformIndexHtml (#17373)

@​sveltejs/kit@​3.0.1

Patch Changes

• fix: ensure relative imports in generated types work with nodenext module resolution (#17351)

... (truncated)

Changelog

Sourced from @​sveltejs/kit's changelog.

3.1.1

Patch Changes

• fix: return a 400 response instead of throwing when reroute rewrites a malformed pathname (1d21a3b)

• fix: restore function snapshots on reload when SSR is disabled (#17477)

• fix: prevent separate non-exported query.batch functions from sharing a batch (3529813)

• fix: reuse the original fetch across dev server reloads (#17548)

• fix: avoid adding a file watcher while loading src/env (#17502)

• fix: parse remote form submissions in linear time (d593e7e)

• fix: prevent server-side route resolution from loading code from another origin for pathnames starting with // (dd63fd1)

• fix: preserve service worker sourcemaps when injecting env (#17566)

• fix: prevent server-only modules from being imported into browser code via src/params.js (ae07803)

• fix: avoid injecting a non-serializable TypeScript config callback by default (#17512)

• fix: report actionable errors for remote modules in server-only locations (#17567)

3.1.0

Minor Changes

• feat: support report-sha256/report-sha384/report-sha512 CSP hash-reporting keywords (#17398)

• feat: emit a sveltekit.endpoint span for +server handlers when server tracing is enabled (#17325)

Patch Changes

• fix: don't treat every module as server-only when the project is inside a server directory (#17376)

• fix: continue deployment recovery when service worker updates fail (#17440)

• fix: infer prerendered MIME types from generated files (#17381)

• fix: leave generated files alone when their contents are unchanged (#17310)

• fix: leave focus in the parent page when an app in an unfocused iframe starts or navigates (#17297)

• fix: don't warn about Storybook's Vite plugins that use transformIndexHtml (#17373)

3.0.1

... (truncated)

Commits

• 3d85a7a Version Packages
• 9ed55b4 only treat params as a client entrypoint with client-side route resolution
• ae07803 fix: prevent server-only modules from being imported into browser code via sr...
• a8f7c1e Merge commit from fork
• 7993d5e Merge commit from fork
• 24d8ee4 Merge commit from fork
• 2c190fe Merge commit from fork
• 8503225 Merge pull request #17548 from sachinkr7368/fix/dev-fetch-wrapper-leak
• a2fa1c0 Merge pull request #17566 from CNSeniorious000/fix/service-worker-sourcemap
• b378468 test: check service worker sourcemaps in options-3
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.