chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates by dependabot[bot] · Pull Request #1 · danielbodnar/browsercode

dependabot · 2026-06-13T00:43:53Z

Bumps the npm_and_yarn group with 3 updates in the / directory: @sveltejs/kit, svelte and esbuild.

Updates @sveltejs/kit from 2.59.1 to 2.65.0

Release notes

Sourced from @sveltejs/kit's releases.

@sveltejs/kit@2.65.0

Minor Changes

feat: allow queries to refresh other queries (#16012)

Patch Changes

fix: dedupe remote data (#15991)

fix: skip client build if all routes have CSR disabled (#15936)

@sveltejs/kit@2.64.0

Minor Changes

feat: allow commands to receive File objects (#15978)

Patch Changes

fix: avoid server components from being bundled if SSR is turned off for a route (#15982)

@sveltejs/kit@2.63.1

Patch Changes

fix: use SSE for query.live (#15957)

fix: use forward slashes in the generated env.d.ts import path on Windows (#15977)

fix: allow $app/environment with a warning when explicitEnvironmentVariables is enabled (#15980)

fix: avoid importing Vite while validating explicit environment variables (#15953)

docs: adjust the release version of explicit env vars (#15968)

fix: ensure version is defined when importing from $app/env with explicit environment variables (#15971)

@sveltejs/kit@2.63.0

Minor Changes

... (truncated)

Changelog

Sourced from @sveltejs/kit's changelog.

2.65.0

Minor Changes

feat: allow queries to refresh other queries (#16012)

Patch Changes

fix: dedupe remote data (#15991)

fix: skip client build if all routes have CSR disabled (#15936)

2.64.0

Minor Changes

feat: allow commands to receive File objects (#15978)

Patch Changes

fix: avoid server components from being bundled if SSR is turned off for a route (#15982)

2.63.1

Patch Changes

fix: use SSE for query.live (#15957)

fix: use forward slashes in the generated env.d.ts import path on Windows (#15977)

fix: allow $app/environment with a warning when explicitEnvironmentVariables is enabled (#15980)

fix: avoid importing Vite while validating explicit environment variables (#15953)

docs: adjust the release version of explicit env vars (#15968)

fix: ensure version is defined when importing from $app/env with explicit environment variables (#15971)

2.63.0

Minor Changes

... (truncated)

Commits

ce77bf3 Version Packages (#15988)
372a6a6 fix: dedupe remote data (#15991)
607713e fix: copy public directory assets if client build is skipped (#16004)
3968fb9 fix: skip client build if all routes have CSR disabled (#15936)
1c30797 Version Packages (#15984)
c630529 feat: allow commands to receive File objects (#15978)
1a2c1fd fix: avoid adding the component to the server node if SSR is turned off (#15982)
33dec0e Version Packages (#15962)
0fd507c fix: allow $app/environment with a warning when `explicitEnvironmentVariabl...
a31fdc6 docs: fix explicit env vars docs version (#15968)
Additional commits viewable in compare view

Updates svelte from 5.55.5 to 5.56.3

Release notes

Sourced from svelte's releases.

svelte@5.56.3

Patch Changes

fix: ignore errors that occur in destroyed effects (#18384)

fix: type BigInts in $state.snapshot(...) return values (#18388)

svelte@5.56.2

Patch Changes

fix: properly track effect end node for async sibling component (#18371)

fix: prevent false-positive reactivity loss warning (#18373)

chore: bump esrap dependency (#18372)

fix: ignore declaration tags for animation directive (#18366)

fix: reject pending async deriveds on discard (#18308)

svelte@5.56.1

Patch Changes

fix: error at compile time on duplicate snippet/declaration tag definitions (#18351)

fix: parse declaration tag contents more robustly (#18353)

fix: correctly transform references to earlier declarators in a declaration tag (e.g. {let a = $state(0), b = $derived(a * 2)}) (#18348)

fix: avoid spurious state_referenced_locally warnings for $derived declarations in declaration tags (#18348)

fix: tolerate whitespace before let/const in declaration tags (#18348)

fix: prevent infinite loop when a tag's expression ends with a trailing / at the end of the input (#18350)

fix: more robust parsing of declaration tags with regards to type (#18330)

fix: preserve newlines in spread input values when the type attribute is applied after value (#18345)

fix: update SvelteURLSearchParams when setting duplicate keys to the same joined value (#18336)

fix: check references for blockers on server, too (#18352)

svelte@5.56.0

Minor Changes

feat: allow declarations in the template (#18282)

Patch Changes

... (truncated)

Changelog

Sourced from svelte's changelog.

5.56.3

Patch Changes

fix: ignore errors that occur in destroyed effects (#18384)

fix: type BigInts in $state.snapshot(...) return values (#18388)

5.56.2

Patch Changes

fix: properly track effect end node for async sibling component (#18371)

fix: prevent false-positive reactivity loss warning (#18373)

chore: bump esrap dependency (#18372)

fix: ignore declaration tags for animation directive (#18366)

fix: reject pending async deriveds on discard (#18308)

5.56.1

Patch Changes

fix: error at compile time on duplicate snippet/declaration tag definitions (#18351)

fix: parse declaration tag contents more robustly (#18353)

fix: correctly transform references to earlier declarators in a declaration tag (e.g. {let a = $state(0), b = $derived(a * 2)}) (#18348)

fix: avoid spurious state_referenced_locally warnings for $derived declarations in declaration tags (#18348)

fix: tolerate whitespace before let/const in declaration tags (#18348)

fix: prevent infinite loop when a tag's expression ends with a trailing / at the end of the input (#18350)

fix: more robust parsing of declaration tags with regards to type (#18330)

fix: preserve newlines in spread input values when the type attribute is applied after value (#18345)

fix: update SvelteURLSearchParams when setting duplicate keys to the same joined value (#18336)

fix: check references for blockers on server, too (#18352)

5.56.0

Minor Changes

... (truncated)

Commits

a9f4854 Version Packages (#18389)
71a6515 fix: check boundary exists before calling error handler in async derived (#18...
3d83c9a fix: add bigint to Primitive type for $state.snapshot (#18388)
51baf1c Version Packages (#18357)
3d5c4ab fix: prevent false-positive reactivity loss warning (#18373)
bdb1a0f fix: ensure async block assigns correct nodes to effect (#18371)
e4bfc5f chore: bump esrap dependency (#18372)
1b4c43b fix: ignore declaration tags for animation directive (#18366)
85dcb91 chore: upgrade to vitest v4 (#18265)
a81f965 fix: reject pending async deriveds on discard (#18308)
Additional commits viewable in compare view

Updates devalue from 5.8.0 to 5.8.1

Release notes

Sourced from devalue's releases.

v5.8.1

Patch Changes

206ca67: fix: force sparse arrays to allocate sparsely

Changelog

Sourced from devalue's changelog.

5.8.1

Patch Changes

206ca67: fix: force sparse arrays to allocate sparsely

Commits

796ea83 Version Packages (#152)
206ca67 Merge commit from fork
See full diff in compare view

Removes esbuild

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 3 updates in the / directory: [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit), [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) and [esbuild](https://github.com/evanw/esbuild). Updates `@sveltejs/kit` from 2.59.1 to 2.65.0 - [Release notes](https://github.com/sveltejs/kit/releases) - [Changelog](https://github.com/sveltejs/kit/blob/main/packages/kit/CHANGELOG.md) - [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/kit@2.65.0/packages/kit) Updates `svelte` from 5.55.5 to 5.56.3 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.56.3/packages/svelte) Updates `devalue` from 5.8.0 to 5.8.1 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.8.0...v5.8.1) Removes `esbuild` --- updated-dependencies: - dependency-name: "@sveltejs/kit" dependency-version: 2.65.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: svelte dependency-version: 5.56.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.8.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-06-13T00:44:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
@sveltejs/kit@2.59.1 ⏵ 2.65.0		⁺²	⁺¹	⁺¹
@sveltejs/vite-plugin-svelte@6.2.4 ⏵ 7.1.2	⁺¹		⁺¹
vite@7.3.2 ⏵ 8.0.16	⁺¹		⁺¹
svelte@5.55.5 ⏵ 5.56.3	⁺¹	⁺⁶	⁺¹

View full report

socket-security · 2026-06-13T00:44:27Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Potential security risk (AI signal): npm `@emnapi/core` Notes: undefined Confidence: undefined Severity: undefined From: package-lock.json → `npm/vite@8.0.16` → `npm/@emnapi/core@1.10.0` ℹ Read more on: This package \| This alert \| What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/core@1.10.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Recently published: npm `@napi-rs/wasm-runtime` published 3 days ago Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/@napi-rs/wasm-runtime@1.1.5` ℹ Read more on: This package \| This alert \| What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@napi-rs/wasm-runtime@1.1.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Potential security risk (AI signal): npm `@sveltejs/kit` Notes: undefined Confidence: undefined Severity: undefined From: package-lock.json → `npm/@sveltejs/kit@2.65.0` ℹ Read more on: This package \| This alert \| What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@sveltejs/kit@2.65.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Recently published: npm `@sveltejs/kit` published 2 days ago Location: Package overview From: package-lock.json → `npm/@sveltejs/kit@2.65.0` ℹ Read more on: This package \| This alert \| What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@sveltejs/kit@2.65.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Recently published: npm `obug` published 11 hours ago Location: Package overview From: package-lock.json → `npm/@sveltejs/vite-plugin-svelte@7.1.2` → `npm/obug@2.1.3` ℹ Read more on: This package \| This alert \| What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/obug@2.1.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Recently published: npm `svelte` published 5 days ago Location: Package overview From: package-lock.json → `npm/svelte@5.56.3` ℹ Read more on: This package \| This alert \| What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/svelte@5.56.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `@emnapi/core` reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/@emnapi/core@1.10.0` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/core@1.10.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `@emnapi/wasi-threads` reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/@emnapi/wasi-threads@1.2.1` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/wasi-threads@1.2.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `@rolldown/binding-wasm32-wasi` Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/@rolldown/binding-wasm32-wasi@1.0.3` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@rolldown/binding-wasm32-wasi@1.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `@rolldown/binding-wasm32-wasi` Env Vars: NAPI_RS_ASYNC_WORK_POOL_SIZE Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/@rolldown/binding-wasm32-wasi@1.0.3` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@rolldown/binding-wasm32-wasi@1.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `@rolldown/binding-wasm32-wasi` reads UV_THREADPOOL_SIZE Env Vars: UV_THREADPOOL_SIZE Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/@rolldown/binding-wasm32-wasi@1.0.3` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@rolldown/binding-wasm32-wasi@1.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `@tybys/wasm-util` Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/@tybys/wasm-util@0.10.2` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tybys/wasm-util@0.10.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `@tybys/wasm-util` reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/@tybys/wasm-util@0.10.2` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tybys/wasm-util@0.10.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `@tybys/wasm-util` reads NODE_DEBUG_NATIVE Env Vars: NODE_DEBUG_NATIVE Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/@tybys/wasm-util@0.10.2` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@tybys/wasm-util@0.10.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `rolldown` reads NAPI_RS_NATIVE_LIBRARY_PATH Env Vars: NAPI_RS_NATIVE_LIBRARY_PATH Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/rolldown@1.0.3` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown@1.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `rolldown` Env Vars: NAPI_RS_ENFORCE_VERSION_CHECK Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/rolldown@1.0.3` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown@1.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `rolldown` reads NAPI_RS_FORCE_WASI Env Vars: NAPI_RS_FORCE_WASI Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/rolldown@1.0.3` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown@1.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `rolldown` Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/rolldown@1.0.3` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown@1.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `rolldown` reads NODE_ENV Env Vars: NODE_ENV Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/rolldown@1.0.3` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown@1.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `rolldown` reads CONSOLA_LEVEL Env Vars: CONSOLA_LEVEL Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/rolldown@1.0.3` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown@1.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Environment variable access: npm `rolldown` reads ROLLDOWN_TEST Env Vars: ROLLDOWN_TEST Location: Package overview From: package-lock.json → `npm/vite@8.0.16` → `npm/rolldown@1.0.3` ℹ Read more on: This package \| This alert \| What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rolldown@1.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 13, 2026

Navigation Menu

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates - #1

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-effb8a5d70

dependabot Bot commented on behalf of github Jun 13, 2026

Uh oh!

socket-security Bot commented Jun 13, 2026

Uh oh!

socket-security Bot commented Jun 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 13, 2026

@​sveltejs/kit@​2.65.0

Minor Changes

Patch Changes

@​sveltejs/kit@​2.64.0

Minor Changes

Patch Changes

@​sveltejs/kit@​2.63.1

Patch Changes

@​sveltejs/kit@​2.63.0

Minor Changes

2.65.0

Minor Changes

Patch Changes

2.64.0

Minor Changes

Patch Changes

2.63.1

Patch Changes

2.63.0

Minor Changes

svelte@5.56.3

Patch Changes

svelte@5.56.2

Patch Changes

svelte@5.56.1

Patch Changes

svelte@5.56.0

Minor Changes

Patch Changes

5.56.3

Patch Changes

5.56.2

Patch Changes

5.56.1

Patch Changes

5.56.0

Minor Changes

v5.8.1

Patch Changes

5.8.1

Patch Changes

Uh oh!

socket-security Bot commented Jun 13, 2026

Uh oh!

socket-security Bot commented Jun 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`@sveltejs/kit@2`.65.0

`@sveltejs/kit@2`.64.0

`@sveltejs/kit@2`.63.1

`@sveltejs/kit@2`.63.0