npm audit reports 13 advisories, mostly in dev tooling (Vite 5, Vitest 2, esbuild, tinypool). devalue ≤5.9.2, rated high, does ship in the server bundle through SvelteKit.
Fix
Upgrade SvelteKit/devalue past 5.9.2
Upgrade dev tooling (Vite, Vitest, esbuild, tinypool)
Reviewed 4f5725ee74. Both fix items are done, so I'm closing this.
Checklist
SvelteKit and devalue upgraded. SvelteKit is now ^2.70.3, and package.json:49-53 overrides devalue to ^5.9.4 and SvelteKit's cookie to ^0.7.2. npm ls resolves @sveltejs/kit@2.70.3, devalue@5.9.4 and cookie@0.7.2.
Dev tooling upgraded. Vite 7.3.7, Vitest 4.1.11 and @sveltejs/vite-plugin-svelte 6.2.4 (package.json:46-47). esbuild now resolves to 0.28.2, and tinypool is gone because Vitest 4 no longer uses it. npm audit, including dev dependencies, reports 0 vulnerabilities.
Review notes
Good extra steps: the new engines field (package.json:7) matches Vite 7's Node 22.12+ requirement, and the development guide explains the overrides and says not to audit with --omit=dev. The Docker image's node:22-alpine tracks the latest 22.x, so it meets the new minimum.
npm run check reports 0 errors, and npm run build succeeds on Vite 7.
The full test suite passes except for 1 of 2,559 tests, and that failure is pre-existing. autoscaling-lifecycle.test.ts fails about half the time both before this commit (7 of 15 runs on e9be3f7 with Vitest 2) and after it (8 of 15). The test writes the restart's requested_at (autoscaling-lifecycle.test.ts:66) and the next status time (:72) with separate new Date() calls. A status reading only counts if it's strictly newer than the latest submission, which includes restart requests (server-observation.ts:70, lifecycle-evidence.ts:16). When both timestamps land on the same millisecond, the server reads as unknown and autoscaling waits. With a 2 ms pause before :72, 0 of 15 runs failed. It only affects the test, not production, where status reads come seconds after a restart. Tracked in #79.
Minor and non-blocking: the Docker build still runs npm install --include=dev (Dockerfile:10), so the image isn't guaranteed to install the audited lockfile versions. The overrides still apply. Switching to npm ci is already covered by #69.
Reviewed 4f5725ee74936f8664c9545dcc1023444ec4b081. Both fix items are done, so I'm closing this.
**Checklist**
- [x] **SvelteKit and `devalue` upgraded.** SvelteKit is now `^2.70.3`, and `package.json:49-53` overrides `devalue` to `^5.9.4` and SvelteKit's `cookie` to `^0.7.2`. `npm ls` resolves `@sveltejs/kit@2.70.3`, `devalue@5.9.4` and `cookie@0.7.2`.
- [x] **Dev tooling upgraded.** Vite 7.3.7, Vitest 4.1.11 and `@sveltejs/vite-plugin-svelte` 6.2.4 (`package.json:46-47`). esbuild now resolves to 0.28.2, and tinypool is gone because Vitest 4 no longer uses it. `npm audit`, including dev dependencies, reports 0 vulnerabilities.
**Review notes**
- Good extra steps: the new `engines` field (`package.json:7`) matches Vite 7's Node 22.12+ requirement, and the development guide explains the overrides and says not to audit with `--omit=dev`. The Docker image's `node:22-alpine` tracks the latest 22.x, so it meets the new minimum.
- `npm run check` reports 0 errors, and `npm run build` succeeds on Vite 7.
- The full test suite passes except for 1 of 2,559 tests, and that failure is pre-existing. `autoscaling-lifecycle.test.ts` fails about half the time both before this commit (7 of 15 runs on e9be3f7 with Vitest 2) and after it (8 of 15). The test writes the restart's `requested_at` (`autoscaling-lifecycle.test.ts:66`) and the next status time (`:72`) with separate `new Date()` calls. A status reading only counts if it's strictly newer than the latest submission, which includes restart requests (`server-observation.ts:70`, `lifecycle-evidence.ts:16`). When both timestamps land on the same millisecond, the server reads as unknown and autoscaling waits. With a 2 ms pause before `:72`, 0 of 15 runs failed. It only affects the test, not production, where status reads come seconds after a restart. Tracked in #79.
- Minor and non-blocking: the Docker build still runs `npm install --include=dev` (`Dockerfile:10`), so the image isn't guaranteed to install the audited lockfile versions. The overrides still apply. Switching to `npm ci` is already covered by #69.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
npm auditreports 13 advisories, mostly in dev tooling (Vite 5, Vitest 2, esbuild, tinypool).devalue≤5.9.2, rated high, does ship in the server bundle through SvelteKit.Fix
devaluepast 5.9.2References:
Reviewed
4f5725ee74. Both fix items are done, so I'm closing this.Checklist
devalueupgraded. SvelteKit is now^2.70.3, andpackage.json:49-53overridesdevalueto^5.9.4and SvelteKit'scookieto^0.7.2.npm lsresolves@sveltejs/kit@2.70.3,devalue@5.9.4andcookie@0.7.2.@sveltejs/vite-plugin-svelte6.2.4 (package.json:46-47). esbuild now resolves to 0.28.2, and tinypool is gone because Vitest 4 no longer uses it.npm audit, including dev dependencies, reports 0 vulnerabilities.Review notes
enginesfield (package.json:7) matches Vite 7's Node 22.12+ requirement, and the development guide explains the overrides and says not to audit with--omit=dev. The Docker image'snode:22-alpinetracks the latest 22.x, so it meets the new minimum.npm run checkreports 0 errors, andnpm run buildsucceeds on Vite 7.autoscaling-lifecycle.test.tsfails about half the time both before this commit (7 of 15 runs one9be3f7with Vitest 2) and after it (8 of 15). The test writes the restart'srequested_at(autoscaling-lifecycle.test.ts:66) and the next status time (:72) with separatenew Date()calls. A status reading only counts if it's strictly newer than the latest submission, which includes restart requests (server-observation.ts:70,lifecycle-evidence.ts:16). When both timestamps land on the same millisecond, the server reads as unknown and autoscaling waits. With a 2 ms pause before:72, 0 of 15 runs failed. It only affects the test, not production, where status reads come seconds after a restart. Tracked in #79.npm install --include=dev(Dockerfile:10), so the image isn't guaranteed to install the audited lockfile versions. The overrides still apply. Switching tonpm ciis already covered by #69.