SvelteKit 3.1.1 Fixes, Wrangler 4.156, Astro 7.4.4

Executive Summary

• SvelteKit 3.1.1 (Oct 29) ships 11 patches, including a fix that stops server-side route resolution loading code from another origin for pathnames starting with //, and a linear-time parser for remote form submissions. See the release notes.
• Wrangler 4.155.0 and 4.156.0 (Oct 28 and 29) add remote Analytics Engine bindings in local dev, account-wide D1 insights, and a protective .assetsignore so autoconfig no longer uploads files like .env or .git. Notes: 4.155.0 and 4.156.0.
• Astro 7.4.4 (notes) and BullMQ 6.5.1 (notes) are small patches from Oct 28. Motion 14.8.0 landed Oct 29 with no published notes.
• Still open if unpatched: the Oct 21 Node.js security releases (10 CVEs, four High).

SvelteKit 3.1.1: 11 Patches, Two Security-Relevant

The 3.1.1 release is all patch changes. The release notes do not label any of them as advisories, but several touch trust boundaries: server-side route resolution no longer loads code from another origin for pathnames starting with //, server-only modules can no longer be pulled into browser code through src/params.js, and remote form submissions are now parsed in linear time. Other fixes: a malformed pathname rewritten by reroute now returns a 400 instead of throwing, query.batch functions that are separate and not exported no longer share a batch, and the dev server reuses the original fetch across reloads.

If you use a reroute hook, check how it handles malformed input after upgrading:

Upgrade command:

npm install @sveltejs/[email protected]
npx svelte-kit sync

Wrangler 4.155 and 4.156: Safer Autoconfig, Wider D1 Insights

4.156.0 fixes a path comparison bug that stopped autoconfig from writing a protective .assetsignore when it used the project root as the static assets directory, so files such as .env and .git could be uploaded. The generated file now covers more paths, and non-interactive autoconfig exits with an error when a root holds both static files and a Pages functions directory. The experimental wrangler d1 insights command now runs across every database in the account when no name is given, and fails with a clear message (including the Account Analytics: Read permission) instead of printing an empty list. Durable Object self-references are fixed in @cloudflare/vitest-plugin and container validation.

4.155.0 adds remote Analytics Engine bindings in local development, tail output that renders terminal control characters as visible text, preserved Flagship flag metadata on update, and UTF-8 validation of .assetsignore before building asset manifests.

// wrangler.jsonc: send local Analytics Engine writes to the real dataset
{
  "analytics_engine_datasets": [
    { "binding": "EVENTS", "dataset": "app_events", "remote": true }
  ]
}

npx wrangler d1 insights   # experimental: top queries across all D1 databases

If you previously ran autoconfig on a project root, review what was uploaded and rotate anything sensitive that may have been included.

Astro 7.4.4, BullMQ 6.5.1, Motion 14.8.0

• Astro 7.4.4: astro add can now configure tagged versions of official adapters (notes).
• BullMQ 6.5.1: flows now defer releasing the parent until all children are added, fixing issue #4944 in the Python, Elixir, Rust and .NET implementations (notes).
• Motion 14.8.0: published Oct 29 as a minor release. The GitHub release page lists no notes, so read the changelog diff before upgrading.

Carry-Over: Node.js Security Releases

Node.js 26.12.1, 24.22.1 and 22.23.4 fix 10 CVEs. The High ones are CVE-2026-111497 (Brotli decoder out-of-bounds write), CVE-2026-105482 (DNS NUL truncation), CVE-2026-105483 and CVE-2026-106069 (TLS IP identity checks). The official advisory notes that end-of-life lines are always affected. Rebuild container images on a patched runtime.

node --version   # want v26.12.1, v24.22.1 or v22.23.4

Scope Note

This audit checked npm publish times and GitHub release pages. Next.js 16.5.0 canaries continue daily (npm), with 16.4.3 still the stable tag. I did not find verifiable Oct 29 stable releases for the other tools on the list, so none are claimed here.

Action Items

1. Upgrade SvelteKit to 3.1.1.
2. Move Wrangler to 4.156.0 and audit anything autoconfig uploaded from a project root.
3. Confirm every Node.js runtime and image is on a patched version.