chore(deps): update dependency svelte to v5.55.7 [security] #3
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/npm-svelte-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
5.43.6→5.55.7Svelte SSR attribute spreading includes inherited properties from prototype chain
CVE-2026-27125 / GHSA-crpf-4hrx-3jrp
More information
Details
In server-side rendering, attribute spreading on elements (e.g.
<div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments whereObject.prototypehas already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected.Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Svelte affected by cross-site scripting via spread attributes in Svelte SSR
CVE-2026-27121 / GHSA-f7gr-6p89-r883
More information
Details
Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers.
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Svelte affected by XSS in SSR
<option>elementCVE-2026-27119 / GHSA-h7h7-mm68-gmrc
More information
Details
In certain circumstances, the server-side rendering output of an
<option>element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected.Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Svelte SSR does not validate dynamic element tag names in
<svelte:element>CVE-2026-27122 / GHSA-m56q-vw4c-c2cp
More information
Details
When using
<svelte:element this={tag}>in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected.Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Svelte vulnerable to XSS during SSR with contenteditable
bind:innerTextandbind:textContentCVE-2026-27901 / GHSA-phwv-c562-gvmh
More information
Details
The contents of
bind:innerTextandbind:textContentoncontenteditableelements were not properly escaped. This could enable HTML injection and Cross-site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server.Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Svelte SSR vulnerable to cross-site scripting via spread attributes
CVE-2026-42599 / GHSA-pr6f-5x2q-rwfp
More information
Details
When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability only triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires.
This is similar to but different from CVE-2026-27121.
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
CVE-2026-42573 / GHSA-rcqx-6q8c-2c42
More information
Details
Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.
You are vulnerable if all of the following is true:
nameattribute on an input or button element within that formSeverity
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
sveltejs/svelte (svelte)
v5.55.7Compare Source
Patch Changes
fix: prevent XSS on
hydratablefrom user contents (a16ebc67bbcf8f708360195687e1b2719463e1a4)chore: bump devalue (#18219)
fix: disallow empty attribute names during SSR (
547853e2406a2147ad7fb5ffeba95b01bd9642da)fix: harden regex (
d2375e2ebcab5c88feb5652f1a9d621b8f06b259)fix: move Svelte runtime properties to symbols (
e1cbbd96441e82c9eb8a23a2903c0d06d3cda991)v5.55.6Compare Source
Patch Changes
fix: leave stale promises to wait for a later resolution, instead of rejecting (#18180)
fix: keep dependencies of
$state.eager/pending(#18218)fix: reapply context after transforming error during SSR (#18099)
fix: don't rebase just-created batches (#18117)
chore: allow
nullforpendingin typings (#18201)fix: flush eager effects in production (#18107)
fix: rethrow error of failed iterable after calling
return()(#18169)fix: account for proxified instance when updating
bind:this(#18147)fix: ensure scheduled batch is flushed if not obsolete (#18131)
fix: resolve stale deriveds with latest value (#18167)
chore: remove unnecessary
increment_pendingcalls (#18183)fix: correctly compile component member expressions for SSR (#18192)
fix: reset
source.updatedstack traces afterflush(#18196)fix: replacing async 'blocking' strategy with 'merging' (#18205)
fix: allow
@debugtags to reference awaited variables (#18138)fix: re-run fallback props if dependencies update (#18146)
fix: abort running obsolete async branches (#18118)
fix: ignore comments when reading CSS values (#18153)
fix: wrap
Promise.allinsaveduring SSR (#18178)fix: ignore false-positive errors of
$inspectdependencies (#18106)v5.55.5Compare Source
Patch Changes
fix: don't mark deriveds while an effect is updating (#18124)
fix: do not dispatch introstart event with animation of animate directive (#18122)
v5.55.4Compare Source
Patch Changes
fix: never mark a child effect root as inert (#18111)
fix: reset context after waiting on blockers of
@constexpressions (#18100)fix: keep flushing new eager effects (#18102)
v5.55.3Compare Source
Patch Changes
fix: ensure proper HMR updates for dynamic components (#18079)
fix: correctly calculate
@constblockers (#18039)fix: freeze deriveds once their containing effects are destroyed (#17921)
fix: defer error boundary rendering in forks (#18076)
fix: avoid false positives for reactivity loss warning (#18088)
v5.55.2Compare Source
Patch Changes
fix: invalidate
@consttags based on visible references in legacy mode (#18041)fix: handle parens in template expressions more robustly (#18075)
fix: disallow
--inidPrefix(#18038)fix: correct types for
ontoggleon<details>elements (#18063)fix: don't override
$destroy/set/oninstance methods in dev mode (#18034)fix: unskip branches of earlier batches after commit (#18048)
fix: never set derived.v inside fork (#18037)
fix: skip rebase logic in non-async mode (#18040)
fix: don't reset status of uninitialized deriveds (#18054)
v5.55.1Compare Source
Patch Changes
fix: unlink errored and otherwise finished batch (#18264)
perf: walk composedPath() directly in delegated event propagation (#18268)
fix: transfer effects when merging batches (#18254)
fix: allow
$derived(await ...)in disconnected effect roots (#18273)fix: remove temporary raw-text hydration markers (#18269)
fix: propagate async
@constblockers through closure references so template expressions like{(() => host)()}correctly wait for the awaited value (#18309)fix: properly unlink batches (#18298)
fix: settle discarded batch (#18290)
fix: declare
let:directives before{@const}declarations on slotted elements (#18271)fix: resume outro-ed branches if they were kept around (#18291)
fix: avoid waterfall-warning when async resolves to same value (#18297)
fix: correctly coordinate component-level effects inside async blocks (#18260)
fix: make unnecessary commit work less likely (#18263)
chore: add tag name to
a11y_click_events_have_key_eventswarning (#18272)fix: catch rejected promises while merging/committing (#18266)
v5.55.0Compare Source
Minor Changes
Patch Changes
v5.54.1Compare Source
Patch Changes
fix: hydration comments during hmr (#17975)
fix: null out
effect.bindestroy_effect(#17980)fix: group sync statements (#17977)
fix: defer batch resolution until earlier intersecting batches have committed (#17162)
fix: properly invoke
iterator.return()during reactivity loss check (#17966)fix: remove trailing semicolon from {@const} tag printer (#17962)
v5.54.0Compare Source
Minor Changes
css,runes,customElementcompiler options to be functions (#17951)Patch Changes
v5.53.13Compare Source
Patch Changes
fix: ensure
$inspectafter top level await doesn't break builds (#17943)fix: resume inert effects when they come from offscreen (#17942)
fix: don't eagerly access not-yet-initialized functions in template (#17938)
fix: discard batches made obsolete by commit (#17934)
fix: ensure "is standalone child" is correctly reset (#17944)
fix: remove nodes in boundary when work is pending and HMR is active (#17932)
v5.53.12Compare Source
Patch Changes
fix: update
select.__valueonchange(#17745)chore: add
invarianthelper for debugging (#17929)fix: ensure deriveds values are correct across batches (#17917)
fix: handle async RHS in
assignment_value_stale(#17925)fix: avoid traversing clean roots (#17928)
v5.53.11Compare Source
Patch Changes
fix: remove
untrackcircular dependency (#17910)fix: recover from errors that leave a corrupted effect tree (#17888)
fix: properly lazily evaluate RHS when checking for
assignment_value_stale(#17906)fix: resolve boundary in correct batch when hydrating (#17914)
chore: rebase batches after process, not during (#17900)
v5.53.10Compare Source
Patch Changes
v5.53.9Compare Source
Patch Changes
bind:thiscleanup timing (#17885)v5.53.8Compare Source
Patch Changes
fix:
{@html}no longer duplicates content insidecontenteditableelements (#17853)fix: don't access inert block effects (#17882)
fix: handle asnyc updates within pending boundary (#17873)
perf: avoid re-traversing the effect tree after
$:assignments (#17848)chore: simplify scheduling logic (#17805)
v5.53.7Compare Source
Patch Changes
fix: correctly add __svelte_meta after else-if chains (#17830)
perf: cache element interactivity and source line splitting in compiler (#17839)
chore: avoid rescheduling effects during branch commit (#17837)
perf: optimize CSS selector pruning (#17846)
fix: preserve original boundary errors when keyed each rows are removed during async updates (#17843)
perf: avoid O(n²) name scanning in scope
generateandunique(#17844)fix: preserve each items that are needed by pending batches (#17819)
v5.53.6Compare Source
Patch Changes
perf: optimize parser hot paths for faster compilation (#17811)
fix:
SvelteMapincorrectly handles keys withundefinedvalues (#17826)fix: SvelteURL
searchsetter now returns the normalized value, matching native URL behavior (#17828)fix: visit synthetic value node during ssr (#17824)
fix: always case insensitive event handlers during ssr (#17822)
chore: more efficient effect scheduling (#17808)
perf: optimize compiler analysis phase (#17823)
fix: skip redundant batch.apply (#17816)
chore: null out current_batch before committing branches (#17809)
v5.53.5Compare Source
Patch Changes
fix: escape
innerTextandtextContentbindings ofcontenteditable(0df5abcae223058ceb95491470372065fb87951d)fix: sanitize
transformErrorvalues prior to embedding in HTML comments (0298e979371bb583855c9810db79a70a551d22b9)v5.53.4Compare Source
Patch Changes
fix: set server context after async transformError (#17799)
fix: hydrate if blocks correctly (#17784)
fix: handle default parameters scope leaks (#17788)
fix: prevent flushed effects from running again (#17787)
v5.53.3Compare Source
Patch Changes
fix: render
:catchof#awaitblock with correct key (#17769)chore: pin aria-query@5.3.1 (#17772)
fix: make string coercion consistent to
toString(#17774)v5.53.2Compare Source
Patch Changes
fix: update expressions on server deriveds (#17767)
fix: further obfuscate
node:cryptoimport from overzealous static analysis (#17763)v5.53.1Compare Source
Patch Changes
fix: ensure
$inspectafter top level await doesn't break builds (#17943)fix: resume inert effects when they come from offscreen (#17942)
fix: don't eagerly access not-yet-initialized functions in template (#17938)
fix: discard batches made obsolete by commit (#17934)
fix: ensure "is standalone child" is correctly reset (#17944)
fix: remove nodes in boundary when work is pending and HMR is active (#17932)
v5.53.0Compare Source
Minor Changes
feat: allow comments in tags (#17671)
feat: allow error boundaries to work on the server (#17672)
Patch Changes
fix: use TrustedHTML to test for customizable
<select>support, where necessary (#17743)fix: ensure head effects are kept in the effect tree (#17746)
chore: deactivate current_batch by default in unset_context (#17738)
v5.52.0Compare Source
Minor Changes
{@html}expressions (#17701)Patch Changes
fix: repair dynamic component truthy/falsy hydration mismatches (#17737)
fix: re-run non-render-bound deriveds on the server (#17674)
v5.51.5Compare Source
Patch Changes
fix: check to make sure
svelte:elementtags are valid during SSR (73098bb26c6f06e7fd1b0746d817d2c5ee90755f)fix: misc option escaping and backwards compatibility (#17741)
fix: strip event handlers during SSR (
a0c7f289156e9fafaeaf5ca14af6c06fe9b9eae5)fix: replace usage of
for inwithfor of Object.keys(f89c7ddd7eebaa1ef3cc540400bec2c9140b330c)fix: always escape option body in SSR (
f7c80da18c215e3727c2a611b0b8744cc6e504c5)chore: upgrade
devalue(#17739)v5.51.4Compare Source
Patch Changes
chore: proactively defer effects in pending boundary (#17734)
fix: detect and error on non-idempotent each block keys in dev mode (#17732)
v5.51.3Compare Source
Patch Changes
fix: prevent event delegation logic conflicting between svelte instances (#17728)
fix: treat CSS attribute selectors as case-insensitive for HTML enumerated attributes (#17712)
fix: locate Rollup annontaion friendly to JS downgraders (#17724)
fix: run effects in pending snippets (#17719)
v5.51.2Compare Source
Patch Changes
fix: take async into consideration for dev delegated handlers (#17710)
fix: emit state_referenced_locally warning for non-destructured props (#17708)
v5.51.1Compare Source
Patch Changes
fix: don't crash on undefined
document.contentType(#17707)fix: use symbols for encapsulated event delegation (#17703)
v5.51.0Compare Source
Minor Changes
TrustedTypesfor HTML handling where supported (#16271)Patch Changes
fix: sanitize template-literal-special-characters in SSR attribute values (#17692)
fix: follow-up formatting in
print()— flush block-level elements into separate sequences (#17699)fix: preserve delegated event handlers as long as one or more root components are using them (#17695)
v5.50.3Compare Source
Patch Changes
fix: take into account
nodeNamecase sensitivity on XHTML pages (#17689)fix: render
multipleandselectedattributes as empty strings for XHTML compliance (#17689)fix: always lowercase HTML elements, for XHTML compliance (#17664)
fix: freeze effects-inside-deriveds when disconnecting, unfreeze on reconnect (#17682)
fix: propagate
$effecterrors to<svelte:boundary>(#17684)v5.50.2Compare Source
Patch Changes
fix: resolve
effect_update_depth_exceededwhen usingbind:valueon<select>with derived state in legacy mode (#17645)fix: don't swallow
DOMExceptionwhenmedia.play()fails inbind:paused(#17656)chore: provide proper public type for
parseCssresult (#17654)fix: robustify blocker calculation (#17676)
fix: reduce if block nesting (#17662)
v5.50.1Compare Source
Patch Changes
fix: render boolean attribute values as empty strings for XHTML compliance (#17648)
fix: prevent async render tag hydration mismatches (#17652)
v5.50.0Compare Source
Minor Changes
Patch Changes
fix: ensure infinite effect loops are cleared after flushing (#17601)
fix: allow
{#key NaN}(#17642)fix: detect store in each block expression regardless of AST shape (#17636)
fix: treat
<menu>like<ul>/<ol>for a11y role checks (#17638)fix: add vite-ignore comment inside dynamic crypto import (#17623)
chore: wrap JSDoc URLs in
@seeand@linktags (#17617)fix: properly hydrate already-resolved async blocks (#17641)
fix: emit
each_key_duplicateerror in production (#16724)fix: exit resolved async blocks on correct node when hydrating (#17640)
v5.49.2Compare Source
Patch Changes
chore: remove SvelteKit data attributes from elements.d.ts (#17613)
fix: avoid erroneous async derived expressions for blocks (#17604)
fix: avoid Cloudflare warnings about not having the "node:crypto" module (#17612)
fix: reschedule effects inside unskipped branches (#17604)
v5.49.1Compare Source
Patch Changes
fix: merge consecutive large text nodes (#17587)
fix: only create async functions in SSR output when necessary (#17593)
fix: properly separate multiline html blocks from each other in
print()(#17319)fix: prevent unhandled exceptions arising from dangling promises in
3a92020f16to0eeeb42a650eeeb42a65to0a416283d3View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.