Update dependency svelte to v5.53.5 [SECURITY]#121
Open
renovate[bot] wants to merge 1 commit intomasterfrom
Open
Update dependency svelte to v5.53.5 [SECURITY]#121renovate[bot] wants to merge 1 commit intomasterfrom
renovate[bot] wants to merge 1 commit intomasterfrom
Conversation
renovate
bot
force-pushed
the
renovate/npm-svelte-vulnerability
branch
from
269955b to
ab9a124
Compare
renovate
bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.43.5→5.53.5GitHub Vulnerability Alerts
CVE-2026-27119
In certain circumstances, the server-side rendering output of an
<option>element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected.CVE-2026-27122
When using
<svelte:element this={tag}>in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected.CVE-2026-27121
Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers.
CVE-2026-27125
In server-side rendering, attribute spreading on elements (e.g.
<div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments whereObject.prototypehas already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected.CVE-2026-27901
The contents of
bind:innerTextandbind:textContentoncontenteditableelements were not properly escaped. This could enable HTML injection and Cross-site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server.Release Notes
sveltejs/svelte (svelte)
v5.53.5Compare Source
Patch Changes
fix: escape
innerTextandtextContentbindings ofcontenteditable(0df5abcae223058ceb95491470372065fb87951d)fix: sanitize
transformErrorvalues prior to embedding in HTML comments (0298e979371bb583855c9810db79a70a551d22b9)v5.53.4Compare Source
Patch Changes
fix: set server context after async transformError (#17799)
fix: hydrate if blocks correctly (#17784)
fix: handle default parameters scope leaks (#17788)
fix: prevent flushed effects from running again (#17787)
v5.53.3Compare Source
Patch Changes
fix: render
:catchof#awaitblock with correct key (#17769)chore: pin aria-query@5.3.1 (#17772)
fix: make string coercion consistent to
toString(#17774)v5.53.2Compare Source
Patch Changes
fix: update expressions on server deriveds (#17767)
fix: further obfuscate
node:cryptoimport from overzealous static analysis (#17763)v5.53.1Compare Source
Patch Changes
v5.53.0Compare Source
Minor Changes
feat: allow comments in tags (#17671)
feat: allow error boundaries to work on the server (#17672)
Patch Changes
fix: use TrustedHTML to test for customizable
<select>support, where necessary (#17743)fix: ensure head effects are kept in the effect tree (#17746)
chore: deactivate current_batch by default in unset_context (#17738)
v5.52.0Compare Source
Minor Changes
{@​html}expressions (#17701)Patch Changes
fix: repair dynamic component truthy/falsy hydration mismatches (#17737)
fix: re-run non-render-bound deriveds on the server (#17674)
v5.51.5Compare Source
Patch Changes
fix: check to make sure
svelte:elementtags are valid during SSR (73098bb26c6f06e7fd1b0746d817d2c5ee90755f)fix: misc option escaping and backwards compatibility (#17741)
fix: strip event handlers during SSR (
a0c7f289156e9fafaeaf5ca14af6c06fe9b9eae5)fix: replace usage of
for inwithfor of Object.keys(f89c7ddd7eebaa1ef3cc540400bec2c9140b330c)fix: always escape option body in SSR (
f7c80da18c215e3727c2a611b0b8744cc6e504c5)chore: upgrade
devalue(#17739)v5.51.4Compare Source
Patch Changes
chore: proactively defer effects in pending boundary (#17734)
fix: detect and error on non-idempotent each block keys in dev mode (#17732)
v5.51.3Compare Source
Patch Changes
fix: prevent event delegation logic conflicting between svelte instances (#17728)
fix: treat CSS attribute selectors as case-insensitive for HTML enumerated attributes (#17712)
fix: locate Rollup annontaion friendly to JS downgraders (#17724)
fix: run effects in pending snippets (#17719)
v5.51.2Compare Source
Patch Changes
fix: take async into consideration for dev delegated handlers (#17710)
fix: emit state_referenced_locally warning for non-destructured props (#17708)
v5.51.1Compare Source
Patch Changes
fix: don't crash on undefined
document.contentType(#17707)fix: use symbols for encapsulated event delegation (#17703)
v5.51.0Compare Source
Minor Changes
TrustedTypesfor HTML handling where supported (#16271)Patch Changes
fix: sanitize template-literal-special-characters in SSR attribute values (#17692)
fix: follow-up formatting in
print()— flush block-level elements into separate sequences (#17699)fix: preserve delegated event handlers as long as one or more root components are using them (#17695)
v5.50.3Compare Source
Patch Changes
fix: take into account
nodeNamecase sensitivity on XHTML pages (#17689)fix: render
multipleandselectedattributes as empty strings for XHTML compliance (#17689)fix: always lowercase HTML elements, for XHTML compliance (#17664)
fix: freeze effects-inside-deriveds when disconnecting, unfreeze on reconnect (#17682)
fix: propagate
$effecterrors to<svelte:boundary>(#17684)v5.50.2Compare Source
Patch Changes
fix: resolve
effect_update_depth_exceededwhen usingbind:valueon<select>with derived state in legacy mode (#17645)fix: don't swallow
DOMExceptionwhenmedia.play()fails inbind:paused(#17656)chore: provide proper public type for
parseCssresult (#17654)fix: robustify blocker calculation (#17676)
fix: reduce if block nesting (#17662)
v5.50.1Compare Source
Patch Changes
fix: render boolean attribute values as empty strings for XHTML compliance (#17648)
fix: prevent async render tag hydration mismatches (#17652)
v5.50.0Compare Source
Minor Changes
Patch Changes
fix: ensure infinite effect loops are cleared after flushing (#17601)
fix: allow
{#key NaN}(#17642)fix: detect store in each block expression regardless of AST shape (#17636)
fix: treat
<menu>like<ul>/<ol>for a11y role checks (#17638)fix: add vite-ignore comment inside dynamic crypto import (#17623)
chore: wrap JSDoc URLs in
@seeand@linktags (#17617)fix: properly hydrate already-resolved async blocks (#17641)
fix: emit
each_key_duplicateerror in production (#16724)fix: exit resolved async blocks on correct node when hydrating (#17640)
v5.49.2Compare Source
Patch Changes
chore: remove SvelteKit data attributes from elements.d.ts (#17613)
fix: avoid erroneous async derived expressions for blocks (#17604)
fix: avoid Cloudflare warnings about not having the "node:crypto" module (#17612)
fix: reschedule effects inside unskipped branches (#17604)
v5.49.1Compare Source
Patch Changes
fix: merge consecutive large text nodes (#17587)
fix: only create async functions in SSR output when necessary (#17593)
fix: properly separate multiline html blocks from each other in
print()(#17319)fix: prevent unhandled exceptions arising from dangling promises in <script> (#17591)
v5.49.0Compare Source
Minor Changes
ShadowRootInitobject to custom elementshadowoption (#17088)Patch Changes
fix: throw for unset
createContextget on the server (#17580)fix: reset effects inside skipped branches (#17581)
fix: preserve old dependencies when updating reaction inside fork (#17579)
fix: more conservative assignment_value_stale warnings (#17574)
fix: disregard
popoverelements when determining whether an element has content (#17367)fix: fire introstart/outrostart events after delay, if specified (#17567)
fix: increment signal versions when discarding forks (#17577)
v5.48.5Compare Source
Patch Changes
fix: run boundary
onerrorcallbacks in a microtask, in case they result in the boundary's destruction (#17561)fix: prevent unintended exports from namespaces (#17562)
fix: each block breaking with effects interspersed among items (#17550)
v5.48.4Compare Source
Patch Changes
v5.48.3Compare Source
Patch Changes
fix: hydration failing with settled async blocks (#17539)
fix: add pointer and touch events to a11y_no_static_element_interactions warning (#17551)
fix: handle false dynamic components in SSR (#17542)
fix: avoid unnecessary block effect re-runs after async work completes (#17535)
fix: avoid using dev-mode array.includes wrapper on internal array checks (#17536)
v5.48.2Compare Source
Patch Changes
waitfunction from internal client index (#17530)v5.48.1Compare Source
Patch Changes
fix: hoist snippets above const in same block (#17516)
fix: properly hydrate await in
{@​html}(#17528)fix: batch resolution of async work (#17511)
fix: account for empty statements when visiting in transform async (#17524)
fix: avoid async overhead for already settled promises (#17461)
fix: better code generation for const tags with async dependencies (#17518)
v5.48.0Compare Source
Minor Changes
parseCssfromsvelte/compiler(#17496)Patch Changes
fix: handle non-string values in
svelte:elementthisattribute (#17499)fix: faster deduplication of dependencies (#17503)
v5.47.1Compare Source
Patch Changes
selectedcontentreactivity (#17486)v5.47.0Compare Source
Minor Changes
<select>elements (#17429)Patch Changes
fix: mark subtree of svelte boundary as dynamic (#17468)
fix: don't reset static elements with debug/snippets (#17477)
v5.46.4Compare Source
Patch Changes
devalue.unevalto serializehydratablekeys (ef81048e238844b729942441541d6dcfe6c8ccca)v5.46.3Compare Source
Patch Changes
fix: reconnect clean deriveds when they are read in a reactive context (#17362)
fix: don't transform references of function declarations in legacy mode (#17431)
fix: notify deriveds of changes to sources inside forks (#17437)
fix: always reconnect deriveds in get, when appropriate (#17451)
fix: prevent derives without dependencies from ever re-running (
286b40c4526ce9970cb81ddd5e65b93b722fe468)fix: correctly update writable deriveds inside forks (#17437)
fix: remove
$inspectcalls after await expressions when compiling for production server code (#17407)fix: clear batch between runs (#17424)
fix: adjust
locproperty ofProgramnodes created from<script>elements (#17428)fix: don't revert source to UNINITIALIZED state when time travelling (#17409)
v5.46.1Compare Source
Patch Changes
fix: type
currentTargetinonfunction (#17370)fix: skip static optimisation for stateless deriveds after
await(#17389)fix: prevent infinite loop when HMRing a component with an
await(#17380)v5.46.0Compare Source
Minor Changes
cspoption torender(...), and emit hashes when usinghydratable(#17338)v5.45.10Compare Source
Patch Changes
AsyncLocalStorage(#17350)v5.45.9Compare Source
Patch Changes
fix: correctly reschedule deferred effects when reviving a batch after async work (#17332)
fix: correctly print
!doctypeduringprint(#17341)v5.45.8Compare Source
Patch Changes
fix: set AST
root.startto0androot.endtotemplate.length(#17125)fix: prevent erroneous
state_referenced_locallywarnings on prop fallbacks (#17329)v5.45.7Compare Source
Patch Changes
fix: Add
<textarea wrap="off">as a valid attribute value (#17326)fix: add more css selectors to
print()(#17330)fix: don't crash on
hydratableserialization failure (#17315)v5.45.6Compare Source
Patch Changes
fix: don't issue a11y warning for
<video>without captions if it has nosrc(#17311)fix: add
srcObjectto permitted<audio>/<video>attributes (#17310)v5.45.5Compare Source
Patch Changes
fix: correctly reconcile each blocks after outroing branches are resumed (#17258)
fix: destroy each items after siblings are resumed (#17258)
v5.45.4Compare Source
Patch Changes
chore: move DOM-related effect properties to
effect.nodes(#17293)fix: allow
$props.id()to occur after anawait(#17285)fix: keep reactions up to date even when read outside of effect (#17295)
v5.45.3Compare Source
Patch Changes
add props to state_referenced_locally (#17266)
fix: preserve node locations for better sourcemaps (#17269)
fix: handle cross-realm Promises in
hydratable(#17284)v5.45.2Compare Source
Patch Changes
fix: array destructuring after await (#17254)
fix: throw on invalid
{@​tag}s (#17256)v5.45.1Compare Source
Patch Changes
v5.45.0Compare Source
Minor Changes
print(...)function (#16188)v5.44.1Compare Source
Patch Changes
fix: await blockers before initialising const (#17226)
fix: link offscreen items and last effect in each block correctly (#17244)
fix: generate correct code for simple destructurings (#17237)
fix: ensure each block animations don't mess with transitions (#17238)
v5.44.0Compare Source
Minor Changes
hydratableAPI (#17154)v5.43.15Compare Source
Patch Changes
fix: don't execute attachments and attribute effects eagerly (#17208)
chore: lift "flushSync cannot be called in effects" restriction (#17139)
fix: store forked derived values (#17212)
v5.43.14Compare Source
Patch Changes
fix: correctly migrate named self closing slots (#17199)
fix: error at compile time instead of at runtime on await expressions inside bindings/transitions/animations/attachments (#17198)
fix: take async blockers into account for bindings/transitions/animations/attachments (#17198)
v5.43.13Compare Source
Patch Changes
v5.43.12Compare Source
Patch Changes
v5.43.11Compare Source
Patch Changes
perf: don't use tracing overeager during dev (#17183)
fix: don't cancel transition of already outroing elements (#17186)
v5.43.10Compare Source
Patch Changes
v5.43.9Compare Source
Patch Changes
fix: correctly handle functions when determining async blockers (#17137)
fix: keep deriveds reactive after their original parent effect was destroyed (#17171)
fix: ensure eager effects don't break reactions chain (#17138)
fix: ensure async
@constin boundary hydrates correctly (#17165)fix: take blockers into account when creating
#awaitblocks (#17137)fix: parallelize async
@consts in the template (#17165)v5.43.8Compare Source
Patch Changes
v5.43.7Compare Source
Patch Changes
fix: properly defer document title until async work is complete (#17158)
fix: ensure deferred effects can be rescheduled later on (#17147)
fix: take blockers of components into account (#17153)
v5.43.6Compare Source
Patch Changes
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.