chore(deps): update dependency svelte to v5.51.5 [security]#3373
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
chore(deps): update dependency svelte to v5.51.5 [security]#3373renovate[bot] wants to merge 1 commit intomainfrom
renovate[bot] wants to merge 1 commit intomainfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
5 Skipped Deployments
|
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.49.1→5.51.5GitHub Vulnerability Alerts
CVE-2026-27119
In certain circumstances, the server-side rendering output of an
<option>element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected.CVE-2026-27122
When using
<svelte:element this={tag}>in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected.CVE-2026-27121
Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers.
Release Notes
sveltejs/svelte (svelte)
v5.51.5Compare Source
Patch Changes
fix: check to make sure
svelte:elementtags are valid during SSR (73098bb26c6f06e7fd1b0746d817d2c5ee90755f)fix: misc option escaping and backwards compatibility (#17741)
fix: strip event handlers during SSR (
a0c7f289156e9fafaeaf5ca14af6c06fe9b9eae5)fix: replace usage of
for inwithfor of Object.keys(f89c7ddd7eebaa1ef3cc540400bec2c9140b330c)fix: always escape option body in SSR (
f7c80da18c215e3727c2a611b0b8744cc6e504c5)chore: upgrade
devalue(#17739)v5.51.4Compare Source
Patch Changes
chore: proactively defer effects in pending boundary (#17734)
fix: detect and error on non-idempotent each block keys in dev mode (#17732)
v5.51.3Compare Source
Patch Changes
fix: prevent event delegation logic conflicting between svelte instances (#17728)
fix: treat CSS attribute selectors as case-insensitive for HTML enumerated attributes (#17712)
fix: locate Rollup annontaion friendly to JS downgraders (#17724)
fix: run effects in pending snippets (#17719)
v5.51.2Compare Source
Patch Changes
fix: take async into consideration for dev delegated handlers (#17710)
fix: emit state_referenced_locally warning for non-destructured props (#17708)
v5.51.1Compare Source
Patch Changes
fix: don't crash on undefined
document.contentType(#17707)fix: use symbols for encapsulated event delegation (#17703)
v5.51.0Compare Source
Minor Changes
TrustedTypesfor HTML handling where supported (#16271)Patch Changes
fix: sanitize template-literal-special-characters in SSR attribute values (#17692)
fix: follow-up formatting in
print()— flush block-level elements into separate sequences (#17699)fix: preserve delegated event handlers as long as one or more root components are using them (#17695)
v5.50.3Compare Source
Patch Changes
fix: take into account
nodeNamecase sensitivity on XHTML pages (#17689)fix: render
multipleandselectedattributes as empty strings for XHTML compliance (#17689)fix: always lowercase HTML elements, for XHTML compliance (#17664)
fix: freeze effects-inside-deriveds when disconnecting, unfreeze on reconnect (#17682)
fix: propagate
$effecterrors to<svelte:boundary>(#17684)v5.50.2Compare Source
Patch Changes
fix: resolve
effect_update_depth_exceededwhen usingbind:valueon<select>with derived state in legacy mode (#17645)fix: don't swallow
DOMExceptionwhenmedia.play()fails inbind:paused(#17656)chore: provide proper public type for
parseCssresult (#17654)fix: robustify blocker calculation (#17676)
fix: reduce if block nesting (#17662)
v5.50.1Compare Source
Patch Changes
fix: render boolean attribute values as empty strings for XHTML compliance (#17648)
fix: prevent async render tag hydration mismatches (#17652)
v5.50.0Compare Source
Minor Changes
Patch Changes
fix: ensure infinite effect loops are cleared after flushing (#17601)
fix: allow
{#key NaN}(#17642)fix: detect store in each block expression regardless of AST shape (#17636)
fix: treat
<menu>like<ul>/<ol>for a11y role checks (#17638)fix: add vite-ignore comment inside dynamic crypto import (#17623)
chore: wrap JSDoc URLs in
@seeand@linktags (#17617)fix: properly hydrate already-resolved async blocks (#17641)
fix: emit
each_key_duplicateerror in production (#16724)fix: exit resolved async blocks on correct node when hydrating (#17640)
v5.49.2Compare Source
Patch Changes
chore: remove SvelteKit data attributes from elements.d.ts (#17613)
fix: avoid erroneous async derived expressions for blocks (#17604)
fix: avoid Cloudflare warnings about not having the "node:crypto" module (#17612)
fix: reschedule effects inside unskipped branches (#17604)
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate using a curated preset maintained by