From c9098bcaa0cf7accf7de4a16f8b72671023e69e7 Mon Sep 17 00:00:00 2001
From: Paolo Ricciuti <ricciutipaolo@gmail.com>
Date: Wed, 9 Jul 2025 15:32:18 +0200
Subject: [PATCH 1/9] fix: use `state` instead of `source` in reactive classes
 (#16239)

* fix: use `state` instead of `source` in reactive classes

* fix: use `active_reaction` as indication to use `source` or `state`

* fix: cleanup `#initial_reaction` on `teardown` to free memory

* fix: use `#source` in `set` too

* unused

* chore: use WeakRef

* use update_version instead of WeakRef in SvelteSet/SvelteMap (#16324)

* tidy up

* tweak comment to remove active_reaction reference

---------

Co-authored-by: Rich Harris <rich.harris@vercel.com>
---
 .../svelte/src/internal/client/runtime.js     |   6 +-
 packages/svelte/src/motion/spring.js          |  12 +-
 packages/svelte/src/motion/tweened.js         |   6 +-
 packages/svelte/src/reactivity/map.js         |  25 ++++-
 packages/svelte/src/reactivity/set.js         |  18 ++-
 .../side-effect-derived-map/_config.js        |  33 +++++-
 .../side-effect-derived-map/main.svelte       | 106 +++++++++++++++---
 .../side-effect-derived-set/_config.js        |  12 +-
 .../side-effect-derived-set/main.svelte       |  51 ++++++---
 .../side-effect-derived-spring/_config.js     |  23 ++++
 .../side-effect-derived-spring/main.svelte    |  26 +++++
 .../side-effect-derived-tween/_config.js      |  23 ++++
 .../side-effect-derived-tween/main.svelte     |  26 +++++
 13 files changed, 318 insertions(+), 49 deletions(-)
 create mode 100644 packages/svelte/tests/runtime-runes/samples/side-effect-derived-spring/_config.js
 create mode 100644 packages/svelte/tests/runtime-runes/samples/side-effect-derived-spring/main.svelte
 create mode 100644 packages/svelte/tests/runtime-runes/samples/side-effect-derived-tween/_config.js
 create mode 100644 packages/svelte/tests/runtime-runes/samples/side-effect-derived-tween/main.svelte

diff --git a/packages/svelte/src/internal/client/runtime.js b/packages/svelte/src/internal/client/runtime.js
index 28fcf26e83..cd7170d326 100644
--- a/packages/svelte/src/internal/client/runtime.js
+++ b/packages/svelte/src/internal/client/runtime.js
@@ -134,6 +134,8 @@ let write_version = 1;
 /** @type {number} Used to version each read of a source of derived to avoid duplicating depedencies inside a reaction */
 let read_version = 0;
 
+export let update_version = read_version;
+
 // If we are working with a get() chain that has no active container,
 // to prevent memory leaks, we skip adding the reaction.
 export let skip_reaction = false;
@@ -267,6 +269,7 @@ export function update_reaction(reaction) {
 	var previous_reaction_sources = source_ownership;
 	var previous_component_context = component_context;
 	var previous_untracking = untracking;
+	var previous_update_version = update_version;
 
 	var flags = reaction.f;
 
@@ -280,7 +283,7 @@ export function update_reaction(reaction) {
 	source_ownership = null;
 	set_component_context(reaction.ctx);
 	untracking = false;
-	read_version++;
+	update_version = ++read_version;
 
 	reaction.f |= EFFECT_IS_UPDATING;
 
@@ -368,6 +371,7 @@ export function update_reaction(reaction) {
 		source_ownership = previous_reaction_sources;
 		set_component_context(previous_component_context);
 		untracking = previous_untracking;
+		update_version = previous_update_version;
 
 		reaction.f ^= EFFECT_IS_UPDATING;
 	}
diff --git a/packages/svelte/src/motion/spring.js b/packages/svelte/src/motion/spring.js
index 0f3bc6fb9f..44be1a501b 100644
--- a/packages/svelte/src/motion/spring.js
+++ b/packages/svelte/src/motion/spring.js
@@ -5,7 +5,7 @@ import { writable } from '../store/shared/index.js';
 import { loop } from '../internal/client/loop.js';
 import { raf } from '../internal/client/timing.js';
 import { is_date } from './utils.js';
-import { set, source } from '../internal/client/reactivity/sources.js';
+import { set, state } from '../internal/client/reactivity/sources.js';
 import { render_effect } from '../internal/client/reactivity/effects.js';
 import { tag } from '../internal/client/dev/tracing.js';
 import { get } from '../internal/client/runtime.js';
@@ -170,9 +170,9 @@ export function spring(value, opts = {}) {
  * @since 5.8.0
  */
 export class Spring {
-	#stiffness = source(0.15);
-	#damping = source(0.8);
-	#precision = source(0.01);
+	#stiffness = state(0.15);
+	#damping = state(0.8);
+	#precision = state(0.01);
 
 	#current;
 	#target;
@@ -194,8 +194,8 @@ export class Spring {
 	 * @param {SpringOpts} [options]
 	 */
 	constructor(value, options = {}) {
-		this.#current = DEV ? tag(source(value), 'Spring.current') : source(value);
-		this.#target = DEV ? tag(source(value), 'Spring.target') : source(value);
+		this.#current = DEV ? tag(state(value), 'Spring.current') : state(value);
+		this.#target = DEV ? tag(state(value), 'Spring.target') : state(value);
 
 		if (typeof options.stiffness === 'number') this.#stiffness.v = clamp(options.stiffness, 0, 1);
 		if (typeof options.damping === 'number') this.#damping.v = clamp(options.damping, 0, 1);
diff --git a/packages/svelte/src/motion/tweened.js b/packages/svelte/src/motion/tweened.js
index 09bd06c325..437c22ec3b 100644
--- a/packages/svelte/src/motion/tweened.js
+++ b/packages/svelte/src/motion/tweened.js
@@ -6,7 +6,7 @@ import { raf } from '../internal/client/timing.js';
 import { loop } from '../internal/client/loop.js';
 import { linear } from '../easing/index.js';
 import { is_date } from './utils.js';
-import { set, source } from '../internal/client/reactivity/sources.js';
+import { set, state } from '../internal/client/reactivity/sources.js';
 import { tag } from '../internal/client/dev/tracing.js';
 import { get, render_effect } from 'svelte/internal/client';
 import { DEV } from 'esm-env';
@@ -191,8 +191,8 @@ export class Tween {
 	 * @param {TweenedOptions<T>} options
 	 */
 	constructor(value, options = {}) {
-		this.#current = source(value);
-		this.#target = source(value);
+		this.#current = state(value);
+		this.#target = state(value);
 		this.#defaults = options;
 
 		if (DEV) {
diff --git a/packages/svelte/src/reactivity/map.js b/packages/svelte/src/reactivity/map.js
index cd2fac163f..4fa2dfd7b2 100644
--- a/packages/svelte/src/reactivity/map.js
+++ b/packages/svelte/src/reactivity/map.js
@@ -2,7 +2,7 @@
 import { DEV } from 'esm-env';
 import { set, source, state } from '../internal/client/reactivity/sources.js';
 import { label, tag } from '../internal/client/dev/tracing.js';
-import { get } from '../internal/client/runtime.js';
+import { get, update_version } from '../internal/client/runtime.js';
 import { increment } from './utils.js';
 
 /**
@@ -56,6 +56,7 @@ export class SvelteMap extends Map {
 	#sources = new Map();
 	#version = state(0);
 	#size = state(0);
+	#update_version = update_version || -1;
 
 	/**
 	 * @param {Iterable<readonly [K, V]> | null | undefined} [value]
@@ -79,6 +80,19 @@ export class SvelteMap extends Map {
 		}
 	}
 
+	/**
+	 * If the source is being created inside the same reaction as the SvelteMap instance,
+	 * we use `state` so that it will not be a dependency of the reaction. Otherwise we
+	 * use `source` so it will be.
+	 *
+	 * @template T
+	 * @param {T} value
+	 * @returns {Source<T>}
+	 */
+	#source(value) {
+		return update_version === this.#update_version ? state(value) : source(value);
+	}
+
 	/** @param {K} key */
 	has(key) {
 		var sources = this.#sources;
@@ -87,7 +101,7 @@ export class SvelteMap extends Map {
 		if (s === undefined) {
 			var ret = super.get(key);
 			if (ret !== undefined) {
-				s = source(0);
+				s = this.#source(0);
 
 				if (DEV) {
 					tag(s, `SvelteMap get(${label(key)})`);
@@ -123,7 +137,7 @@ export class SvelteMap extends Map {
 		if (s === undefined) {
 			var ret = super.get(key);
 			if (ret !== undefined) {
-				s = source(0);
+				s = this.#source(0);
 
 				if (DEV) {
 					tag(s, `SvelteMap get(${label(key)})`);
@@ -154,7 +168,7 @@ export class SvelteMap extends Map {
 		var version = this.#version;
 
 		if (s === undefined) {
-			s = source(0);
+			s = this.#source(0);
 
 			if (DEV) {
 				tag(s, `SvelteMap get(${label(key)})`);
@@ -219,8 +233,7 @@ export class SvelteMap extends Map {
 		if (this.#size.v !== sources.size) {
 			for (var key of super.keys()) {
 				if (!sources.has(key)) {
-					var s = source(0);
-
+					var s = this.#source(0);
 					if (DEV) {
 						tag(s, `SvelteMap get(${label(key)})`);
 					}
diff --git a/packages/svelte/src/reactivity/set.js b/packages/svelte/src/reactivity/set.js
index 8a656c2bc1..9e3c330beb 100644
--- a/packages/svelte/src/reactivity/set.js
+++ b/packages/svelte/src/reactivity/set.js
@@ -2,7 +2,7 @@
 import { DEV } from 'esm-env';
 import { source, set, state } from '../internal/client/reactivity/sources.js';
 import { label, tag } from '../internal/client/dev/tracing.js';
-import { get } from '../internal/client/runtime.js';
+import { get, update_version } from '../internal/client/runtime.js';
 import { increment } from './utils.js';
 
 var read_methods = ['forEach', 'isDisjointFrom', 'isSubsetOf', 'isSupersetOf'];
@@ -50,6 +50,7 @@ export class SvelteSet extends Set {
 	#sources = new Map();
 	#version = state(0);
 	#size = state(0);
+	#update_version = update_version || -1;
 
 	/**
 	 * @param {Iterable<T> | null | undefined} [value]
@@ -75,6 +76,19 @@ export class SvelteSet extends Set {
 		if (!inited) this.#init();
 	}
 
+	/**
+	 * If the source is being created inside the same reaction as the SvelteSet instance,
+	 * we use `state` so that it will not be a dependency of the reaction. Otherwise we
+	 * use `source` so it will be.
+	 *
+	 * @template T
+	 * @param {T} value
+	 * @returns {Source<T>}
+	 */
+	#source(value) {
+		return update_version === this.#update_version ? state(value) : source(value);
+	}
+
 	// We init as part of the first instance so that we can treeshake this class
 	#init() {
 		inited = true;
@@ -116,7 +130,7 @@ export class SvelteSet extends Set {
 				return false;
 			}
 
-			s = source(true);
+			s = this.#source(true);
 
 			if (DEV) {
 				tag(s, `SvelteSet has(${label(value)})`);
diff --git a/packages/svelte/tests/runtime-runes/samples/side-effect-derived-map/_config.js b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-map/_config.js
index 5ad6f57e31..c10dc7fb55 100644
--- a/packages/svelte/tests/runtime-runes/samples/side-effect-derived-map/_config.js
+++ b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-map/_config.js
@@ -8,7 +8,8 @@ export default test({
 	},
 
 	test({ assert, target }) {
-		const [button1, button2] = target.querySelectorAll('button');
+		const [button1, button2, button3, button4, button5, button6, button7, button8] =
+			target.querySelectorAll('button');
 
 		assert.throws(() => {
 			button1?.click();
@@ -19,5 +20,35 @@ export default test({
 			button2?.click();
 			flushSync();
 		});
+
+		assert.throws(() => {
+			button3?.click();
+			flushSync();
+		}, /state_unsafe_mutation/);
+
+		assert.doesNotThrow(() => {
+			button4?.click();
+			flushSync();
+		});
+
+		assert.throws(() => {
+			button5?.click();
+			flushSync();
+		}, /state_unsafe_mutation/);
+
+		assert.doesNotThrow(() => {
+			button6?.click();
+			flushSync();
+		});
+
+		assert.throws(() => {
+			button7?.click();
+			flushSync();
+		}, /state_unsafe_mutation/);
+
+		assert.doesNotThrow(() => {
+			button8?.click();
+			flushSync();
+		});
 	}
 });
diff --git a/packages/svelte/tests/runtime-runes/samples/side-effect-derived-map/main.svelte b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-map/main.svelte
index bdd5ccb75c..c37f37ceb6 100644
--- a/packages/svelte/tests/runtime-runes/samples/side-effect-derived-map/main.svelte
+++ b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-map/main.svelte
@@ -1,27 +1,101 @@
 <script>
 	import { SvelteMap } from 'svelte/reactivity';
 
-	let visibleExternal = $state(false);
-	let external = new SvelteMap();
-	const throws = $derived.by(() => {
-		external.set(1, 1);
-		return external;
+	let outside_basic = $state(false);
+	let outside_basic_map = new SvelteMap();
+	const throw_basic = $derived.by(() => {
+		outside_basic_map.set(1, 1);
+		return outside_basic_map;
 	});
 
-	let visibleInternal = $state(false);
-	const works = $derived.by(() => {
-		let internal = new SvelteMap();
-		internal.set(1, 1);
-		return internal;
+	let inside_basic = $state(false);
+	const works_basic = $derived.by(() => {
+		let inside = new SvelteMap();
+		inside.set(1, 1);
+		return inside;
+	});
+
+	let outside_has = $state(false);
+	let outside_has_map = new SvelteMap([[1, 1]]);
+	const throw_has = $derived.by(() => {
+		outside_has_map.has(1);
+		outside_has_map.set(1, 2);
+		return outside_has_map;
+	});
+
+	let inside_has = $state(false);
+	const works_has = $derived.by(() => {
+		let inside = new SvelteMap([[1, 1]]);
+		inside.has(1);
+		inside.set(1, 1);
+		return inside;
+	});
+
+	let outside_get = $state(false);
+	let outside_get_map = new SvelteMap([[1, 1]]);
+	const throw_get = $derived.by(() => {
+		outside_get_map.get(1);
+		outside_get_map.set(1, 2);
+		return outside_get_map;
+	});
+
+	let inside_get = $state(false);
+	const works_get = $derived.by(() => {
+		let inside = new SvelteMap([[1, 1]]);
+		inside.get(1);
+		inside.set(1, 1);
+		return inside;
+	});
+
+	let outside_values = $state(false);
+	let outside_values_map = new SvelteMap([[1, 1]]);
+	const throw_values = $derived.by(() => {
+		outside_values_map.values(1);
+		outside_values_map.set(1, 2);
+		return outside_values_map;
+	});
+
+	let inside_values = $state(false);
+	const works_values = $derived.by(() => {
+		let inside = new SvelteMap([[1, 1]]);
+		inside.values();
+		inside.set(1, 1);
+		return inside;
 	});
 </script>
 
-<button onclick={() => (visibleExternal = true)}>external</button>
-{#if visibleExternal}
-	{throws}
+<button onclick={() => (outside_basic = true)}>external</button>
+{#if outside_basic}
+	{throw_basic}
+{/if}
+<button onclick={() => (inside_basic = true)}>internal</button>
+{#if inside_basic}
+	{works_basic}
+{/if}
+
+<button onclick={() => (outside_has = true)}>external</button>
+{#if outside_has}
+	{throw_has}
 {/if}
-<button onclick={() => (visibleInternal = true)}>internal</button>
-{#if visibleInternal}
-	{works}
+<button onclick={() => (inside_has = true)}>internal</button>
+{#if inside_has}
+	{works_has}
 {/if}
 
+<button onclick={() => (outside_get = true)}>external</button>
+{#if outside_get}
+	{throw_get}
+{/if}
+<button onclick={() => (inside_get = true)}>internal</button>
+{#if inside_get}
+	{works_get}
+{/if}
+
+<button onclick={() => (outside_values = true)}>external</button>
+{#if outside_values}
+	{throw_values}
+{/if}
+<button onclick={() => (inside_values = true)}>internal</button>
+{#if inside_values}
+	{works_values}
+{/if}
diff --git a/packages/svelte/tests/runtime-runes/samples/side-effect-derived-set/_config.js b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-set/_config.js
index 5ad6f57e31..5cf066fb8a 100644
--- a/packages/svelte/tests/runtime-runes/samples/side-effect-derived-set/_config.js
+++ b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-set/_config.js
@@ -8,7 +8,7 @@ export default test({
 	},
 
 	test({ assert, target }) {
-		const [button1, button2] = target.querySelectorAll('button');
+		const [button1, button2, button3, button4] = target.querySelectorAll('button');
 
 		assert.throws(() => {
 			button1?.click();
@@ -19,5 +19,15 @@ export default test({
 			button2?.click();
 			flushSync();
 		});
+
+		assert.throws(() => {
+			button3?.click();
+			flushSync();
+		}, /state_unsafe_mutation/);
+
+		assert.doesNotThrow(() => {
+			button4?.click();
+			flushSync();
+		});
 	}
 });
diff --git a/packages/svelte/tests/runtime-runes/samples/side-effect-derived-set/main.svelte b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-set/main.svelte
index 8564f6e7c4..1d6735ba64 100644
--- a/packages/svelte/tests/runtime-runes/samples/side-effect-derived-set/main.svelte
+++ b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-set/main.svelte
@@ -1,27 +1,52 @@
 <script>
 	import { SvelteSet } from 'svelte/reactivity';
 
-	let visibleExternal = $state(false);
-	let external = new SvelteSet();
-	const throws = $derived.by(() => {
-		external.add(1);
-		return external;
+	let outside_basic = $state(false);
+	let outside_basic_set = new SvelteSet();
+	const throws_basic = $derived.by(() => {
+		outside_basic_set.add(1);
+		return outside_basic_set;
 	})
 
-	let visibleInternal = $state(false);
-	const works = $derived.by(() => {
+	let inside_basic = $state(false);
+	const works_basic = $derived.by(() => {
 		let internal = new SvelteSet();
 		internal.add(1);
 		return internal;
 	})
+
+	let outside_has_delete = $state(false);
+	let outside_has_delete_set = new SvelteSet([1]);
+	const throws_has_delete = $derived.by(() => {
+		outside_has_delete_set.has(1);
+		outside_has_delete_set.delete(1);
+		return outside_has_delete_set;
+	})
+
+	let inside_has_delete = $state(false);
+	const works_has_delete = $derived.by(() => {
+		let internal = new SvelteSet([1]);
+		internal.has(1);
+		internal.delete(1);
+		return internal;
+	})
 </script>
 
-<button onclick={() => (visibleExternal = true)}>external</button>
-{#if visibleExternal}
-	{throws}
+<button onclick={() => (outside_basic = true)}>external</button>
+{#if outside_basic}
+	{throws_basic}
+{/if}
+<button onclick={() => (inside_basic = true)}>internal</button>
+{#if inside_basic}
+	{works_basic}
+{/if}
+
+<button onclick={() => (outside_has_delete = true)}>external</button>
+{#if outside_has_delete}
+	{throws_has_delete}
 {/if}
-<button onclick={() => (visibleInternal = true)}>internal</button>
-{#if visibleInternal}
-	{works}
+<button onclick={() => (inside_has_delete = true)}>internal</button>
+{#if inside_has_delete}
+	{works_has_delete}
 {/if}
 
diff --git a/packages/svelte/tests/runtime-runes/samples/side-effect-derived-spring/_config.js b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-spring/_config.js
new file mode 100644
index 0000000000..5ad6f57e31
--- /dev/null
+++ b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-spring/_config.js
@@ -0,0 +1,23 @@
+import { flushSync } from 'svelte';
+import { test } from '../../test';
+
+export default test({
+	compileOptions: {
+		dev: true,
+		runes: true
+	},
+
+	test({ assert, target }) {
+		const [button1, button2] = target.querySelectorAll('button');
+
+		assert.throws(() => {
+			button1?.click();
+			flushSync();
+		}, /state_unsafe_mutation/);
+
+		assert.doesNotThrow(() => {
+			button2?.click();
+			flushSync();
+		});
+	}
+});
diff --git a/packages/svelte/tests/runtime-runes/samples/side-effect-derived-spring/main.svelte b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-spring/main.svelte
new file mode 100644
index 0000000000..b0818deca9
--- /dev/null
+++ b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-spring/main.svelte
@@ -0,0 +1,26 @@
+<script>
+	import { Spring } from 'svelte/motion';
+
+	let outside_basic = $state(false);
+	let outside_basic_spring = new Spring(0);
+	const throws_basic = $derived.by(() => {
+		outside_basic_spring.set(1);
+		return outside_basic_spring;
+	})
+
+	let inside_basic = $state(false);
+	const works_basic = $derived.by(() => {
+		let internal = new Spring(0);
+		internal.set(1);
+		return internal;
+	})
+</script>
+
+<button onclick={() => (outside_basic = true)}>external</button>
+{#if outside_basic}
+	{throws_basic}
+{/if}
+<button onclick={() => (inside_basic = true)}>internal</button>
+{#if inside_basic}
+	{works_basic}
+{/if}
\ No newline at end of file
diff --git a/packages/svelte/tests/runtime-runes/samples/side-effect-derived-tween/_config.js b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-tween/_config.js
new file mode 100644
index 0000000000..5ad6f57e31
--- /dev/null
+++ b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-tween/_config.js
@@ -0,0 +1,23 @@
+import { flushSync } from 'svelte';
+import { test } from '../../test';
+
+export default test({
+	compileOptions: {
+		dev: true,
+		runes: true
+	},
+
+	test({ assert, target }) {
+		const [button1, button2] = target.querySelectorAll('button');
+
+		assert.throws(() => {
+			button1?.click();
+			flushSync();
+		}, /state_unsafe_mutation/);
+
+		assert.doesNotThrow(() => {
+			button2?.click();
+			flushSync();
+		});
+	}
+});
diff --git a/packages/svelte/tests/runtime-runes/samples/side-effect-derived-tween/main.svelte b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-tween/main.svelte
new file mode 100644
index 0000000000..bd007f2b50
--- /dev/null
+++ b/packages/svelte/tests/runtime-runes/samples/side-effect-derived-tween/main.svelte
@@ -0,0 +1,26 @@
+<script>
+	import { Tween } from 'svelte/motion';
+
+	let outside_basic = $state(false);
+	let outside_basic_tween = new Tween(0);
+	const throws_basic = $derived.by(() => {
+		outside_basic_tween.set(1);
+		return outside_basic_tween;
+	})
+
+	let inside_basic = $state(false);
+	const works_basic = $derived.by(() => {
+		let internal = new Tween(0);
+		internal.set(1);
+		return internal;
+	})
+</script>
+
+<button onclick={() => (outside_basic = true)}>external</button>
+{#if outside_basic}
+	{throws_basic}
+{/if}
+<button onclick={() => (inside_basic = true)}>internal</button>
+{#if inside_basic}
+	{works_basic}
+{/if}
\ No newline at end of file

From 9d176b50080ed075d97ed96a15e2109b3db69886 Mon Sep 17 00:00:00 2001
From: Rich Harris <rich.harris@vercel.com>
Date: Wed, 9 Jul 2025 09:37:29 -0400
Subject: [PATCH 2/9] chore: changeset for #16239 (#16325)

---
 .changeset/gorgeous-birds-brake.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .changeset/gorgeous-birds-brake.md

diff --git a/.changeset/gorgeous-birds-brake.md b/.changeset/gorgeous-birds-brake.md
new file mode 100644
index 0000000000..8365cc0e6a
--- /dev/null
+++ b/.changeset/gorgeous-birds-brake.md
@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: associate sources in Spring/Tween/SvelteMap/SvelteSet with correct reaction

From fab2091743d48f682d470cccb1a99590ce6bac32 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 9 Jul 2025 09:41:08 -0400
Subject: [PATCH 3/9] Version Packages (#16314)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 .changeset/gorgeous-birds-brake.md | 5 -----
 .changeset/light-rivers-jump.md    | 5 -----
 packages/svelte/CHANGELOG.md       | 8 ++++++++
 packages/svelte/package.json       | 2 +-
 packages/svelte/src/version.js     | 2 +-
 5 files changed, 10 insertions(+), 12 deletions(-)
 delete mode 100644 .changeset/gorgeous-birds-brake.md
 delete mode 100644 .changeset/light-rivers-jump.md

diff --git a/.changeset/gorgeous-birds-brake.md b/.changeset/gorgeous-birds-brake.md
deleted file mode 100644
index 8365cc0e6a..0000000000
--- a/.changeset/gorgeous-birds-brake.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'svelte': patch
----
-
-fix: associate sources in Spring/Tween/SvelteMap/SvelteSet with correct reaction
diff --git a/.changeset/light-rivers-jump.md b/.changeset/light-rivers-jump.md
deleted file mode 100644
index 2454d57156..0000000000
--- a/.changeset/light-rivers-jump.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'svelte': patch
----
-
-fix: re-evaluate derived props during teardown
diff --git a/packages/svelte/CHANGELOG.md b/packages/svelte/CHANGELOG.md
index 89ae380840..19aa1466c0 100644
--- a/packages/svelte/CHANGELOG.md
+++ b/packages/svelte/CHANGELOG.md
@@ -1,5 +1,13 @@
 # svelte
 
+## 5.35.5
+
+### Patch Changes
+
+- fix: associate sources in Spring/Tween/SvelteMap/SvelteSet with correct reaction ([#16325](https://github.com/sveltejs/svelte/pull/16325))
+
+- fix: re-evaluate derived props during teardown ([#16278](https://github.com/sveltejs/svelte/pull/16278))
+
 ## 5.35.4
 
 ### Patch Changes
diff --git a/packages/svelte/package.json b/packages/svelte/package.json
index aaf8f26fec..4ac497ed41 100644
--- a/packages/svelte/package.json
+++ b/packages/svelte/package.json
@@ -2,7 +2,7 @@
   "name": "svelte",
   "description": "Cybernetically enhanced web apps",
   "license": "MIT",
-  "version": "5.35.4",
+  "version": "5.35.5",
   "type": "module",
   "types": "./types/index.d.ts",
   "engines": {
diff --git a/packages/svelte/src/version.js b/packages/svelte/src/version.js
index c4111b9e8d..eb68753d71 100644
--- a/packages/svelte/src/version.js
+++ b/packages/svelte/src/version.js
@@ -4,5 +4,5 @@
  * The current version, as set in package.json.
  * @type {string}
  */
-export const VERSION = '5.35.4';
+export const VERSION = '5.35.5';
 export const PUBLIC_VERSION = '5';

From 71ed9e4648705ac79f1f834b8530d0d3ee06ffa2 Mon Sep 17 00:00:00 2001
From: Rich Harris <rich.harris@vercel.com>
Date: Wed, 9 Jul 2025 20:56:33 -0400
Subject: [PATCH 4/9] chore: simplify/optimize source_ownership occurrence
 (#16328)

---
 packages/svelte/src/internal/client/runtime.js | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/packages/svelte/src/internal/client/runtime.js b/packages/svelte/src/internal/client/runtime.js
index cd7170d326..d6e7325ba3 100644
--- a/packages/svelte/src/internal/client/runtime.js
+++ b/packages/svelte/src/internal/client/runtime.js
@@ -236,16 +236,13 @@ function schedule_possible_effect_self_invalidation(signal, effect, root = true)
 	var reactions = signal.reactions;
 	if (reactions === null) return;
 
+	if (source_ownership?.reaction === active_reaction && source_ownership.sources.includes(signal)) {
+		return;
+	}
+
 	for (var i = 0; i < reactions.length; i++) {
 		var reaction = reactions[i];
 
-		if (
-			source_ownership?.reaction === active_reaction &&
-			source_ownership.sources.includes(signal)
-		) {
-			continue;
-		}
-
 		if ((reaction.f & DERIVED) !== 0) {
 			schedule_possible_effect_self_invalidation(/** @type {Derived} */ (reaction), effect, false);
 		} else if (effect === reaction) {

From 86b06cb6945816ec8182544ba101cd38679f96a1 Mon Sep 17 00:00:00 2001
From: Rich Harris <rich.harris@vercel.com>
Date: Thu, 10 Jul 2025 01:58:42 -0400
Subject: [PATCH 5/9] chore: dry out transition `get_options` (#16329)

---
 .../src/internal/client/dom/elements/transitions.js   | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/packages/svelte/src/internal/client/dom/elements/transitions.js b/packages/svelte/src/internal/client/dom/elements/transitions.js
index 38100e982c..00fad9ffdb 100644
--- a/packages/svelte/src/internal/client/dom/elements/transitions.js
+++ b/packages/svelte/src/internal/client/dom/elements/transitions.js
@@ -209,21 +209,14 @@ export function transition(flags, element, get_fn, get_params) {
 	var outro;
 
 	function get_options() {
-		var previous_reaction = active_reaction;
-		var previous_effect = active_effect;
-		set_active_reaction(null);
-		set_active_effect(null);
-		try {
+		return without_reactive_context(() => {
 			// If a transition is still ongoing, we use the existing options rather than generating
 			// new ones. This ensures that reversible transitions reverse smoothly, rather than
 			// jumping to a new spot because (for example) a different `duration` was used
 			return (current_options ??= get_fn()(element, get_params?.() ?? /** @type {P} */ ({}), {
 				direction
 			}));
-		} finally {
-			set_active_reaction(previous_reaction);
-			set_active_effect(previous_effect);
-		}
+		});
 	}
 
 	/** @type {TransitionManager} */

From c3361bfdb7adc3f2df6ec831fb54f2ca614880e9 Mon Sep 17 00:00:00 2001
From: Rich Harris <rich.harris@vercel.com>
Date: Thu, 10 Jul 2025 01:59:57 -0400
Subject: [PATCH 6/9] chore: remove component_context.d (#16330)

---
 packages/svelte/src/internal/client/context.js          | 9 ++-------
 packages/svelte/src/internal/client/reactivity/props.js | 8 --------
 packages/svelte/src/internal/client/types.d.ts          | 2 --
 3 files changed, 2 insertions(+), 17 deletions(-)

diff --git a/packages/svelte/src/internal/client/context.js b/packages/svelte/src/internal/client/context.js
index 736b81c172..d79d827fee 100644
--- a/packages/svelte/src/internal/client/context.js
+++ b/packages/svelte/src/internal/client/context.js
@@ -139,16 +139,15 @@ export function getAllContexts() {
  * @returns {void}
  */
 export function push(props, runes = false, fn) {
-	var ctx = (component_context = {
+	component_context = {
 		p: component_context,
 		c: null,
-		d: false,
 		e: null,
 		m: false,
 		s: props,
 		x: null,
 		l: null
-	});
+	};
 
 	if (legacy_mode_flag && !runes) {
 		component_context.l = {
@@ -159,10 +158,6 @@ export function push(props, runes = false, fn) {
 		};
 	}
 
-	teardown(() => {
-		/** @type {ComponentContext} */ (ctx).d = true;
-	});
-
 	if (DEV) {
 		// component function
 		component_context.function = fn;
diff --git a/packages/svelte/src/internal/client/reactivity/props.js b/packages/svelte/src/internal/client/reactivity/props.js
index 03daad5251..f39d45bb04 100644
--- a/packages/svelte/src/internal/client/reactivity/props.js
+++ b/packages/svelte/src/internal/client/reactivity/props.js
@@ -268,14 +268,6 @@ export function spread_props(...props) {
 	return new Proxy({ props }, spread_props_handler);
 }
 
-/**
- * @param {Derived} current_value
- * @returns {boolean}
- */
-function has_destroyed_component_ctx(current_value) {
-	return current_value.ctx?.d ?? false;
-}
-
 /**
  * This function is responsible for synchronizing a possibly bound prop with the inner component state.
  * It is used whenever the compiler sees that the component writes to the prop, or when it has a default prop_value.
diff --git a/packages/svelte/src/internal/client/types.d.ts b/packages/svelte/src/internal/client/types.d.ts
index 0b7310e172..bcbd0ac8a3 100644
--- a/packages/svelte/src/internal/client/types.d.ts
+++ b/packages/svelte/src/internal/client/types.d.ts
@@ -14,8 +14,6 @@ export type ComponentContext = {
 	p: null | ComponentContext;
 	/** context */
 	c: null | Map<unknown, unknown>;
-	/** destroyed */
-	d: boolean;
 	/** deferred effects */
 	e: null | Array<{
 		fn: () => void | (() => void);

From 0cafe34c92dd21b532702bf6bc27cce108e25ea0 Mon Sep 17 00:00:00 2001
From: Rich Harris <rich.harris@vercel.com>
Date: Thu, 10 Jul 2025 07:44:07 -0400
Subject: [PATCH 7/9] chore: DRY out increment logic (#16332)

---
 packages/svelte/src/internal/client/proxy.js     | 16 ++++------------
 .../src/internal/client/reactivity/sources.js    |  8 ++++++++
 .../svelte/src/reactivity/create-subscriber.js   |  3 +--
 packages/svelte/src/reactivity/map.js            |  3 +--
 packages/svelte/src/reactivity/set.js            |  3 +--
 .../svelte/src/reactivity/url-search-params.js   |  3 +--
 packages/svelte/src/reactivity/utils.js          |  7 -------
 7 files changed, 16 insertions(+), 27 deletions(-)
 delete mode 100644 packages/svelte/src/reactivity/utils.js

diff --git a/packages/svelte/src/internal/client/proxy.js b/packages/svelte/src/internal/client/proxy.js
index d9063aee34..97c8da9d33 100644
--- a/packages/svelte/src/internal/client/proxy.js
+++ b/packages/svelte/src/internal/client/proxy.js
@@ -8,7 +8,7 @@ import {
 	is_array,
 	object_prototype
 } from '../shared/utils.js';
-import { state as source, set } from './reactivity/sources.js';
+import { state as source, set, increment } from './reactivity/sources.js';
 import { PROXY_PATH_SYMBOL, STATE_SYMBOL } from '#client/constants';
 import { UNINITIALIZED } from '../../constants.js';
 import * as e from './errors.js';
@@ -118,7 +118,7 @@ export function proxy(value) {
 				if (prop in target) {
 					const s = with_parent(() => source(UNINITIALIZED, stack));
 					sources.set(prop, s);
-					update_version(version);
+					increment(version);
 
 					if (DEV) {
 						tag(s, get_label(path, prop));
@@ -136,7 +136,7 @@ export function proxy(value) {
 					}
 				}
 				set(s, UNINITIALIZED);
-				update_version(version);
+				increment(version);
 			}
 
 			return true;
@@ -304,7 +304,7 @@ export function proxy(value) {
 					}
 				}
 
-				update_version(version);
+				increment(version);
 			}
 
 			return true;
@@ -343,14 +343,6 @@ function get_label(path, prop) {
 	return /^\d+$/.test(prop) ? `${path}[${prop}]` : `${path}['${prop}']`;
 }
 
-/**
- * @param {Source<number>} signal
- * @param {1 | -1} [d]
- */
-function update_version(signal, d = 1) {
-	set(signal, signal.v + d);
-}
-
 /**
  * @param {any} value
  */
diff --git a/packages/svelte/src/internal/client/reactivity/sources.js b/packages/svelte/src/internal/client/reactivity/sources.js
index a86ccfee4f..9f08354cc0 100644
--- a/packages/svelte/src/internal/client/reactivity/sources.js
+++ b/packages/svelte/src/internal/client/reactivity/sources.js
@@ -259,6 +259,14 @@ export function update_pre(source, d = 1) {
 	return set(source, d === 1 ? ++value : --value);
 }
 
+/**
+ * Silently (without using `get`) increment a source
+ * @param {Source<number>} source
+ */
+export function increment(source) {
+	set(source, source.v + 1);
+}
+
 /**
  * @param {Value} signal
  * @param {number} status should be DIRTY or MAYBE_DIRTY
diff --git a/packages/svelte/src/reactivity/create-subscriber.js b/packages/svelte/src/reactivity/create-subscriber.js
index 491ffb45cb..67a92ceb7b 100644
--- a/packages/svelte/src/reactivity/create-subscriber.js
+++ b/packages/svelte/src/reactivity/create-subscriber.js
@@ -1,8 +1,7 @@
 import { get, tick, untrack } from '../internal/client/runtime.js';
 import { effect_tracking, render_effect } from '../internal/client/reactivity/effects.js';
-import { source } from '../internal/client/reactivity/sources.js';
+import { source, increment } from '../internal/client/reactivity/sources.js';
 import { tag } from '../internal/client/dev/tracing.js';
-import { increment } from './utils.js';
 import { DEV } from 'esm-env';
 
 /**
diff --git a/packages/svelte/src/reactivity/map.js b/packages/svelte/src/reactivity/map.js
index 4fa2dfd7b2..014b5e7c7c 100644
--- a/packages/svelte/src/reactivity/map.js
+++ b/packages/svelte/src/reactivity/map.js
@@ -1,9 +1,8 @@
 /** @import { Source } from '#client' */
 import { DEV } from 'esm-env';
-import { set, source, state } from '../internal/client/reactivity/sources.js';
+import { set, source, state, increment } from '../internal/client/reactivity/sources.js';
 import { label, tag } from '../internal/client/dev/tracing.js';
 import { get, update_version } from '../internal/client/runtime.js';
-import { increment } from './utils.js';
 
 /**
  * A reactive version of the built-in [`Map`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map) object.
diff --git a/packages/svelte/src/reactivity/set.js b/packages/svelte/src/reactivity/set.js
index 9e3c330beb..d7c2deeaae 100644
--- a/packages/svelte/src/reactivity/set.js
+++ b/packages/svelte/src/reactivity/set.js
@@ -1,9 +1,8 @@
 /** @import { Source } from '#client' */
 import { DEV } from 'esm-env';
-import { source, set, state } from '../internal/client/reactivity/sources.js';
+import { source, set, state, increment } from '../internal/client/reactivity/sources.js';
 import { label, tag } from '../internal/client/dev/tracing.js';
 import { get, update_version } from '../internal/client/runtime.js';
-import { increment } from './utils.js';
 
 var read_methods = ['forEach', 'isDisjointFrom', 'isSubsetOf', 'isSupersetOf'];
 var set_like_methods = ['difference', 'intersection', 'symmetricDifference', 'union'];
diff --git a/packages/svelte/src/reactivity/url-search-params.js b/packages/svelte/src/reactivity/url-search-params.js
index 389da7cdb6..2381e11875 100644
--- a/packages/svelte/src/reactivity/url-search-params.js
+++ b/packages/svelte/src/reactivity/url-search-params.js
@@ -1,9 +1,8 @@
 import { DEV } from 'esm-env';
-import { state } from '../internal/client/reactivity/sources.js';
+import { state, increment } from '../internal/client/reactivity/sources.js';
 import { tag } from '../internal/client/dev/tracing.js';
 import { get } from '../internal/client/runtime.js';
 import { get_current_url } from './url.js';
-import { increment } from './utils.js';
 
 export const REPLACE = Symbol();
 
diff --git a/packages/svelte/src/reactivity/utils.js b/packages/svelte/src/reactivity/utils.js
deleted file mode 100644
index cd55e0e0ba..0000000000
--- a/packages/svelte/src/reactivity/utils.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/** @import { Source } from '#client' */
-import { set } from '../internal/client/reactivity/sources.js';
-
-/** @param {Source<number>} source */
-export function increment(source) {
-	set(source, source.v + 1);
-}

From 8da222f46021fd2bd3e69048557a229c20a2fe94 Mon Sep 17 00:00:00 2001
From: Rich Harris <rich.harris@vercel.com>
Date: Thu, 10 Jul 2025 08:57:33 -0400
Subject: [PATCH 8/9] chore: simplify component pop (#16331)

* chore: simplify pop

* shuffle

* remove .m flag on component context

* unused

* shuffle

* simplify

* context is never null in pop

* changeset
---
 .changeset/new-candles-marry.md               |  5 ++
 .../svelte/src/internal/client/context.js     | 50 ++++++++-----------
 .../src/internal/client/reactivity/effects.js | 18 ++-----
 .../svelte/src/internal/client/types.d.ts     |  8 +--
 4 files changed, 30 insertions(+), 51 deletions(-)
 create mode 100644 .changeset/new-candles-marry.md

diff --git a/.changeset/new-candles-marry.md b/.changeset/new-candles-marry.md
new file mode 100644
index 0000000000..4d55980c72
--- /dev/null
+++ b/.changeset/new-candles-marry.md
@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+chore: simplify internal component `pop()`
diff --git a/packages/svelte/src/internal/client/context.js b/packages/svelte/src/internal/client/context.js
index d79d827fee..6876a89f57 100644
--- a/packages/svelte/src/internal/client/context.js
+++ b/packages/svelte/src/internal/client/context.js
@@ -143,7 +143,6 @@ export function push(props, runes = false, fn) {
 		p: component_context,
 		c: null,
 		e: null,
-		m: false,
 		s: props,
 		x: null,
 		l: null
@@ -171,37 +170,28 @@ export function push(props, runes = false, fn) {
  * @returns {T}
  */
 export function pop(component) {
-	const context_stack_item = component_context;
-	if (context_stack_item !== null) {
-		if (component !== undefined) {
-			context_stack_item.x = component;
-		}
-		const component_effects = context_stack_item.e;
-		if (component_effects !== null) {
-			var previous_effect = active_effect;
-			var previous_reaction = active_reaction;
-			context_stack_item.e = null;
-			try {
-				for (var i = 0; i < component_effects.length; i++) {
-					var component_effect = component_effects[i];
-					set_active_effect(component_effect.effect);
-					set_active_reaction(component_effect.reaction);
-					create_user_effect(component_effect.fn);
-				}
-			} finally {
-				set_active_effect(previous_effect);
-				set_active_reaction(previous_reaction);
-			}
-		}
-		component_context = context_stack_item.p;
-		if (DEV) {
-			dev_current_component_function = context_stack_item.p?.function ?? null;
+	var context = /** @type {ComponentContext} */ (component_context);
+	var effects = context.e;
+
+	if (effects !== null) {
+		context.e = null;
+
+		for (var fn of effects) {
+			create_user_effect(fn);
 		}
-		context_stack_item.m = true;
 	}
-	// Micro-optimization: Don't set .a above to the empty object
-	// so it can be garbage-collected when the return here is unused
-	return component || /** @type {T} */ ({});
+
+	if (component !== undefined) {
+		context.x = component;
+	}
+
+	component_context = context.p;
+
+	if (DEV) {
+		dev_current_component_function = component_context?.function ?? null;
+	}
+
+	return component ?? /** @type {T} */ ({});
 }
 
 /** @returns {boolean} */
diff --git a/packages/svelte/src/internal/client/reactivity/effects.js b/packages/svelte/src/internal/client/reactivity/effects.js
index df2afd3e38..51c6805529 100644
--- a/packages/svelte/src/internal/client/reactivity/effects.js
+++ b/packages/svelte/src/internal/client/reactivity/effects.js
@@ -179,28 +179,18 @@ export function teardown(fn) {
 export function user_effect(fn) {
 	validate_effect('$effect');
 
-	// Non-nested `$effect(...)` in a component should be deferred
-	// until the component is mounted
-	var defer =
-		active_effect !== null &&
-		(active_effect.f & BRANCH_EFFECT) !== 0 &&
-		component_context !== null &&
-		!component_context.m;
-
 	if (DEV) {
 		define_property(fn, 'name', {
 			value: '$effect'
 		});
 	}
 
-	if (defer) {
+	if (!active_reaction && active_effect && (active_effect.f & BRANCH_EFFECT) !== 0) {
+		// Top-level `$effect(...)` in a component — defer until mount
 		var context = /** @type {ComponentContext} */ (component_context);
-		(context.e ??= []).push({
-			fn,
-			effect: active_effect,
-			reaction: active_reaction
-		});
+		(context.e ??= []).push(fn);
 	} else {
+		// Everything else — create immediately
 		return create_user_effect(fn);
 	}
 }
diff --git a/packages/svelte/src/internal/client/types.d.ts b/packages/svelte/src/internal/client/types.d.ts
index bcbd0ac8a3..a42f91343c 100644
--- a/packages/svelte/src/internal/client/types.d.ts
+++ b/packages/svelte/src/internal/client/types.d.ts
@@ -15,13 +15,7 @@ export type ComponentContext = {
 	/** context */
 	c: null | Map<unknown, unknown>;
 	/** deferred effects */
-	e: null | Array<{
-		fn: () => void | (() => void);
-		effect: null | Effect;
-		reaction: null | Reaction;
-	}>;
-	/** mounted */
-	m: boolean;
+	e: null | Array<() => void | (() => void)>;
 	/**
 	 * props — needed for legacy mode lifecycle functions, and for `createEventDispatcher`
 	 * @deprecated remove in 6.0

From 0e7e873a1b9a4b5c999ccc2525172d658fc73e25 Mon Sep 17 00:00:00 2001
From: "Dominik G." <dominik.goepel@gmx.de>
Date: Thu, 10 Jul 2025 15:41:47 +0200
Subject: [PATCH 9/9] chore: update svelte-ecosystem-ci trigger (#16315)

---
 .github/workflows/ecosystem-ci-trigger.yml | 43 +++++++++++++++-------
 1 file changed, 30 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ecosystem-ci-trigger.yml b/.github/workflows/ecosystem-ci-trigger.yml
index 71df3242e8..7c6b740370 100644
--- a/.github/workflows/ecosystem-ci-trigger.yml
+++ b/.github/workflows/ecosystem-ci-trigger.yml
@@ -8,9 +8,17 @@ jobs:
   trigger:
     runs-on: ubuntu-latest
     if: github.repository == 'sveltejs/svelte' && github.event.issue.pull_request && startsWith(github.event.comment.body, '/ecosystem-ci run')
+    permissions:
+      issues: write # to add / delete reactions
+      pull-requests: read # to read PR data
+      actions: read # to check workflow status
+      contents: read # to clone the repo
     steps:
-      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
-      - uses: actions/github-script@v6
+      - name: monitor action permissions
+        uses: GitHubSecurityLab/actions-permissions/monitor@v1
+      - name: check user authorization # user needs triage permission
+        uses: actions/github-script@v7
+        id: check-permissions
         with:
           script: |
             const user = context.payload.sender.login
@@ -29,7 +37,7 @@ jobs:
             }
 
             if (hasTriagePermission) {
-              console.log('Allowed')
+              console.log('User is allowed. Adding +1 reaction.')
               await github.rest.reactions.createForIssueComment({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
@@ -37,16 +45,18 @@ jobs:
                 content: '+1',
               })
             } else {
-              console.log('Not allowed')
+              console.log('User is not allowed. Adding -1 reaction.')
               await github.rest.reactions.createForIssueComment({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 comment_id: context.payload.comment.id,
                 content: '-1',
               })
-              throw new Error('not allowed')
+              throw new Error('User does not have the necessary permissions.')
             }
-      - uses: actions/github-script@v6
+
+      - name: Get PR Data
+        uses: actions/github-script@v7
         id: get-pr-data
         with:
           script: |
@@ -59,21 +69,27 @@ jobs:
             return {
               num: context.issue.number,
               branchName: pr.head.ref,
+              commit: pr.head.sha,
               repo: pr.head.repo.full_name
             }
-      - id: generate-token
-        uses: tibdex/github-app-token@b62528385c34dbc9f38e5f4225ac829252d1ea92 #keep pinned for security reasons, currently 1.8.0
+
+      - name: Generate Token
+        id: generate-token
+        uses: actions/create-github-app-token@v2
         with:
-          app_id: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_ID }}
-          private_key: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_PRIVATE_KEY }}
-          repository: '${{ github.repository_owner }}/svelte-ecosystem-ci'
-      - uses: actions/github-script@v6
+          app-id: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_ID }}
+          private-key: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_PRIVATE_KEY }}
+          repositories: |
+            svelte
+            svelte-ecosystem-ci
+
+      - name: Trigger Downstream Workflow
+        uses: actions/github-script@v7
         id: trigger
         env:
           COMMENT: ${{ github.event.comment.body }}
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
-          result-encoding: string
           script: |
             const comment = process.env.COMMENT.trim()
             const prData = ${{ steps.get-pr-data.outputs.result }}
@@ -89,6 +105,7 @@ jobs:
                 prNumber: '' + prData.num,
                 branchName: prData.branchName,
                 repo: prData.repo,
+                commit: prData.commit,
                 suite: suite === '' ? '-' : suite
               }
             })