From 2bace308e37ac1def958be750bd699ed302bb715 Mon Sep 17 00:00:00 2001
From: Floze <88098863+floze-the-genius@users.noreply.github.com>
Date: Wed, 22 Jul 2026 16:17:27 +0400
Subject: [PATCH 1/4] fix: preserve select selection with spread attributes
 (#18561)

Fixes #18557

A `<select>` with spread attributes initializes the option mutation
observer even when those attributes never provide a `value`. In that
case the element has no internal `__value`, but the observer previously
treated the missing property as an explicit `undefined` value and
deselected every option after an option was added or removed.

Only reapply the programmatic selection when `__value` is actually
present. This preserves the browser's current selection for spreads
without a value while keeping the existing behavior for bindings,
including an explicitly stored `undefined` value.

A runtime-legacy regression fixture covers both adding and removing an
option in client and hydration modes.

### Before submitting

- [x] References the existing issue
- [x] Uses a `fix:` title
- [x] Includes a regression test
- [x] Includes a patch changeset for `svelte`

### Test plan

- [x] `FILTER=select-spread-preserve-selection pnpm test runtime-legacy
--maxWorkers=1` (2 tests passed: client and hydrate)
- [x] `git diff --check`
- [ ] Full `pnpm test` was not run because the shared host was under
resource pressure and broad test processes were explicitly avoided
- [ ] `pnpm lint` and `pnpm check` were not run for the same reason
- [ ] Targeted repository Prettier check was attempted, but could not
start because `prettier-plugin-svelte` required the ungenerated
`packages/svelte/compiler/index.js`; no broad build or dependency
reinstall was run

### AI disclosure

AI-assisted: the implementation, regression test, and pull request text
were prepared with OpenAI Codex and reviewed by the contributor.

Co-authored-by: Paolo Ricciuti <ricciutipaolo@gmail.com>
---
 .changeset/tidy-select-spreads.md             |  5 ++++
 .../client/dom/elements/bindings/select.js    |  6 +++--
 .../_config.js                                | 25 +++++++++++++++++++
 .../main.svelte                               | 16 ++++++++++++
 4 files changed, 50 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/tidy-select-spreads.md
 create mode 100644 packages/svelte/tests/runtime-legacy/samples/select-spread-preserve-selection/_config.js
 create mode 100644 packages/svelte/tests/runtime-legacy/samples/select-spread-preserve-selection/main.svelte

diff --git a/.changeset/tidy-select-spreads.md b/.changeset/tidy-select-spreads.md
new file mode 100644
index 0000000000..3b14dc5d34
--- /dev/null
+++ b/.changeset/tidy-select-spreads.md
@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: preserve select selection when spread attributes omit value
diff --git a/packages/svelte/src/internal/client/dom/elements/bindings/select.js b/packages/svelte/src/internal/client/dom/elements/bindings/select.js
index eb26062653..e390e23ea0 100644
--- a/packages/svelte/src/internal/client/dom/elements/bindings/select.js
+++ b/packages/svelte/src/internal/client/dom/elements/bindings/select.js
@@ -56,8 +56,10 @@ export function select_option(select, value, mounting = false) {
  */
 export function init_select(select) {
 	var observer = new MutationObserver(() => {
-		// @ts-ignore
-		select_option(select, select.__value);
+		if ('__value' in select) {
+			// @ts-ignore
+			select_option(select, select.__value);
+		}
 		// Deliberately don't update the potential binding value,
 		// the model should be preserved unless explicitly changed
 	});
diff --git a/packages/svelte/tests/runtime-legacy/samples/select-spread-preserve-selection/_config.js b/packages/svelte/tests/runtime-legacy/samples/select-spread-preserve-selection/_config.js
new file mode 100644
index 0000000000..8bc2f11e26
--- /dev/null
+++ b/packages/svelte/tests/runtime-legacy/samples/select-spread-preserve-selection/_config.js
@@ -0,0 +1,25 @@
+import { flushSync } from 'svelte';
+import { ok, test } from '../../test';
+
+export default test({
+	mode: ['client', 'hydrate'],
+
+	async test({ assert, component, target }) {
+		const select = target.querySelector('select');
+		ok(select);
+
+		assert.equal(select.selectedIndex, 0);
+
+		component.toggle();
+		flushSync();
+		await Promise.resolve();
+
+		assert.equal(select.selectedIndex, 0);
+
+		component.toggle();
+		flushSync();
+		await Promise.resolve();
+
+		assert.equal(select.selectedIndex, 0);
+	}
+});
diff --git a/packages/svelte/tests/runtime-legacy/samples/select-spread-preserve-selection/main.svelte b/packages/svelte/tests/runtime-legacy/samples/select-spread-preserve-selection/main.svelte
new file mode 100644
index 0000000000..229ce4fb73
--- /dev/null
+++ b/packages/svelte/tests/runtime-legacy/samples/select-spread-preserve-selection/main.svelte
@@ -0,0 +1,16 @@
+<script>
+	let show_extra = false;
+	const attributes = { 'aria-label': 'choice' };
+
+	export function toggle() {
+		show_extra = !show_extra;
+	}
+</script>
+
+<select {...attributes}>
+	<option value="">Choose an option</option>
+	<option value="first">First</option>
+	{#if show_extra}
+		<option value="extra">Extra</option>
+	{/if}
+</select>

From 3dde011d3a9e7b9145169da0b75dcd607a378c0e Mon Sep 17 00:00:00 2001
From: Nic Polumeyv <nicolas.polum@outlook.com>
Date: Thu, 23 Jul 2026 17:45:50 -0400
Subject: [PATCH 2/4] fix: call `onerror` and provide a working `reset` when
 hydrating a failed boundary (#18556)

Fixes #18555

A boundary that failed during SSR hydrates via
`#hydrate_failed_content`, which never calls `onerror` and passes the
`failed` snippet a no-op `reset`. Both came in with #17672, whose docs
say `onerror` "will be called upon hydration with the deserialized error
object". Once hydrated as failed, the boundary can never leave that
state. Downstream this is what keeps SvelteKit's `+error.svelte` mounted
after navigating away from a server-rendered error page
(sveltejs/kit#16345).

This extracts the reset/onerror machinery from `#handle_error` into
`#create_reset` and uses it in the hydration path too. `onerror` is
invoked in a microtask because it may mutate state, which is disallowed
while hydrating. `#handle_error` already invokes it asynchronously, so
the timing matches the error path.

The tests flip a `recovered` flag before calling `reset`, since the
child would otherwise throw again. That is the intended retry pattern,
and the same one kit uses when it resets route boundaries on navigation.
Verified against kit end to end, hydrating a server-rendered error page
and navigating away now tears it down with no kit changes needed.
---
 .changeset/hydrated-boundary-reset.md         |  5 ++
 .../internal/client/dom/blocks/boundary.js    | 89 ++++++++++++-------
 .../error-boundary-hydrate-1/_config.js       | 19 ++++
 .../error-boundary-hydrate-1/child.svelte     |  3 +
 .../error-boundary-hydrate-1/main.svelte      | 29 ++++++
 .../error-boundary-hydrate-2/_config.js       | 16 ++++
 .../error-boundary-hydrate-2/child.svelte     |  3 +
 .../error-boundary-hydrate-2/main.svelte      | 22 +++++
 8 files changed, 152 insertions(+), 34 deletions(-)
 create mode 100644 .changeset/hydrated-boundary-reset.md
 create mode 100644 packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-1/_config.js
 create mode 100644 packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-1/child.svelte
 create mode 100644 packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-1/main.svelte
 create mode 100644 packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-2/_config.js
 create mode 100644 packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-2/child.svelte
 create mode 100644 packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-2/main.svelte

diff --git a/.changeset/hydrated-boundary-reset.md b/.changeset/hydrated-boundary-reset.md
new file mode 100644
index 0000000000..799a57fd9b
--- /dev/null
+++ b/.changeset/hydrated-boundary-reset.md
@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: call `onerror` and provide a working `reset` when hydrating a failed boundary
diff --git a/packages/svelte/src/internal/client/dom/blocks/boundary.js b/packages/svelte/src/internal/client/dom/blocks/boundary.js
index 0c0903ff52..4f655a3695 100644
--- a/packages/svelte/src/internal/client/dom/blocks/boundary.js
+++ b/packages/svelte/src/internal/client/dom/blocks/boundary.js
@@ -199,17 +199,68 @@ export class Boundary {
 	 */
 	#hydrate_failed_content(error) {
 		const failed = this.#props.failed;
+		const { reset, invoke_onerror } = this.#create_reset(error);
+
+		// `onerror` may mutate state, which is disallowed while hydrating
+		queue_micro_task(invoke_onerror);
+
 		if (!failed) return;
 
 		this.#failed_effect = branch(() => {
 			failed(
 				this.#anchor,
 				() => error,
-				() => () => {}
+				() => reset
 			);
 		});
 	}
 
+	/**
+	 * Creates the `reset` function for a failed boundary, along with a function
+	 * that invokes `onerror` with it (if provided)
+	 * @param {unknown} error
+	 * @returns {{ reset: () => void, invoke_onerror: () => void }}
+	 */
+	#create_reset(error) {
+		var did_reset = false;
+		var calling_on_error = false;
+
+		const reset = () => {
+			if (did_reset) {
+				w.svelte_boundary_reset_noop();
+				return;
+			}
+
+			did_reset = true;
+
+			if (calling_on_error) {
+				e.svelte_boundary_reset_onerror();
+			}
+
+			if (this.#failed_effect !== null) {
+				pause_effect(this.#failed_effect, () => {
+					this.#failed_effect = null;
+				});
+			}
+
+			this.#run(() => {
+				this.#render();
+			});
+		};
+
+		const invoke_onerror = () => {
+			try {
+				calling_on_error = true;
+				this.#props.onerror?.(error, reset);
+				calling_on_error = false;
+			} catch (err) {
+				invoke_error_boundary(err, this.#effect && this.#effect.parent);
+			}
+		};
+
+		return { reset, invoke_onerror };
+	}
+
 	#hydrate_pending_content() {
 		const pending = this.#props.pending;
 		if (!pending) return;
@@ -429,43 +480,13 @@ export class Boundary {
 			set_hydrate_node(skip_nodes());
 		}
 
-		var onerror = this.#props.onerror;
 		let failed = this.#props.failed;
-		var did_reset = false;
-		var calling_on_error = false;
-
-		const reset = () => {
-			if (did_reset) {
-				w.svelte_boundary_reset_noop();
-				return;
-			}
-
-			did_reset = true;
-
-			if (calling_on_error) {
-				e.svelte_boundary_reset_onerror();
-			}
-
-			if (this.#failed_effect !== null) {
-				pause_effect(this.#failed_effect, () => {
-					this.#failed_effect = null;
-				});
-			}
-
-			this.#run(() => {
-				this.#render();
-			});
-		};
 
 		/** @param {unknown} transformed_error */
 		const handle_error_result = (transformed_error) => {
-			try {
-				calling_on_error = true;
-				onerror?.(transformed_error, reset);
-				calling_on_error = false;
-			} catch (error) {
-				invoke_error_boundary(error, this.#effect && this.#effect.parent);
-			}
+			const { reset, invoke_onerror } = this.#create_reset(transformed_error);
+
+			invoke_onerror();
 
 			if (failed) {
 				this.#failed_effect = this.#run(() => {
diff --git a/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-1/_config.js b/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-1/_config.js
new file mode 100644
index 0000000000..f0aef7e92f
--- /dev/null
+++ b/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-1/_config.js
@@ -0,0 +1,19 @@
+import { flushSync } from 'svelte';
+import { test } from '../../test';
+
+export default test({
+	mode: ['hydrate'],
+	ssrHtml: '<p>failed: error</p> <button>reset</button>',
+	transformError: () => 'error',
+
+	test({ assert, target, logs }) {
+		// `onerror` is called upon hydration with the deserialized error
+		assert.deepEqual(logs, ['onerror: error']);
+
+		const btn = target.querySelector('button');
+		btn?.click();
+		flushSync();
+
+		assert.htmlEqual(target.innerHTML, '<p>recovered</p> <button>reset</button>');
+	}
+});
diff --git a/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-1/child.svelte b/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-1/child.svelte
new file mode 100644
index 0000000000..e93c7bb0fa
--- /dev/null
+++ b/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-1/child.svelte
@@ -0,0 +1,3 @@
+<script>
+	throw new Error('unlucky');
+</script>
diff --git a/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-1/main.svelte b/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-1/main.svelte
new file mode 100644
index 0000000000..e84198473b
--- /dev/null
+++ b/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-1/main.svelte
@@ -0,0 +1,29 @@
+<script>
+	import Child from './child.svelte';
+
+	let recovered = $state(false);
+	let reset_fn = $state();
+</script>
+
+<svelte:boundary
+	onerror={(error, reset) => {
+		console.log(`onerror: ${error}`);
+		reset_fn = reset;
+	}}
+>
+	{#if recovered}
+		<p>recovered</p>
+	{:else}
+		<Child />
+	{/if}
+
+	{#snippet failed(error)}
+		<p>failed: {error}</p>
+	{/snippet}
+</svelte:boundary>
+
+<button
+	onclick={() => {
+		recovered = true;
+		reset_fn();
+	}}>reset</button>
diff --git a/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-2/_config.js b/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-2/_config.js
new file mode 100644
index 0000000000..e5c52eb19c
--- /dev/null
+++ b/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-2/_config.js
@@ -0,0 +1,16 @@
+import { flushSync } from 'svelte';
+import { test } from '../../test';
+
+export default test({
+	mode: ['hydrate'],
+	ssrHtml: '<p>failed: error</p> <button>reset</button>',
+	transformError: () => 'error',
+
+	test({ assert, target }) {
+		const btn = target.querySelector('button');
+		btn?.click();
+		flushSync();
+
+		assert.htmlEqual(target.innerHTML, '<p>recovered</p>');
+	}
+});
diff --git a/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-2/child.svelte b/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-2/child.svelte
new file mode 100644
index 0000000000..e93c7bb0fa
--- /dev/null
+++ b/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-2/child.svelte
@@ -0,0 +1,3 @@
+<script>
+	throw new Error('unlucky');
+</script>
diff --git a/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-2/main.svelte b/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-2/main.svelte
new file mode 100644
index 0000000000..1642a94e7a
--- /dev/null
+++ b/packages/svelte/tests/runtime-runes/samples/error-boundary-hydrate-2/main.svelte
@@ -0,0 +1,22 @@
+<script>
+	import Child from './child.svelte';
+
+	let recovered = $state(false);
+</script>
+
+<svelte:boundary>
+	{#if recovered}
+		<p>recovered</p>
+	{:else}
+		<Child />
+	{/if}
+
+	{#snippet failed(error, reset)}
+		<p>failed: {error}</p>
+		<button
+			onclick={() => {
+				recovered = true;
+				reset();
+			}}>reset</button>
+	{/snippet}
+</svelte:boundary>

From 23bc246a99c649c0c325509debb93e062948e240 Mon Sep 17 00:00:00 2001
From: Elliott Johnson <hello@ell.iott.dev>
Date: Fri, 24 Jul 2026 14:14:11 -0600
Subject: [PATCH 3/4] chore: Supply chain hardening (#18253)

`svelte`

Supply-chain hardening pass.

## Changes
- Bump `packageManager` from `pnpm@10.4.0` to `pnpm@10.33.4` with
`+sha512` integrity suffix.
- Add to `pnpm-workspace.yaml`:
  - `minimumReleaseAge: 1440`
  - `minimumReleaseAgeExclude: ['@sveltejs/*', svelte, esrap, devalue]`
  - `blockExoticSubdeps: true`
- Remove `pkg.pr.new.yml` workflow in favor of `pkg.svelte.dev`
- Pin all third-party GitHub Actions to full SHA with `# vX.Y.Z`
comments across `ci.yml`, `autofix.yml`, `release.yml`,
`ecosystem-ci-trigger.yml`
- Upgrade `pnpm/action-setup` references in `ci.yml`, `autofix.yml`,
`release.yml` from a SHA that was incorrectly labeled `# v4` (actually
`v5.0.0` / `v4.4.0`) to the current `v6.0.8` SHA so the version label
matches reality.
---
 .github/workflows/autofix.yml              |   8 +-
 .github/workflows/ci.yml                   |  30 +--
 .github/workflows/ecosystem-ci-trigger.yml |   8 +-
 .github/workflows/pkg.pr.new.yml           | 229 ---------------------
 .github/workflows/release.yml              |   6 +-
 package.json                               |   2 +-
 pnpm-workspace.yaml                        |  12 ++
 7 files changed, 39 insertions(+), 256 deletions(-)
 delete mode 100644 .github/workflows/pkg.pr.new.yml

diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
index b6c26e0792..5cdbd34e5b 100644
--- a/.github/workflows/autofix.yml
+++ b/.github/workflows/autofix.yml
@@ -28,7 +28,7 @@ jobs:
       - name: Get PR ref
         if: github.event_name != 'workflow_dispatch'
         id: pr
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const { data: pull } = await github.rest.pulls.get({
@@ -46,12 +46,12 @@ jobs:
               core.setFailed('PR is from a fork');
             }
             core.setOutput('ref', pull.head.ref);
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         if: github.event_name == 'workflow_dispatch' || steps.pr.outcome == 'success'
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && github.ref || steps.pr.outputs.ref }}
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
-      - uses: actions/setup-node@v6
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: pnpm
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 365717755e..3846690135 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,9 +32,9 @@ jobs:
             os: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ${{ matrix.node-version }}
           cache: pnpm
@@ -48,9 +48,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 22
           cache: pnpm
@@ -65,9 +65,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: pnpm
@@ -82,9 +82,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: pnpm
@@ -105,9 +105,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           cache: pnpm
diff --git a/.github/workflows/ecosystem-ci-trigger.yml b/.github/workflows/ecosystem-ci-trigger.yml
index 8a6d1bf345..8691a64ca4 100644
--- a/.github/workflows/ecosystem-ci-trigger.yml
+++ b/.github/workflows/ecosystem-ci-trigger.yml
@@ -17,7 +17,7 @@ jobs:
       contents: read # to clone the repo
     steps:
       - name: Check User Permissions
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         id: check-permissions
         with:
           script: |
@@ -56,7 +56,7 @@ jobs:
             }
 
       - name: Get PR Data
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         id: get-pr-data
         with:
           script: |
@@ -106,7 +106,7 @@ jobs:
 
       - name: Generate Token
         id: generate-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
         with:
           app-id: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_ID }}
           private-key: ${{ secrets.ECOSYSTEM_CI_GITHUB_APP_PRIVATE_KEY }}
@@ -115,7 +115,7 @@ jobs:
             svelte-ecosystem-ci
 
       - name: Trigger Downstream Workflow
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         id: trigger
         env:
           COMMENT: ${{ github.event.comment.body }}
diff --git a/.github/workflows/pkg.pr.new.yml b/.github/workflows/pkg.pr.new.yml
deleted file mode 100644
index 0fcda5a778..0000000000
--- a/.github/workflows/pkg.pr.new.yml
+++ /dev/null
@@ -1,229 +0,0 @@
-name: pkg.pr.new
-on:
-  pull_request_target:
-    types: [opened, synchronize]
-  push:
-    branches: [main]
-  workflow_dispatch:
-    inputs:
-      sha:
-        description: 'Commit SHA to build'
-        required: true
-        type: string
-      pr:
-        description: 'PR number to comment on'
-        required: true
-        type: number
-
-permissions: {}
-
-jobs:
-  build:
-    # Skip pull_request_target events from forks — maintainers can use workflow_dispatch instead
-    if: >
-      github.event_name != 'pull_request_target' ||
-      github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
-    # No permissions — this job runs user-controlled code
-    permissions: {}
-
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          # For pull_request_target, check out the PR head.
-          # For workflow_dispatch, check out the manually specified SHA.
-          # For push, fall back to the push SHA.
-          ref: ${{ github.event.pull_request.head.sha || inputs.sha || github.sha }}
-
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 22.x
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Build
-        run: pnpm build
-
-      - run: pnpx pkg-pr-new publish --comment=off --json output.json --compact --no-template './packages/svelte'
-
-      - name: Upload output
-        uses: actions/upload-artifact@v4
-        with:
-          name: output
-          path: ./output.json
-
-  # Sanitizes the untrusted output from the build job before it's consumed by
-  # jobs with elevated permissions. This ensures that only known package names
-  # and valid SHA prefixes make it through.
-  sanitize:
-    needs: build
-    runs-on: ubuntu-latest
-
-    permissions: {}
-
-    steps:
-      - name: Download artifact
-        uses: actions/download-artifact@v7
-        with:
-          name: output
-
-      - name: Sanitize output
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const fs = require('fs');
-            const raw = JSON.parse(fs.readFileSync('output.json', 'utf8'));
-
-            const ALLOWED_PACKAGES = new Set(['svelte']);
-            const SHA_PATTERN = /^[0-9a-f]{7}$/;
-
-            const packages = (raw.packages || [])
-              .filter(p => {
-                if (!ALLOWED_PACKAGES.has(p.name)) {
-                  console.log(`Skipping unexpected package: ${JSON.stringify(p.name)}`);
-                  return false;
-                }
-                const sha = p.url?.replace(/^.+@([^@]+)$/, '$1');
-                if (!sha || !SHA_PATTERN.test(sha)) {
-                  console.log(`Skipping package with invalid SHA: ${JSON.stringify(p.url)}`);
-                  return false;
-                }
-                return true;
-              })
-              .map(p => ({
-                name: p.name,
-                sha: p.url.replace(/^.+@([^@]+)$/, '$1'),
-              }));
-
-            fs.writeFileSync('sanitized-output.json', JSON.stringify({ packages }), 'utf8');
-
-      - name: Upload sanitized output
-        uses: actions/upload-artifact@v4
-        with:
-          name: sanitized-output
-          path: ./sanitized-output.json
-
-  comment:
-    needs: sanitize
-    if: github.event_name == 'pull_request_target' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-
-    permissions:
-      contents: read
-      pull-requests: write
-
-    steps:
-      - name: Download sanitized artifact
-        uses: actions/download-artifact@v7
-        with:
-          name: sanitized-output
-
-      - name: Resolve PR number
-        id: pr
-        uses: actions/github-script@v8
-        with:
-          script: |
-            if (context.eventName === 'pull_request_target') {
-              core.setOutput('number', context.issue.number);
-              return;
-            }
-
-            // For workflow_dispatch, use the explicitly provided PR number.
-            // We can't use listPullRequestsAssociatedWithCommit because fork
-            // commits don't exist in the base repo, so the API returns nothing.
-            const pr = Number('${{ inputs.pr }}');
-            if (!pr || isNaN(pr)) {
-              core.setFailed('workflow_dispatch requires a valid pr input');
-              return;
-            }
-
-            core.setOutput('number', pr);
-
-      - name: Post or update comment
-        uses: actions/github-script@v8
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const fs = require('fs');
-            const { packages } = JSON.parse(fs.readFileSync('sanitized-output.json', 'utf8'));
-
-            if (packages.length === 0) {
-              console.log('No valid packages found. Skipping comment.');
-              return;
-            }
-
-            const issue_number = parseInt('${{ steps.pr.outputs.number }}', 10);
-
-            const bot_comment_identifier = `<!-- pkg.pr.new comment -->`;
-
-            const body = `${bot_comment_identifier}
-
-            [Playground](https://svelte.dev/playground?version=pr-${issue_number})
-
-            \`\`\`
-            ${packages.map(p => `pnpm add https://pkg.pr.new/${p.name}@${issue_number}`).join('\n')}
-            \`\`\`
-            `;
-
-            const comments = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number,
-            });
-            const existing = comments.data.find(c => c.body.includes(bot_comment_identifier));
-
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number,
-                body,
-              });
-            }
-
-  log:
-    needs: sanitize
-    if: github.event_name == 'push'
-    runs-on: ubuntu-latest
-
-    permissions: {}
-
-    steps:
-      - name: Download sanitized artifact
-        uses: actions/download-artifact@v7
-        with:
-          name: sanitized-output
-
-      - name: Log publish info
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const fs = require('fs');
-            const { packages } = JSON.parse(fs.readFileSync('sanitized-output.json', 'utf8'));
-
-            if (packages.length === 0) {
-              console.log('No valid packages found.');
-              return;
-            }
-
-            console.log('\n' + '='.repeat(50));
-            console.log('Publish Information');
-            console.log('='.repeat(50));
-            for (const p of packages) {
-              console.log(`${p.name} - pnpm add https://pkg.pr.new/${p.name}@${p.sha}`);
-            }
-            const svelte = packages.find(p => p.name === 'svelte');
-            if (svelte) {
-              console.log(`\nPlayground: https://svelte.dev/playground?version=commit-${svelte.sha}`);
-            }
-            console.log('='.repeat(50));
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 359fcb7eea..12fe17582e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,13 +23,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           # This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
           fetch-depth: 0
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24.x
           cache: pnpm
diff --git a/package.json b/package.json
index 0d2fbc7fd6..a178d31698 100644
--- a/package.json
+++ b/package.json
@@ -5,7 +5,7 @@
   "private": true,
   "type": "module",
   "license": "MIT",
-  "packageManager": "pnpm@10.4.0",
+  "packageManager": "pnpm@10.33.4+sha512.1c67b3b359b2d408119ba1ed289f34b8fc3c6873412bec6fd264fbdc82489e510fcbecb9ce9d22dae7f3b76269d8441046014bdca53b9979cd7a561ad631b800",
   "engines": {
     "pnpm": ">=9.0.0"
   },
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index f94dac7cc7..8c81497078 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,3 +1,15 @@
+minimumReleaseAge: 2880
+minimumReleaseAgeExclude:
+  - '@sveltejs/*'
+  - svelte
+  - esrap
+  - devalue
+  - zimmerframe
+  - prettier-plugin-svelte
+  - svelte-check
+  - esm-env
+blockExoticSubdeps: true
+
 packages:
   - 'packages/*'
   - 'playgrounds/*'

From 44a7813730579b94004e182e5a67aab27aa9d2a6 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sat, 25 Jul 2026 00:04:41 +0200
Subject: [PATCH 4/4] Version Packages (#18572)

This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## svelte@5.56.8

### Patch Changes

- fix: call `onerror` and provide a working `reset` when hydrating a
failed boundary
([#18556](https://github.com/sveltejs/svelte/pull/18556))

- fix: preserve select selection when spread attributes omit value
([#18561](https://github.com/sveltejs/svelte/pull/18561))

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 .changeset/hydrated-boundary-reset.md | 5 -----
 .changeset/tidy-select-spreads.md     | 5 -----
 packages/svelte/CHANGELOG.md          | 8 ++++++++
 packages/svelte/package.json          | 2 +-
 packages/svelte/src/version.js        | 2 +-
 5 files changed, 10 insertions(+), 12 deletions(-)
 delete mode 100644 .changeset/hydrated-boundary-reset.md
 delete mode 100644 .changeset/tidy-select-spreads.md

diff --git a/.changeset/hydrated-boundary-reset.md b/.changeset/hydrated-boundary-reset.md
deleted file mode 100644
index 799a57fd9b..0000000000
--- a/.changeset/hydrated-boundary-reset.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'svelte': patch
----
-
-fix: call `onerror` and provide a working `reset` when hydrating a failed boundary
diff --git a/.changeset/tidy-select-spreads.md b/.changeset/tidy-select-spreads.md
deleted file mode 100644
index 3b14dc5d34..0000000000
--- a/.changeset/tidy-select-spreads.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'svelte': patch
----
-
-fix: preserve select selection when spread attributes omit value
diff --git a/packages/svelte/CHANGELOG.md b/packages/svelte/CHANGELOG.md
index a9b93f5341..722fc21052 100644
--- a/packages/svelte/CHANGELOG.md
+++ b/packages/svelte/CHANGELOG.md
@@ -1,5 +1,13 @@
 # svelte
 
+## 5.56.8
+
+### Patch Changes
+
+- fix: call `onerror` and provide a working `reset` when hydrating a failed boundary ([#18556](https://github.com/sveltejs/svelte/pull/18556))
+
+- fix: preserve select selection when spread attributes omit value ([#18561](https://github.com/sveltejs/svelte/pull/18561))
+
 ## 5.56.7
 
 ### Patch Changes
diff --git a/packages/svelte/package.json b/packages/svelte/package.json
index 67f349be71..82dd4faf61 100644
--- a/packages/svelte/package.json
+++ b/packages/svelte/package.json
@@ -2,7 +2,7 @@
   "name": "svelte",
   "description": "Cybernetically enhanced web apps",
   "license": "MIT",
-  "version": "5.56.7",
+  "version": "5.56.8",
   "type": "module",
   "types": "./types/index.d.ts",
   "engines": {
diff --git a/packages/svelte/src/version.js b/packages/svelte/src/version.js
index e9737ec13c..8fb86f3398 100644
--- a/packages/svelte/src/version.js
+++ b/packages/svelte/src/version.js
@@ -4,5 +4,5 @@
  * The current version, as set in package.json.
  * @type {string}
  */
-export const VERSION = '5.56.7';
+export const VERSION = '5.56.8';
 export const PUBLIC_VERSION = '5';