Merge commit from fork

.changeset/fix-that-thing.md

@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: always escape option body in SSR

packages/svelte/src/internal/server/renderer.js

@@ -12,6 +12,7 @@ import { get_render_context, with_render_context, init_render_context } from './
 import { sha256 } from './crypto.js';
 import * as devalue from 'devalue';
 import { noop } from '../shared/utils.js';
+import { escape_html } from '../../escaping.js';
 
 /** @typedef {'head' | 'body'} RendererType */
 /** @typedef {{ [key in RendererType]: string }} AccumulatedContent */
@@ -275,7 +276,7 @@ export class Renderer {
 				renderer.#out.push(' selected=""');
 			}
 
-			renderer.#out.push(`>${body}${is_rich ? '<!>' : ''}</option>`);
+			renderer.#out.push(`>${escape_html(body)}${is_rich ? '<!>' : ''}</option>`);
 
 			// super edge case, but may as well handle it
 			if (head) {

packages/svelte/tests/server-side-rendering/samples/option-body-escaped/_expected.html

@@ -0,0 +1 @@
+<!--[--><select><option>a&lt;/option>&lt;script>alert("pwnd")&lt;/script>&lt;option>puppa</option></select><!--]-->

packages/svelte/tests/server-side-rendering/samples/option-body-escaped/main.svelte

@@ -0,0 +1,6 @@
+<script>
+	let selectedBook = $state("a</option><sc"+"ript>alert(\"pwnd\")</sc"+"ript><option>puppa");
+</script>
+<select>
+  <option>{selectedBook}</option>
+</select>