11144 Commits (34d3d7735c2ad87203ef025319ec9504bd8b645c)

 

All Branches   

Search

Author	SHA1	Message	Date
Rich Harris	34d3d7735c	Merge branch 'main' into tweak-parser	2 weeks ago
Simon H	7be1a0247f	fix: ensure proper HMR updates for dynamic components (#18079) ... The BranchManager in `branches.js` does create a temporary anchor when creating a new branch offscreen, and deletes it once the branch is committed. Normally this is fine, but the combination of HMR and dynamic components leads to a bug: Since `svelte-component.js` passes the temporary anchor along to the component it generates, which is the HMR wrapper, this wrapper will have an obsolete, disconnected anchor on updates, leading to the content disappearing. The fix is to add a dev-only symbol which we set on the original (then obsolete) anchor to tell about the updated anchor that should be used for HMR updates. Fixes https://github.com/sveltejs/kit/issues/14699 Fixes #17211	2 weeks ago
Simon H	a4ce776070	fix: defer error boundary rendering in forks (#18076) ... RIght now, when an async error occurs inside a fork, the error UI will show immediately. This change defers the removal of the current content etc until the fork is committed. The BranchManager logic cannot be reused here since this is not about pending work, and we cannot wait for other pending work to complete if the fork commits. Instead, batches now have a "on fork commit" callback set which the boundary pushes to. The boundary's effects are skipped in the fork until it's committing, at which point we "resume" the error logic (calling onerror, transforming it, etc) Fixes #18060	2 weeks ago
Rich Harris	7796bac806	chore: dedupe dependencies (#18084)	2 weeks ago
dependabot[bot]	c712809ebd	chore(deps): bump vite from 5.4.20 to 7.3.2 (#18081) ... Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 5.4.20 to 7.3.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v7.3.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.3.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.3.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.7</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.7/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.6</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.5</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <p><em>Note: 7.2.5 failed to publish so it is skipped on npm</em></p> <h2>v7.2.4</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.4/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@7.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@7.2.1/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@7.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@7.2.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0-beta.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0-beta.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0-beta.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.1.12</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.1.12/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.1...v7.3.2">7.3.2</a> (2026-04-06)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>avoid path traversal with optimize deps sourcemap handler (<a href="https://redirect.github.com/vitejs/vite/issues/22161">#22161</a>) (<a href="09d8c903bd">09d8c90</a>)</li> <li>backport <a href="https://redirect.github.com/vitejs/vite/issues/22159">#22159</a>, apply server.fs check to env transport (<a href="https://redirect.github.com/vitejs/vite/issues/22162">#22162</a>) (<a href="19db0f29c3">19db0f2</a>)</li> <li>check <code>server.fs</code> after stripping query as well (<a href="https://redirect.github.com/vitejs/vite/issues/22160">#22160</a>) (<a href="f8103cc946">f8103cc</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.0...v7.3.1">7.3.1</a> (2026-01-07)<!-- raw HTML omitted --></h2> <h3>Features</h3> <ul> <li>add <code>ignoreOutdatedRequests</code> option to <code>optimizeDeps</code> (<a href="https://redirect.github.com/vitejs/vite/issues/21364">#21364</a>) (<a href="9d39d373a7">9d39d37</a>)</li> </ul> <h2><a href="https://github.com/vitejs/vite/compare/v7.2.7...v7.3.0">7.3.0</a> (2025-12-15)</h2> <h3>Features</h3> <ul> <li><strong>deps:</strong> update esbuild from ^0.25.0 to ^0.27.0 (<a href="https://redirect.github.com/vitejs/vite/issues/21183">#21183</a>) (<a href="cff26ec0fc">cff26ec</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.6...v7.2.7">7.2.7</a> (2025-12-08)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>plugin shortcut support (<a href="https://redirect.github.com/vitejs/vite/issues/21211">#21211</a>) (<a href="721f16343d">721f163</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.5...v7.2.6">7.2.6</a> (2025-12-01)<!-- raw HTML omitted --></h2> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.4...v7.2.5">7.2.5</a> (2025-12-01)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li><strong>config:</strong> handle shebang properly (<a href="https://redirect.github.com/vitejs/vite/issues/21158">#21158</a>) (<a href="df5a30d269">df5a30d</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21146">#21146</a>) (<a href="a3cd262f37">a3cd262</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21175">#21175</a>) (<a href="72e398a46d">72e398a</a>)</li> <li>fix <code>external: true</code> merging (<a href="https://redirect.github.com/vitejs/vite/issues/21164">#21164</a>) (<a href="5ef557a96c">5ef557a</a>)</li> <li>shortcuts not rebound after server restart (<a href="https://redirect.github.com/vitejs/vite/issues/21166">#21166</a>) (<a href="3765f7baea">3765f7b</a>)</li> </ul> <h3>Performance Improvements</h3> <ul> <li><strong>deps:</strong> replace debug with obug (<a href="https://redirect.github.com/vitejs/vite/issues/21137">#21137</a>) (<a href="203a5512a4">203a551</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>clarify manifest.json <code>imports</code> field is JS chunks only (<a href="https://redirect.github.com/vitejs/vite/issues/21136">#21136</a>) (<a href="46d3077f2b">46d3077</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21174">#21174</a>) (<a href="74559c9474">74559c9</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.3...v7.2.4">7.2.4</a> (2025-11-20)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>revert &quot;perf(deps): replace debug with obug (<a href="https://redirect.github.com/vitejs/vite/issues/21107">#21107</a>)&quot; (<a href="2d66b7b14a">2d66b7b</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.2...v7.2.3">7.2.3</a> (2025-11-20)<!-- raw HTML omitted --></h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="cc383e07b6"><code>cc383e0</code></a> release: v7.3.2</li> <li><a href="09d8c903bd"><code>09d8c90</code></a> fix: avoid path traversal with optimize deps sourcemap handler (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161">#22161</a>)</li> <li><a href="f8103cc946"><code>f8103cc</code></a> fix: check <code>server.fs</code> after stripping query as well (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22160">#22160</a>)</li> <li><a href="19db0f29c3"><code>19db0f2</code></a> fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159">#22159</a>, apply server.fs check to env transport (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22162">#22162</a>)</li> <li><a href="95e8923f35"><code>95e8923</code></a> release: v7.3.1</li> <li><a href="9d39d373a7"><code>9d39d37</code></a> feat: add <code>ignoreOutdatedRequests</code> option to <code>optimizeDeps</code> (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21364">#21364</a>)</li> <li><a href="acf7e05eae"><code>acf7e05</code></a> release: v7.3.0</li> <li><a href="cff26ec0fc"><code>cff26ec</code></a> feat(deps): update esbuild from ^0.25.0 to ^0.27.0 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21183">#21183</a>)</li> <li><a href="317b3b272f"><code>317b3b2</code></a> release: v7.2.7</li> <li><a href="721f16343d"><code>721f163</code></a> fix: plugin shortcut support (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21211">#21211</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v7.3.2/packages/vite">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/sveltejs/svelte/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2 weeks ago
Rich Harris	70b836bc19	move	2 weeks ago
Rich Harris	e81c007adf	tweak	2 weeks ago
Rich Harris	c07a4ac414	tidy up	2 weeks ago
Rich Harris	bebdc00ff7	unused	2 weeks ago
Rich Harris	9d22d80151	DRY out	2 weeks ago
Rich Harris	036fa89d1e	simplify	2 weeks ago
Rich Harris	37e79aec96	tidy up	2 weeks ago
Rich Harris	2459947858	fix/tidy up	2 weeks ago
Rich Harris	204a42d67a	add previously-failing test	2 weeks ago
Rich Harris	a8d79ffbd8	tidy up	2 weeks ago
Rich Harris	ebb1954419	WIP	2 weeks ago
Rich Harris	7fa3488634	tweak	2 weeks ago
Rich Harris	4f712fe2d5	tweak	2 weeks ago
Rich Harris	7d9df9afc3	WIP	2 weeks ago
dependabot[bot]	582c57ceb8	chore(deps-dev): bump vite from 7.1.11 to 7.3.2 (#18074) ... Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 7.1.11 to 7.3.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v7.3.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.3.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.3.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.7</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.7/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.6</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.5</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <p><em>Note: 7.2.5 failed to publish so it is skipped on npm</em></p> <h2>v7.2.4</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.4/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@7.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@7.2.1/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@7.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@7.2.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0-beta.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0-beta.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0-beta.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.1.12</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.1.12/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.1...v7.3.2">7.3.2</a> (2026-04-06)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>avoid path traversal with optimize deps sourcemap handler (<a href="https://redirect.github.com/vitejs/vite/issues/22161">#22161</a>) (<a href="09d8c903bd">09d8c90</a>)</li> <li>backport <a href="https://redirect.github.com/vitejs/vite/issues/22159">#22159</a>, apply server.fs check to env transport (<a href="https://redirect.github.com/vitejs/vite/issues/22162">#22162</a>) (<a href="19db0f29c3">19db0f2</a>)</li> <li>check <code>server.fs</code> after stripping query as well (<a href="https://redirect.github.com/vitejs/vite/issues/22160">#22160</a>) (<a href="f8103cc946">f8103cc</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.0...v7.3.1">7.3.1</a> (2026-01-07)<!-- raw HTML omitted --></h2> <h3>Features</h3> <ul> <li>add <code>ignoreOutdatedRequests</code> option to <code>optimizeDeps</code> (<a href="https://redirect.github.com/vitejs/vite/issues/21364">#21364</a>) (<a href="9d39d373a7">9d39d37</a>)</li> </ul> <h2><a href="https://github.com/vitejs/vite/compare/v7.2.7...v7.3.0">7.3.0</a> (2025-12-15)</h2> <h3>Features</h3> <ul> <li><strong>deps:</strong> update esbuild from ^0.25.0 to ^0.27.0 (<a href="https://redirect.github.com/vitejs/vite/issues/21183">#21183</a>) (<a href="cff26ec0fc">cff26ec</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.6...v7.2.7">7.2.7</a> (2025-12-08)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>plugin shortcut support (<a href="https://redirect.github.com/vitejs/vite/issues/21211">#21211</a>) (<a href="721f16343d">721f163</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.5...v7.2.6">7.2.6</a> (2025-12-01)<!-- raw HTML omitted --></h2> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.4...v7.2.5">7.2.5</a> (2025-12-01)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li><strong>config:</strong> handle shebang properly (<a href="https://redirect.github.com/vitejs/vite/issues/21158">#21158</a>) (<a href="df5a30d269">df5a30d</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21146">#21146</a>) (<a href="a3cd262f37">a3cd262</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21175">#21175</a>) (<a href="72e398a46d">72e398a</a>)</li> <li>fix <code>external: true</code> merging (<a href="https://redirect.github.com/vitejs/vite/issues/21164">#21164</a>) (<a href="5ef557a96c">5ef557a</a>)</li> <li>shortcuts not rebound after server restart (<a href="https://redirect.github.com/vitejs/vite/issues/21166">#21166</a>) (<a href="3765f7baea">3765f7b</a>)</li> </ul> <h3>Performance Improvements</h3> <ul> <li><strong>deps:</strong> replace debug with obug (<a href="https://redirect.github.com/vitejs/vite/issues/21137">#21137</a>) (<a href="203a5512a4">203a551</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>clarify manifest.json <code>imports</code> field is JS chunks only (<a href="https://redirect.github.com/vitejs/vite/issues/21136">#21136</a>) (<a href="46d3077f2b">46d3077</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21174">#21174</a>) (<a href="74559c9474">74559c9</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.3...v7.2.4">7.2.4</a> (2025-11-20)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>revert &quot;perf(deps): replace debug with obug (<a href="https://redirect.github.com/vitejs/vite/issues/21107">#21107</a>)&quot; (<a href="2d66b7b14a">2d66b7b</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.2...v7.2.3">7.2.3</a> (2025-11-20)<!-- raw HTML omitted --></h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="cc383e07b6"><code>cc383e0</code></a> release: v7.3.2</li> <li><a href="09d8c903bd"><code>09d8c90</code></a> fix: avoid path traversal with optimize deps sourcemap handler (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161">#22161</a>)</li> <li><a href="f8103cc946"><code>f8103cc</code></a> fix: check <code>server.fs</code> after stripping query as well (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22160">#22160</a>)</li> <li><a href="19db0f29c3"><code>19db0f2</code></a> fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159">#22159</a>, apply server.fs check to env transport (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22162">#22162</a>)</li> <li><a href="95e8923f35"><code>95e8923</code></a> release: v7.3.1</li> <li><a href="9d39d373a7"><code>9d39d37</code></a> feat: add <code>ignoreOutdatedRequests</code> option to <code>optimizeDeps</code> (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21364">#21364</a>)</li> <li><a href="acf7e05eae"><code>acf7e05</code></a> release: v7.3.0</li> <li><a href="cff26ec0fc"><code>cff26ec</code></a> feat(deps): update esbuild from ^0.25.0 to ^0.27.0 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21183">#21183</a>)</li> <li><a href="317b3b272f"><code>317b3b2</code></a> release: v7.2.7</li> <li><a href="721f16343d"><code>721f163</code></a> fix: plugin shortcut support (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21211">#21211</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v7.3.2/packages/vite">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/sveltejs/svelte/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2 weeks ago
Rich Harris	e1240c610d	WIP	2 weeks ago
Rich Harris	ceacc7fa46	WIP	2 weeks ago
github-actions[bot]	2e29c87cc9	Version Packages (#18036) ... This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.55.2 ### Patch Changes - fix: invalidate `@const` tags based on visible references in legacy mode ([#18041](https://github.com/sveltejs/svelte/pull/18041)) - fix: handle parens in template expressions more robustly ([#18075](https://github.com/sveltejs/svelte/pull/18075)) - fix: disallow `--` in `idPrefix` ([#18038](https://github.com/sveltejs/svelte/pull/18038)) - fix: correct types for `ontoggle` on `<details>` elements ([#18063](https://github.com/sveltejs/svelte/pull/18063)) - fix: don't override `$destroy/set/on` instance methods in dev mode ([#18034](https://github.com/sveltejs/svelte/pull/18034)) - fix: unskip branches of earlier batches after commit ([#18048](https://github.com/sveltejs/svelte/pull/18048)) - fix: never set derived.v inside fork ([#18037](https://github.com/sveltejs/svelte/pull/18037)) - fix: skip rebase logic in non-async mode ([#18040](https://github.com/sveltejs/svelte/pull/18040)) - fix: don't reset status of uninitialized deriveds ([#18054](https://github.com/sveltejs/svelte/pull/18054)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2 weeks ago
Rich Harris	6b653b8d17	chore: simplify parser (#18077) ... small tidy-up spurred by #17954 — rather than try-catching every `parse_expression_at` call and passing the error to `parser.acorn_error`, we can handle the error locally and get rid of that method ### Before submitting the PR, please make sure you do the following - [ ] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [ ] Ideally, include a test that fails without this PR but passes with it. - [ ] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint` --------- Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>	2 weeks ago
Rich Harris	8966601dcd	fix: handle parens in template expressions more robustly (#18075) ... While looking into #17954 I realised that a) our code for handling parentheses in expressions is unnecessarily convoluted and b) it doesn't handle the case where you have an opening parent outside the first comment — this fails to parse: ```svelte {(/**/ 42)} ``` This fixes it and simplifies the code a good bit. ### Before submitting the PR, please make sure you do the following - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [x] Ideally, include a test that fails without this PR but passes with it. - [x] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint`	2 weeks ago
Simon H	0395ef0df7	fix: unskip branches of earlier batches after commit (#18048) ... Fixes #17571 where the situation is the following: A derived creates a new query. That query initializes loading with true. This means the if block is marked for destruction (therefore effects inside branch are skipped), but it's not doing that yet because the query promise is pending. Then query resolves and loading is set back to false right before resolving, but it's not the same tick so `loading=false` is a separate thing. Because that later batch doesn't see any overlap with an earlier batch (the earlier batch did set loading to true but not via set but indirectly via recreating the query) it doesn't wait on it and flushes right away. Now the if block is marked as visible again but the earlier batch doesn't know that if noone unskips its branch. If we don't do that the render effect that is now dirty as part of that batch will not run.	2 weeks ago
Rich Harris	cd5bda00a8	chore: fix changeset (#18073) ... prevents the changelog from getting borked up	2 weeks ago
Simon H	d86cb5cc32	fix: skip rebase logic in non-async mode (#18040) ... Fixes part of #17940 (the hydration->error thing still needs a repro). Essentially in sync mode render effects are executed during traversing the effect tree, and when flushSync is called during that it can cause the timing of things getting out of sync such that you end up wanting to rebase another branch, which is never needed in sync mode. So we just skip that logic in sync mode. Another way would be to adjust flushSync such that it does appends itself to the end of the current flushing cycle if it notices processing is already ongoing. This will not work when you pass a callback function to `flushSync` though - another indicator that we should probably remove that callback argument. --------- Co-authored-by: Rich Harris <rich.harris@vercel.com> Co-authored-by: Rich Harris <hello@rich-harris.dev>	2 weeks ago
Simon H	adba758067	fix: don't reset status of uninitialized deriveds (#18054) ... If a new branch is created (e.g. if block becomes truthy) inside a fork and a derived is read inside the new branch for the first time, it will get reactions but its true value will stay uninitialized due to the fork. If the fork then commits, it will NOT change its value because it will not reexecute: there is no effect running after commit telling it to do that, because it was only read inside new effects which already ran while still inside the fork. Now, when that branch is removed (e.g. if block becomes falsy), the derived loses its reactions again and becomes disconnected, at which point the status is reset. So we end up with a maybe_dirty or clean derived and an uninitialized value, causing breakage if it's called again afterwards. The fix is to not reset the status in this case. Fixes https://github.com/sveltejs/kit/issues/15126 Fixes https://github.com/sveltejs/kit/issues/15318 Fixes https://github.com/sveltejs/kit/issues/15061	2 weeks ago
ottomated	14adb8caa9	fix: correct types for `ontoggle` on <details> elements (#18063) ... `<details>` elements fire `ontoggle` as ToggleEvents ([source](https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/toggle_event)), but they're currently just typed as Event. ### Before submitting the PR, please make sure you do the following - [ ] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [ ] This message body should clearly illustrate what problems it solves. - [ ] Ideally, include a test that fails without this PR but passes with it. - [x] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint`	2 weeks ago
Matia	7a2a17557c	docs: add CSS custom properties section to style directive (#18065) ... Adds documentation for using CSS custom properties with the `style:` directive. I think this was lost at some point during the great transition. It's only mentioned in the [best practices](https://svelte.dev/docs/svelte/best-practices#Using-JavaScript-variables-in-CSS) section, so I thought it would make sense to include it.	2 weeks ago
Rich Harris	f8ef6de325	chore: squelch hydration warnings in tests (#18046) ... Gets rid of some annoying console spam. I don't totally understand why `warnings` isn't populated by the time the assertions happen (it seems to happen just afterwards, except if I sleep for a few milliseconds and then do the assertion the warnings get swallowed altogether?) but for right now I don't much care	3 weeks ago
Rich Harris	8ee2169609	chore: improve benchmarks (#18061) ... This makes the benchmarks slightly more honest — it adds the async flag, and a benchmark that tests the (common) scenario where most effects are clean. Relevant to #18035, will self-merge so we can do a fresh comparison	3 weeks ago
Rich Harris	206974a5cd	chore: generate markdown tables of CPU profiles (#18059) ... extracted from #18035 — this should have been part of #18047 but I missed it off, oops. Will self-merge so it doesn't get in the way of #18035, and because the `performance-investigation` skill is predicated on this code existing --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>	3 weeks ago
Rich Harris	a9530e5330	chore: add labels to more internal deriveds (#18050) ... tiny QoL thing	3 weeks ago
Rich Harris	704e3bb5f0	chore: agent hints for perf investigations (#18047) ... This adds some hints in an `AGENTS.md` for how to conduct performance investigations, along with a utility for comparing profiles from different branches to identify hotspots. We will likely want to put other stuff in `AGENTS.md` in future but I figured we could start with something immediately useful. It also tweaks the comparison script — rather than nuking results from existing branches, it keeps them around so that we don't need to re-run benchmarks (which takes a long time) for branches that haven't changed. --------- Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>	3 weeks ago
Rich Harris	c93e251654	fix: never set derived.v inside fork (#18037) ... This started out as me implementing https://github.com/sveltejs/svelte/pull/17998/changes#r3018047965, but then I realised that I'd also fixed the bug that #17998 addresses. So I guess it's an alternative to that PR --------- Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>	3 weeks ago
Rich Harris	345b8ed69f	chore: keep previous benchmark runs around (#18049) ... extracted from #18047 – will self-merge this bit	3 weeks ago
Rich Harris	e402b2d0d6	chore: write `pnpm bench:compare` report to disk (#18045) ... will give this a quick self-merge to unblock	3 weeks ago
Rich Harris	99b1467ba4	chore: generate CPU profiles when running benchmarks (#18043) ... This causes `pnpm bench` and `pnpm bench:compare` to generate `.cpuprofile` files for each benchmark, which should in theory make it easier to understand how different branches affect performance (and find opportunities for optimisation). These files can be opened directly in VS Code and other editors, or in [profiler.firefox.com](https://profiler.firefox.com), [speedscope.app](https://www.speedscope.app), Chrome's performance devtools and so on.	3 weeks ago
Rich Harris	edcbb0e640	fix: invalidate `@const` tags based on visible references in legacy mode (#18041) ... closes #17992	3 weeks ago
Rich Harris	ff3495dc05	fix: disallow `--` in `idPrefix` (#18038) ... supersedes #17993	3 weeks ago
Scott Wu	51629ec7bd	docs: update references to `vite-plugin-svelte` (#18027) ... ### Before submitting the PR, please make sure you do the following - [ ] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [ ] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [ ] This message body should clearly illustrate what problems it solves. - [ ] Ideally, include a test that fails without this PR but passes with it. - [ ] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [ ] Run the tests with `pnpm test` and lint the project with `pnpm lint` --------- Co-authored-by: Rich Harris <hello@rich-harris.dev> Co-authored-by: Rich Harris <rich.harris@vercel.com>	3 weeks ago
dagecko	e0f925116c	fix: pin 9 actions to commit SHA (#18025) ... Re-submission of #18017. Had a problem with my fork and had to delete it, which closed the original PR. Apologies for the noise. ## Summary This PR pins all GitHub Actions to immutable commit SHAs instead of mutable version tags. - Pin 9 unpinned actions to full 40-character SHAs - Add version comments for readability ## Changes by file | File | Changes | |------|---------| | autofix.yml | Pinned actions to SHA | | ci.yml | Pinned actions to SHA | | pkg.pr.new.yml | Pinned actions to SHA | | release.yml | Pinned actions to SHA | ## A note on internal action pinning This PR pins all actions including org-owned ones. Best practice is to pin everything — the tj-actions/changed-files attack was an internally maintained action that was compromised, and every repo referencing it by tag silently executed attacker code. That said, it's your codebase. If you'd prefer to leave org-owned actions unpinned, let us know and we'll adjust the PR. ## How to verify Review the diff — each change is mechanical and preserves workflow behavior: - **SHA pinning**: `action@v3` becomes `action@abc123 # v3` — original version preserved as comment - No workflow logic, triggers, or permissions are modified I wrote a scanner called Runner Guard and open sourced it [here](https://github.com/Vigilant-LLC/runner-guard). If you have any questions, reach out. I'll be monitoring comms. \- Chris Nyhuis (dagecko)	3 weeks ago
Simon H	97d45f85c6	fix: don't override `$destroy/set/on` instance methods in dev mode (#18034) ... Don't think we need a test for this Fixes #17988	3 weeks ago
Rich Harris	aba4ab8737	chore: fix editorconfig (#18033) ... I don't know why exactly, but VS Code suddenly started paying attention to this line. An indent size of 2 inside an IDE is for masochists and barbarians. If that's your preference then that's up to you but there's certainly no reason to impose it on everyone who clones this repo.	3 weeks ago
github-actions[bot]	37ab33c0a3	Version Packages (#18006) ... This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.55.1 ### Patch Changes - fix: correctly handle bindings on the server ([#18009](https://github.com/sveltejs/svelte/pull/18009)) - fix: prevent hydration error on async `{@html ...}` ([#17999](https://github.com/sveltejs/svelte/pull/17999)) - fix: cleanup `superTypeParameters` in `ClassDeclarations`/`ClassExpression` ([#18015](https://github.com/sveltejs/svelte/pull/18015)) - fix: improve duplicate module import error message ([#18016](https://github.com/sveltejs/svelte/pull/18016)) - fix: reschedule new effects in prior batches ([#18021](https://github.com/sveltejs/svelte/pull/18021)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	3 weeks ago
Rohit Nair P	4879f9da99	fix: improve duplicate module import error message (#18016) ... ## Description **While investigating the compiler analysis phase for errors or missing lines, I located an explicit `TODO fix the message here` comment in the source code (`packages/svelte/src/compiler/phases/2-analyze/visitors/shared/utils.js`).** ### Triggering Code ```svelte <script module> import { foo } from './somewhere.js'; </script> <script> let foo = 'conflict'; // Triggers the duplicate module import error </script> ``` ## The Bug When a component author creates a local `let` declaration in the instance `<script>` block that shadows a variable imported in the `<script module>` block, the compiler emits a `declaration_duplicate_module_import` error. However, the error message text was misleading. It stated: ```diff - Cannot declare a variable with the same name as an import inside `<script module>` + Cannot declare a variable with the same name as an import from `<script module>` ``` This incorrectly implies that the duplicate declaration itself is happening *inside* the module script block, rather than colliding with an import *from* that block. ## Changes Made | Action | Target (File / Function) | Description | | :--- | :--- | :--- | | **Template Fix** | `packages/svelte/messages/compile-errors/script.md` | Changed "inside" to "from" to accurately reflect the nature of the shadow collision. | | **Regenerated Errors** | `packages/svelte/src/compiler/errors.js` | Ran `pnpm generate` to apply the updated markdown template into the dictionary list. | | **Removed TODO** | `ensure_no_module_import_conflict` function | Removed the original `// TODO fix the message here` notation from the validator. | | **Test Adjustments** | `illegal-variable-declaration/errors.json` | Updated the validator test suite snapshots to assert against the correct error message format. | ## Validation Results * The error correctly throws when a user replicates this component structure. * Vitest suite `tests/validator/test.ts` successfully asserts the new, clearer message. --- ### Before submitting the PR, please make sure you do the following - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [x] Ideally, include a test that fails without this PR but passes with it. - [x] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint` # THANK YOU	3 weeks ago
Simon H	04eadbc8a9	fix: correctly handle bindings on the server (#18009) ... `item.subsume(item)` did nothing, honestly kinda weird how this only turned up now Fixes #17981	3 weeks ago
Paolo Ricciuti	957f2755fa	fix: cleanup `superTypeParameters` in `ClassDeclarations`/`ClassExpression` (#18015) ... Closes #18012 We were removing `superTypeArguments` but the AST showed `superTypeParameters`. Luckily, I was able to pinpoint `esrap@2.2.4` as the cause... I've only bumped `esrap` and that made the test fail (so that I could fix it) And of course it was that...there's literally a commit that explicitly print them lol f9137c4101	3 weeks ago