svelte

Commit Graph

Author	SHA1	Message	Date
Rich Harris	dae91eb65a	fix message	3 months ago
Rich Harris	2df832d4c7	Merge branch 'main' into head-warning	3 months ago
Rich Harris	de2e09d59a	Update .changeset/fresh-trains-doubt.md Co-authored-by: Conduitry <git@chor.date>	3 months ago
Wesley	bd29b9ef2b	docs: document $state.snapshot toJSON behavior (#18154 ) ### Before submitting the PR, please make sure you do the following - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [ ] Ideally, include a test that fails without this PR but passes with it. - [ ] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [ ] Run the tests with `pnpm test` and lint the project with `pnpm lint` `$state.snapshot` already clones the value returned from `toJSON`, and its `Snapshot<T>` type reflects that return type. The `$state.snapshot` docs now call out that behavior explicitly, including the generated ambient types shown by editors. Test plan: `pnpm check`; `pnpm lint`. Fixes #18129 Co-authored-by: sakaenyeniceri5 <sakaenyeniceri5@users.noreply.github.com>	3 months ago
Rich Harris	489b5fbb0d	changeset	3 months ago
Elvin Seudieu Jr.	057d3fa7f6	Merge branch 'main' into head-warning	3 months ago
Elvin Seudieu	0ba5dee5e2	fixing lint issues	3 months ago
568cats	a4905410df	Add test to ensure <head> in components produces a warning	3 months ago
github-actions[bot]	b771df3464	Version Packages (#18125 ) This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.55.5 ### Patch Changes - fix: don't mark deriveds while an effect is updating ([#18124](https://github.com/sveltejs/svelte/pull/18124)) - fix: do not dispatch introstart event with animation of animate directive ([#18122](https://github.com/sveltejs/svelte/pull/18122)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	3 months ago
Elvin Seudieu	f9abdb6428	added compiler warning functionality for head warnings (untested)	3 months ago
Simon H	8e7319063a	fix: don't mark deriveds while an effect is updating (#18124 ) Fixes #18123 This makes setting state inside effects slightly slower theoretically (since they hit the new guard), but I verified that the original issue for which we introduced this (#16658) is still fast with this change. The more we add logic to this the more I think we should investigate switching to a different mechanism. I tried using a `Set` previously but it did hurt the benchmarks a bit - might try to revisit a variant of this. --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	3 months ago
dabund24	51736e576d	fix: do not dispatch transition event with animation (#18122 ) closes #18056 related: #17567 and #14009 # Changes move `dispatch_event()` calls in `transitions.js` out of `animate()` function using an additional `on_begin()` callback parameter. Doing so makes it possible to dispatch the `introstart` and `outrostart` events only from `transition()`. # Testing add a test checking that svelte dispatches no event when it runs an animation	3 months ago
Rohan Santhosh Kumar	48dc9b40c0	docs: fix spacing around option tag in bind docs (#18114 ) ## Summary - Fix the missing space before `<option>` in the bind documentation. ## Related issue - N/A ## Guideline alignment - Read `CONTRIBUTING.md` and kept this to one focused docs-only file change. - No behavior, test, fixture, changeset, or generated-file changes. ## Test plan - `git diff --check` - Not run: docs-only spacing fix. Co-authored-by: Codex <codex@openai.com>	3 months ago
Simon H	6a149666c1	chore: enhance download script to ask for folder (#18112 ) If project that is downloaded is a project that can't be transfered into the playground (because it relies on SvelteKit stuff), instead of failing it now asks if you want to put it into another folder within the playgrounds folder	3 months ago
github-actions[bot]	7fddfbdbbd	Version Packages (#18105 ) This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.55.4 ### Patch Changes - fix: never mark a child effect root as inert ([#18111](https://github.com/sveltejs/svelte/pull/18111)) - fix: reset context after waiting on blockers of `@const` expressions ([#18100](https://github.com/sveltejs/svelte/pull/18100)) - fix: keep flushing new eager effects ([#18102](https://github.com/sveltejs/svelte/pull/18102)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	3 months ago
Simon H	671fc2ea11	fix: never mark a child effect root as inert (#18111 ) A nested `$effect.root` was marked `INERT` during `pause_children`, which caused it to stay in that state indefinetly after the rest of the parent tree was destroyed. Consequently deriveds inside no longer update and cause warnings. This fixes it by not marking nested `$effect.root`s as inert, just like nested `$effect.root`s are not destryoed and instead become a new root. Fixes #18097	3 months ago
Simon H	0ed8c282f9	fix: reset context after waiting on blockers of `@const` expressions (#18100 ) Regression from #18039 - we need to have each await expression (and waiting on blockers is one) in its own entry of `(renderer.)run`. Else context is not restored correctly and if the synchronous expression afterwards requires it stuff breaks. Fixes #18098	3 months ago
Simon H	273f1a85a4	fix: keep flushing new eager effects (#18102 ) The previous code "swallowed" new additions to the array of eager effects that happened while flushing since `eager_flush` did not clear the array before running, only afterwards. Now it clears the beforehand, causing newly added eager effects to run, too. An example where this can happen is `$state.eager` and `$effect.pending` in combination: first `$state.eager` is flushed, then due to `flushSync` the `queue_micro_task` inside `boundary.js` that flushes `$effect.pending` is triggered synchronously, adding new entries to the `eager_versions` array. If they're only cleared at the end of `eager_flush`, new entries are swallowed. Related to #18095 (but not fixing it yet)	3 months ago
github-actions[bot]	4a50e8ea3b	Version Packages (#18085 ) This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.55.3 ### Patch Changes - fix: ensure proper HMR updates for dynamic components ([#18079](https://github.com/sveltejs/svelte/pull/18079)) - fix: correctly calculate `@const` blockers ([#18039](https://github.com/sveltejs/svelte/pull/18039)) - fix: freeze deriveds once their containing effects are destroyed ([#17921](https://github.com/sveltejs/svelte/pull/17921)) - fix: defer error boundary rendering in forks ([#18076](https://github.com/sveltejs/svelte/pull/18076)) - fix: avoid false positives for reactivity loss warning ([#18088](https://github.com/sveltejs/svelte/pull/18088)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	3 months ago
Simon H	15588f5fbf	fix: avoid false positives for reactivity loss warning (#18088 ) Avoids two categories of false positives for reactivity loss warning: 1. if you have synchronously read signals already as part of invoking the async_derived function, then it shouldn't warn when these signals are read after an await if we know they haven't changed (we check the write version for that) 2. `track_reactivity_loss` kept the `reactivity_loss_tracker` around indefinitely, both when invoking the async operation as well as when it's finished. The former is buggy because while the async operation happens unrelated reads as part of other reactivity work can happen, the latter is buggy because if it's the last in a chain of awaits it's kept around until the next async work starts. Fixes https://github.com/sveltejs/kit/issues/15654 --------- Co-authored-by: Rich Harris <rich.harris@vercel.com> Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>	3 months ago
Rich Harris	0e9e76f292	fix: freeze deriveds once their containing effects are destroyed (#17921 ) Per https://github.com/sveltejs/svelte/pull/17862#issuecomment-4049752548, this freezes the value of a derived if it was created inside a parent effect that is now destroyed. This prevents the sort of bug where a derived reads `foo.bar` even though `foo` is now `undefined`. If the derived is dirty, a warning will be printed. This PR also gets rid of some weirdness around `derived.parent` — it can only ever be an `Effect \| null`, and there's no need for `get_derived_parent_effect`. Blocked on https://github.com/sveltejs/kit/pull/15533 and a follow-up that switches remote functions to use `$effect.root` (since this effectively undoes #17171), hence draft. ### Before submitting the PR, please make sure you do the following - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [x] Ideally, include a test that fails without this PR but passes with it. - [x] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint` --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>	3 months ago
Simon H	3937ec03bd	fix: correctly calculate `@const` blockers (#18039 ) Move the calculation of blockers into the analysis phase and then only push the right thunks in the transform phase - similar to how we already do it with top level `$.run` Fixes #18024 The solution is a tiny bit brittle (not much more than the top level one we already have) and I tried to make it a bit more robust but ended up in a rabbit hole in #18032 - we can revisit that solution once all the old stuff is gone. Until then this is the most pragmatic/non-invasive change. --------- Co-authored-by: Rich Harris <rich.harris@vercel.com>	3 months ago
Simon H	7be1a0247f	fix: ensure proper HMR updates for dynamic components (#18079 ) The BranchManager in `branches.js` does create a temporary anchor when creating a new branch offscreen, and deletes it once the branch is committed. Normally this is fine, but the combination of HMR and dynamic components leads to a bug: Since `svelte-component.js` passes the temporary anchor along to the component it generates, which is the HMR wrapper, this wrapper will have an obsolete, disconnected anchor on updates, leading to the content disappearing. The fix is to add a dev-only symbol which we set on the original (then obsolete) anchor to tell about the updated anchor that should be used for HMR updates. Fixes https://github.com/sveltejs/kit/issues/14699 Fixes #17211	3 months ago
Simon H	a4ce776070	fix: defer error boundary rendering in forks (#18076 ) RIght now, when an async error occurs inside a fork, the error UI will show immediately. This change defers the removal of the current content etc until the fork is committed. The BranchManager logic cannot be reused here since this is not about pending work, and we cannot wait for other pending work to complete if the fork commits. Instead, batches now have a "on fork commit" callback set which the boundary pushes to. The boundary's effects are skipped in the fork until it's committing, at which point we "resume" the error logic (calling onerror, transforming it, etc) Fixes #18060	3 months ago
Rich Harris	7796bac806	chore: dedupe dependencies (#18084 )	3 months ago
dependabot[bot]	c712809ebd	chore(deps): bump vite from 5.4.20 to 7.3.2 (#18081 ) Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 5.4.20 to 7.3.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v7.3.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.3.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.3.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.7</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.7/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.6</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.5</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <p><em>Note: 7.2.5 failed to publish so it is skipped on npm</em></p> <h2>v7.2.4</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.4/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@7.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@7.2.1/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@7.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@7.2.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0-beta.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0-beta.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0-beta.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.1.12</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.1.12/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.1...v7.3.2">7.3.2</a> (2026-04-06)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>avoid path traversal with optimize deps sourcemap handler (<a href="https://redirect.github.com/vitejs/vite/issues/22161">#22161</a>) (<a href="`09d8c903bd`">09d8c90</a>)</li> <li>backport <a href="https://redirect.github.com/vitejs/vite/issues/22159">#22159</a>, apply server.fs check to env transport (<a href="https://redirect.github.com/vitejs/vite/issues/22162">#22162</a>) (<a href="`19db0f29c3`">19db0f2</a>)</li> <li>check <code>server.fs</code> after stripping query as well (<a href="https://redirect.github.com/vitejs/vite/issues/22160">#22160</a>) (<a href="`f8103cc946`">f8103cc</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.0...v7.3.1">7.3.1</a> (2026-01-07)<!-- raw HTML omitted --></h2> <h3>Features</h3> <ul> <li>add <code>ignoreOutdatedRequests</code> option to <code>optimizeDeps</code> (<a href="https://redirect.github.com/vitejs/vite/issues/21364">#21364</a>) (<a href="`9d39d373a7`">9d39d37</a>)</li> </ul> <h2><a href="https://github.com/vitejs/vite/compare/v7.2.7...v7.3.0">7.3.0</a> (2025-12-15)</h2> <h3>Features</h3> <ul> <li><strong>deps:</strong> update esbuild from ^0.25.0 to ^0.27.0 (<a href="https://redirect.github.com/vitejs/vite/issues/21183">#21183</a>) (<a href="`cff26ec0fc`">cff26ec</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.6...v7.2.7">7.2.7</a> (2025-12-08)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>plugin shortcut support (<a href="https://redirect.github.com/vitejs/vite/issues/21211">#21211</a>) (<a href="`721f16343d`">721f163</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.5...v7.2.6">7.2.6</a> (2025-12-01)<!-- raw HTML omitted --></h2> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.4...v7.2.5">7.2.5</a> (2025-12-01)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li><strong>config:</strong> handle shebang properly (<a href="https://redirect.github.com/vitejs/vite/issues/21158">#21158</a>) (<a href="`df5a30d269`">df5a30d</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21146">#21146</a>) (<a href="`a3cd262f37`">a3cd262</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21175">#21175</a>) (<a href="`72e398a46d`">72e398a</a>)</li> <li>fix <code>external: true</code> merging (<a href="https://redirect.github.com/vitejs/vite/issues/21164">#21164</a>) (<a href="`5ef557a96c`">5ef557a</a>)</li> <li>shortcuts not rebound after server restart (<a href="https://redirect.github.com/vitejs/vite/issues/21166">#21166</a>) (<a href="`3765f7baea`">3765f7b</a>)</li> </ul> <h3>Performance Improvements</h3> <ul> <li><strong>deps:</strong> replace debug with obug (<a href="https://redirect.github.com/vitejs/vite/issues/21137">#21137</a>) (<a href="`203a5512a4`">203a551</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>clarify manifest.json <code>imports</code> field is JS chunks only (<a href="https://redirect.github.com/vitejs/vite/issues/21136">#21136</a>) (<a href="`46d3077f2b`">46d3077</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21174">#21174</a>) (<a href="`74559c9474`">74559c9</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.3...v7.2.4">7.2.4</a> (2025-11-20)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>revert "perf(deps): replace debug with obug (<a href="https://redirect.github.com/vitejs/vite/issues/21107">#21107</a>)" (<a href="`2d66b7b14a`">2d66b7b</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.2...v7.2.3">7.2.3</a> (2025-11-20)<!-- raw HTML omitted --></h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="`cc383e07b6`"><code>cc383e0</code></a> release: v7.3.2</li> <li><a href="`09d8c903bd`"><code>09d8c90</code></a> fix: avoid path traversal with optimize deps sourcemap handler (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161">#22161</a>)</li> <li><a href="`f8103cc946`"><code>f8103cc</code></a> fix: check <code>server.fs</code> after stripping query as well (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22160">#22160</a>)</li> <li><a href="`19db0f29c3`"><code>19db0f2</code></a> fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159">#22159</a>, apply server.fs check to env transport (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22162">#22162</a>)</li> <li><a href="`95e8923f35`"><code>95e8923</code></a> release: v7.3.1</li> <li><a href="`9d39d373a7`"><code>9d39d37</code></a> feat: add <code>ignoreOutdatedRequests</code> option to <code>optimizeDeps</code> (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21364">#21364</a>)</li> <li><a href="`acf7e05eae`"><code>acf7e05</code></a> release: v7.3.0</li> <li><a href="`cff26ec0fc`"><code>cff26ec</code></a> feat(deps): update esbuild from ^0.25.0 to ^0.27.0 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21183">#21183</a>)</li> <li><a href="`317b3b272f`"><code>317b3b2</code></a> release: v7.2.7</li> <li><a href="`721f16343d`"><code>721f163</code></a> fix: plugin shortcut support (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21211">#21211</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v7.3.2/packages/vite">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=vite&package-manager=npm_and_yarn&previous-version=5.4.20&new-version=7.3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/sveltejs/svelte/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 months ago
dependabot[bot]	582c57ceb8	chore(deps-dev): bump vite from 7.1.11 to 7.3.2 (#18074 ) Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 7.1.11 to 7.3.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v7.3.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.3.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.3.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.7</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.7/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.6</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.5</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <p><em>Note: 7.2.5 failed to publish so it is skipped on npm</em></p> <h2>v7.2.4</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.4/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@7.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@7.2.1/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@7.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@7.2.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0-beta.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0-beta.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0-beta.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.1.12</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.1.12/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.1...v7.3.2">7.3.2</a> (2026-04-06)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>avoid path traversal with optimize deps sourcemap handler (<a href="https://redirect.github.com/vitejs/vite/issues/22161">#22161</a>) (<a href="`09d8c903bd`">09d8c90</a>)</li> <li>backport <a href="https://redirect.github.com/vitejs/vite/issues/22159">#22159</a>, apply server.fs check to env transport (<a href="https://redirect.github.com/vitejs/vite/issues/22162">#22162</a>) (<a href="`19db0f29c3`">19db0f2</a>)</li> <li>check <code>server.fs</code> after stripping query as well (<a href="https://redirect.github.com/vitejs/vite/issues/22160">#22160</a>) (<a href="`f8103cc946`">f8103cc</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.0...v7.3.1">7.3.1</a> (2026-01-07)<!-- raw HTML omitted --></h2> <h3>Features</h3> <ul> <li>add <code>ignoreOutdatedRequests</code> option to <code>optimizeDeps</code> (<a href="https://redirect.github.com/vitejs/vite/issues/21364">#21364</a>) (<a href="`9d39d373a7`">9d39d37</a>)</li> </ul> <h2><a href="https://github.com/vitejs/vite/compare/v7.2.7...v7.3.0">7.3.0</a> (2025-12-15)</h2> <h3>Features</h3> <ul> <li><strong>deps:</strong> update esbuild from ^0.25.0 to ^0.27.0 (<a href="https://redirect.github.com/vitejs/vite/issues/21183">#21183</a>) (<a href="`cff26ec0fc`">cff26ec</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.6...v7.2.7">7.2.7</a> (2025-12-08)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>plugin shortcut support (<a href="https://redirect.github.com/vitejs/vite/issues/21211">#21211</a>) (<a href="`721f16343d`">721f163</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.5...v7.2.6">7.2.6</a> (2025-12-01)<!-- raw HTML omitted --></h2> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.4...v7.2.5">7.2.5</a> (2025-12-01)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li><strong>config:</strong> handle shebang properly (<a href="https://redirect.github.com/vitejs/vite/issues/21158">#21158</a>) (<a href="`df5a30d269`">df5a30d</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21146">#21146</a>) (<a href="`a3cd262f37`">a3cd262</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21175">#21175</a>) (<a href="`72e398a46d`">72e398a</a>)</li> <li>fix <code>external: true</code> merging (<a href="https://redirect.github.com/vitejs/vite/issues/21164">#21164</a>) (<a href="`5ef557a96c`">5ef557a</a>)</li> <li>shortcuts not rebound after server restart (<a href="https://redirect.github.com/vitejs/vite/issues/21166">#21166</a>) (<a href="`3765f7baea`">3765f7b</a>)</li> </ul> <h3>Performance Improvements</h3> <ul> <li><strong>deps:</strong> replace debug with obug (<a href="https://redirect.github.com/vitejs/vite/issues/21137">#21137</a>) (<a href="`203a5512a4`">203a551</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>clarify manifest.json <code>imports</code> field is JS chunks only (<a href="https://redirect.github.com/vitejs/vite/issues/21136">#21136</a>) (<a href="`46d3077f2b`">46d3077</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21174">#21174</a>) (<a href="`74559c9474`">74559c9</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.3...v7.2.4">7.2.4</a> (2025-11-20)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>revert "perf(deps): replace debug with obug (<a href="https://redirect.github.com/vitejs/vite/issues/21107">#21107</a>)" (<a href="`2d66b7b14a`">2d66b7b</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.2...v7.2.3">7.2.3</a> (2025-11-20)<!-- raw HTML omitted --></h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="`cc383e07b6`"><code>cc383e0</code></a> release: v7.3.2</li> <li><a href="`09d8c903bd`"><code>09d8c90</code></a> fix: avoid path traversal with optimize deps sourcemap handler (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161">#22161</a>)</li> <li><a href="`f8103cc946`"><code>f8103cc</code></a> fix: check <code>server.fs</code> after stripping query as well (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22160">#22160</a>)</li> <li><a href="`19db0f29c3`"><code>19db0f2</code></a> fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159">#22159</a>, apply server.fs check to env transport (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22162">#22162</a>)</li> <li><a href="`95e8923f35`"><code>95e8923</code></a> release: v7.3.1</li> <li><a href="`9d39d373a7`"><code>9d39d37</code></a> feat: add <code>ignoreOutdatedRequests</code> option to <code>optimizeDeps</code> (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21364">#21364</a>)</li> <li><a href="`acf7e05eae`"><code>acf7e05</code></a> release: v7.3.0</li> <li><a href="`cff26ec0fc`"><code>cff26ec</code></a> feat(deps): update esbuild from ^0.25.0 to ^0.27.0 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21183">#21183</a>)</li> <li><a href="`317b3b272f`"><code>317b3b2</code></a> release: v7.2.7</li> <li><a href="`721f16343d`"><code>721f163</code></a> fix: plugin shortcut support (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21211">#21211</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v7.3.2/packages/vite">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=vite&package-manager=npm_and_yarn&previous-version=7.1.11&new-version=7.3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/sveltejs/svelte/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	3 months ago
github-actions[bot]	2e29c87cc9	Version Packages (#18036 ) This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.55.2 ### Patch Changes - fix: invalidate `@const` tags based on visible references in legacy mode ([#18041](https://github.com/sveltejs/svelte/pull/18041)) - fix: handle parens in template expressions more robustly ([#18075](https://github.com/sveltejs/svelte/pull/18075)) - fix: disallow `--` in `idPrefix` ([#18038](https://github.com/sveltejs/svelte/pull/18038)) - fix: correct types for `ontoggle` on `<details>` elements ([#18063](https://github.com/sveltejs/svelte/pull/18063)) - fix: don't override `$destroy/set/on` instance methods in dev mode ([#18034](https://github.com/sveltejs/svelte/pull/18034)) - fix: unskip branches of earlier batches after commit ([#18048](https://github.com/sveltejs/svelte/pull/18048)) - fix: never set derived.v inside fork ([#18037](https://github.com/sveltejs/svelte/pull/18037)) - fix: skip rebase logic in non-async mode ([#18040](https://github.com/sveltejs/svelte/pull/18040)) - fix: don't reset status of uninitialized deriveds ([#18054](https://github.com/sveltejs/svelte/pull/18054)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	3 months ago
Rich Harris	6b653b8d17	chore: simplify parser (#18077 ) small tidy-up spurred by #17954 — rather than try-catching every `parse_expression_at` call and passing the error to `parser.acorn_error`, we can handle the error locally and get rid of that method ### Before submitting the PR, please make sure you do the following - [ ] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [ ] Ideally, include a test that fails without this PR but passes with it. - [ ] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint` --------- Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>	3 months ago
Rich Harris	8966601dcd	fix: handle parens in template expressions more robustly (#18075 ) While looking into #17954 I realised that a) our code for handling parentheses in expressions is unnecessarily convoluted and b) it doesn't handle the case where you have an opening parent outside the first comment — this fails to parse: ```svelte {(/**/ 42)} ``` This fixes it and simplifies the code a good bit. ### Before submitting the PR, please make sure you do the following - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [x] Ideally, include a test that fails without this PR but passes with it. - [x] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint`	3 months ago
Simon H	0395ef0df7	fix: unskip branches of earlier batches after commit (#18048 ) Fixes #17571 where the situation is the following: A derived creates a new query. That query initializes loading with true. This means the if block is marked for destruction (therefore effects inside branch are skipped), but it's not doing that yet because the query promise is pending. Then query resolves and loading is set back to false right before resolving, but it's not the same tick so `loading=false` is a separate thing. Because that later batch doesn't see any overlap with an earlier batch (the earlier batch did set loading to true but not via set but indirectly via recreating the query) it doesn't wait on it and flushes right away. Now the if block is marked as visible again but the earlier batch doesn't know that if noone unskips its branch. If we don't do that the render effect that is now dirty as part of that batch will not run.	3 months ago
Rich Harris	cd5bda00a8	chore: fix changeset (#18073 ) prevents the changelog from getting borked up	3 months ago
Simon H	d86cb5cc32	fix: skip rebase logic in non-async mode (#18040 ) Fixes part of #17940 (the hydration->error thing still needs a repro). Essentially in sync mode render effects are executed during traversing the effect tree, and when flushSync is called during that it can cause the timing of things getting out of sync such that you end up wanting to rebase another branch, which is never needed in sync mode. So we just skip that logic in sync mode. Another way would be to adjust flushSync such that it does appends itself to the end of the current flushing cycle if it notices processing is already ongoing. This will not work when you pass a callback function to `flushSync` though - another indicator that we should probably remove that callback argument. --------- Co-authored-by: Rich Harris <rich.harris@vercel.com> Co-authored-by: Rich Harris <hello@rich-harris.dev>	3 months ago
Simon H	adba758067	fix: don't reset status of uninitialized deriveds (#18054 ) If a new branch is created (e.g. if block becomes truthy) inside a fork and a derived is read inside the new branch for the first time, it will get reactions but its true value will stay uninitialized due to the fork. If the fork then commits, it will NOT change its value because it will not reexecute: there is no effect running after commit telling it to do that, because it was only read inside new effects which already ran while still inside the fork. Now, when that branch is removed (e.g. if block becomes falsy), the derived loses its reactions again and becomes disconnected, at which point the status is reset. So we end up with a maybe_dirty or clean derived and an uninitialized value, causing breakage if it's called again afterwards. The fix is to not reset the status in this case. Fixes https://github.com/sveltejs/kit/issues/15126 Fixes https://github.com/sveltejs/kit/issues/15318 Fixes https://github.com/sveltejs/kit/issues/15061	3 months ago
ottomated	14adb8caa9	fix: correct types for `ontoggle` on <details> elements (#18063 ) `<details>` elements fire `ontoggle` as ToggleEvents ([source](https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/toggle_event)), but they're currently just typed as Event. ### Before submitting the PR, please make sure you do the following - [ ] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [ ] This message body should clearly illustrate what problems it solves. - [ ] Ideally, include a test that fails without this PR but passes with it. - [x] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint`	3 months ago
Matia	7a2a17557c	docs: add CSS custom properties section to style directive (#18065 ) Adds documentation for using CSS custom properties with the `style:` directive. I think this was lost at some point during the great transition. It's only mentioned in the [best practices](https://svelte.dev/docs/svelte/best-practices#Using-JavaScript-variables-in-CSS) section, so I thought it would make sense to include it.	3 months ago
Rich Harris	f8ef6de325	chore: squelch hydration warnings in tests (#18046 ) Gets rid of some annoying console spam. I don't totally understand why `warnings` isn't populated by the time the assertions happen (it seems to happen just afterwards, except if I sleep for a few milliseconds and then do the assertion the warnings get swallowed altogether?) but for right now I don't much care	3 months ago
Rich Harris	8ee2169609	chore: improve benchmarks (#18061 ) This makes the benchmarks slightly more honest — it adds the async flag, and a benchmark that tests the (common) scenario where most effects are clean. Relevant to #18035, will self-merge so we can do a fresh comparison	3 months ago
Rich Harris	206974a5cd	chore: generate markdown tables of CPU profiles (#18059 ) extracted from #18035 — this should have been part of #18047 but I missed it off, oops. Will self-merge so it doesn't get in the way of #18035, and because the `performance-investigation` skill is predicated on this code existing --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>	3 months ago
Rich Harris	a9530e5330	chore: add labels to more internal deriveds (#18050 ) tiny QoL thing	3 months ago
Rich Harris	704e3bb5f0	chore: agent hints for perf investigations (#18047 ) This adds some hints in an `AGENTS.md` for how to conduct performance investigations, along with a utility for comparing profiles from different branches to identify hotspots. We will likely want to put other stuff in `AGENTS.md` in future but I figured we could start with something immediately useful. It also tweaks the comparison script — rather than nuking results from existing branches, it keeps them around so that we don't need to re-run benchmarks (which takes a long time) for branches that haven't changed. --------- Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>	3 months ago
Rich Harris	c93e251654	fix: never set derived.v inside fork (#18037 ) This started out as me implementing https://github.com/sveltejs/svelte/pull/17998/changes#r3018047965, but then I realised that I'd also fixed the bug that #17998 addresses. So I guess it's an alternative to that PR --------- Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>	3 months ago
Rich Harris	345b8ed69f	chore: keep previous benchmark runs around (#18049 ) extracted from #18047 – will self-merge this bit	4 months ago
Rich Harris	e402b2d0d6	chore: write `pnpm bench:compare` report to disk (#18045 ) will give this a quick self-merge to unblock	4 months ago
Rich Harris	99b1467ba4	chore: generate CPU profiles when running benchmarks (#18043 ) This causes `pnpm bench` and `pnpm bench:compare` to generate `.cpuprofile` files for each benchmark, which should in theory make it easier to understand how different branches affect performance (and find opportunities for optimisation). These files can be opened directly in VS Code and other editors, or in [profiler.firefox.com](https://profiler.firefox.com), [speedscope.app](https://www.speedscope.app), Chrome's performance devtools and so on.	4 months ago
Rich Harris	edcbb0e640	fix: invalidate `@const` tags based on visible references in legacy mode (#18041 ) closes #17992	4 months ago
Rich Harris	ff3495dc05	fix: disallow `--` in `idPrefix` (#18038 ) supersedes #17993	4 months ago
Scott Wu	51629ec7bd	docs: update references to `vite-plugin-svelte` (#18027 ) ### Before submitting the PR, please make sure you do the following - [ ] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [ ] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [ ] This message body should clearly illustrate what problems it solves. - [ ] Ideally, include a test that fails without this PR but passes with it. - [ ] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [ ] Run the tests with `pnpm test` and lint the project with `pnpm lint` --------- Co-authored-by: Rich Harris <hello@rich-harris.dev> Co-authored-by: Rich Harris <rich.harris@vercel.com>	4 months ago
dagecko	e0f925116c	fix: pin 9 actions to commit SHA (#18025 ) Re-submission of #18017. Had a problem with my fork and had to delete it, which closed the original PR. Apologies for the noise. ## Summary This PR pins all GitHub Actions to immutable commit SHAs instead of mutable version tags. - Pin 9 unpinned actions to full 40-character SHAs - Add version comments for readability ## Changes by file \| File \| Changes \| \|------\|---------\| \| autofix.yml \| Pinned actions to SHA \| \| ci.yml \| Pinned actions to SHA \| \| pkg.pr.new.yml \| Pinned actions to SHA \| \| release.yml \| Pinned actions to SHA \| ## A note on internal action pinning This PR pins all actions including org-owned ones. Best practice is to pin everything — the tj-actions/changed-files attack was an internally maintained action that was compromised, and every repo referencing it by tag silently executed attacker code. That said, it's your codebase. If you'd prefer to leave org-owned actions unpinned, let us know and we'll adjust the PR. ## How to verify Review the diff — each change is mechanical and preserves workflow behavior: - SHA pinning: `action@v3` becomes `action@abc123 # v3` — original version preserved as comment - No workflow logic, triggers, or permissions are modified I wrote a scanner called Runner Guard and open sourced it [here](https://github.com/Vigilant-LLC/runner-guard). If you have any questions, reach out. I'll be monitoring comms. \- Chris Nyhuis (dagecko)	4 months ago
Simon H	97d45f85c6	fix: don't override `$destroy/set/on` instance methods in dev mode (#18034 ) Don't think we need a test for this Fixes #17988	4 months ago

1 2 3 4 5 ...

11149 Commits (dae91eb65a45ce10d94a4f7ffdd78c8bb8961234) All Branches Search

11149 Commits (dae91eb65a45ce10d94a4f7ffdd78c8bb8961234)

All Branches