11446 Commits (e5ce0fd4bdb452bafa6dacaafbb7ea3243acfe60)

 

All Branches   

Search

Author	SHA1	Message	Date
paoloricciuti	e5ce0fd4bd	fix: always validate snippets if custom renderer is enabled	2 days ago
paoloricciuti	ac314d7cca	fix: store and restore parent renderer in effect	2 days ago
paoloricciuti	c2efb64bc2	fix: skip single node optimization in custom renderer	2 days ago
paoloricciuti	c22f2fa603	Merge remote-tracking branch 'origin/main' into svelte-custom-renderer	2 days ago
github-actions[bot]	44a7813730	Version Packages (#18572) ... This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.56.8 ### Patch Changes - fix: call `onerror` and provide a working `reset` when hydrating a failed boundary ([#18556](https://github.com/sveltejs/svelte/pull/18556)) - fix: preserve select selection when spread attributes omit value ([#18561](https://github.com/sveltejs/svelte/pull/18561)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	1 week ago
Elliott Johnson	23bc246a99	chore: Supply chain hardening (#18253) ... `svelte` Supply-chain hardening pass. ## Changes - Bump `packageManager` from `pnpm@10.4.0` to `pnpm@10.33.4` with `+sha512` integrity suffix. - Add to `pnpm-workspace.yaml`: - `minimumReleaseAge: 1440` - `minimumReleaseAgeExclude: ['@sveltejs/*', svelte, esrap, devalue]` - `blockExoticSubdeps: true` - Remove `pkg.pr.new.yml` workflow in favor of `pkg.svelte.dev` - Pin all third-party GitHub Actions to full SHA with `# vX.Y.Z` comments across `ci.yml`, `autofix.yml`, `release.yml`, `ecosystem-ci-trigger.yml` - Upgrade `pnpm/action-setup` references in `ci.yml`, `autofix.yml`, `release.yml` from a SHA that was incorrectly labeled `# v4` (actually `v5.0.0` / `v4.4.0`) to the current `v6.0.8` SHA so the version label matches reality.	1 week ago
Nic Polumeyv	3dde011d3a	fix: call `onerror` and provide a working `reset` when hydrating a failed boundary (#18556) ... Fixes #18555 A boundary that failed during SSR hydrates via `#hydrate_failed_content`, which never calls `onerror` and passes the `failed` snippet a no-op `reset`. Both came in with #17672, whose docs say `onerror` "will be called upon hydration with the deserialized error object". Once hydrated as failed, the boundary can never leave that state. Downstream this is what keeps SvelteKit's `+error.svelte` mounted after navigating away from a server-rendered error page (sveltejs/kit#16345). This extracts the reset/onerror machinery from `#handle_error` into `#create_reset` and uses it in the hydration path too. `onerror` is invoked in a microtask because it may mutate state, which is disallowed while hydrating. `#handle_error` already invokes it asynchronously, so the timing matches the error path. The tests flip a `recovered` flag before calling `reset`, since the child would otherwise throw again. That is the intended retry pattern, and the same one kit uses when it resets route boundaries on navigation. Verified against kit end to end, hydrating a server-rendered error page and navigating away now tears it down with no kit changes needed.	1 week ago
Floze	2bace308e3	fix: preserve select selection with spread attributes (#18561) ... Fixes #18557 A `<select>` with spread attributes initializes the option mutation observer even when those attributes never provide a `value`. In that case the element has no internal `__value`, but the observer previously treated the missing property as an explicit `undefined` value and deselected every option after an option was added or removed. Only reapply the programmatic selection when `__value` is actually present. This preserves the browser's current selection for spreads without a value while keeping the existing behavior for bindings, including an explicitly stored `undefined` value. A runtime-legacy regression fixture covers both adding and removing an option in client and hydration modes. ### Before submitting - [x] References the existing issue - [x] Uses a `fix:` title - [x] Includes a regression test - [x] Includes a patch changeset for `svelte` ### Test plan - [x] `FILTER=select-spread-preserve-selection pnpm test runtime-legacy --maxWorkers=1` (2 tests passed: client and hydrate) - [x] `git diff --check` - [ ] Full `pnpm test` was not run because the shared host was under resource pressure and broad test processes were explicitly avoided - [ ] `pnpm lint` and `pnpm check` were not run for the same reason - [ ] Targeted repository Prettier check was attempted, but could not start because `prettier-plugin-svelte` required the ungenerated `packages/svelte/compiler/index.js`; no broad build or dependency reinstall was run ### AI disclosure AI-assisted: the implementation, regression test, and pull request text were prepared with OpenAI Codex and reviewed by the contributor. Co-authored-by: Paolo Ricciuti <ricciutipaolo@gmail.com>	1 week ago
paoloricciuti	216f258068	Merge remote-tracking branch 'origin/main' into svelte-custom-renderer	2 weeks ago
github-actions[bot]	b29d7002ec	Version Packages (#18560) ... This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.56.7 ### Patch Changes - chore: provide `indent` option for `print` ([#18474](https://github.com/sveltejs/svelte/pull/18474)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2 weeks ago
Rich Harris	d9e40d17cf	docs: update link on hooks page (#18564) ... this docs page updated recently and broke everything	2 weeks ago
Manuel	b791cac54e	chore: provide `indent` option for `print` (#18474) ... Relevant for https://github.com/sveltejs/cli/pull/1138. This is basically just an option from `esrap` that we pass through. That will allow tools like `sv migrate` to provide a guessed indent based on the other file contents and therefore allow us to produce way smaller diffs. Since we are just passing an option, there is no need for a test here. Technically a `feat:` but i dont think this is relevant enough. ### Before submitting the PR, please make sure you do the following - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [ ] Ideally, include a test that fails without this PR but passes with it. - [x] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint`	2 weeks ago
github-actions[bot]	4a6a85b5f1	Version Packages (#18552) ... This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.56.6 ### Patch Changes - perf: skip unnecessary blocker analysis when compiling components without top-level await ([#18548](https://github.com/sveltejs/svelte/pull/18548)) - fix: rerun derived that had an abort controller on reconnection ([#18551](https://github.com/sveltejs/svelte/pull/18551)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2 weeks ago
Joe Schafer	d0dbe1a480	perf: skip quadratic blocker analysis when no top-level await (#18548) ... Skip function reference tracing in `calculate_blockers` when a component has no top-level `await`. Blockers only represent dependencies on top-level async statements. Without a top-level `await`, no binding can have a blocker, so tracing every top-level function cannot affect the generated output. In large components with many functions and transitive assignments, that unnecessary work can become quadratic.	2 weeks ago
Simon H	22e0adb75a	fix: rerun derived that had an abort controller on reconnection (#18551) ... Follow-up to #18400 - we need to mark a derived with an abort signal that is frozen as dirty so it is guaranteed to rerun when it reconnects/is re-requested. Else you could return a stale value, or worse, you returned a promise from the derived which you aborted, and it's now in the rejected state until you update one of its dependencies.	2 weeks ago
github-actions[bot]	602a873b6b	Version Packages (#18497) ... This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.56.5 ### Patch Changes - chore: drop dead code that make TSGO fail ([#18496](https://github.com/sveltejs/svelte/pull/18496)) - fix: don't (re)connect deriveds when read inside branch/root effects ([#18527](https://github.com/sveltejs/svelte/pull/18527)) - fix: skip unnecessary derived effect in earlier batch ([#18525](https://github.com/sveltejs/svelte/pull/18525)) - fix: avoid declaration tag warning in event handlers ([#18500](https://github.com/sveltejs/svelte/pull/18500)) - fix: abort deriveds own AbortSignal when it disconnects ([#18400](https://github.com/sveltejs/svelte/pull/18400)) - fix: ensure `$state.eager()` is correctly transormed for SSR output ([#18530](https://github.com/sveltejs/svelte/pull/18530)) - fix: correctly transform declaration tags during SSR ([#18492](https://github.com/sveltejs/svelte/pull/18492)) - fix: transform computed keys in keyed `{#each}` destructuring patterns ([#18521](https://github.com/sveltejs/svelte/pull/18521)) - fix: chain preprocessor sourcemaps with an empty `sources[0]` instead of dropping them ([#18518](https://github.com/sveltejs/svelte/pull/18518)) - fix: clear previous_task reference after abort in Tween to prevent memory leak on interrupted tweens ([#18541](https://github.com/sveltejs/svelte/pull/18541)) - fix: don't treat declaration tags as parts inside each blocks ([#18507](https://github.com/sveltejs/svelte/pull/18507)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	3 weeks ago
paoloricciuti	2311e1757d	Merge remote-tracking branch 'origin/main' into svelte-custom-renderer	3 weeks ago
adiGuba	a4fd67e361	fix: $state.eager() is sometimes incorrect in SSR (#18530) ... Fix #18529 A simple fix : `context.visit()` was missing on the argument of `$state.eager()`, so the generated code can be incorrect in some case :	3 weeks ago
prashantg-pixi	199ffebca3	fix: clear previous_task reference after abort in Tween (#18541) ... avoids memory leaks	3 weeks ago
Simon H	edeef1f9f7	chore: add some failing tests (#18528) ... During my explorations I collected these new tests which are currently failing. Two of them work on the incremental-batches branch, all of them (adjusted for new behavior) pass on my uncommitted entangle batches branch, and all of them also pass on another uncommitted experimental branch of overlaying deriveds which will likely not land.	3 weeks ago
Fedor Nezhivoi	a91b068786	fix: abort deriveds own AbortSignal when it disconnects (#18400) ... Fixes https://github.com/sveltejs/svelte/issues/18301 --------- Co-authored-by: Fedor Nezhivoi <f.nezhivoi@corp.vk.com> Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com> Co-authored-by: Simon Holthausen <simon.holthausen@vercel.com>	3 weeks ago
Simon H	4da9f74cd9	chore: bench compare report as HTML (#18543) ... Creates a `results.html` file which is much better to look at compared to the terminal output.	3 weeks ago
Simon H	af6f1d309b	chore: run every benchmark in its own process (#18542) ... While benchmarking it became apparent that when running the full `pnpm bench:compare` suite results could be wildly different compared to only comparing single benchmarks. The reason (most likely) is that the heap/GC/JIT state from one benchmark contaminates the others. Therefore this adjusts the runners such that each benchmark entry is run in its own forked process, not just each branch. This should give better, more stable results. Also a little fix to compare results by name; I made the mistake of adding a new benchmark to main which wasn't present on other branches yet, which made the results really confusing.	3 weeks ago
paoloricciuti	ce6e71c695	Merge remote-tracking branch 'origin/main' into svelte-custom-renderer	3 weeks ago
Thribhuvan	b4d1583ae2	fix: transform computed keys in keyed each block destructuring patterns (#18521) ... fixes #18519	3 weeks ago
Simon H	8e4f26552c	chore: changeset (#18527) ... for #18517	3 weeks ago
Rabindra Kumar Meher	08a9e9e7e4	fix: prevent derived connection leak in untracked contexts (#18517) ... Fixes #18501. Problem is that is_updating_effect was also set to true for branch/root effects which are not reactive --------- Co-authored-by: Simon Holthausen <simon.holthausen@vercel.com>	3 weeks ago
JY Wey	bfbb026f2f	fix: skip unnecessary derived effect in earlier batch (#18525) ... fixes #18438 Currently the `mark` method inside `#merge` for `earlier_batch` will schedule effect for undirty derived. Add the condition for derived to prevent unnecessary effect be scheduled. ``` if ((flags & DERIVED) !== 0) { mark(/** @type {Derived} */ (reaction)); } ```	3 weeks ago
Simon H	c2b7642263	chore: add benchmarks (#18523) ... Add two kairo variants to better measure of `#traverse` / block effects perf	3 weeks ago
Ivan	5edd8b0602	fix: chain preprocessor sourcemaps with an empty sources[0] (#18518) ... ## Summary Fixes #18491 — the compiler discards an upstream plugin's sourcemap when it's generated without a `source` option (e.g. `new MagicString(code).generateMap()`), producing wrong devtools/stack-trace positions. ### Root cause `compile()` already supports composing an incoming sourcemap into its output via `options.sourcemap` (`merge_with_preprocessor_map` → `apply_preprocessor_sourcemap` → `combine_sourcemaps` in `packages/svelte/src/compiler/utils/mapped_code.js`). This is the same mechanism `preprocess()` uses internally, and it's the documented contract for tools that transform a `.svelte` file before compiling it (see `CompileOptions.sourcemap`'s doc comment). `combine_sourcemaps` composes maps by matching `sourcefile === filename` (the basename of the file being compiled). A sourcemap produced by `new MagicString(code).generateMap()` **without** a `source` option — which is exactly what the reporter's Vite plugin does — has `sources: ['']`. That empty string never equals `filename`, so `remapping()` treats the node as a leaf (the "original" file) instead of a branch to keep chaining through, and the whole incoming map is silently dropped. The result: every position that flows through that segment resolves to `{ source: null, line: null, column: null }`, which is what produces the wrong/missing devtools mapping described in the issue. Vite itself already has to handle this exact ambiguity: in `pluginContainer.ts`'s `_getCombinedSourcemap`, an empty `sources[0]` from a MagicString-based transform is patched to refer to the file being transformed before Vite uses it internally. This PR applies the same normalization on svelte's side, so the contract holds regardless of whether the caller happens to pass a `source` option to `generateMap()`. ### Fix In `apply_preprocessor_sourcemap`, normalize an incoming map's `sources: ['']` (or `[null]`/`[undefined]`) to `[filename]` before calling `combine_sourcemaps`, so the chain-matching step can actually find it.	3 weeks ago
Paolo Ricciuti	41642b70ee	fix: avoid declaration tag warning in event handlers (#18500) ... Closes #18493 Co-authored-by: justjavac <justjavac@gmail.com>	3 weeks ago
paoloricciuti	0c226fcf4e	Merge remote-tracking branch 'origin/main' into svelte-custom-renderer	4 weeks ago
Paolo Ricciuti	8fb7ceeba5	fix: don't treat declaration tags as parts inside each blocks (#18507) ... Closes #18506 Declaration tags in the scope of an each block were considered "parts" and transformed to use their value instead of the signal itself. We can safely check on the `kind` of the binding since a `kind` of `state`, `state_raw` or `derived` in the each scope needs to be a declaration tag (and it's a stable reference so we can use them directly)	4 weeks ago
Paolo Ricciuti	33304b4b15	Merge branch 'main' into svelte-custom-renderer	1 month ago
Paolo Ricciuti	b1cadd1eae	chore: drop dead code that make TSGO fail (#18496)	1 month ago
Paolo Ricciuti	b9e03714eb	fix: correctly transform declaration tags during SSR (#18492) ... Closes #18490	1 month ago
paoloricciuti	39887f5ace	fix: update snapshot	1 month ago
Paolo Ricciuti	7c5b06657c	Merge branch 'main' into svelte-custom-renderer	1 month ago
github-actions[bot]	eae50dfd1c	Version Packages (#18435) ... This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.56.4 ### Patch Changes - fix: include wrapping parentheses in `{@const}` declarator `end` position ([#18436](https://github.com/sveltejs/svelte/pull/18436)) - fix: always unset reactivity context after restoring it ([#18453](https://github.com/sveltejs/svelte/pull/18453)) - fix: don't notify `searchParams` subscribers when the URL changes without affecting the search string ([#18425](https://github.com/sveltejs/svelte/pull/18425)) - fix: strip `?` from optional parameters in `<script lang="ts">` so generated JavaScript is valid ([#18448](https://github.com/sveltejs/svelte/pull/18448)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	1 month ago
Simon H	36ae0622a8	fix: always unset reactivity context after restoring it (#18453) ... When calling `save`, we restore the context after the promise resolves. But we do not unset it after the subsequent synchronous execution. That means that until `unset_context` runs in `async_derived` we will not have the correct (nulled) context. That causes problems if the `save` isn't the last promise contributing to the `async_derived`, because it means the context is not properly unset until the promise _after_ the `save` within the `async_derived` settles. This can cause all sorts of mixups, including a wrong mutation error. fixes #18441	1 month ago
jyc.dev	a6985bcd24	fix: strip `?` from optional parameters in svelte lang ts (#18448) ... In `esrap@2.2.12` we fixed the missing `?` in ts files https://github.com/sveltejs/esrap/pull/139 It's good for `ts`, but bad for svelte compiler that was not removing it as it was a esrap issue not printing it :/ This issue came: https://github.com/sveltejs/esrap/issues/141 This PR is fixing the issue in the compiler stripping the `?`	1 month ago
paoloricciuti	d39049edc5	fix: lint	2 months ago
Paolo Ricciuti	4873b8028f	Merge branch 'main' into svelte-custom-renderer	2 months ago
Yuichiro Yamashita	c4daa490bb	fix: include wrapping parentheses in `{@const}` declarator end (#18436) ... `{@const x = (a)}` (and any `{@const}` whose initializer is wrapped in parentheses, e.g. `(a = b)`, `({ ... })`) produced a `VariableDeclarator` whose `end` fell before the closing `)`. `read_expression` strips the wrapping parens from the returned node but advances the parser past them, so `init.end` excludes the `)` while the parser position does not. Use the parser position for the declarator `end` instead. Fixes source slices / tooling that rely on the node range (the range previously yielded invalid, unbalanced source). <img width="2064" height="1746" alt="image" src="https://github.com/user-attachments/assets/64153ee5-d543-442d-8018-d3668acfd7a7" /> ### Before submitting the PR, please make sure you do the following - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [x] Ideally, include a test that fails without this PR but passes with it. - [x] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [ ] Run the tests with `pnpm test` and lint the project with `pnpm lint`	2 months ago
Nic Polumeyv	0510174bc0	fix: make `SvelteURLSearchParams` notifications accurate (#18425) ... `SvelteURLSearchParams` has two notification bugs that surface through `SvelteURL`. The first is over-notification. Setting `url.href` always rebuilds the params and bumps their version signal, even when the search string didn't change at all. Effects that read `size` (or any params method) re-run on every unrelated `href` write, which is #17218, where it caused infinite effect loops in a router. The fix is a guard in the internal replace path that bails out when the incoming params serialize identically to the current ones. The second is under-notification, and it's sneakier. Every read method tracks the version signal, `get`, `getAll`, `has`, `keys`, `values`, `entries`, `toString`, `size`, the iterator... except `forEach`, which was never overridden. The inherited platform method reads the internal list directly and subscribes to nothing, so a template that renders params via `forEach` never updates: ```js $effect(() => { url.searchParams.forEach((value, key) => entries.push(`${key}=${value}`)); // never re-runs }); ``` We found this one in the wild while making `page.url` a `SvelteURL` in sveltejs/kit#16031. Kit's own test suite renders query params with `forEach`, and the coarse object-identity signal that previously masked the gap went away, leaving stale UI after client-side navigations. The fix is the same one-line tracking pattern every other read method already uses. Fixes #17218 --- - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [x] Ideally, include a test that fails without this PR but passes with it. - [x] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint`	2 months ago
dependabot[bot]	8ea3ee8c62	chore(deps-dev): bump esbuild from 0.25.11 to 0.28.1 (#18427) ... Bumps [esbuild](https://github.com/evanw/esbuild) from 0.25.11 to 0.28.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/releases">esbuild's releases</a>.</em></p> <blockquote> <h2>v0.28.1</h2> <ul> <li> <p>Disallow <code>\</code> in local development server HTTP requests (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr">GHSA-g7r4-m6w7-qqqr</a>)</p> <p>This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a <code>\</code> backslash character. It happened due to the use of Go's <code>path.Clean()</code> function, which only handles Unix-style <code>/</code> characters. HTTP requests with paths containing <code>\</code> are no longer allowed.</p> <p>Thanks to <a href="https://github.com/dellalibera"><code>@​dellalibera</code></a> for reporting this issue.</p> </li> <li> <p>Add integrity checks to the Deno API (<a href="https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr">GHSA-gv7w-rqvm-qjhr</a>)</p> <p>The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.</p> <p>Note that esbuild's Deno API installs from <code>registry.npmjs.org</code> by default, but allows the <code>NPM_CONFIG_REGISTRY</code> environment variable to override this with a custom package registry. This change means that the esbuild executable served by <code>NPM_CONFIG_REGISTRY</code> must now match the expected content.</p> <p>Thanks to <a href="https://github.com/sondt99"><code>@​sondt99</code></a> for reporting this issue.</p> </li> <li> <p>Avoid inlining <code>using</code> and <code>await using</code> declarations (<a href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>)</p> <p>Previously esbuild's minifier sometimes incorrectly inlined <code>using</code> and <code>await using</code> declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for <code>let</code> and <code>const</code> declarations by avoiding doing it for <code>var</code> declarations, which no longer worked when more declaration types were added. Here's an example:</p> <pre lang="js"><code>// Original code { using x = new Resource() x.activate() } <p>// Old output (with --minify)<br /> new Resource().activate();</p> <p>// New output (with --minify)<br /> {using e=new Resource;e.activate()}<br /> </code></pre></p> </li> <li> <p>Fix module evaluation when an error is thrown (<a href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>, <a href="https://redirect.github.com/evanw/esbuild/pull/4467">#4467</a>)</p> <p>If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if <code>import()</code> or <code>require()</code> is used to import a module multiple times. The thrown error is supposed to be thrown by every call to <code>import()</code> or <code>require()</code>, not just the first. With this release, esbuild will now throw the same error every time you call <code>import()</code> or <code>require()</code> on a module that throws during its evaluation.</p> </li> <li> <p>Fix some edge cases around the <code>new</code> operator (<a href="https://redirect.github.com/evanw/esbuild/issues/4477">#4477</a>)</p> <p>Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a <code>new</code> expression (specifically an optional chain and/or a tagged template literal). The generated code for the <code>new</code> target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the <code>new</code> target in parentheses. Here is an example of some affected code:</p> <pre lang="js"><code>// Original code new (foo()`bar`)() new (foo()?.bar)() <p>// Old output<br /> new foo()<code>bar</code>();<br /> new (foo())?.bar();</p> <p></code></pre></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md">esbuild's changelog</a>.</em></p> <blockquote> <h1>Changelog: 2025</h1> <p>This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).</p> <h2>0.27.2</h2> <ul> <li> <p>Allow import path specifiers starting with <code>#/</code> (<a href="https://redirect.github.com/evanw/esbuild/pull/4361">#4361</a>)</p> <p>Previously the specification for <code>package.json</code> disallowed import path specifiers starting with <code>#/</code>, but this restriction <a href="https://redirect.github.com/nodejs/node/pull/60864">has recently been relaxed</a> and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping <code>#/*</code> to <code>./src/*</code> (previously you had to use another character such as <code>#_*</code> instead, which was more confusing). There is some more context in <a href="https://redirect.github.com/nodejs/node/issues/49182">nodejs/node#49182</a>.</p> <p>This change was contributed by <a href="https://github.com/hybrist"><code>@​hybrist</code></a>.</p> </li> <li> <p>Automatically add the <code>-webkit-mask</code> prefix (<a href="https://redirect.github.com/evanw/esbuild/issues/4357">#4357</a>, <a href="https://redirect.github.com/evanw/esbuild/issues/4358">#4358</a>)</p> <p>This release automatically adds the <code>-webkit-</code> vendor prefix for the <a href="https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/mask"><code>mask</code></a> CSS shorthand property:</p> <pre lang="css"><code>/* Original code */ main { mask: url(x.png) center/5rem no-repeat } <p>/* Old output (with --target=chrome110) */<br /> main {<br /> mask: url(x.png) center/5rem no-repeat;<br /> }</p> <p>/* New output (with --target=chrome110) */<br /> main {<br /> -webkit-mask: url(x.png) center/5rem no-repeat;<br /> mask: url(x.png) center/5rem no-repeat;<br /> }<br /> </code></pre></p> <p>This change was contributed by <a href="https://github.com/BPJEnnova"><code>@​BPJEnnova</code></a>.</p> </li> <li> <p>Additional minification of <code>switch</code> statements (<a href="https://redirect.github.com/evanw/esbuild/issues/4176">#4176</a>, <a href="https://redirect.github.com/evanw/esbuild/issues/4359">#4359</a>)</p> <p>This release contains additional minification patterns for reducing <code>switch</code> statements. Here is an example:</p> <pre lang="js"><code>// Original code switch (x) { case 0: foo() break case 1: default: bar() } </code></pre> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="bb9db84c02"><code>bb9db84</code></a> publish 0.28.1 to npm</li> <li><a href="9ff053e53b"><code>9ff053e</code></a> security: add integrity checks to the Deno API</li> <li><a href="0a9bf2135b"><code>0a9bf21</code></a> enforce non-negative size in gzip parser</li> <li><a href="e2a1a71320"><code>e2a1a71</code></a> security: forbid <code>\\</code> in local dev server requests</li> <li><a href="83a2cbfc35"><code>83a2cbf</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4482">#4482</a>: don't inline <code>using</code> declarations</li> <li><a href="308ad745d8"><code>308ad74</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4471">#4471</a>: renaming of nested <code>var</code> declarations</li> <li><a href="f013f5f99a"><code>f013f5f</code></a> fix some typos</li> <li><a href="aafd6e48b1"><code>aafd6e4</code></a> chore: fix some minor issues in comments (<a href="https://redirect.github.com/evanw/esbuild/issues/4462">#4462</a>)</li> <li><a href="15300c30b5"><code>15300c3</code></a> follow up: cjs evaluation fixes</li> <li><a href="1bda0c31d7"><code>1bda0c3</code></a> fix <a href="https://redirect.github.com/evanw/esbuild/issues/4461">#4461</a>, fix <a href="https://redirect.github.com/evanw/esbuild/issues/4467">#4467</a>: esm evaluation fixes</li> <li>Additional commits viewable in <a href="https://github.com/evanw/esbuild/compare/v0.25.11...v0.28.1">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for esbuild since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/sveltejs/svelte/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2 months ago
Paolo Ricciuti	4116e9f25e	Merge branch 'main' into svelte-custom-renderer	2 months ago
Rich Harris	2084125c0f	Unified `mount` API for components with custom renderers (#18317) ... Targets #18042. Am opening this so I can start a discussion over on that PR (https://github.com/sveltejs/svelte/pull/18042#issuecomment-4567867958) --------- Co-authored-by: paoloricciuti <ricciutipaolo@gmail.com>	2 months ago
github-actions[bot]	a9f48540e2	Version Packages (#18389) ... This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.56.3 ### Patch Changes - fix: ignore errors that occur in destroyed effects ([#18384](https://github.com/sveltejs/svelte/pull/18384)) - fix: type BigInts in `$state.snapshot(...)` return values ([#18388](https://github.com/sveltejs/svelte/pull/18388)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2 months ago
sijie-Z	71a6515bd6	fix: check boundary exists before calling error handler in async derived (#18384) ... fixes #18383 I traced the issue to `packages/svelte/src/internal/client/error-handling.js`, specifically the `invoke_error_boundary` function. The problem is at line 56 where `effect.b.error(error)` is called without checking if `effect.b` exists. What happens is: when an async `$derived` rejects inside a `<svelte:boundary>`, the error is handled correctly the first time. But if the boundary is destroyed before the rejection fully settles (e.g. component unmounts), a subsequent settle tries to call `effect.b.error()` on a destroyed boundary where `effect.b` is `null`, causing a `TypeError`. The fix adds a null check for `effect.b` before calling `error()`. If the boundary has been destroyed, we skip it and continue bubbling up to the parent boundary. This way the error still gets handled properly instead of crashing. This could also be tested by creating a component with an async `$derived` that rejects after the component unmounts, but I wanted to get the fix up first for review. --------- Co-authored-by: Rich Harris <rich.harris@vercel.com>	2 months ago