11159 Commits (f080b412eed0e2b846a3bdf12e1a623604fdeb4b)

 

All Branches   

Search

Author	SHA1	Message	Date
Mathias Picker	f080b412ee	Update packages/svelte/elements.d.ts ... Refactor StyleValue types Co-authored-by: 7nik <kfiiranet@gmail.com>	6 days ago
Mathias Picker	88b1a2f4b4	chore: drop redundant comment in style-update test	7 days ago
Mathias Picker	b87eb5a893	chore: drop redundant String() coercion in to_style ... After the new normalization step, `value` at the final return is always either null/undefined or a string, so `String(value)` is doing nothing.	7 days ago
Mathias Picker	b6b6d03869	fix: drop style attribute when value normalises to empty ... Previously the client kept an empty `style=""` for empty-string values while SSR dropped the attribute, which is a hydration mismatch and now also affects every object/array input that filters down to nothing (`style={false}`, `style={{}}`, `style={[null, false]}`). Coerce empty to `null` in `to_style` so client and SSR agree, matching what the directive path already did and what `to_class` does for `class={''}`. Two existing tests asserted `<div style="">` for `component.style = ''` as an incidental side effect; updated to expect the attribute dropped.	7 days ago
Mathias Picker	cd5b9add37	fix: also widen HTMLAttributes['style'] to StyleValue ... I only updated SVGAttributes['style'] in the previous commit and missed the HTMLAttributes one, which left object/array styles failing the type check on regular HTML elements.	7 days ago
Mathias Picker	3e2d1a89c3	chore: drop redundant '' check in style_value_to_string ... The empty string already falls through to the `typeof value === 'string'` branch which returns it as-is, so the explicit check was redundant.	7 days ago
Mathias Picker	e4ad69ea76	feat: allow style attribute to be an object or array ... Mirrors the clsx-style ergonomics that `class` has had since 5.16. The `style` attribute now accepts an object, array, or any nested combination, normalised by a small runtime helper alongside the existing `to_style`. Object keys are emitted verbatim (no camelCase conversion), falsy entries are dropped, and existing `style:` directive precedence is unchanged.	7 days ago
Rich Harris	dc5bd887b5	fix: resolve stale deriveds with latest value (#18167) ... While looking into #18162 I found an adjacent bug. Currently, if an async derived resolves in batch 2 before it resolves in batch 1, we reject the promise belonging to batch 1 and by extension the batch itself. This means that any other changes in batch 1 are silently discarded, incorrectly. The fix is almost comically simple: rather than rejecting the earlier promise, we just resolve it with the latest value. I have a hunch that this might also enable us to simplify the rebase logic, though I haven't investigated that in this PR. ### Before submitting the PR, please make sure you do the following - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [x] Ideally, include a test that fails without this PR but passes with it. - [x] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint`	1 week ago
Rich Harris	e65025be58	docs: fix testing docs (#18163) ... extracted from https://github.com/sveltejs/svelte.dev/pull/1959	2 weeks ago
Simon H	572444a696	fix: ignore false-positive errors of `$inspect` dependencies (#18106) ... We had logic in place to ignore errors of `$inspect` effects that are about to destroy, but we didn't take into account that we can get these transient errors while checking for `is_dirty` in preparation for running the effect, too. Now effects are marked as dirty in case an error occurs while evaluating their dependencies, which guarantees we will see the error again but we can then handle it properly. Fixes #15741 --------- Co-authored-by: Rich Harris <rich.harris@vercel.com>	2 weeks ago
Simon H	90a70cb012	fix: flush eager effects in production (#18107) ... While working on #18106 I noticed that we're not adding eager effects inside `mark_reactions` when `DEV` is `false`. As a result production build could have `$state.eager` or `$state.pending` not working correctly. ~No test because I can't get Vitest to not run with `DEV` being `true`.~ added a test	2 weeks ago
Simon H	9521b9f3dc	fix: don't rebase just-created batches (#18117) ... It's possible to rebase just-created batches. Case A: - batch A runs effects - one of these effects writes to a source. This creates a new batch B - an effect _after_ that (still part of "flush effects of batch A") executes a derived. This creates an entry in the `current` Map in batch B - batch A commits after processing batch B (`next_batch` etc logic), batch B is pending. Due to derived being part of batchB.current batch A can wrongfully think these are connected and try to rerun/add effects etc on batch B Case B: - like case A but with an additional await inside a pending snippet Case C: - batch A with source a and b, it flushes effects - one of these effects schedules batch B with b and c scheduling an async effect - batch B is deferred - batch A commits. Due to the a/b/c partial overlap it will needlessly rerun the just scheduled async effect All these cases are wrong. We fix it like this: 1. we call `this.#commit()` _before_ running the new batches, which may stick around due to having pending work, and we don't want to rebase these. This fixes case A and C 2. we capture derived values in `previous_batch` if it exists, because it means we're currently flushing effects, and derived writes belong to that batch and not a new one that might have been scheduled already. This fixes case B Discovered this while working on #18097 --------- Co-authored-by: Rich Harris <rich.harris@vercel.com>	2 weeks ago
Rohan Santhosh Kumar	7719a74eef	chore: fix constructor typo in attributes comment (#18115) ... ## Summary - Fix the `constructor` typo in the attributes comment. ## Related issue - N/A ## Guideline alignment - Read `CONTRIBUTING.md` and kept this to one focused text-only file change. - No behavior, test, fixture, changeset, or generated-file changes. ## Test plan - `git diff --check` - Not run: comment-only change. Co-authored-by: Codex <codex@openai.com>	2 weeks ago
Eduardo Kurek	146cb5ea6c	fix: lazy props reactivity (#18146) ... Fix #18132 This PR treat lazy fallbacks on `prop()` as derived. Now a default function that uses a $state is recalculated whenever its dependents changes. This change implies that this lazy functions cannot mutate a state anymore (because it is derived), causing a `state_unsafe_mutation`error. This implies on a breaking change, but reasonable. --- ### New breaking change here - **Who does this affect**: Everyone that has updated a $state on a default lazy prop. Example: ```html <script> let myValue = $state(0); let callCount = $state(0); function getValue() { callCount++; // causes a state_unsafe_mutation error return myValue; // returning a state doesn't cause an error, and now it is tracked as a dependency } let { value = getValue() } = $props(); </script> ``` **Why make this breaking change** This encourages people to not update states on a function that fundamentaly, is readonly. When someone wants to use a default function expecting that it should be tracked, its not likely that this function will change some state. It is anti-pattern to change some state inside a getter function. But what if someone wants to do it, like in the code above? The code above doesn't make sense before this PR, the old way to calculate lazy functions is to execute it one time, and only one, so the `callCount` variable will never change. But let's assume that someone did it, how to migrate? The migration in same example is easy, since the `callCount` is executed only once, it will not be executed after the component is mounted. So the `callCount` doesn't need to be a state, the `callCount` will be in a valid state when the component is created. So here is the migrated code: ```html <script> let myValue = $state(0); let callCount = 0; function getValue() { callCount++; // doesn't causes an error return myValue; } let { value = getValue() } = $props(); </script> ``` As we can see, there is no reason for the variable `callCount` in this example (before this PR), and if someone did it, it is more likely that they used a constant instead: ```html <script> let myValue = $state(0); let callCount = 1; function getValue() { return myValue; } let { value = getValue() } = $props(); </script> ``` There is another example that causes the `state_unsafe_mutation` and how to fix (this happened on the tests that i changed): ```html <script> let log = $state([]); function fallbackExample => { log.push('fallback called'); return 1; // any value, just to show the issue with the log } let { value = fallbackExample() } = $props(); </script> ``` Here, we can see that `log` variable is a state. Before this PR, as i said, this function `fallbackExample` will be executed once. So the logs will be computed when the component is mounted. So there is no reason to make the `log` a state. The simplest way to fix this is to make it a normal variable: ```html <script> let log = []; </script> ``` But with this PR, the function might be recalculated at some point, and the `log` with a state makes sense now, so how to migrate in this case? As i said, changing a state inside a lazy prop function is not a good practice, we can think in a way to invert this dependency, and change the approach from push (imperative mutation) to pull (declarative derivation). If a developer really needs to track how many times a fallback is executed or react to its changes, they should use a $derived or an $effect that observes the same dependencies as the fallback, or simply observe the property itself: ```html <script> let { value = fallbackExample() } = $props(); let log = $state([]); $effect(() => { const message = `${value}`; untrack(() => { // we don't want to track changes on the log variable log.push(message); }); }); </script> ``` ### After all, how to migrate? 1. **If there is no state mutation inside the prop function, no need to changes**; 2. **If there is a state mutation inside the prop function, but the value muted is declared inside the same component:** remove the state from it. Before this PR the method will be executed only once, and to get the same result, you do not need the variable to be a state; **Before** ```html <script> let log = $state([]); const fallback_fn = () => { log.push('fallback_fn'); return 1; } const { myProp = fallback_fn() } = $props(); </script> ``` **After** ```html <script> let log = []; const fallback_fn = () => { log.push('fallback_fn'); return 1; } const { myProp = fallback_fn() } = $props(); </script> ``` 3. **If there is a state mutation inside the prop function, and the value is read in multiple places:** change your approach, use a effect to detect the change on the prop, and apply your mutation inside the effect; Before: ```html <script> import { setLog } from './logs.js'; // setLog apply a mutation on a state const fallback_fn = () => { setLog('fallback_fn'); return 1; } const { myProp = fallback_fn() } = $props(); </script> ``` After ```html <script> import { setLog } from './logs.js'; // setLog apply a mutation on a state const fallback_fn = () => { return 1; } const { myProp = fallback_fn() } = $props(); $effect(() => { const message = `${myProp}`; untrack(() => { setLog(message); }); }); </script> ``` ### Severity (number of people affected x effort): Low - **Affected Users:** Minimal. Mutating state inside a property initializer is a rare edge case and considered an anti-pattern (because its a side effect inside a getter). Most users use constants or pure functions for fallbacks. - **Migration Effort:** Low. As demonstrated in the examples above, the fix usually involves either removing an unnecessary $state or moving the side effect to its proper place, the $effect ### Conclusion This PR encourages users to program in a better way. Forcing a clean separation between data and their side effects. The developer can use this new feature mainly in i18n services, providing better usability and experience. Also, this PR makes the properties more predictable, since the expected behavior is that it works reactively, eliminating this bug for future developers. Even though this PR adds a breaking change, it's easily solvable, and the chance of any user facing this problem is low. **Full example to test reactivity in props** (won't work on web, you can get the PR and test localy to see it working): https://svelte.dev/playground/a6608434d8c642179f0e2b72468c74d7?version=latest *A unit test for this reactivity was created: runtime-runes/props-default-value-reactivity*. --------- Co-authored-by: Rich Harris <rich.harris@vercel.com> Co-authored-by: Rich Harris <hello@rich-harris.dev>	2 weeks ago
Simon H	bc82a55647	fix: ensure scheduled batch is flushed if not obsolete (#18131) ... The logic of checking that the current batch is still the generated one is flawed. If microtasks align the current batch can be a different value even if the batch still need to be flushed. This therefore switches the heuristic to what it actually should express: "has this batch run already?" Fixes #18126 (because the batch isn't running, it later runs into the invariant)	2 weeks ago
Simon H	4c96b469f8	fix: allow `@debug` tags to reference awaited variables (#18138) ... Fixes #18137	2 weeks ago
Dor Alagem	69b4c9f561	fix: skip block comments in read_value to prevent apostrophe parsing error (#18153) ... Fixes #18134. ## Problem `read_value()` in `packages/svelte/src/compiler/phases/1-parse/read/style.js` has no logic to skip CSS block comments (`/* ... */`). When the parser encounters an apostrophe inside a comment, it sets `quote_mark = "'"` — treating it as the start of a string literal — then never finds a matching closing quote, and ultimately throws `unexpected_eof` at the end of the style block. Minimal repro: ```svelte <style> /* it's a comment */ .foo { color: red; } </style> ``` → `Error: Unexpected end of input` ## Fix Add a `/* ... */` skip path inside the `read_value` loop, mirroring the same pattern already used in `allow_comment_or_whitespace`. When `/*` is detected outside a string or url context, the parser advances past the entire comment without adding its content to the value string. --------- Co-authored-by: Dor Alagem <doralagem@MacBook-Pro-sl-Dor.local> Co-authored-by: Rich Harris <rich.harris@vercel.com>	2 weeks ago
7nik	ada3076967	fix: account for proxified instance when updating `bind:this` (#18147) ... Fixes #18145 I wonder why nulling happens after updating `bind:this` but not before, which would fix the issue as well, though not as efficiently. ### Before submitting the PR, please make sure you do the following - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [x] Ideally, include a test that fails without this PR but passes with it. - [x] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint`	2 weeks ago
Wesley	bd29b9ef2b	docs: document $state.snapshot toJSON behavior (#18154) ... ### Before submitting the PR, please make sure you do the following - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [ ] Ideally, include a test that fails without this PR but passes with it. - [ ] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [ ] Run the tests with `pnpm test` and lint the project with `pnpm lint` `$state.snapshot` already clones the value returned from `toJSON`, and its `Snapshot<T>` type reflects that return type. The `$state.snapshot` docs now call out that behavior explicitly, including the generated ambient types shown by editors. Test plan: `pnpm check`; `pnpm lint`. Fixes #18129 Co-authored-by: sakaenyeniceri5 <sakaenyeniceri5@users.noreply.github.com>	2 weeks ago
github-actions[bot]	b771df3464	Version Packages (#18125) ... This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.55.5 ### Patch Changes - fix: don't mark deriveds while an effect is updating ([#18124](https://github.com/sveltejs/svelte/pull/18124)) - fix: do not dispatch introstart event with animation of animate directive ([#18122](https://github.com/sveltejs/svelte/pull/18122)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	3 weeks ago
Simon H	8e7319063a	fix: don't mark deriveds while an effect is updating (#18124) ... Fixes #18123 This makes setting state inside effects slightly slower theoretically (since they hit the new guard), but I verified that the original issue for which we introduced this (#16658) is still fast with this change. The more we add logic to this the more I think we should investigate switching to a different mechanism. I tried using a `Set` previously but it did hurt the benchmarks a bit - might try to revisit a variant of this. --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	3 weeks ago
dabund24	51736e576d	fix: do not dispatch transition event with animation (#18122) ... closes #18056 related: #17567 and #14009 # Changes move `dispatch_event()` calls in `transitions.js` out of `animate()` function using an additional `on_begin()` callback parameter. Doing so makes it possible to dispatch the `introstart` and `outrostart` events only from `transition()`. # Testing add a test checking that svelte dispatches no event when it runs an animation	3 weeks ago
Rohan Santhosh Kumar	48dc9b40c0	docs: fix spacing around option tag in bind docs (#18114) ... ## Summary - Fix the missing space before `<option>` in the bind documentation. ## Related issue - N/A ## Guideline alignment - Read `CONTRIBUTING.md` and kept this to one focused docs-only file change. - No behavior, test, fixture, changeset, or generated-file changes. ## Test plan - `git diff --check` - Not run: docs-only spacing fix. Co-authored-by: Codex <codex@openai.com>	3 weeks ago
Simon H	6a149666c1	chore: enhance download script to ask for folder (#18112) ... If project that is downloaded is a project that can't be transfered into the playground (because it relies on SvelteKit stuff), instead of failing it now asks if you want to put it into another folder within the playgrounds folder	4 weeks ago
github-actions[bot]	7fddfbdbbd	Version Packages (#18105) ... This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.55.4 ### Patch Changes - fix: never mark a child effect root as inert ([#18111](https://github.com/sveltejs/svelte/pull/18111)) - fix: reset context after waiting on blockers of `@const` expressions ([#18100](https://github.com/sveltejs/svelte/pull/18100)) - fix: keep flushing new eager effects ([#18102](https://github.com/sveltejs/svelte/pull/18102)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	4 weeks ago
Simon H	671fc2ea11	fix: never mark a child effect root as inert (#18111) ... A nested `$effect.root` was marked `INERT` during `pause_children`, which caused it to stay in that state indefinetly after the rest of the parent tree was destroyed. Consequently deriveds inside no longer update and cause warnings. This fixes it by not marking nested `$effect.root`s as inert, just like nested `$effect.root`s are not destryoed and instead become a new root. Fixes #18097	4 weeks ago
Simon H	0ed8c282f9	fix: reset context after waiting on blockers of `@const` expressions (#18100) ... Regression from #18039 - we need to have each await expression (and waiting on blockers is one) in its own entry of `(renderer.)run`. Else context is not restored correctly and if the synchronous expression afterwards requires it stuff breaks. Fixes #18098	4 weeks ago
Simon H	273f1a85a4	fix: keep flushing new eager effects (#18102) ... The previous code "swallowed" new additions to the array of eager effects that happened while flushing since `eager_flush` did not clear the array before running, only afterwards. Now it clears the beforehand, causing newly added eager effects to run, too. An example where this can happen is `$state.eager` and `$effect.pending` in combination: first `$state.eager` is flushed, then due to `flushSync` the `queue_micro_task` inside `boundary.js` that flushes `$effect.pending` is triggered synchronously, adding new entries to the `eager_versions` array. If they're only cleared at the end of `eager_flush`, new entries are swallowed. Related to #18095 (but not fixing it yet)	4 weeks ago
github-actions[bot]	4a50e8ea3b	Version Packages (#18085) ... This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.55.3 ### Patch Changes - fix: ensure proper HMR updates for dynamic components ([#18079](https://github.com/sveltejs/svelte/pull/18079)) - fix: correctly calculate `@const` blockers ([#18039](https://github.com/sveltejs/svelte/pull/18039)) - fix: freeze deriveds once their containing effects are destroyed ([#17921](https://github.com/sveltejs/svelte/pull/17921)) - fix: defer error boundary rendering in forks ([#18076](https://github.com/sveltejs/svelte/pull/18076)) - fix: avoid false positives for reactivity loss warning ([#18088](https://github.com/sveltejs/svelte/pull/18088)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	1 month ago
Simon H	15588f5fbf	fix: avoid false positives for reactivity loss warning (#18088) ... Avoids two categories of false positives for reactivity loss warning: 1. if you have synchronously read signals already as part of invoking the async_derived function, then it shouldn't warn when these signals are read after an await if we know they haven't changed (we check the write version for that) 2. `track_reactivity_loss` kept the `reactivity_loss_tracker` around indefinitely, both when invoking the async operation as well as when it's finished. The former is buggy because while the async operation happens unrelated reads as part of other reactivity work can happen, the latter is buggy because if it's the last in a chain of awaits it's kept around until the next async work starts. Fixes https://github.com/sveltejs/kit/issues/15654 --------- Co-authored-by: Rich Harris <rich.harris@vercel.com> Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>	1 month ago
Rich Harris	0e9e76f292	fix: freeze deriveds once their containing effects are destroyed (#17921) ... Per https://github.com/sveltejs/svelte/pull/17862#issuecomment-4049752548, this freezes the value of a derived if it was created inside a parent effect that is now destroyed. This prevents the sort of bug where a derived reads `foo.bar` even though `foo` is now `undefined`. If the derived is dirty, a warning will be printed. This PR also gets rid of some weirdness around `derived.parent` — it can only ever be an `Effect | null`, and there's no need for `get_derived_parent_effect`. Blocked on https://github.com/sveltejs/kit/pull/15533 and a follow-up that switches remote functions to use `$effect.root` (since this effectively undoes #17171), hence draft. ### Before submitting the PR, please make sure you do the following - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [x] Ideally, include a test that fails without this PR but passes with it. - [x] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint` --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>	1 month ago
Simon H	3937ec03bd	fix: correctly calculate `@const` blockers (#18039) ... Move the calculation of blockers into the analysis phase and then only push the right thunks in the transform phase - similar to how we already do it with top level `$.run` Fixes #18024 The solution is a tiny bit brittle (not much more than the top level one we already have) and I tried to make it a bit more robust but ended up in a rabbit hole in #18032 - we can revisit that solution once all the old stuff is gone. Until then this is the most pragmatic/non-invasive change. --------- Co-authored-by: Rich Harris <rich.harris@vercel.com>	1 month ago
Simon H	7be1a0247f	fix: ensure proper HMR updates for dynamic components (#18079) ... The BranchManager in `branches.js` does create a temporary anchor when creating a new branch offscreen, and deletes it once the branch is committed. Normally this is fine, but the combination of HMR and dynamic components leads to a bug: Since `svelte-component.js` passes the temporary anchor along to the component it generates, which is the HMR wrapper, this wrapper will have an obsolete, disconnected anchor on updates, leading to the content disappearing. The fix is to add a dev-only symbol which we set on the original (then obsolete) anchor to tell about the updated anchor that should be used for HMR updates. Fixes https://github.com/sveltejs/kit/issues/14699 Fixes #17211	1 month ago
Simon H	a4ce776070	fix: defer error boundary rendering in forks (#18076) ... RIght now, when an async error occurs inside a fork, the error UI will show immediately. This change defers the removal of the current content etc until the fork is committed. The BranchManager logic cannot be reused here since this is not about pending work, and we cannot wait for other pending work to complete if the fork commits. Instead, batches now have a "on fork commit" callback set which the boundary pushes to. The boundary's effects are skipped in the fork until it's committing, at which point we "resume" the error logic (calling onerror, transforming it, etc) Fixes #18060	1 month ago
Rich Harris	7796bac806	chore: dedupe dependencies (#18084)	1 month ago
dependabot[bot]	c712809ebd	chore(deps): bump vite from 5.4.20 to 7.3.2 (#18081) ... Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 5.4.20 to 7.3.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v7.3.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.3.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.3.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.7</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.7/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.6</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.5</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <p><em>Note: 7.2.5 failed to publish so it is skipped on npm</em></p> <h2>v7.2.4</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.4/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@7.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@7.2.1/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@7.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@7.2.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0-beta.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0-beta.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0-beta.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.1.12</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.1.12/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.1...v7.3.2">7.3.2</a> (2026-04-06)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>avoid path traversal with optimize deps sourcemap handler (<a href="https://redirect.github.com/vitejs/vite/issues/22161">#22161</a>) (<a href="09d8c903bd">09d8c90</a>)</li> <li>backport <a href="https://redirect.github.com/vitejs/vite/issues/22159">#22159</a>, apply server.fs check to env transport (<a href="https://redirect.github.com/vitejs/vite/issues/22162">#22162</a>) (<a href="19db0f29c3">19db0f2</a>)</li> <li>check <code>server.fs</code> after stripping query as well (<a href="https://redirect.github.com/vitejs/vite/issues/22160">#22160</a>) (<a href="f8103cc946">f8103cc</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.0...v7.3.1">7.3.1</a> (2026-01-07)<!-- raw HTML omitted --></h2> <h3>Features</h3> <ul> <li>add <code>ignoreOutdatedRequests</code> option to <code>optimizeDeps</code> (<a href="https://redirect.github.com/vitejs/vite/issues/21364">#21364</a>) (<a href="9d39d373a7">9d39d37</a>)</li> </ul> <h2><a href="https://github.com/vitejs/vite/compare/v7.2.7...v7.3.0">7.3.0</a> (2025-12-15)</h2> <h3>Features</h3> <ul> <li><strong>deps:</strong> update esbuild from ^0.25.0 to ^0.27.0 (<a href="https://redirect.github.com/vitejs/vite/issues/21183">#21183</a>) (<a href="cff26ec0fc">cff26ec</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.6...v7.2.7">7.2.7</a> (2025-12-08)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>plugin shortcut support (<a href="https://redirect.github.com/vitejs/vite/issues/21211">#21211</a>) (<a href="721f16343d">721f163</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.5...v7.2.6">7.2.6</a> (2025-12-01)<!-- raw HTML omitted --></h2> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.4...v7.2.5">7.2.5</a> (2025-12-01)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li><strong>config:</strong> handle shebang properly (<a href="https://redirect.github.com/vitejs/vite/issues/21158">#21158</a>) (<a href="df5a30d269">df5a30d</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21146">#21146</a>) (<a href="a3cd262f37">a3cd262</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21175">#21175</a>) (<a href="72e398a46d">72e398a</a>)</li> <li>fix <code>external: true</code> merging (<a href="https://redirect.github.com/vitejs/vite/issues/21164">#21164</a>) (<a href="5ef557a96c">5ef557a</a>)</li> <li>shortcuts not rebound after server restart (<a href="https://redirect.github.com/vitejs/vite/issues/21166">#21166</a>) (<a href="3765f7baea">3765f7b</a>)</li> </ul> <h3>Performance Improvements</h3> <ul> <li><strong>deps:</strong> replace debug with obug (<a href="https://redirect.github.com/vitejs/vite/issues/21137">#21137</a>) (<a href="203a5512a4">203a551</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>clarify manifest.json <code>imports</code> field is JS chunks only (<a href="https://redirect.github.com/vitejs/vite/issues/21136">#21136</a>) (<a href="46d3077f2b">46d3077</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21174">#21174</a>) (<a href="74559c9474">74559c9</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.3...v7.2.4">7.2.4</a> (2025-11-20)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>revert &quot;perf(deps): replace debug with obug (<a href="https://redirect.github.com/vitejs/vite/issues/21107">#21107</a>)&quot; (<a href="2d66b7b14a">2d66b7b</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.2...v7.2.3">7.2.3</a> (2025-11-20)<!-- raw HTML omitted --></h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="cc383e07b6"><code>cc383e0</code></a> release: v7.3.2</li> <li><a href="09d8c903bd"><code>09d8c90</code></a> fix: avoid path traversal with optimize deps sourcemap handler (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161">#22161</a>)</li> <li><a href="f8103cc946"><code>f8103cc</code></a> fix: check <code>server.fs</code> after stripping query as well (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22160">#22160</a>)</li> <li><a href="19db0f29c3"><code>19db0f2</code></a> fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159">#22159</a>, apply server.fs check to env transport (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22162">#22162</a>)</li> <li><a href="95e8923f35"><code>95e8923</code></a> release: v7.3.1</li> <li><a href="9d39d373a7"><code>9d39d37</code></a> feat: add <code>ignoreOutdatedRequests</code> option to <code>optimizeDeps</code> (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21364">#21364</a>)</li> <li><a href="acf7e05eae"><code>acf7e05</code></a> release: v7.3.0</li> <li><a href="cff26ec0fc"><code>cff26ec</code></a> feat(deps): update esbuild from ^0.25.0 to ^0.27.0 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21183">#21183</a>)</li> <li><a href="317b3b272f"><code>317b3b2</code></a> release: v7.2.7</li> <li><a href="721f16343d"><code>721f163</code></a> fix: plugin shortcut support (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21211">#21211</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v7.3.2/packages/vite">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/sveltejs/svelte/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	1 month ago
dependabot[bot]	582c57ceb8	chore(deps-dev): bump vite from 7.1.11 to 7.3.2 (#18074) ... Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 7.1.11 to 7.3.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v7.3.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.3.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.3.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.3.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.7</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.7/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.6</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.5</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <p><em>Note: 7.2.5 failed to publish so it is skipped on npm</em></p> <h2>v7.2.4</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.4/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@7.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@7.2.1/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@7.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@7.2.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0-beta.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0-beta.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.2.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.2.0-beta.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v7.1.12</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v7.1.12/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.1...v7.3.2">7.3.2</a> (2026-04-06)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>avoid path traversal with optimize deps sourcemap handler (<a href="https://redirect.github.com/vitejs/vite/issues/22161">#22161</a>) (<a href="09d8c903bd">09d8c90</a>)</li> <li>backport <a href="https://redirect.github.com/vitejs/vite/issues/22159">#22159</a>, apply server.fs check to env transport (<a href="https://redirect.github.com/vitejs/vite/issues/22162">#22162</a>) (<a href="19db0f29c3">19db0f2</a>)</li> <li>check <code>server.fs</code> after stripping query as well (<a href="https://redirect.github.com/vitejs/vite/issues/22160">#22160</a>) (<a href="f8103cc946">f8103cc</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.3.0...v7.3.1">7.3.1</a> (2026-01-07)<!-- raw HTML omitted --></h2> <h3>Features</h3> <ul> <li>add <code>ignoreOutdatedRequests</code> option to <code>optimizeDeps</code> (<a href="https://redirect.github.com/vitejs/vite/issues/21364">#21364</a>) (<a href="9d39d373a7">9d39d37</a>)</li> </ul> <h2><a href="https://github.com/vitejs/vite/compare/v7.2.7...v7.3.0">7.3.0</a> (2025-12-15)</h2> <h3>Features</h3> <ul> <li><strong>deps:</strong> update esbuild from ^0.25.0 to ^0.27.0 (<a href="https://redirect.github.com/vitejs/vite/issues/21183">#21183</a>) (<a href="cff26ec0fc">cff26ec</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.6...v7.2.7">7.2.7</a> (2025-12-08)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>plugin shortcut support (<a href="https://redirect.github.com/vitejs/vite/issues/21211">#21211</a>) (<a href="721f16343d">721f163</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.5...v7.2.6">7.2.6</a> (2025-12-01)<!-- raw HTML omitted --></h2> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.4...v7.2.5">7.2.5</a> (2025-12-01)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li><strong>config:</strong> handle shebang properly (<a href="https://redirect.github.com/vitejs/vite/issues/21158">#21158</a>) (<a href="df5a30d269">df5a30d</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21146">#21146</a>) (<a href="a3cd262f37">a3cd262</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21175">#21175</a>) (<a href="72e398a46d">72e398a</a>)</li> <li>fix <code>external: true</code> merging (<a href="https://redirect.github.com/vitejs/vite/issues/21164">#21164</a>) (<a href="5ef557a96c">5ef557a</a>)</li> <li>shortcuts not rebound after server restart (<a href="https://redirect.github.com/vitejs/vite/issues/21166">#21166</a>) (<a href="3765f7baea">3765f7b</a>)</li> </ul> <h3>Performance Improvements</h3> <ul> <li><strong>deps:</strong> replace debug with obug (<a href="https://redirect.github.com/vitejs/vite/issues/21137">#21137</a>) (<a href="203a5512a4">203a551</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>clarify manifest.json <code>imports</code> field is JS chunks only (<a href="https://redirect.github.com/vitejs/vite/issues/21136">#21136</a>) (<a href="46d3077f2b">46d3077</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/21174">#21174</a>) (<a href="74559c9474">74559c9</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.3...v7.2.4">7.2.4</a> (2025-11-20)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li>revert &quot;perf(deps): replace debug with obug (<a href="https://redirect.github.com/vitejs/vite/issues/21107">#21107</a>)&quot; (<a href="2d66b7b14a">2d66b7b</a>)</li> </ul> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v7.2.2...v7.2.3">7.2.3</a> (2025-11-20)<!-- raw HTML omitted --></h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="cc383e07b6"><code>cc383e0</code></a> release: v7.3.2</li> <li><a href="09d8c903bd"><code>09d8c90</code></a> fix: avoid path traversal with optimize deps sourcemap handler (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22161">#22161</a>)</li> <li><a href="f8103cc946"><code>f8103cc</code></a> fix: check <code>server.fs</code> after stripping query as well (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22160">#22160</a>)</li> <li><a href="19db0f29c3"><code>19db0f2</code></a> fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22159">#22159</a>, apply server.fs check to env transport (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22162">#22162</a>)</li> <li><a href="95e8923f35"><code>95e8923</code></a> release: v7.3.1</li> <li><a href="9d39d373a7"><code>9d39d37</code></a> feat: add <code>ignoreOutdatedRequests</code> option to <code>optimizeDeps</code> (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21364">#21364</a>)</li> <li><a href="acf7e05eae"><code>acf7e05</code></a> release: v7.3.0</li> <li><a href="cff26ec0fc"><code>cff26ec</code></a> feat(deps): update esbuild from ^0.25.0 to ^0.27.0 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21183">#21183</a>)</li> <li><a href="317b3b272f"><code>317b3b2</code></a> release: v7.2.7</li> <li><a href="721f16343d"><code>721f163</code></a> fix: plugin shortcut support (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21211">#21211</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v7.3.2/packages/vite">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/sveltejs/svelte/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	1 month ago
github-actions[bot]	2e29c87cc9	Version Packages (#18036) ... This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.55.2 ### Patch Changes - fix: invalidate `@const` tags based on visible references in legacy mode ([#18041](https://github.com/sveltejs/svelte/pull/18041)) - fix: handle parens in template expressions more robustly ([#18075](https://github.com/sveltejs/svelte/pull/18075)) - fix: disallow `--` in `idPrefix` ([#18038](https://github.com/sveltejs/svelte/pull/18038)) - fix: correct types for `ontoggle` on `<details>` elements ([#18063](https://github.com/sveltejs/svelte/pull/18063)) - fix: don't override `$destroy/set/on` instance methods in dev mode ([#18034](https://github.com/sveltejs/svelte/pull/18034)) - fix: unskip branches of earlier batches after commit ([#18048](https://github.com/sveltejs/svelte/pull/18048)) - fix: never set derived.v inside fork ([#18037](https://github.com/sveltejs/svelte/pull/18037)) - fix: skip rebase logic in non-async mode ([#18040](https://github.com/sveltejs/svelte/pull/18040)) - fix: don't reset status of uninitialized deriveds ([#18054](https://github.com/sveltejs/svelte/pull/18054)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	1 month ago
Rich Harris	6b653b8d17	chore: simplify parser (#18077) ... small tidy-up spurred by #17954 — rather than try-catching every `parse_expression_at` call and passing the error to `parser.acorn_error`, we can handle the error locally and get rid of that method ### Before submitting the PR, please make sure you do the following - [ ] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [ ] Ideally, include a test that fails without this PR but passes with it. - [ ] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint` --------- Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>	1 month ago
Rich Harris	8966601dcd	fix: handle parens in template expressions more robustly (#18075) ... While looking into #17954 I realised that a) our code for handling parentheses in expressions is unnecessarily convoluted and b) it doesn't handle the case where you have an opening parent outside the first comment — this fails to parse: ```svelte {(/**/ 42)} ``` This fixes it and simplifies the code a good bit. ### Before submitting the PR, please make sure you do the following - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [x] This message body should clearly illustrate what problems it solves. - [x] Ideally, include a test that fails without this PR but passes with it. - [x] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint`	1 month ago
Simon H	0395ef0df7	fix: unskip branches of earlier batches after commit (#18048) ... Fixes #17571 where the situation is the following: A derived creates a new query. That query initializes loading with true. This means the if block is marked for destruction (therefore effects inside branch are skipped), but it's not doing that yet because the query promise is pending. Then query resolves and loading is set back to false right before resolving, but it's not the same tick so `loading=false` is a separate thing. Because that later batch doesn't see any overlap with an earlier batch (the earlier batch did set loading to true but not via set but indirectly via recreating the query) it doesn't wait on it and flushes right away. Now the if block is marked as visible again but the earlier batch doesn't know that if noone unskips its branch. If we don't do that the render effect that is now dirty as part of that batch will not run.	1 month ago
Rich Harris	cd5bda00a8	chore: fix changeset (#18073) ... prevents the changelog from getting borked up	1 month ago
Simon H	d86cb5cc32	fix: skip rebase logic in non-async mode (#18040) ... Fixes part of #17940 (the hydration->error thing still needs a repro). Essentially in sync mode render effects are executed during traversing the effect tree, and when flushSync is called during that it can cause the timing of things getting out of sync such that you end up wanting to rebase another branch, which is never needed in sync mode. So we just skip that logic in sync mode. Another way would be to adjust flushSync such that it does appends itself to the end of the current flushing cycle if it notices processing is already ongoing. This will not work when you pass a callback function to `flushSync` though - another indicator that we should probably remove that callback argument. --------- Co-authored-by: Rich Harris <rich.harris@vercel.com> Co-authored-by: Rich Harris <hello@rich-harris.dev>	1 month ago
Simon H	adba758067	fix: don't reset status of uninitialized deriveds (#18054) ... If a new branch is created (e.g. if block becomes truthy) inside a fork and a derived is read inside the new branch for the first time, it will get reactions but its true value will stay uninitialized due to the fork. If the fork then commits, it will NOT change its value because it will not reexecute: there is no effect running after commit telling it to do that, because it was only read inside new effects which already ran while still inside the fork. Now, when that branch is removed (e.g. if block becomes falsy), the derived loses its reactions again and becomes disconnected, at which point the status is reset. So we end up with a maybe_dirty or clean derived and an uninitialized value, causing breakage if it's called again afterwards. The fix is to not reset the status in this case. Fixes https://github.com/sveltejs/kit/issues/15126 Fixes https://github.com/sveltejs/kit/issues/15318 Fixes https://github.com/sveltejs/kit/issues/15061	1 month ago
ottomated	14adb8caa9	fix: correct types for `ontoggle` on <details> elements (#18063) ... `<details>` elements fire `ontoggle` as ToggleEvents ([source](https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/toggle_event)), but they're currently just typed as Event. ### Before submitting the PR, please make sure you do the following - [ ] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] Prefix your PR title with `feat:`, `fix:`, `chore:`, or `docs:`. - [ ] This message body should clearly illustrate what problems it solves. - [ ] Ideally, include a test that fails without this PR but passes with it. - [x] If this PR changes code within `packages/svelte/src`, add a changeset (`npx changeset`). ### Tests and linting - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint`	1 month ago
Matia	7a2a17557c	docs: add CSS custom properties section to style directive (#18065) ... Adds documentation for using CSS custom properties with the `style:` directive. I think this was lost at some point during the great transition. It's only mentioned in the [best practices](https://svelte.dev/docs/svelte/best-practices#Using-JavaScript-variables-in-CSS) section, so I thought it would make sense to include it.	1 month ago
Rich Harris	f8ef6de325	chore: squelch hydration warnings in tests (#18046) ... Gets rid of some annoying console spam. I don't totally understand why `warnings` isn't populated by the time the assertions happen (it seems to happen just afterwards, except if I sleep for a few milliseconds and then do the assertion the warnings get swallowed altogether?) but for right now I don't much care	1 month ago
Rich Harris	8ee2169609	chore: improve benchmarks (#18061) ... This makes the benchmarks slightly more honest — it adds the async flag, and a benchmark that tests the (common) scenario where most effects are clean. Relevant to #18035, will self-merge so we can do a fresh comparison	1 month ago
Rich Harris	206974a5cd	chore: generate markdown tables of CPU profiles (#18059) ... extracted from #18035 — this should have been part of #18047 but I missed it off, oops. Will self-merge so it doesn't get in the way of #18035, and because the `performance-investigation` skill is predicated on this code existing --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>	1 month ago
Rich Harris	a9530e5330	chore: add labels to more internal deriveds (#18050) ... tiny QoL thing	1 month ago