You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In the Svelte 5 (runes) variant of useAskable, focus and clear event listeners are registered synchronously during module initialization — not inside a lifecycle hook. There is no corresponding cleanup, so if the component unmounts, listeners remain on the context indefinitely.
Root cause
packages/svelte/src/useAskable.svelte.ts:
letfocus: AskableFocus|null=$state(null);ctx.on('focus',(f)=>{focus=f;});// registered at init, never removedctx.on('clear',()=>{focus=null;});// registered at init, never removedif(options?.observe!==false){ctx.observe(document,observeOpts);}
Unlike the store-based Svelte implementation which returns a destroy() function, the runes variant has no teardown path at all.
Expected behavior
Listeners should be registered in an effect with proper cleanup, or the function should return a destroy() handle the caller is responsible for calling.
Activity
fix: audit fixes for sanitizer leaks, context cleanup, and listener t…