Skip to content

fix(deps): update dependency svelte to v5.46.4 [security]#15220

Merged
florian-lefebvre merged 1 commit intomainfrom
renovate/npm-svelte-vulnerability
Jan 21, 2026
Merged

fix(deps): update dependency svelte to v5.46.4 [security]#15220
florian-lefebvre merged 1 commit intomainfrom
renovate/npm-svelte-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jan 15, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
svelte (source) ^4.2.20 → ^5.0.0 age confidence
svelte (source) 5.46.1 → 5.46.4 age confidence

GitHub Vulnerability Alerts

CVE-2025-15265

Summary

An XSS vulnerability exists in Svelte 5.46.0-2 resulting from improper escaping of hydratable keys. If these keys incorporate untrusted user input, arbitrary JavaScript can be injected into server-rendered HTML.

Details

When using the hydratable function, the first argument is used as a key to uniquely identify the data, such that the value is not regenerated in the browser.

This key is embedded into a <script> block in the server-rendered <head> without escaping unsafe characters. A malicious key can break out of the script context and inject arbitrary JavaScript into the HTML response.

Impact

This is a cross-site scripting vulnerability affecting applications that have the experimental.async flag enabled and use hydratable with keys incorporating untrusted user input.

  • Impact: Arbitrary JS execution in the client’s browser.
  • Exploitability: Remote, single-request if key is attacker-controlled.
  • Typical Outcomes:
    • Session/token theft
    • DOM defacement
    • CSRF bypass via injected JS
    • Account takeover depending on cookie/session strategy

Affected applications should upgrade to a patched version immediately.

Release Notes

sveltejs/svelte (svelte)

v5.46.4

Compare Source

Patch Changes

v5.46.3

Compare Source

Patch Changes

  • fix: reconnect clean deriveds when they are read in a reactive context (#​17362)

  • fix: don't transform references of function declarations in legacy mode (#​17431)

  • fix: notify deriveds of changes to sources inside forks (#​17437)

  • fix: always reconnect deriveds in get, when appropriate (#​17451)

  • fix: prevent derives without dependencies from ever re-running (286b40c4526ce9970cb81ddd5e65b93b722fe468)

  • fix: correctly update writable deriveds inside forks (#​17437)

  • fix: remove $inspect calls after await expressions when compiling for production server code (#​17407)

  • fix: clear batch between runs (#​17424)

  • fix: adjust loc property of Program nodes created from <script> elements (#​17428)

  • fix: don't revert source to UNINITIALIZED state when time travelling (#​17409)

v5.46.1

Compare Source

Patch Changes

  • fix: type currentTarget in on function (#​17370)

  • fix: skip static optimisation for stateless deriveds after await (#​17389)

  • fix: prevent infinite loop when HMRing a component with an await (#​17380)

v5.46.0

Compare Source

Minor Changes
  • feat: Add csp option to render(...), and emit hashes when using hydratable (#​17338)

v5.45.10

Compare Source

Patch Changes
  • fix: race condition when importing AsyncLocalStorage (#​17350)

v5.45.9

Compare Source

Patch Changes

  • fix: correctly reschedule deferred effects when reviving a batch after async work (#​17332)

  • fix: correctly print !doctype during print (#​17341)

v5.45.8

Compare Source

Patch Changes

  • fix: set AST root.start to 0 and root.end to template.length (#​17125)

  • fix: prevent erroneous state_referenced_locally warnings on prop fallbacks (#​17329)

v5.45.7

Compare Source

Patch Changes

  • fix: Add <textarea wrap="off"> as a valid attribute value (#​17326)

  • fix: add more css selectors to print() (#​17330)

  • fix: don't crash on hydratable serialization failure (#​17315)

v5.45.6

Compare Source

Patch Changes

  • fix: don't issue a11y warning for <video> without captions if it has no src (#​17311)

  • fix: add srcObject to permitted <audio>/<video> attributes (#​17310)

v5.45.5

Compare Source

Patch Changes

  • fix: correctly reconcile each blocks after outroing branches are resumed (#​17258)

  • fix: destroy each items after siblings are resumed (#​17258)

v5.45.4

Compare Source

Patch Changes

  • chore: move DOM-related effect properties to effect.nodes (#​17293)

  • fix: allow $props.id() to occur after an await (#​17285)

  • fix: keep reactions up to date even when read outside of effect (#​17295)

v5.45.3

Compare Source

Patch Changes

  • add props to state_referenced_locally (#​17266)

  • fix: preserve node locations for better sourcemaps (#​17269)

  • fix: handle cross-realm Promises in hydratable (#​17284)

v5.45.2

Compare Source

Patch Changes

  • fix: array destructuring after await (#​17254)

  • fix: throw on invalid {@&#8203;tag}s (#​17256)

v5.45.1

Compare Source

Patch Changes
  • fix: link offscreen items and last effect in each block correctly (#​17240)

v5.45.0

Compare Source

Minor Changes

v5.44.1

Compare Source

Patch Changes

  • fix: await blockers before initialising const (#​17226)

  • fix: link offscreen items and last effect in each block correctly (#​17244)

  • fix: generate correct code for simple destructurings (#​17237)

  • fix: ensure each block animations don't mess with transitions (#​17238)

v5.44.0

Compare Source

Minor Changes

v5.43.15

Compare Source

Patch Changes

  • fix: don't execute attachments and attribute effects eagerly (#​17208)

  • chore: lift "flushSync cannot be called in effects" restriction (#​17139)

  • fix: store forked derived values (#​17212)

v5.43.14

Compare Source

Patch Changes

  • fix: correctly migrate named self closing slots (#​17199)

  • fix: error at compile time instead of at runtime on await expressions inside bindings/transitions/animations/attachments (#​17198)

  • fix: take async blockers into account for bindings/transitions/animations/attachments (#​17198)

v5.43.13

Compare Source

Patch Changes
  • fix: don't set derived values during time traveling (#​17200)

v5.43.12

Compare Source

Patch Changes
  • fix: maintain correct linked list of effects when updating each blocks (#​17191)

v5.43.11

Compare Source

Patch Changes

  • perf: don't use tracing overeager during dev (#​17183)

  • fix: don't cancel transition of already outroing elements (#​17186)

v5.43.10

Compare Source

Patch Changes
  • fix: avoid other batches running with queued root effects of main batch (#​17145)

v5.43.9

Compare Source

Patch Changes

  • fix: correctly handle functions when determining async blockers (#​17137)

  • fix: keep deriveds reactive after their original parent effect was destroyed (#​17171)

  • fix: ensure eager effects don't break reactions chain (#​17138)

  • fix: ensure async @const in boundary hydrates correctly (#​17165)

  • fix: take blockers into account when creating #await blocks (#​17137)

  • fix: parallelize async @consts in the template (#​17165)

v5.43.8

Compare Source

Patch Changes
  • fix: each block losing reactivity when items removed while promise pending (#​17150)

v5.43.7

Compare Source

Patch Changes

  • fix: properly defer document title until async work is complete (#​17158)

  • fix: ensure deferred effects can be rescheduled later on (#​17147)

  • fix: take blockers of components into account (#​17153)

v5.43.6

Compare Source

Patch Changes
  • fix: don't deactivate other batches (#​17132)

v5.43.5

Compare Source

Patch Changes

  • fix: ensure async static props/attributes are awaited (#​17120)

  • fix: wait on dependencies of async bindings (#​17120)

  • fix: await dependencies of style directives (#​17120)

v5.43.4

Compare Source

Patch Changes

  • chore: simplify connection/disconnection logic (#​17105)

  • fix: reconnect deriveds to effect tree when time-travelling (#​17105)

v5.43.3

Compare Source

Patch Changes

  • fix: ensure fork always accesses correct values (#​17098)

  • fix: change title only after any pending work has completed (#​17061)

  • fix: preserve symbols when creating derived rest properties (#​17096)

v5.43.2

Compare Source

Patch Changes
  • fix: treat each blocks with async dependencies as uncontrolled (#​17077)

v5.43.1

Compare Source

Patch Changes
  • fix: transform $bindable after await expressions (#​17066)

v5.43.0

Compare Source

Minor Changes
Patch Changes
  • fix: settle batch after DOM updates (#​17054)

v5.42.3

Compare Source

Patch Changes

  • fix: handle <svelte:head> rendered asynchronously (#​17052)

  • fix: don't restore batch in #await (#​17051)

v5.42.2

Compare Source

Patch Changes

  • fix: better error message for global variable assignments (#​17036)

  • chore: tweak memoizer logic (#​17042)

v5.42.1

Compare Source

Patch Changes
  • fix: ignore fork discard() after commit() (#​17034)

v5.42.0

Compare Source

Minor Changes
Patch Changes

  • fix: always allow setContext before first await in component (#​17031)

  • fix: less confusing names for inspect errors (#​17026)

v5.41.4

Compare Source

Patch Changes

  • fix: take into account static blocks when determining transition locality (#​17018)

  • fix: coordinate mount of snippets with await expressions (#​17021)

  • fix: better optimization of await expressions (#​17025)

  • fix: flush pending changes after rendering failed snippet (#​16995)

v5.41.3

Compare Source

Patch Changes

  • chore: exclude vite optimized deps from stack traces (#​17008)

  • perf: skip repeatedly traversing the same derived (#​17016)

v5.41.2

Compare Source

Patch Changes

  • fix: keep batches alive until all async work is complete (#​16971)

  • fix: don't preserve reactivity context across function boundaries (#​17002)

  • fix: make $inspect logs come from the callsite (#​17001)

  • fix: ensure guards (eg. if, each, key) run before their contents (#​16930)

v5.41.1

Compare Source

Patch Changes

  • fix: place let: declarations before {@&#8203;const} declarations (#​16985)

  • fix: improve each_key_without_as error (#​16983)

  • chore: centralise branch management (#​16977)

v5.41.0

Compare Source

Minor Changes
  • feat: add $state.eager(value) rune (#​16849)
Patch Changes

  • fix: preserve <select> state while focused (#​16958)

  • chore: run boundary async effects in the context of the current batch (#​16968)

  • fix: error if each block has key but no as clause (#​16966)

v5.40.2

Compare Source

Patch Changes
  • fix: add hydration markers in pending branch of SSR boundary (#​16965)

v5.40.1

Compare Source

Patch Changes
  • chore: Remove sync-in-async warning for server rendering (#​16949)

v5.40.0

Compare Source

Minor Changes
  • feat: add createContext utility for type-safe context (#​16948)
Patch Changes

  • chore: simplify batch.apply() (#​16945)

  • fix: don't rerun async effects unnecessarily (#​16944)

v5.39.13

Compare Source

Patch Changes

  • fix: add missing type for fr attribute for radialGradient tags in svg (#​16943)

  • fix: unset context on stale promises (#​16935)

v5.39.12

Compare Source

Patch Changes

  • fix: better input cursor restoration for bind:value (#​16925)

  • fix: track the user's getter of bind:this (#​16916)

  • fix: generate correct SSR code for the case where pending is an attribute (#​16919)

  • fix: generate correct code for each blocks with async body (#​16923)

v5.39.11

Compare Source

Patch Changes
  • fix: flush batches whenever an async value resolves (#​16912)

v5.39.10

Compare Source

Patch Changes

  • fix: hydrate each blocks inside element correctly (#​16908)

  • fix: allow await in if block consequent and alternate (#​16890)

  • fix: don't replace rest props with $$props for excluded props (#​16898)

  • fix: correctly transform $derived private fields on server (#​16894)

  • fix: add UNKNOWN evaluation value before breaking for binding.initial===SnippetBlock (#​16910)

v5.39.9

Compare Source

Patch Changes
  • fix: flush when pending boundaries resolve (#​16897)

v5.39.8

Compare Source

Patch Changes

  • fix: check boundary pending attribute at runtime on server (#​16855)

  • fix: preserve tuple type in $state.snapshot (#​16864)

  • fix: allow await in svelte:boundary without pending (#​16857)

  • fix: update bind:checked error message to clarify usage with radio inputs (#​16874)

v5.39.7

Compare Source

Patch Changes

  • chore: simplify batch logic (#​16847)

  • fix: rebase pending batches when other batches are committed (#​16866)

  • fix: wrap async children in $$renderer.async (#​16862)

  • fix: silence label warning for buttons and anchor tags with title attributes (#​16872)

  • fix: coerce nullish <title> to empty string (#​16863)

v5.39.6

Compare Source

Patch Changes

  • fix: depend on reads of deriveds created within reaction (async mode) (#​16823)

  • fix: SSR regression of processing attributes of <select> and <option> (#​16821)

  • fix: async class: + spread attributes were compiled into sync server-side code (#​16834)

  • fix: ensure tick resolves within a macrotask (#​16825)

v5.39.5

Compare Source

Patch Changes

  • fix: allow {@&#8203;html await ...} and snippets with async content on the server (#​16817)

  • fix: use nginx SSI-compatible comments for $props.id() (#​16820)

v5.39.4

Compare Source

Patch Changes
  • fix: restore hydration state after await in <script> (#​16806)

v5.39.3

Compare Source

Patch Changes

v5.39.2

Compare Source

Patch Changes

  • fix: preserve SSR context when block expressions contain await (#​16791)

  • chore: bump some devDependencies (#​16787)

v5.39.1

Compare Source

Patch Changes

  • fix: add missing type for fr attribute for radialGradient tags in svg (#​16943)

  • fix: unset context on stale promises (#​16935)

v5.39.0

Compare Source

Minor Changes
Patch Changes
  • fix: correctly SSR hidden="until-found" (#​16773)

v5.38.10

Compare Source

Patch Changes
  • fix: flush effects scheduled during boundary's pending phase (#​16738)

v5.38.9

Compare Source

Patch Changes

  • chore: generate CSS hash using the filename (#​16740)

  • fix: correctly analyze <object.property> components (#​16711)

  • fix: clean up scheduling system (#​16741)

  • fix: transform input defaults from spread (#​16481)

  • fix: don't destroy contents of svelte:boundary unless the boundary is an error boundary (#​16746)

v5.38.8

Compare Source

Patch Changes
  • fix: send $effect.pending count to the correct boundary (#​16732)

v5.38.7

Compare Source

Patch Changes

  • fix: replace undefined with void(0) in CallExpressions (#​16693)

  • fix: ensure batch exists when resetting a failed boundary (#​16698)

  • fix: place store setup inside async body (#​16687)

v5.38.6

Compare Source

Patch Changes
  • fix: don't fail on flushSync while flushing effects (#​16674)

v5.38.5

Compare Source

Patch Changes
  • fix: ensure async deriveds always get dependencies from thennable (#​16672)

v5.38.3

Compare Source

Patch Changes

  • fix: ensure correct order of template effect values (#​16655)

  • fix: allow async {@&#8203;const} in more places (#​16643)

  • fix: properly catch top level await errors (#​16619)

  • perf: prune effects without dependencies (#​16625)

  • fix: only emit for_await_track_reactivity_loss in async mode (#​16644)

v5.38.2

Compare Source

Patch Changes

  • perf: run blocks eagerly during flush instead of aborting (#​16631)

  • fix: don't clone non-proxies in $inspect (#​16617)

  • fix: avoid recursion error when tagging circular references (#​16622)

v5.38.1

Compare Source

Patch Changes
  • fix: flush effects scheduled during boundary's pending phase (#​16738)

v5.38.0

Compare Source

Minor Changes
  • feat: allow await inside @const declarations (#​16542)
Patch Changes

  • fix: remount at any hydration error (#​16248)

  • chore: emit await_reactivity_loss in for await loops (#​16521)

  • fix: emit snippet_invalid_export instead of undefined_export for exported snippets (#​16539)

v5.37.3

Compare Source

Patch Changes
  • fix: reset attribute cache after setting corresponding property (#​16543)

v5.37.2

Compare Source

Patch Changes

  • fix: double event processing in firefox due to event object being garbage collected (#​16527)

  • fix: add bindable dimension attributes types to SVG and MathML elements (#​16525)

  • fix: correctly differentiate static fields before emitting duplicate_class_field (#​16526)

  • fix: prevent last_propagated_event from being DCE'd (#​16538)

v5.37.1

Compare Source

Patch Changes

  • chore: remove some todos (#​16515)

  • fix: allow await expressions inside {#await ...} argument (#​16514)

  • fix: append_styles in an effect to make them available on mount (#​16509)

  • chore: remove parser.template_untrimmed (#​16511)

  • fix: always inject styles when compiling as a custom element (#​16509)

v5.37.0

Compare Source

Minor Changes
  • feat: ignore component options in compileModule (#​16362)
Patch Changes
  • fix: always mark props as stateful (#​16504)

v5.36.17

Compare Source

Patch Changes

  • fix: throw on duplicate class field declarations (#​16502)

  • fix: add types for part attribute to svg attributes (#​16499)

v5.36.16

Compare Source

Patch Changes

  • fix: don't update a focused input with values from its own past (#​16491)

  • fix: don't destroy effect roots created inside of deriveds (#​16492)

v5.36.15

Compare Source

Patch Changes
  • fix: preserve dirty status of deferred effects (#​16487)

v5.36.14

Compare Source

Patch Changes

  • fix: keep input in sync when binding updated via effect (#​16482)

  • fix: rename form accept-charset attribute (#​16478)

  • fix: prevent infinite async loop (#​16482)

  • fix: exclude derived writes from effect abort and rescheduling (#​16482)

v5.36.13

Compare Source

Patch Changes
  • fix: ensure subscriptions are picked up correctly by deriveds (#​16466)

v5.36.12

Compare Source

Patch Changes
  • chore: move capture_signals to legacy module (#​16456)

v5.36.10

Compare Source

Patch Changes
  • fix: prevent batches from getting intertwined (#​16446)

v5.36.9

Compare Source

Patch Changes

  • fix: don't reexecute derived with no dependencies on teardown (#​16438)

  • fix: disallow export { foo as default } in <script module> (#​16447)

  • fix: move ownership validation into async component body (#​16449)

  • fix: allow async destructured deriveds (#​16444)

  • fix: move store setup/cleanup outside of async component body (#​16443)

v5.36.8

Compare Source

Patch Changes

  • fix: keep effect in the graph if it has an abort controller (#​16430)

  • chore: Switch payload.out to an array (#​16428)

v5.36.7

Compare Source

Patch Changes
  • fix: allow instrinsic <svelte:...> elements to inherit from SvelteHTMLElements (#​16424)

v5.36.6

Compare Source

Patch Changes

  • fix: delegate functions with shadowed variables if declared locally (#​16417)

  • fix: handle error in correct boundary after reset (#​16171)

  • fix: make <svelte:boundary> reset function a noop after the first call (#​16171)

v5.36.5

Compare Source

Patch Changes

  • fix: silence $inspect errors when the effect is about to be destroyed (#​16391)

  • fix: more informative error when effects run in an infinite loop (#​16405)

v5.36.4

Compare Source

Patch Changes

  • fix: avoid microtask in flushSync (#​16394)

  • fix: ensure compiler state is reset before compilation (#​16396)

v5.36.3

Compare Source

Patch Changes

  • fix: don't log await_reactivity_loss warning when signal is read in untrack (#​16385)

  • fix: better handle $inspect on array mutations (#​16389)

  • fix: leave proxied array length untouched when deleting properties (#​16389)

  • fix: update $effect.pending() immediately after a batch is removed (#​16382)

v5.36.2

Compare Source

Patch Changes

  • fix: add $effect.pending() to types (#​16376)

  • fix: add pending snippet to <svelte:boundary> types (#​16379)

v5.36.1

Compare Source

Patch Changes

  • fix: throw on duplicate class field declarations (#​16502)

  • fix: add types for part attribute to svg attributes (#​16499)

v5.36.0

Compare Source

Minor Changes
  • feat: support await in components when using the experimental.async compiler option (#​15844)
Patch Changes

  • fix: silence a11y warning for inert elements (#​16339)

  • chore: clean up a11y analysis code (#​16345)

v5.35.7

Compare Source

Patch Changes

  • fix: silence autofocus a11y warning inside <dialog> (#​16341)

  • fix: don't show adjusted error messages in boundaries (#​16360)

  • chore: replace inline regex with variable (#​16340)

v5.35.6

Compare Source

Patch Changes

  • chore: simplify reaction/source ownership tracking (#​16333)

  • chore: simplify internal component pop() (#​16331)

v5.35.5

Compare Source

Patch Changes

  • fix: associate sources in Spring/Tween/SvelteMap/SvelteSet with correct reaction (#​16325)

  • fix: re-evaluate derived props during teardown (#​16278)

v5.35.4

Compare Source

Patch Changes
  • fix: abort and reschedule effect processing after state change in user effect (#​16280)

v5.35.3

Compare Source

Patch Changes

  • fix: account for mounting when select_option in attribute_effect (#​16309)

  • fix: do not proxify the value assigned to a derived (#​16302)

v5.35.2

Compare Source

Patch Changes

v5.35.1

Compare Source

Patch Changes
  • feat: add parent hierarchy to __svelte_meta objects (#​16255)

v5.35.0

Compare Source

Minor Changes
Patch Changes

v5.34.9

Compare Source

Patch Changes
  • fix: ensure unowned deriveds can add themselves as reactions while connected (#​16249)

v5.34.8

Compare Source

Patch Changes

  • fix: untrack $inspect.with and add check for unsafe mutation (#​16209)

  • fix: use fine grained for template if the component is not explicitly in legacy mode (#​16232)

  • lift unsafe_state_mutation constraints for SvelteSet, SvelteMap, SvelteDate, SvelteURL and SvelteURLSearchParams created inside the derived (#​16221)

[v5.34.7](https://redirect.github.com/sveltejs/svelte/blob/HEAD/packages/svelte/CHANGELOG.md#5347

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Jan 15, 2026
@changeset-bot
Copy link

changeset-bot bot commented Jan 15, 2026 •
edited
Loading

⚠️ No Changeset found

Latest commit: 0a857dc

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions github-actions bot added pkg: svelte Related to Svelte (scope) pkg: integration Related to any renderer integration (scope) labels Jan 15, 2026
@renovate renovate bot force-pushed the renovate/npm-svelte-vulnerability branch 3 times, most recently from a2bb5c8 to 5c42d73 Compare January 19, 2026 09:21
@renovate renovate bot changed the title fix(deps): update dependency svelte to v5.46.4 [security] fix(deps): update dependency svelte to v5.46.4 [security] - autoclosed Jan 19, 2026
@renovate renovate bot closed this Jan 19, 2026
@renovate renovate bot deleted the renovate/npm-svelte-vulnerability branch January 19, 2026 13:12
@renovate renovate bot changed the title fix(deps): update dependency svelte to v5.46.4 [security] - autoclosed fix(deps): update dependency svelte to v5.46.4 [security] Jan 20, 2026
@renovate renovate bot reopened this Jan 20, 2026
@renovate renovate bot force-pushed the renovate/npm-svelte-vulnerability branch 2 times, most recently from 5c42d73 to 1af2cba Compare January 20, 2026 10:31
@renovate renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from 1af2cba to 0a857dc Compare January 20, 2026 13:22
florian-lefebvre
florian-lefebvre reviewed Jan 21, 2026
View reviewed changes
packages/language-tools/language-server/test/package.json
"@astrojs/vue": "workspace:*",
"astro": "workspace:*",
"svelte": "^4.2.20"
"svelte": "^5.0.0"
Copy link
Member

@florian-lefebvre florian-lefebvre Jan 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Princesseuh do you know if this was on v4 on purpose? Or is upgrading to v5 safe?

Copy link
Member

@Princesseuh Princesseuh Jan 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's just used for tests, so probably that Svelte 5 didn't exist when I made this, ha. Should be safe to upgrade

@florian-lefebvre florian-lefebvre merged commit 80fb286 into main Jan 21, 2026
25 checks passed
florian-lefebvre added a commit that referenced this pull request Jan 22, 2026
@florian-lefebvre @renovate
@github-actions @ematipico @ascorbic @matthewp @Princesseuh @sarah11918 @ArmandPhilippot @Fryuni @HiDeoo @delucis @antonyfaris @astrobot-houston @volpeon @martrapp @fkatsuhiro @OliverSpeir @deining @gameroman @fabon-f @Raanelom @rahuld109 @43081j @eureka928 @cameronraysmith @rururux @jcayzac @drwpow @MkDev11 @aprici7y @Slackluky @btea @ixchio @simensfo @lamalex @kedarvartak @NAM-MAN @CloudyWSA @webstackdev
Merge main into next (#15276)
0f16291 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Emanuele Stoppa <[email protected]>
Co-authored-by: Matt Kane <[email protected]>
Co-authored-by:  Matthew Phillips <[email protected]>
Co-authored-by: Matthew Phillips <[email protected]>
Co-authored-by: Florian Lefebvre <[email protected]>
Co-authored-by: Erika <[email protected]>
Co-authored-by: Sarah Rainsberger <[email protected]>
Co-authored-by: Armand Philippot <[email protected]>
Co-authored-by: matthewp <[email protected]>
Co-authored-by: florian-lefebvre <[email protected]>
Co-authored-by: ematipico <[email protected]>
Co-authored-by: Luiz Ferraz <[email protected]>
Co-authored-by: HiDeoo <[email protected]>
Co-authored-by: Princesseuh <[email protected]>
Co-authored-by: Chris Swithinbank <[email protected]>
Co-authored-by: Antony Faris <[email protected]>
Co-authored-by: Erika <[email protected]>
Co-authored-by: Houston (Bot) <[email protected]>
Co-authored-by: Florian Lefebvre <[email protected]>
Co-authored-by: Volpeon <[email protected]>
Co-authored-by: Martin Trapp <[email protected]>
Co-authored-by: fkatsuhiro <[email protected]>
Co-authored-by: Oliver Speir <[email protected]>
Co-authored-by: Andreas Deininger <[email protected]>
Co-authored-by: Roman <[email protected]>
Co-authored-by: fabon <[email protected]>
Co-authored-by: Raanelom <[email protected]>
Co-authored-by: Rahul Dogra <[email protected]>
Co-authored-by: James Garbutt <[email protected]>
Co-authored-by: Pegasus <[email protected]>
Co-authored-by: Cameron Smith <[email protected]>
Co-authored-by: Martin Trapp <[email protected]>
Co-authored-by: Rafael ヤスヒデ 須藤 <[email protected]>
Co-authored-by: Matthew Phillips <[email protected]>
Co-authored-by: Julien Cayzac <[email protected]>
Co-authored-by: Drew Powers <[email protected]>
Co-authored-by: Emanuele Stoppa <[email protected]>
Co-authored-by: MkDev11 <[email protected]>
Co-authored-by: andy <[email protected]>
Co-authored-by: Luky Setiawan <[email protected]>
Co-authored-by: btea <[email protected]>
Co-authored-by: cid <[email protected]>
Co-authored-by: Simen Sagholen Førrisdal <[email protected]>
Co-authored-by: Alex Launi <[email protected]>
Co-authored-by: Kedar Vartak <[email protected]>
Co-authored-by: yy <[email protected]>
Co-authored-by: Matheus Baroni <[email protected]>
Co-authored-by: Kevin Brown <[email protected]>
fix(ci): Reinstall deps after having published VS Code (#14996)
fix(svelte): allow client directives (#15004)
fix(assets): Fixes missing format option for svgs in the passthrough service (#14987)
fix(deps): update all non-major dependencies (#15020)
fix(content-layer): Try a smarter solution to normalize bare image paths in JSON (#15028)
fix(astro): assets vite build log (#15034)
resolved (#15033)
fix: Remote images: Prevent internal caching from interfering with Astro's cache (#14954)
fix(deps): update astro adapters (#15084)
fix(deps): update all non-major dependencies (#15072)
fix(deps): update astro client runtimes (#15085)
fix: move ts-plugin node_modules to dist (#15083)
fix: components imports paths (#15107)
fix(assets): Use Vite's isFileLoadingAllowed to check if a file can be loaded (#15052)
fix(vscode): Correctly handle TypeScript blocks ending with types (#15109)
fix(svelte): improve Svelte children prop type checking (#15070)
fix Firefox e2e tests for playwright 1.57 (#15113)
fix(deps): update astro dependencies (#15103)
fix: lint vt test (#15114)
fix(deps): update language tools (#15104)
resolver abstraction (#15111)
fix(vue): add HTML attributes to generated TypeScript types (#15016)
Fixes #14686
fix(vscode): Don't update @types/vscode automatically (#15131)
fix: adjust page warning to only show up in more relevant times (#15127)
fix(dev): preserve query params when base path is stripped (#15124)
fix(assets): hoist ?? inside JSON.stringify in virtual module codegen (#15140)
fix(toolbar): skip image audit for framework components (#15149)
Fixes #15048
fix: Accept setCookie from both context and headers (#15152)
fix(ci): Move ts-plugin-bundle to node_modules after recreating node_modules (#15156)
fix: scripts not rendering with unused Fragment slots (#13847) (#15147)
Fix hydration for framework components in MDX slots (#15150)
fix(deps): update astro adapters (#15173)
fix: fix image 500 error when moving dist directory in standalone Node (#15169)
fix: Allow node: prefix for Node builtins for Vercel middleware (#14863)
fix: Allow node: prefix for Node builtins for Vercel middleware (#14839)"
fix(node): hash URL stripping (#15196)
fix(core): add defensive validation for mod.page in App.render (#15148)
fix(css): rewrite absolute URLs with base path in dev mode (#14622)
Closes #14585
fix(docs): replace outdated Astro docs links (#15199)
fix(lint): Move ESLint comment (#15216)
fix: update devalue to the latest (#15222)
fix(css): prevent CSS double-bundling (#14991) (#15017)
Fixes #14991
fix: assets referenced via js chunks are not flagged as orphaned (#14607)
fix(build): Prevent duplicate CSS for hydrated client components" (#14612)"
Fixes #14252
fix(deps): update astro client runtimes (#15240)
fix(deps): update astro adapters (#15243)
fix(deps): update astro dependencies (#15241)
fix(deps): update dependency prettier to ^3.8.0 (#15244)
fix(deps): update all non-major dependencies (#15242)
Fix greedy regex in error message markdown rendering (#15230)
Fixes #15068
fixes: #15252
fix: prevent font copying when stopping dev server with q+enter (#15178)
fix: renovate config typo (#15256)
Fixes #15251
fix: typo in comment (#15232)
fix(deps): update dependency svelte to v5.46.4 [security] (#15220)
fix: add favicon.ico fallbacks to all examples (#15262)
florian-lefebvre added a commit that referenced this pull request Jan 30, 2026
@florian-lefebvre @renovate
@github-actions @ematipico @ascorbic @matthewp @Princesseuh @sarah11918 @ArmandPhilippot @Fryuni @HiDeoo @delucis @claude @antonyfaris @astrobot-houston @volpeon @martrapp @fkatsuhiro @OliverSpeir @deining @gameroman @fabon-f @Raanelom @rahuld109 @43081j @eureka928 @cameronraysmith @rururux @jcayzac @drwpow @MkDev11 @aprici7y @Slackluky @btea @ixchio @simensfo @lamalex @kedarvartak @NAM-MAN @CloudyWSA @webstackdev @EricGrill @cameronapak @tony @jmortlock @patrickarlt @mark-ignacio
Merge main into next (#15348)
336b003 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Emanuele Stoppa <[email protected]>
Co-authored-by: Matt Kane <[email protected]>
Co-authored-by:  Matthew Phillips <[email protected]>
Co-authored-by: Matthew Phillips <[email protected]>
Co-authored-by: Florian Lefebvre <[email protected]>
Co-authored-by: Erika <[email protected]>
Co-authored-by: Sarah Rainsberger <[email protected]>
Co-authored-by: Armand Philippot <[email protected]>
Co-authored-by: matthewp <[email protected]>
Co-authored-by: florian-lefebvre <[email protected]>
Co-authored-by: ematipico <[email protected]>
Co-authored-by: Luiz Ferraz <[email protected]>
Co-authored-by: HiDeoo <[email protected]>
Co-authored-by: Princesseuh <[email protected]>
Co-authored-by: Chris Swithinbank <[email protected]>
Co-authored-by: Claude Opus 4.5 <[email protected]>
Co-authored-by: Antony Faris <[email protected]>
Co-authored-by: Erika <[email protected]>
Co-authored-by: Houston (Bot) <[email protected]>
Co-authored-by: Florian Lefebvre <[email protected]>
Co-authored-by: Volpeon <[email protected]>
Co-authored-by: Martin Trapp <[email protected]>
Co-authored-by: fkatsuhiro <[email protected]>
Co-authored-by: Oliver Speir <[email protected]>
Co-authored-by: Andreas Deininger <[email protected]>
Co-authored-by: Roman <[email protected]>
Co-authored-by: fabon <[email protected]>
Co-authored-by: Raanelom <[email protected]>
Co-authored-by: Rahul Dogra <[email protected]>
Co-authored-by: James Garbutt <[email protected]>
Co-authored-by: Pegasus <[email protected]>
Co-authored-by: Cameron Smith <[email protected]>
Co-authored-by: Martin Trapp <[email protected]>
Co-authored-by: Rafael ヤスヒデ 須藤 <[email protected]>
Co-authored-by: Matthew Phillips <[email protected]>
Co-authored-by: Julien Cayzac <[email protected]>
Co-authored-by: Drew Powers <[email protected]>
Co-authored-by: Emanuele Stoppa <[email protected]>
Co-authored-by: MkDev11 <[email protected]>
Co-authored-by: andy <[email protected]>
Co-authored-by: Luky Setiawan <[email protected]>
Co-authored-by: btea <[email protected]>
Co-authored-by: cid <[email protected]>
Co-authored-by: Simen Sagholen Førrisdal <[email protected]>
Co-authored-by: Alex Launi <[email protected]>
Co-authored-by: Kedar Vartak <[email protected]>
Co-authored-by: yy <[email protected]>
Co-authored-by: Matheus Baroni <[email protected]>
Co-authored-by: Kevin Brown <[email protected]>
Co-authored-by: Eric Grill <[email protected]>
Co-authored-by: Cameron Pak <[email protected]>
Co-authored-by: Tony Narlock <[email protected]>
Co-authored-by: John Mortlock <[email protected]>
Co-authored-by: Patrick Arlt <[email protected]>
Co-authored-by: Mark Ignacio <[email protected]>
fix(ci): Reinstall deps after having published VS Code (#14996)
fix(svelte): allow client directives (#15004)
fix(assets): Fixes missing format option for svgs in the passthrough service (#14987)
fix(deps): update all non-major dependencies (#15020)
fix(content-layer): Try a smarter solution to normalize bare image paths in JSON (#15028)
fix(astro): assets vite build log (#15034)
resolved (#15033)
fix: Remote images: Prevent internal caching from interfering with Astro's cache (#14954)
fix(deps): update astro adapters (#15084)
fix(deps): update all non-major dependencies (#15072)
fix(deps): update astro client runtimes (#15085)
fix: move ts-plugin node_modules to dist (#15083)
fix: components imports paths (#15107)
fix(assets): Use Vite's isFileLoadingAllowed to check if a file can be loaded (#15052)
fix(vscode): Correctly handle TypeScript blocks ending with types (#15109)
fix(svelte): improve Svelte children prop type checking (#15070)
fix Firefox e2e tests for playwright 1.57 (#15113)
fix(deps): update astro dependencies (#15103)
fix: lint vt test (#15114)
fix(deps): update language tools (#15104)
resolver abstraction (#15111)
fix(vue): add HTML attributes to generated TypeScript types (#15016)
Fixes #14686
fix(vscode): Don't update @types/vscode automatically (#15131)
fix: adjust page warning to only show up in more relevant times (#15127)
fix(dev): preserve query params when base path is stripped (#15124)
fix(assets): hoist ?? inside JSON.stringify in virtual module codegen (#15140)
fix(toolbar): skip image audit for framework components (#15149)
Fixes #15048
fix: Accept setCookie from both context and headers (#15152)
fix(ci): Move ts-plugin-bundle to node_modules after recreating node_modules (#15156)
fix: scripts not rendering with unused Fragment slots (#13847) (#15147)
Fix hydration for framework components in MDX slots (#15150)
fix(deps): update astro adapters (#15173)
fix: fix image 500 error when moving dist directory in standalone Node (#15169)
fix: Allow node: prefix for Node builtins for Vercel middleware (#14863)
fix: Allow node: prefix for Node builtins for Vercel middleware (#14839)"
fix(node): hash URL stripping (#15196)
fix(core): add defensive validation for mod.page in App.render (#15148)
fix(css): rewrite absolute URLs with base path in dev mode (#14622)
Closes #14585
fix(docs): replace outdated Astro docs links (#15199)
fix(lint): Move ESLint comment (#15216)
fix: update devalue to the latest (#15222)
fix(css): prevent CSS double-bundling (#14991) (#15017)
Fixes #14991
fix: assets referenced via js chunks are not flagged as orphaned (#14607)
fix(build): Prevent duplicate CSS for hydrated client components" (#14612)"
Fixes #14252
fix(deps): update astro client runtimes (#15240)
fix(deps): update astro adapters (#15243)
fix(deps): update astro dependencies (#15241)
fix(deps): update dependency prettier to ^3.8.0 (#15244)
fix(deps): update all non-major dependencies (#15242)
Fix greedy regex in error message markdown rendering (#15230)
Fixes #15068
fixes: #15252
fix: prevent font copying when stopping dev server with q+enter (#15178)
fix: renovate config typo (#15256)
Fixes #15251
fix: typo in comment (#15232)
fix(deps): update dependency svelte to v5.46.4 [security] (#15220)
fix: add favicon.ico fallbacks to all examples (#15262)
fix(cli): add .vercel to .gitignore when using astro add vercel (#15185)
Closes #15058
fix(fonts): font providers as class instances (#15286)
Fix: Remove await from getActionResult JSDoc example (#15304)
fix(errors): Only style valid URLs in the error overlay (#15324)
fix(fonts): remove getFontBuffer() (#15334)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Princesseuh Princesseuh Princesseuh left review comments

@florian-lefebvre florian-lefebvre florian-lefebvre approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file pkg: integration Related to any renderer integration (scope) pkg: svelte Related to Svelte (scope)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Princesseuh @florian-lefebvre