svelte

svelte breaking-changes badge

svelte (latest known version: 5.56.8) has 365 known breaking changes on record, each backed by a source URL.

Actively maintainedLatest known version: 5.56.8npm ↗

Security advisories

GHSA-6738-r8g5-qwp3MODERATE>=5.46.0 <5.46.4

svelte vulnerable to Cross-site Scripting

source ↗

GHSA-8266-84wp-wv5cMODERATE<4.2.19

Svelte has a potential mXSS vulnerability due to improper HTML escaping

source ↗

GHSA-9rmh-mm8f-r9h6MODERATE>=5.51.5 <5.55.7

Svelte: ReDoS in `<svelte:element>` Tag Validation

source ↗

GHSA-crpf-4hrx-3jrpMODERATE<5.51.5

Svelte SSR attribute spreading includes inherited properties from prototype chain

source ↗

GHSA-f3cj-j4f6-wq85MODERATE>=5.46.0 <5.55.7

Svelte: SSR XSS via Insecure Promise Serialization in hydratable

source ↗

GHSA-f7gr-6p89-r883MODERATE<5.51.5

Svelte affected by cross-site scripting via spread attributes in Svelte SSR

source ↗

GHSA-gw32-9rmw-qwwwHIGH>=3.0.0 <3.59.2

svelte is vulnerable to XSS with textarea bind:value

source ↗

GHSA-h7h7-mm68-gmrcMODERATE>=5.39.3 <5.51.5

Svelte affected by XSS in SSR `<option>` element

source ↗

GHSA-m56q-vw4c-c2cpMODERATE<5.51.5

Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

source ↗

GHSA-phwv-c562-gvmhMODERATE<5.53.5

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

source ↗

GHSA-pr6f-5x2q-rwfpMODERATE<5.55.7

Svelte SSR vulnerable to cross-site scripting via spread attributes

source ↗

GHSA-qgvg-pr8v-6rr3MODERATE>=5.53.0 <5.53.5

Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

source ↗

GHSA-rcqx-6q8c-2c42MODERATE<5.55.7

Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State

source ↗

GHSA-wv8q-r932-8hc7MODERATE<3.49.0

Svelte vulnerable to XSS when using objects during server-side rendering

source ↗

Recent changes

vsvelte@5.56.7Notable

Added `indent` option for `print` function

source ↗

vsvelte@5.56.6Notable

rerun derived that had an abort controller on reconnection

source ↗

vsvelte@5.56.6Notable

skip unnecessary blocker analysis when compiling components without top-level await

source ↗

vsvelte@5.56.5Notable

don't treat declaration tags as parts inside each blocks

source ↗

vsvelte@5.56.5Notable

clear previous_task reference after abort in Tween to prevent memory leak on interrupted tweens

source ↗

vsvelte@5.56.5Notable

chain preprocessor sourcemaps with an empty `sources[0]` instead of dropping them

source ↗

vsvelte@5.56.5Notable

transform computed keys in keyed `{#each}` destructuring patterns

source ↗

vsvelte@5.56.5Notable

correctly transform declaration tags during SSR

source ↗

vsvelte@5.56.5Notable

ensure `$state.eager()` is correctly transformed for SSR output

source ↗

vsvelte@5.56.5Notable

abort deriveds own AbortSignal when it disconnects

source ↗

vsvelte@5.56.5Notable

avoid declaration tag warning in event handlers

source ↗

vsvelte@5.56.5Notable

skip unnecessary derived effect in earlier batch

source ↗

vsvelte@5.56.5Notable

don't (re)connect deriveds when read inside branch/root effects

source ↗

vsvelte@5.56.5Notable

drop dead code that make TSGO fail

source ↗

vsvelte@5.56.4Notable

don't notify `searchParams` subscribers when the URL changes without affecting the search string

source ↗

vsvelte@5.56.4Notable

always unset reactivity context after restoring it

source ↗

vsvelte@5.56.4Notable

include wrapping parentheses in `{@const}` declarator `end` position

source ↗

vsvelte@5.56.4Breaking

strip `?` from optional parameters in `<script lang="ts">` so generated JavaScript is valid

source ↗

vsvelte@5.56.3Security

Ignore errors that occur in destroyed effects

source ↗

vsvelte@5.56.3Notable

Type BigInts in $state.snapshot(...) return values

source ↗

vsvelte@5.56.2Security

fix: reject pending async deriveds on discard

source ↗

vsvelte@5.56.2Notable

fix: ignore declaration tags for animation directive

source ↗

vsvelte@5.56.2Notable

fix: prevent false-positive reactivity loss warning

source ↗

vsvelte@5.56.2Notable

fix: properly track effect end node for async sibling component

source ↗

vsvelte@5.56.1Notable

check references for blockers on server, too

source ↗

vsvelte@5.56.1Notable

update SvelteURLSearchParams when setting duplicate keys to the same joined value

source ↗

vsvelte@5.56.1Notable

preserve newlines in spread input values when the type attribute is applied after value

source ↗

vsvelte@5.56.1Notable

more robust parsing of declaration tags with regards to type

source ↗

vsvelte@5.56.1Notable

prevent infinite loop when a tag's expression ends with a trailing / at the end of the input

source ↗

vsvelte@5.56.1Notable

tolerate whitespace before let/const in declaration tags

source ↗

Check what changed for svelte since your installed version, live.

Open the playground →