merge main (successfully, i think - things changed a bit)

Author: Rich-Harris

.changeset/real-cameras-attack.md

@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: always use `setAttribute` when setting `style`

.changeset/strange-planes-shout.md

@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: make `style:` directive and CSS handling more robust

.github/workflows/ci.yml

@@ -12,6 +12,7 @@ env:
 
 jobs:
   Tests:
+    permissions: {}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 15
     strategy:
@@ -41,6 +42,7 @@ jobs:
         env:
           CI: true
   Lint:
+    permissions: {}
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
@@ -61,6 +63,7 @@ jobs:
         if: (${{ success() }} || ${{ failure() }}) # ensures this step runs even if previous steps fail
         run: pnpm build && { [ "`git status --porcelain=v1`" == "" ] || (echo "Generated types have changed — please regenerate types locally with `cd packages/svelte && pnpm generate:types` and commit the changes after you have reviewed them"; git diff; exit 1); }
   Benchmarks:
+    permissions: {}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:

.github/workflows/ecosystem-ci-trigger.yml

@@ -9,6 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'sveltejs/svelte' && github.event.issue.pull_request && startsWith(github.event.comment.body, '/ecosystem-ci run')
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - uses: actions/github-script@v6
         with:
           script: |

.github/workflows/pkg.pr.new-comment.yml

@@ -11,6 +11,7 @@ jobs:
     name: 'Update comment'
     runs-on: ubuntu-latest
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - name: Download artifact
         uses: actions/download-artifact@v4
         with:

.github/workflows/pkg.pr.new.yml

@@ -3,6 +3,8 @@ on: [push, pull_request]
 
 jobs:
   build:
+    permissions: {}
+
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/release.yml

@@ -17,6 +17,7 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
       - name: Checkout Repo
         uses: actions/checkout@v4
         with:

packages/svelte/src/compiler/phases/2-analyze/index.js

@@ -769,17 +769,24 @@ export function analyze_component(root, source, options) {
 		}
 
 		let has_class = false;
+		let has_style = false;
 		let has_spread = false;
 		let has_class_directive = false;
+		let has_style_directive = false;
 
 		for (const attribute of node.attributes) {
 			// The spread method appends the hash to the end of the class attribute on its own
 			if (attribute.type === 'SpreadAttribute') {
 				has_spread = true;
 				break;
+			} else if (attribute.type === 'Attribute') {
+				has_class ||= attribute.name.toLowerCase() === 'class';
+				has_style ||= attribute.name.toLowerCase() === 'style';
+			} else if (attribute.type === 'ClassDirective') {
+				has_class_directive = true;
+			} else if (attribute.type === 'StyleDirective') {
+				has_style_directive = true;
 			}
-			has_class_directive ||= attribute.type === 'ClassDirective';
-			has_class ||= attribute.type === 'Attribute' && attribute.name.toLowerCase() === 'class';
 		}
 
 		// We need an empty class to generate the set_class() or class="" correctly
@@ -796,6 +803,21 @@ export function analyze_component(root, source, options) {
 				])
 			);
 		}
+
+		// We need an empty style to generate the set_style() correctly
+		if (!has_spread && !has_style && has_style_directive) {
+			node.attributes.push(
+				create_attribute('style', -1, -1, [
+					{
+						type: 'Text',
+						data: '',
+						raw: '',
+						start: -1,
+						end: -1
+					}
+				])
+			);
+		}
 	}
 
 	// TODO