chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security] by renovate[bot] · Pull Request #639 · unjs/unhead

renovate · 2026-01-15T22:59:03Z

This PR contains the following updates:

Package	Change	Age	Confidence
svelte (source)	`5.46.1` → `5.51.5`
svelte (source)	`>=5.38.0` → `>=5.51.5`

GitHub Vulnerability Alerts

CVE-2025-15265

Summary

An XSS vulnerability exists in Svelte 5.46.0-2 resulting from improper escaping of hydratable keys. If these keys incorporate untrusted user input, arbitrary JavaScript can be injected into server-rendered HTML.

Details

When using the hydratable function, the first argument is used as a key to uniquely identify the data, such that the value is not regenerated in the browser.

This key is embedded into a <script> block in the server-rendered <head> without escaping unsafe characters. A malicious key can break out of the script context and inject arbitrary JavaScript into the HTML response.

Impact

This is a cross-site scripting vulnerability affecting applications that have the experimental.async flag enabled and use hydratable with keys incorporating untrusted user input.

Impact: Arbitrary JS execution in the client’s browser.
Exploitability: Remote, single-request if key is attacker-controlled.
Typical Outcomes:
- Session/token theft
- DOM defacement
- CSRF bypass via injected JS
- Account takeover depending on cookie/session strategy

Affected applications should upgrade to a patched version immediately.

CVE-2026-27119

In certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected.

CVE-2026-27121

Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers.

CVE-2026-27122

When using <svelte:element this={tag}> in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected.

CVE-2026-27125

In server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected.

Release Notes

sveltejs/svelte (svelte)

`v5.51.5`

Compare Source

Patch Changes

fix: check to make sure svelte:element tags are valid during SSR (73098bb26c6f06e7fd1b0746d817d2c5ee90755f)
fix: misc option escaping and backwards compatibility (#17741)
fix: strip event handlers during SSR (a0c7f289156e9fafaeaf5ca14af6c06fe9b9eae5)
fix: replace usage of for in with for of Object.keys (f89c7ddd7eebaa1ef3cc540400bec2c9140b330c)
fix: always escape option body in SSR (f7c80da18c215e3727c2a611b0b8744cc6e504c5)
chore: upgrade devalue (#17739)

`v5.51.4`

Compare Source

Patch Changes

chore: proactively defer effects in pending boundary (#17734)
fix: detect and error on non-idempotent each block keys in dev mode (#17732)

`v5.51.3`

Compare Source

Patch Changes

fix: prevent event delegation logic conflicting between svelte instances (#17728)
fix: treat CSS attribute selectors as case-insensitive for HTML enumerated attributes (#17712)
fix: locate Rollup annontaion friendly to JS downgraders (#17724)
fix: run effects in pending snippets (#17719)

`v5.51.2`

Compare Source

Patch Changes

fix: take async into consideration for dev delegated handlers (#17710)
fix: emit state_referenced_locally warning for non-destructured props (#17708)

`v5.51.1`

Compare Source

Patch Changes

fix: don't crash on undefined document.contentType (#17707)
fix: use symbols for encapsulated event delegation (#17703)

`v5.51.0`

Compare Source

Minor Changes

feat: Use TrustedTypes for HTML handling where supported (#16271)

Patch Changes

fix: sanitize template-literal-special-characters in SSR attribute values (#17692)
fix: follow-up formatting in print() — flush block-level elements into separate sequences (#17699)
fix: preserve delegated event handlers as long as one or more root components are using them (#17695)

`v5.50.3`

Compare Source

Patch Changes

fix: take into account nodeName case sensitivity on XHTML pages (#17689)
fix: render multiple and selected attributes as empty strings for XHTML compliance (#17689)
fix: always lowercase HTML elements, for XHTML compliance (#17664)
fix: freeze effects-inside-deriveds when disconnecting, unfreeze on reconnect (#17682)
fix: propagate $effect errors to <svelte:boundary> (#17684)

`v5.50.2`

Compare Source

Patch Changes

fix: resolve effect_update_depth_exceeded when using bind:value on <select> with derived state in legacy mode (#17645)
fix: don't swallow DOMException when media.play() fails in bind:paused (#17656)
chore: provide proper public type for parseCss result (#17654)
fix: robustify blocker calculation (#17676)
fix: reduce if block nesting (#17662)

`v5.50.1`

Compare Source

Patch Changes

fix: render boolean attribute values as empty strings for XHTML compliance (#17648)
fix: prevent async render tag hydration mismatches (#17652)

`v5.50.0`

Compare Source

Minor Changes

feat: allow use of createContext when instantiating components programmatically (#17575)

Patch Changes

fix: ensure infinite effect loops are cleared after flushing (#17601)
fix: allow {#key NaN} (#17642)
fix: detect store in each block expression regardless of AST shape (#17636)
fix: treat <menu> like <ul>/<ol> for a11y role checks (#17638)
fix: add vite-ignore comment inside dynamic crypto import (#17623)
chore: wrap JSDoc URLs in @see and @link tags (#17617)
fix: properly hydrate already-resolved async blocks (#17641)
fix: emit each_key_duplicate error in production (#16724)
fix: exit resolved async blocks on correct node when hydrating (#17640)

`v5.49.2`

Compare Source

Patch Changes

chore: remove SvelteKit data attributes from elements.d.ts (#17613)
fix: avoid erroneous async derived expressions for blocks (#17604)
fix: avoid Cloudflare warnings about not having the "node:crypto" module (#17612)
fix: reschedule effects inside unskipped branches (#17604)

`v5.49.1`

Compare Source

Patch Changes

fix: merge consecutive large text nodes (#17587)
fix: only create async functions in SSR output when necessary (#17593)
fix: properly separate multiline html blocks from each other in print() (#17319)
fix: prevent unhandled exceptions arising from dangling promises in <script> (#17591)

`v5.49.0`

Compare Source

Minor Changes

feat: allow passing ShadowRootInit object to custom element shadow option (#17088)

Patch Changes

fix: throw for unset createContext get on the server (#17580)
fix: reset effects inside skipped branches (#17581)
fix: preserve old dependencies when updating reaction inside fork (#17579)
fix: more conservative assignment_value_stale warnings (#17574)
fix: disregard popover elements when determining whether an element has content (#17367)
fix: fire introstart/outrostart events after delay, if specified (#17567)
fix: increment signal versions when discarding forks (#17577)

`v5.48.5`

Compare Source

Patch Changes

fix: run boundary onerror callbacks in a microtask, in case they result in the boundary's destruction (#17561)
fix: prevent unintended exports from namespaces (#17562)
fix: each block breaking with effects interspersed among items (#17550)

`v5.48.4`

Compare Source

Patch Changes

fix: avoid duplicating escaped characters in CSS AST (#17554)

`v5.48.3`

Compare Source

Patch Changes

fix: hydration failing with settled async blocks (#17539)
fix: add pointer and touch events to a11y_no_static_element_interactions warning (#17551)
fix: handle false dynamic components in SSR (#17542)
fix: avoid unnecessary block effect re-runs after async work completes (#17535)
fix: avoid using dev-mode array.includes wrapper on internal array checks (#17536)

`v5.48.2`

Compare Source

Patch Changes

fix: export wait function from internal client index (#17530)

`v5.48.1`

Compare Source

Patch Changes

fix: hoist snippets above const in same block (#17516)
fix: properly hydrate await in {@html} (#17528)
fix: batch resolution of async work (#17511)
fix: account for empty statements when visiting in transform async (#17524)
fix: avoid async overhead for already settled promises (#17461)
fix: better code generation for const tags with async dependencies (#17518)

`v5.48.0`

Compare Source

Minor Changes

feat: export parseCss from svelte/compiler (#17496)

Patch Changes

fix: handle non-string values in svelte:element this attribute (#17499)
fix: faster deduplication of dependencies (#17503)

`v5.47.1`

Compare Source

Patch Changes

fix: trigger selectedcontent reactivity (#17486)

`v5.47.0`

Compare Source

Minor Changes

feat: customizable <select> elements (#17429)

Patch Changes

fix: mark subtree of svelte boundary as dynamic (#17468)
fix: don't reset static elements with debug/snippets (#17477)

`v5.46.4`

Compare Source

Patch Changes

fix: use devalue.uneval to serialize hydratable keys (ef81048e238844b729942441541d6dcfe6c8ccca)

`v5.46.3`

Compare Source

Patch Changes

fix: reconnect clean deriveds when they are read in a reactive context (#17362)
fix: don't transform references of function declarations in legacy mode (#17431)
fix: notify deriveds of changes to sources inside forks (#17437)
fix: always reconnect deriveds in get, when appropriate (#17451)
fix: prevent derives without dependencies from ever re-running (286b40c4526ce9970cb81ddd5e65b93b722fe468)
fix: correctly update writable deriveds inside forks (#17437)
fix: remove $inspect calls after await expressions when compiling for production server code (#17407)
fix: clear batch between runs (#17424)
fix: adjust loc property of Program nodes created from <script> elements (#17428)
fix: don't revert source to UNINITIALIZED state when time travelling (#17409)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - "after 1am and before 2am" (UTC).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-01-15T22:59:05Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 20 workspace projects
 ERROR  Invalid Version: ^5.46.1

pnpm: Invalid Version: ^5.46.1
    at new _SemVer (/opt/containerbase/tools/pnpm/10.28.0/24.14.0/node_modules/pnpm/dist/pnpm.cjs:38223:17)
    at compare (/opt/containerbase/tools/pnpm/10.28.0/24.14.0/node_modules/pnpm/dist/pnpm.cjs:38616:65)
    at Object.eq (/opt/containerbase/tools/pnpm/10.28.0/24.14.0/node_modules/pnpm/dist/pnpm.cjs:38700:31)
    at installSome (/opt/containerbase/tools/pnpm/10.28.0/24.14.0/node_modules/pnpm/dist/pnpm.cjs:159270:223)
    at _install (/opt/containerbase/tools/pnpm/10.28.0/24.14.0/node_modules/pnpm/dist/pnpm.cjs:159212:21)
    at async mutateModules (/opt/containerbase/tools/pnpm/10.28.0/24.14.0/node_modules/pnpm/dist/pnpm.cjs:159072:23)
    at async recursive (/opt/containerbase/tools/pnpm/10.28.0/24.14.0/node_modules/pnpm/dist/pnpm.cjs:160468:100)
    at async recursiveInstallThenUpdateWorkspaceState (/opt/containerbase/tools/pnpm/10.28.0/24.14.0/node_modules/pnpm/dist/pnpm.cjs:160979:31)
    at async installDeps (/opt/containerbase/tools/pnpm/10.28.0/24.14.0/node_modules/pnpm/dist/pnpm.cjs:160786:11)
    at async /opt/containerbase/tools/pnpm/10.28.0/24.14.0/node_modules/pnpm/dist/pnpm.cjs:194253:23

github-actions · 2026-01-15T23:00:48Z

Bundle Size Analysis

Bundle	Size	Gzipped
Client (Minimal)	11.4 kB	4.7 kB
Server (Minimal)	10.4 kB	4.3 kB
Vue Client (Minimal)	12.3 kB	5.1 kB
Vue Server (Minimal)	11.3 kB	4.6 kB

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from a183c5e to 082944f Compare January 19, 2026 08:03

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte to v5.46.4 [security]~~ chore(deps): update pnpm.catalog.default svelte [security] Jan 19, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from 082944f to 9ac3932 Compare January 19, 2026 12:37

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte [security]~~ chore(deps): update pnpm.catalog.default svelte to v5.46.4 [security] Jan 19, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from 9ac3932 to bd74382 Compare January 19, 2026 20:14

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte to v5.46.4 [security]~~ chore(deps): update pnpm.catalog.default svelte [security] Jan 19, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from bd74382 to 4b3165d Compare January 19, 2026 22:50

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte [security]~~ chore(deps): update pnpm.catalog.default svelte to v5.46.4 [security] Jan 19, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from 4b3165d to f265f3b Compare January 20, 2026 08:01

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte to v5.46.4 [security]~~ chore(deps): update pnpm.catalog.default svelte [security] Jan 20, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from f265f3b to e19aff9 Compare January 20, 2026 11:01

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte [security]~~ chore(deps): update pnpm.catalog.default svelte to v5.46.4 [security] Jan 20, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from e19aff9 to b999fa5 Compare January 23, 2026 21:11

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte to v5.46.4 [security]~~ chore(deps): update pnpm.catalog.default svelte [security] Jan 23, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from b999fa5 to 28c3df7 Compare January 24, 2026 02:53

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte [security]~~ chore(deps): update pnpm.catalog.default svelte to v5.46.4 [security] Jan 24, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from 28c3df7 to 15b84f6 Compare January 25, 2026 00:36

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte to v5.46.4 [security]~~ chore(deps): update pnpm.catalog.default svelte [security] Jan 25, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from 15b84f6 to f79834b Compare January 25, 2026 06:36

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte [security]~~ chore(deps): update pnpm.catalog.default svelte to v5.46.4 [security] Jan 25, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from f79834b to 92c62ac Compare January 29, 2026 14:48

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte to v5.46.4 [security]~~ chore(deps): update pnpm.catalog.default svelte [security] Jan 29, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch 2 times, most recently from f03109b to aefbcd3 Compare January 29, 2026 22:46

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte [security]~~ chore(deps): update pnpm.catalog.default svelte to v5.46.4 [security] Jan 29, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from aefbcd3 to cb5b78e Compare February 2, 2026 16:01

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte to v5.46.4 [security]~~ chore(deps): update pnpm.catalog.default svelte [security] Feb 2, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from cb5b78e to 7d68e6d Compare February 2, 2026 22:06

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from b79a122 to 60b88f1 Compare February 24, 2026 08:52

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security]~~ chore(deps): update pnpm.catalog.default svelte [security] Feb 24, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch 5 times, most recently from 0b9cd30 to 5d6bd02 Compare February 24, 2026 15:09

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte [security]~~ chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security] Feb 24, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from 5d6bd02 to 1dedc70 Compare February 24, 2026 15:42

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security]~~ chore(deps): update pnpm.catalog.default svelte [security] Feb 24, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from 1dedc70 to e369730 Compare February 24, 2026 15:45

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte [security]~~ chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security] Feb 24, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from e369730 to 30d3d33 Compare February 25, 2026 11:44

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security]~~ chore(deps): update pnpm.catalog.default svelte [security] Feb 25, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch 2 times, most recently from 4fa2d61 to a77f112 Compare February 25, 2026 12:15

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte [security]~~ chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security] Feb 25, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from a77f112 to a1d8d90 Compare February 26, 2026 03:16

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security]~~ chore(deps): update pnpm.catalog.default svelte [security] Feb 26, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from a1d8d90 to 952e5a0 Compare February 26, 2026 03:18

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte [security]~~ chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security] Feb 26, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from 952e5a0 to 80c8e91 Compare February 26, 2026 07:38

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security]~~ chore(deps): update pnpm.catalog.default svelte [security] Feb 26, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from 80c8e91 to e692756 Compare February 26, 2026 11:54

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte [security]~~ chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security] Feb 26, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from e692756 to 8d90e60 Compare February 26, 2026 14:03

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security]~~ chore(deps): update pnpm.catalog.default svelte [security] Feb 26, 2026

chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security]

b32d3a3

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from 8d90e60 to b32d3a3 Compare February 26, 2026 19:34

renovate bot changed the title ~~chore(deps): update pnpm.catalog.default svelte [security]~~ chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security] Feb 26, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security]#639

chore(deps): update pnpm.catalog.default svelte to v5.51.5 [security]#639
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-svelte-vulnerability

renovate bot commented Jan 15, 2026 •

edited

Loading

Uh oh!

renovate bot commented Jan 15, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 15, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate bot commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Summary

Details

Impact

Release Notes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

renovate bot commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: pnpm-lock.yaml

Uh oh!

github-actions bot commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bundle Size Analysis

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Jan 15, 2026 •

edited

Loading

renovate bot commented Jan 15, 2026 •

edited

Loading

github-actions bot commented Jan 15, 2026 •

edited

Loading