chore(deps): update dependency svelte to v5.55.7 [security] by renovate[bot] · Pull Request #328 · TanStack/store

renovate · 2026-05-14T22:16:51Z

This PR contains the following updates:

Package	Change	Age	Confidence
svelte (source)	`5.55.3` → `5.55.7`

Svelte: ReDoS in `<svelte:element>` Tag Validation

CVE-2026-42567 / GHSA-9rmh-mm8f-r9h6

More information

Details

An internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their length before passing them to svelte:element, you are safe.

Severity

CVSS Score: 5.9 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Svelte: SSR XSS via Insecure Promise Serialization in hydratable

GHSA-f3cj-j4f6-wq85

More information

Details

Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:

you are using hydratable (an experimental feature at the time of this report)
you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. hydratable('someKey', () => [synchronousValue, promiseValue])

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Svelte SSR vulnerable to cross-site scripting via spread attributes

CVE-2026-42599 / GHSA-pr6f-5x2q-rwfp

More information

Details

When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability only triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires.

This is similar to but different from CVE-2026-27121.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State

CVE-2026-42573 / GHSA-rcqx-6q8c-2c42

More information

Details

Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.

You are vulnerable if all of the following is true:

you are using attribute spreading on a form element
you are using attribute spreading or allow a dynamic value for the name attribute on an input or button element within that form
both of these are simultaneously user-controllable

<form {...spread1}>
  <input {...spread2}>
</form>

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

sveltejs/svelte (svelte)

`v5.55.7`

Compare Source

Patch Changes

fix: prevent XSS on hydratable from user contents (a16ebc67bbcf8f708360195687e1b2719463e1a4)
chore: bump devalue (#18219)
fix: disallow empty attribute names during SSR (547853e2406a2147ad7fb5ffeba95b01bd9642da)
fix: harden regex (d2375e2ebcab5c88feb5652f1a9d621b8f06b259)
fix: move Svelte runtime properties to symbols (e1cbbd96441e82c9eb8a23a2903c0d06d3cda991)

`v5.55.6`

Compare Source

Patch Changes

fix: leave stale promises to wait for a later resolution, instead of rejecting (#18180)
fix: keep dependencies of $state.eager/pending (#18218)
fix: reapply context after transforming error during SSR (#18099)
fix: don't rebase just-created batches (#18117)
chore: allow null for pending in typings (#18201)
fix: flush eager effects in production (#18107)
fix: rethrow error of failed iterable after calling return() (#18169)
fix: account for proxified instance when updating bind:this (#18147)
fix: ensure scheduled batch is flushed if not obsolete (#18131)
fix: resolve stale deriveds with latest value (#18167)
chore: remove unnecessary increment_pending calls (#18183)
fix: correctly compile component member expressions for SSR (#18192)
fix: reset source.updated stack traces after flush (#18196)
fix: replacing async 'blocking' strategy with 'merging' (#18205)
fix: allow @debug tags to reference awaited variables (#18138)
fix: re-run fallback props if dependencies update (#18146)
fix: abort running obsolete async branches (#18118)
fix: ignore comments when reading CSS values (#18153)
fix: wrap Promise.all in save during SSR (#18178)
fix: ignore false-positive errors of $inspect dependencies (#18106)

`v5.55.5`

Compare Source

Patch Changes

fix: don't mark deriveds while an effect is updating (#18124)
fix: do not dispatch introstart event with animation of animate directive (#18122)

`v5.55.4`

Compare Source

Patch Changes

fix: never mark a child effect root as inert (#18111)
fix: reset context after waiting on blockers of @const expressions (#18100)
fix: keep flushing new eager effects (#18102)

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

nx-cloud · 2026-05-14T22:17:19Z

View your CI Pipeline Execution ↗ for commit 1f14af0

Command	Status	Duration	Result
`nx affected --targets=test:sherif,test:knip,tes...`	✅ Succeeded	46s	View ↗
`nx run-many --target=build --exclude=examples/**`	✅ Succeeded	10s	View ↗

☁️ Nx Cloud last updated this comment at 2026-05-14 22:18:26 UTC

pkg-pr-new · 2026-05-14T22:17:44Z

@tanstack/angular-store

npm i https://pkg.pr.new/@tanstack/angular-store@328

@tanstack/lit-store

npm i https://pkg.pr.new/@tanstack/lit-store@328

@tanstack/preact-store

npm i https://pkg.pr.new/@tanstack/preact-store@328

@tanstack/react-store

npm i https://pkg.pr.new/@tanstack/react-store@328

@tanstack/solid-store

npm i https://pkg.pr.new/@tanstack/solid-store@328

@tanstack/store

npm i https://pkg.pr.new/@tanstack/store@328

@tanstack/svelte-store

npm i https://pkg.pr.new/@tanstack/svelte-store@328

@tanstack/vue-store

npm i https://pkg.pr.new/@tanstack/vue-store@328

commit: 1f14af0

socket-security · 2026-05-14T22:18:11Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite@8.0.13
	svelte@5.55.7
	eslint@10.3.0

View full report

socket-security · 2026-05-14T22:18:12Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `svelte` is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: examples/svelte/atoms/package.json → `npm/svelte@5.55.7` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/svelte@5.55.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm `@humanfs/types` Location: Package overview From: pnpm-lock.yaml → `npm/eslint@10.3.0` → `npm/@humanfs/types@0.15.0` ℹ Read more on: This package \| This alert \| What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@humanfs/types@0.15.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

chore(deps): update dependency svelte to v5.55.7 [security]

1f14af0

renovate Bot added the dependencies label May 14, 2026

renovate Bot merged commit 09139b1 into main May 15, 2026
9 checks passed

renovate Bot deleted the renovate/npm-svelte-vulnerability branch May 15, 2026 01:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update dependency svelte to v5.55.7 [security]#328

chore(deps): update dependency svelte to v5.55.7 [security]#328
renovate[bot] merged 1 commit into
mainfrom
renovate/npm-svelte-vulnerability

renovate Bot commented May 14, 2026 •

edited

Loading

Uh oh!

nx-cloud Bot commented May 14, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented May 14, 2026

Uh oh!

socket-security Bot commented May 14, 2026

Uh oh!

socket-security Bot commented May 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Svelte: ReDoS in <svelte:element> Tag Validation

Details

Severity

References

Svelte: SSR XSS via Insecure Promise Serialization in hydratable

Details

Severity

References

Svelte SSR vulnerable to cross-site scripting via spread attributes

Details

Severity

References

Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State

Details

Severity

References

Release Notes

v5.55.7

Patch Changes

v5.55.6

Patch Changes

v5.55.5

Patch Changes

v5.55.4

Patch Changes

Configuration

Uh oh!

nx-cloud Bot commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented May 14, 2026

Uh oh!

socket-security Bot commented May 14, 2026

Uh oh!

socket-security Bot commented May 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 14, 2026 •

edited

Loading

Svelte: ReDoS in `<svelte:element>` Tag Validation

`v5.55.7`

`v5.55.6`

`v5.55.5`

`v5.55.4`

nx-cloud Bot commented May 14, 2026 •

edited

Loading