Update dependency svelte to v5.51.5 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
svelte (source)	5.49.1 → 5.51.5

GitHub Vulnerability Alerts

CVE-2026-27119

In certain circumstances, the server-side rendering output of an <option> element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected.

---

Release Notes

sveltejs/svelte (svelte)

v5.51.5

Compare Source

Patch Changes

• fix: check to make sure svelte:element tags are valid during SSR (73098bb26c6f06e7fd1b0746d817d2c5ee90755f)

• fix: misc option escaping and backwards compatibility (#​17741)

• fix: strip event handlers during SSR (a0c7f289156e9fafaeaf5ca14af6c06fe9b9eae5)

• fix: replace usage of for in with for of Object.keys (f89c7ddd7eebaa1ef3cc540400bec2c9140b330c)

• fix: always escape option body in SSR (f7c80da18c215e3727c2a611b0b8744cc6e504c5)

• chore: upgrade devalue (#​17739)

v5.51.4

Compare Source

Patch Changes

• chore: proactively defer effects in pending boundary (#​17734)

• fix: detect and error on non-idempotent each block keys in dev mode (#​17732)

v5.51.3

Compare Source

Patch Changes

• fix: prevent event delegation logic conflicting between svelte instances (#​17728)

• fix: treat CSS attribute selectors as case-insensitive for HTML enumerated attributes (#​17712)

• fix: locate Rollup annontaion friendly to JS downgraders (#​17724)

• fix: run effects in pending snippets (#​17719)

v5.51.2

Compare Source

Patch Changes

• fix: take async into consideration for dev delegated handlers (#​17710)

• fix: emit state_referenced_locally warning for non-destructured props (#​17708)

v5.51.1

Compare Source

Patch Changes

• fix: don't crash on undefined document.contentType (#​17707)

• fix: use symbols for encapsulated event delegation (#​17703)

v5.51.0

Compare Source

Minor Changes

• feat: Use TrustedTypes for HTML handling where supported (#​16271)

Patch Changes

• fix: sanitize template-literal-special-characters in SSR attribute values (#​17692)

• fix: follow-up formatting in print() — flush block-level elements into separate sequences (#​17699)

• fix: preserve delegated event handlers as long as one or more root components are using them (#​17695)

v5.50.3

Compare Source

Patch Changes

• fix: take into account nodeName case sensitivity on XHTML pages (#​17689)

• fix: render multiple and selected attributes as empty strings for XHTML compliance (#​17689)

• fix: always lowercase HTML elements, for XHTML compliance (#​17664)

• fix: freeze effects-inside-deriveds when disconnecting, unfreeze on reconnect (#​17682)

• fix: propagate $effect errors to <svelte:boundary> (#​17684)

v5.50.2

Compare Source

Patch Changes

• fix: resolve effect_update_depth_exceeded when using bind:value on <select> with derived state in legacy mode (#​17645)

• fix: don't swallow DOMException when media.play() fails in bind:paused (#​17656)

• chore: provide proper public type for parseCss result (#​17654)

• fix: robustify blocker calculation (#​17676)

• fix: reduce if block nesting (#​17662)

v5.50.1

Compare Source

Patch Changes

• fix: render boolean attribute values as empty strings for XHTML compliance (#​17648)

• fix: prevent async render tag hydration mismatches (#​17652)

v5.50.0

Compare Source

Minor Changes

• feat: allow use of createContext when instantiating components programmatically (#​17575)

Patch Changes

• fix: ensure infinite effect loops are cleared after flushing (#​17601)

• fix: allow {#key NaN} (#​17642)

• fix: detect store in each block expression regardless of AST shape (#​17636)

• fix: treat <menu> like <ul>/<ol> for a11y role checks (#​17638)

• fix: add vite-ignore comment inside dynamic crypto import (#​17623)

• chore: wrap JSDoc URLs in @see and @link tags (#​17617)

• fix: properly hydrate already-resolved async blocks (#​17641)

• fix: emit each_key_duplicate error in production (#​16724)

• fix: exit resolved async blocks on correct node when hydrating (#​17640)

v5.49.2

Compare Source

Patch Changes

• chore: remove SvelteKit data attributes from elements.d.ts (#​17613)

• fix: avoid erroneous async derived expressions for blocks (#​17604)

• fix: avoid Cloudflare warnings about not having the "node:crypto" module (#​17612)

• fix: reschedule effects inside unskipped branches (#​17604)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.