chore(deps): update dependency svelte to v5.53.5 [security] by renovate[bot] · Pull Request #10201 · TanStack/query

renovate · 2026-03-01T12:55:06Z

This PR contains the following updates:

Package	Change	Age	Confidence
svelte (source)	`5.51.5` → `5.53.5`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2026-27901

The contents of bind:innerText and bind:textContent on contenteditable elements were not properly escaped. This could enable HTML injection and Cross-site Scripting (XSS) if rendering untrusted data as the binding's initial value on the server.

Release Notes

sveltejs/svelte (svelte)

`v5.53.5`

Compare Source

Patch Changes

fix: escape innerText and textContent bindings of contenteditable (0df5abcae223058ceb95491470372065fb87951d)
fix: sanitize transformError values prior to embedding in HTML comments (0298e979371bb583855c9810db79a70a551d22b9)

`v5.53.4`

Compare Source

Patch Changes

fix: set server context after async transformError (#17799)
fix: hydrate if blocks correctly (#17784)
fix: handle default parameters scope leaks (#17788)
fix: prevent flushed effects from running again (#17787)

`v5.53.3`

Compare Source

Patch Changes

fix: render :catch of #await block with correct key (#17769)
chore: pin aria-query@5.3.1 (#17772)
fix: make string coercion consistent to toString (#17774)

`v5.53.2`

Compare Source

Patch Changes

fix: update expressions on server deriveds (#17767)
fix: further obfuscate node:crypto import from overzealous static analysis (#17763)

`v5.53.1`

Compare Source

Patch Changes

fix: handle shadowed function names correctly (#17753)

`v5.53.0`

Compare Source

Minor Changes

feat: allow comments in tags (#17671)
feat: allow error boundaries to work on the server (#17672)

Patch Changes

fix: use TrustedHTML to test for customizable <select> support, where necessary (#17743)
fix: ensure head effects are kept in the effect tree (#17746)
chore: deactivate current_batch by default in unset_context (#17738)

`v5.52.0`

Compare Source

Minor Changes

feat: support TrustedHTML in {@html} expressions (#17701)

Patch Changes

fix: repair dynamic component truthy/falsy hydration mismatches (#17737)
fix: re-run non-render-bound deriveds on the server (#17674)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2026-03-01T12:55:11Z

⚠️ No Changeset found

Latest commit: 2793f5c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-03-01T12:55:15Z

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch renovate/npm-svelte-vulnerability

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

nx-cloud · 2026-03-01T12:55:35Z

View your CI Pipeline Execution ↗ for commit 2793f5c

Command	Status	Duration	Result
`nx affected --targets=test:sherif,test:knip,tes...`	✅ Succeeded	4m 28s	View ↗
`nx run-many --target=build --exclude=examples/*...`	✅ Succeeded	1s	View ↗

☁️ Nx Cloud last updated this comment at 2026-03-02 01:20:23 UTC

pkg-pr-new · 2026-03-01T12:58:12Z

More templates

@tanstack/angular-query-experimental

npm i https://pkg.pr.new/TanStack/query/@tanstack/angular-query-experimental@10201

@tanstack/eslint-plugin-query

npm i https://pkg.pr.new/TanStack/query/@tanstack/eslint-plugin-query@10201

@tanstack/preact-query

npm i https://pkg.pr.new/TanStack/query/@tanstack/preact-query@10201

@tanstack/preact-query-devtools

npm i https://pkg.pr.new/TanStack/query/@tanstack/preact-query-devtools@10201

@tanstack/query-async-storage-persister

npm i https://pkg.pr.new/TanStack/query/@tanstack/query-async-storage-persister@10201

@tanstack/query-broadcast-client-experimental

npm i https://pkg.pr.new/TanStack/query/@tanstack/query-broadcast-client-experimental@10201

@tanstack/query-core

npm i https://pkg.pr.new/TanStack/query/@tanstack/query-core@10201

@tanstack/query-devtools

npm i https://pkg.pr.new/TanStack/query/@tanstack/query-devtools@10201

@tanstack/query-persist-client-core

npm i https://pkg.pr.new/TanStack/query/@tanstack/query-persist-client-core@10201

@tanstack/query-sync-storage-persister

npm i https://pkg.pr.new/TanStack/query/@tanstack/query-sync-storage-persister@10201

@tanstack/react-query

npm i https://pkg.pr.new/TanStack/query/@tanstack/react-query@10201

@tanstack/react-query-devtools

npm i https://pkg.pr.new/TanStack/query/@tanstack/react-query-devtools@10201

@tanstack/react-query-next-experimental

npm i https://pkg.pr.new/TanStack/query/@tanstack/react-query-next-experimental@10201

@tanstack/react-query-persist-client

npm i https://pkg.pr.new/TanStack/query/@tanstack/react-query-persist-client@10201

@tanstack/solid-query

npm i https://pkg.pr.new/TanStack/query/@tanstack/solid-query@10201

@tanstack/solid-query-devtools

npm i https://pkg.pr.new/TanStack/query/@tanstack/solid-query-devtools@10201

@tanstack/solid-query-persist-client

npm i https://pkg.pr.new/TanStack/query/@tanstack/solid-query-persist-client@10201

@tanstack/svelte-query

npm i https://pkg.pr.new/TanStack/query/@tanstack/svelte-query@10201

@tanstack/svelte-query-devtools

npm i https://pkg.pr.new/TanStack/query/@tanstack/svelte-query-devtools@10201

@tanstack/svelte-query-persist-client

npm i https://pkg.pr.new/TanStack/query/@tanstack/svelte-query-persist-client@10201

@tanstack/vue-query

npm i https://pkg.pr.new/TanStack/query/@tanstack/vue-query@10201

@tanstack/vue-query-devtools

npm i https://pkg.pr.new/TanStack/query/@tanstack/vue-query-devtools@10201

commit: 596aa17

github-actions · 2026-03-01T12:58:23Z

size-limit report 📦

Path	Size
react full	11.92 KB (0%)
react minimal	8.95 KB (0%)

renovate bot added the dependencies Pull requests that update a dependency file label Mar 1, 2026

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch 5 times, most recently from 46d27e6 to 0a68737 Compare March 1, 2026 21:09

chore(deps): update dependency svelte to v5.53.5 [security]

2793f5c

renovate bot force-pushed the renovate/npm-svelte-vulnerability branch from 0a68737 to 2793f5c Compare March 2, 2026 01:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update dependency svelte to v5.53.5 [security]#10201

chore(deps): update dependency svelte to v5.53.5 [security]#10201
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-svelte-vulnerability

renovate bot commented Mar 1, 2026

Uh oh!

changeset-bot bot commented Mar 1, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Mar 1, 2026

Review skipped

Uh oh!

nx-cloud bot commented Mar 1, 2026 •

edited

Loading

Uh oh!

pkg-pr-new bot commented Mar 1, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 1, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate bot commented Mar 1, 2026

GitHub Vulnerability Alerts

Release Notes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Configuration

Uh oh!

changeset-bot bot commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai bot commented Mar 1, 2026

Review skipped

Uh oh!

nx-cloud bot commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new bot commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

size-limit report 📦

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

changeset-bot bot commented Mar 1, 2026 •

edited

Loading

nx-cloud bot commented Mar 1, 2026 •

edited

Loading

pkg-pr-new bot commented Mar 1, 2026 •

edited

Loading

github-actions bot commented Mar 1, 2026 •

edited

Loading