chore(deps): update dependency svelte to v5.55.7 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
svelte (source)	5.55.3 → 5.55.7

---

Svelte SSR vulnerable to cross-site scripting via spread attributes

CVE-2026-42599 / GHSA-pr6f-5x2q-rwfp

More information

Details

When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability only triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires.

This is similar to but different from CVE-2026-27121.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

References

• https://github.com/sveltejs/svelte/security/advisories/GHSA-pr6f-5x2q-rwfp
• https://nvd.nist.gov/vuln/detail/CVE-2026-27121
• https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7
• https://nvd.nist.gov/vuln/detail/CVE-2026-42599
• https://github.com/advisories/GHSA-pr6f-5x2q-rwfp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State

CVE-2026-42573 / GHSA-rcqx-6q8c-2c42

More information

Details

Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.

You are vulnerable if all of the following is true:

• you are using attribute spreading on a form element
• you are using attribute spreading or allow a dynamic value for the name attribute on an input or button element within that form
• both of these are simultaneously user-controllable

<form {...spread1}>
  <input {...spread2}>
</form>

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N

References

• https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42
• https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7
• https://nvd.nist.gov/vuln/detail/CVE-2026-42573
• https://github.com/advisories/GHSA-rcqx-6q8c-2c42

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Svelte: SSR XSS via Insecure Promise Serialization in hydratable

GHSA-f3cj-j4f6-wq85

More information

Details

Contents of hydratable promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:

• you are using hydratable (an experimental feature at the time of this report)
• you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. hydratable('someKey', () => [synchronousValue, promiseValue])

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

References

• https://github.com/sveltejs/svelte/security/advisories/GHSA-f3cj-j4f6-wq85
• https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4
• http://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7
• https://github.com/advisories/GHSA-f3cj-j4f6-wq85

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

sveltejs/svelte (svelte)

v5.55.7

Compare Source

Patch Changes

• fix: prevent XSS on hydratable from user contents (a16ebc67bbcf8f708360195687e1b2719463e1a4)

• chore: bump devalue (#​18219)

• fix: disallow empty attribute names during SSR (547853e2406a2147ad7fb5ffeba95b01bd9642da)

• fix: harden regex (d2375e2ebcab5c88feb5652f1a9d621b8f06b259)

• fix: move Svelte runtime properties to symbols (e1cbbd96441e82c9eb8a23a2903c0d06d3cda991)

v5.55.6

Compare Source

Patch Changes

• fix: leave stale promises to wait for a later resolution, instead of rejecting (#​18180)

• fix: keep dependencies of $state.eager/pending (#​18218)

• fix: reapply context after transforming error during SSR (#​18099)

• fix: don't rebase just-created batches (#​18117)

• chore: allow null for pending in typings (#​18201)

• fix: flush eager effects in production (#​18107)

• fix: rethrow error of failed iterable after calling return() (#​18169)

• fix: account for proxified instance when updating bind:this (#​18147)

• fix: ensure scheduled batch is flushed if not obsolete (#​18131)

• fix: resolve stale deriveds with latest value (#​18167)

• chore: remove unnecessary increment_pending calls (#​18183)

• fix: correctly compile component member expressions for SSR (#​18192)

• fix: reset source.updated stack traces after flush (#​18196)

• fix: replacing async 'blocking' strategy with 'merging' (#​18205)

• fix: allow @debug tags to reference awaited variables (#​18138)

• fix: re-run fallback props if dependencies update (#​18146)

• fix: abort running obsolete async branches (#​18118)

• fix: ignore comments when reading CSS values (#​18153)

• fix: wrap Promise.all in save during SSR (#​18178)

• fix: ignore false-positive errors of $inspect dependencies (#​18106)

v5.55.5

Compare Source

Patch Changes

• fix: don't mark deriveds while an effect is updating (#​18124)

• fix: do not dispatch introstart event with animation of animate directive (#​18122)

v5.55.4

Compare Source

Patch Changes

• fix: never mark a child effect root as inert (#​18111)

• fix: reset context after waiting on blockers of @const expressions (#​18100)

• fix: keep flushing new eager effects (#​18102)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

E2E tests are running

Authorization passed for this commit. See the E2E Tests workflow for results.

[github-actions]

Site preview

Preview: https://60e293b6-site.fullsend-ai.workers.dev

Commit: 1e7551a7688f83f12beadbedc43a580b5967e8db

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:26 AM UTC · Completed 8:33 AM UTC
Commit: 5be0370 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Looks good to me

---

Labels: Dependency lockfile update addressing 3 Svelte XSS CVEs.

Previous run

Looks good to me

---

Labels: Dependency lockfile update addressing 3 Svelte XSS CVEs.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:36 AM UTC · Completed 11:42 AM UTC
Commit: 1e7551a · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 11:58 AM UTC · Completed 12:03 PM UTC
Commit: 1e7551a · View workflow run →

[fullsend-ai-retro]

Retro: PR #2481 — Renovate svelte security update

This was a straightforward Renovate bot PR updating svelte from 5.55.3 to 5.55.7 to address 3 medium-severity XSS CVEs. The only file changed was package-lock.json (7 additions, 7 deletions).

Timeline

1. 08:22Z — Renovate bot opened the PR
2. 08:26–08:33Z — First review agent run (run 27939379622) approved with "Looks good to me"
3. 08:28Z — Human (rh-hemartin) approved
4. 08:33Z — PR removed from merge queue (likely due to check failure or queue invalidation)
5. 11:32Z — rh-hemartin force-pushed the branch (same commit SHA, likely a rebase onto updated main)
6. 11:33–11:42Z — Second review agent run (run 27949609374) approved again with identical verdict
7. 11:54Z — PR merged

Assessment

The workflow completed successfully with no rework. The review agent correctly identified this as a trivial lockfile-only dependency bump both times. Two areas of token waste were observed:

1. Redundant second review — The force push at 11:32Z re-triggered a full review despite no code change. The review agent produced the same verdict. This is a known issue covered by multiple open tickets.
2. Full review for trivial bot PR — A lockfile-only Renovate security update doesn't need the full review agent pipeline. A lightweight fast-path would save tokens.

Existing coverage

All potential proposals are already tracked by open issues — no new proposals needed:

• Dedup reviews on force push with no code change: #1452, #1372, #963, #1355
• Lightweight review path for bot dependency bumps: #1358, #1371
• Skip retro for bot-authored review-only PRs: #1630, #939