Update dependency svelte to v5.56.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
svelte (source)	5.55.4 → 5.56.3

---

Release Notes

sveltejs/svelte (svelte)

v5.56.3

Compare Source

Patch Changes

• fix: ignore errors that occur in destroyed effects (#​18384)

• fix: type BigInts in $state.snapshot(...) return values (#​18388)

v5.56.2

Compare Source

Patch Changes

• fix: properly track effect end node for async sibling component (#​18371)

• fix: prevent false-positive reactivity loss warning (#​18373)

• chore: bump esrap dependency (#​18372)

• fix: ignore declaration tags for animation directive (#​18366)

• fix: reject pending async deriveds on discard (#​18308)

v5.56.1

Compare Source

Patch Changes

• fix: error at compile time on duplicate snippet/declaration tag definitions (#​18351)

• fix: parse declaration tag contents more robustly (#​18353)

• fix: correctly transform references to earlier declarators in a declaration tag (e.g. {let a = $state(0), b = $derived(a * 2)}) (#​18348)

• fix: avoid spurious state_referenced_locally warnings for $derived declarations in declaration tags (#​18348)

• fix: tolerate whitespace before let/const in declaration tags (#​18348)

• fix: prevent infinite loop when a tag's expression ends with a trailing / at the end of the input (#​18350)

• fix: more robust parsing of declaration tags with regards to type (#​18330)

• fix: preserve newlines in spread input values when the type attribute is applied after value (#​18345)

• fix: update SvelteURLSearchParams when setting duplicate keys to the same joined value (#​18336)

• fix: check references for blockers on server, too (#​18352)

v5.56.0

Compare Source

Minor Changes

• feat: allow declarations in the template (#​18282)

Patch Changes

• perf: use createElement instead of createElementNS for HTML elements (#​18262)

• perf: store current_sources as a Set for O(1) membership checks (#​18278)

• perf: deduplicate identical hoisted templates within a component (#​18320)

• perf: hoist rest_props exclude list as a module-scope Set (#​18252)

v5.55.10

Compare Source

Patch Changes

• fix: unlink errored and otherwise finished batch (#​18264)

• perf: walk composedPath() directly in delegated event propagation (#​18268)

• fix: transfer effects when merging batches (#​18254)

• fix: allow $derived(await ...) in disconnected effect roots (#​18273)

• fix: remove temporary raw-text hydration markers (#​18269)

• fix: propagate async @const blockers through closure references so template expressions like {(() => host)()} correctly wait for the awaited value (#​18309)

• fix: properly unlink batches (#​18298)

• fix: settle discarded batch (#​18290)

• fix: declare let: directives before {@​const} declarations on slotted elements (#​18271)

• fix: resume outro-ed branches if they were kept around (#​18291)

• fix: avoid waterfall-warning when async resolves to same value (#​18297)

• fix: correctly coordinate component-level effects inside async blocks (#​18260)

• fix: make unnecessary commit work less likely (#​18263)

• chore: add tag name to a11y_click_events_have_key_events warning (#​18272)

• fix: catch rejected promises while merging/committing (#​18266)

v5.55.9

Compare Source

Patch Changes

• fix: don't unset batch when calling {#await ...} promise (#​18243)

• fix: promise-ify {#await await ...} expressions on the server and correctly hydrate them on the client (#​18243)

• fix: deduplicate dependencies that are added outside the init/update cycle (#​18243)

• fix: avoid false-positive batch invariant error (#​18246)

• fix: inline primitive constants in attribute values during SSR (#​18232)

v5.55.8

Compare Source

Patch Changes

• fix(print): handle svelte:body and fix keyframe percentage double-printing (#​18234)

• fix: execute uninitialized derived even if it's destroyed (#​18228)

• fix: use named symbols everywhere (#​18238)

• fix: don't run teardown effects when deriveds are unfreezed (#​18227)

• fix: unset context synchronously in run (#​18236)

v5.55.7

Compare Source

Patch Changes

• fix: prevent XSS on hydratable from user contents (a16ebc67bbcf8f708360195687e1b2719463e1a4)

• chore: bump devalue (#​18219)

• fix: disallow empty attribute names during SSR (547853e2406a2147ad7fb5ffeba95b01bd9642da)

• fix: harden regex (d2375e2ebcab5c88feb5652f1a9d621b8f06b259)

• fix: move Svelte runtime properties to symbols (e1cbbd96441e82c9eb8a23a2903c0d06d3cda991)

v5.55.6

Compare Source

Patch Changes

• fix: leave stale promises to wait for a later resolution, instead of rejecting (#​18180)

• fix: keep dependencies of $state.eager/pending (#​18218)

• fix: reapply context after transforming error during SSR (#​18099)

• fix: don't rebase just-created batches (#​18117)

• chore: allow null for pending in typings (#​18201)

• fix: flush eager effects in production (#​18107)

• fix: rethrow error of failed iterable after calling return() (#​18169)

• fix: account for proxified instance when updating bind:this (#​18147)

• fix: ensure scheduled batch is flushed if not obsolete (#​18131)

• fix: resolve stale deriveds with latest value (#​18167)

• chore: remove unnecessary increment_pending calls (#​18183)

• fix: correctly compile component member expressions for SSR (#​18192)

• fix: reset source.updated stack traces after flush (#​18196)

• fix: replacing async 'blocking' strategy with 'merging' (#​18205)

• fix: allow @debug tags to reference awaited variables (#​18138)

• fix: re-run fallback props if dependencies update (#​18146)

• fix: abort running obsolete async branches (#​18118)

• fix: ignore comments when reading CSS values (#​18153)

• fix: wrap Promise.all in save during SSR (#​18178)

• fix: ignore false-positive errors of $inspect dependencies (#​18106)

v5.55.5

Compare Source

Patch Changes

• fix: don't mark deriveds while an effect is updating (#​18124)

• fix: do not dispatch introstart event with animation of animate directive (#​18122)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 9pm on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	svelte@​5.56.3

View full report

[github-actions]

Project	Preview URL1	Manage
Limber	https://renovate-svelte-5.x-lockfile.limber-glimdown.pages.dev	on Cloudflare
Tutorial	https://renovate-svelte-5.x-lockfile.limber-glimmer-tutorial.pages.dev	on Cloudflare

Logs

Footnotes

1. if these branch preview links are not working, please check the logs for the commit-based preview link. There is a character limit of 28 for the branch subdomain, as well as some other heuristics, described here for the sake of implementation ease in deploy-preview.yml, that algo has been omitted. The URLs are logged in the wrangler output, but it's hard to get outputs from a matrix job. ↩

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm js-yaml is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@nullvoxpopuli/eslint-configs@5.5.0 → npm/js-yaml@4.2.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-yaml@4.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm svelte is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: apps/repl/package.json → npm/svelte@5.56.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/svelte@5.56.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report