Svelte version 3.50.0 brings a few notable changes compared to its predecessor, 3.49.0, primarily in its development dependencies and file size. The most significant difference is in the increased unpacked size of the package–growing from 7.2 MB in 3.49.0 to 8.7 MB in 3.50.0 (1.5MB difference). A subtle change is on the source-map dependency, that was updated from version 0.7.3 to 0.7.4.
For developers using Svelte, these changes mean a potentially larger initial download and build size, though the impact on runtime performance should be minimal. The updated source-map support may improve debugging experiences, offering more precise mappings from compiled code back to the original source. Developers should be aware of these file size implications, especially in resource-constrained environments, but might also benefit from potentially improved source map accuracy.
The core functionality and developer experience of Svelte is likely to remain consistent between these two versions, so upgrading shouldn't require significant code changes. However, it's always recommended to review the official changelog for the most comprehensive and up-to-date information on specific bug fixes or feature enhancements included in the 3.50.0 release. Keeping dependencies updated is important for modern web development.
All the vulnerabilities related to the version 3.50.0 of the package
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag