Svelte 3.51.0 represents a minor version update over its predecessor, 3.50.1, offering subtle improvements and refinements to this popular JavaScript compiler that transforms your code into highly efficient vanilla JavaScript. While the core "Cybernetically enhanced web apps" description remains consistent, developers will find value in examining the nuanced changes.
A significant area of divergence lies within the dist section, specifically in the fileCount and unpackedSize. Version 3.51.0 registers a fileCount of 248 and an unpackedSize of 8870949 compared to the prior version's 247 files and 8800726 unpacked size. The increase in file count and unpacked size suggests the addition of new features, updated assets or expanded documentation.
The dependencies appear largely identical, indicating stability in the underlying tooling. However, developers are encouraged to run their applications through their test suites to ensure compatibility in their specific environment. Though often invisible, updates like this are vital for continuous improvement, refinement of internal mechanisms and the general health of the Svelte ecosystem.
Ultimately, upgrading from 3.50.1 to 3.51.0 is advisable for developers seeking the latest enhancements, bug fixes and performance tweaks that contribute to a smoother and more efficient Svelte development experience. Always review the changelog posted by the Svelte team for any specific upgrade procedures, deprecation warnings and feature announcements.
All the vulnerabilities related to the version 3.51.0 of the package
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag