Svelte version 3.54.0 introduces a refined development experience compared to its predecessor, 3.53.1, primarily focusing on internal optimizations and tooling improvements rather than groundbreaking new features. While the core functionality remains consistent, developers upgrading should note the subtle enhancements in areas like build processes and potential performance tweaks. One key aspect that might interest developers is the updated packed size: it has increased from 9667546 to 9673183, indicating internal changes in the packaging and build process. Even though the number does not seem relevant, developers should always focus on performance and test their builds after each update.
Both versions share an identical set of development dependencies, ensuring a consistent tooling ecosystem. This includes essential packages like rollup for bundling, typescript for type checking, eslint for code linting, and various Rollup plugins that facilitate the transformation and optimization of Svelte components. The consistent dependency list implies that the upgrade primarily focuses on refining the Svelte compiler and runtime, rather than introducing new external dependencies.
Crucially, the svelte package remains committed to its core philosophy of providing a cybernetically enhanced web app development experience, empowering developers to build high-performance, reactive user interfaces with a focus on simplicity and efficiency. Version 3.54.0 reinforces this commitment through subtle under-the-hood improvements, while maintaining compatibility with existing projects built on version 3.53.1. Developers who use this library should be aware of each upgrade and test the new builds.
All the vulnerabilities related to the version 3.54.0 of the package
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag