Svelte 4.0.1 represents a minor, yet important, update to the Svelte 4 framework, building upon the foundation laid by version 4.0.0. Both versions share the core purpose of enabling developers to create "cybernetically enhanced web apps" with efficiency and performance. Examining the differences reveals subtle improvements primarily concentrated in the dependency updates, reflecting a commitment to staying current with the broader JavaScript ecosystem.
Specifically, svelte@4.0.1 upgrades acorn from version 8.8.2 to 8.9.0, aria-query from 5.2.1 to 5.3.0, several devDependencies like jsdom, rollup, vitest, typescript, and @playwright/test to newer releases. Most notably, @rollup/plugin-node-resolve experiences a jump from 15.0.2 to 15.1.0. These dependency bumps typically incorporate bug fixes, performance enhancements, and new features within those respective libraries. Developers benefit from these updates indirectly through a more reliable and performant Svelte development experience. While the core Svelte compiler functionality remains largely consistent, these upgrades contribute to the overall stability and modern tooling integration of the framework. For teams already using Svelte 4.0.0, upgrading to 4.0.1 is recommended to leverage these dependency improvements. No major breaking changes are expected in a patch version update, ensuring a smooth transition. The slightly smaller file count yet bigger unpacked size may indicate changes in asset handling or packaging within the release.
All the vulnerabilities related to the version 4.0.1 of the package
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag