Svelte version 4.0.4 is a minor patch release following version 4.0.3, both iterations of the JavaScript framework designed for building reactive web applications, described as "Cybernetically enhanced web apps". A quick glance at the dependencies and devDependencies reveals no functional changes, with both versions pinning the same versions of underlying packages like acorn, code-red, rollup, and typescript demonstrating stability in the core toolchain. Users relying on specific versions of these packages are unlikely to experience any breaking changes due to dependency updates. The core difference lies in the "dist" section, specifically the "unpackedSize" property, which decreased from 2,621,865 bytes in version 4.0.3 to 2,621,843 bytes in version 4.0.4. Although the difference represents a very small optimization, the fileCount maintains the same number between the two updates. The updated releaseDate reflects a newer build and publish time for 4.0.4.
For developers considering an upgrade, the changes appear minimal, likely addressing small bugs or performance tweaks. The mirrored dependency structure suggests a safe and straightforward update, without the need for extensive regression testing if you're working with the svelte framework. Users can upgrade confidently, expecting a seamless transition with potentially subtle performance improvements to their svelte applications. It's always a good practice to check specific release notes or commit logs for the exact changes, but based on differences here, it doesn't include any breaking changes or dependency alterations.
All the vulnerabilities related to the version 4.0.4 of the package
Svelte has a potential mXSS vulnerability due to improper HTML escaping
A potential XSS vulnerability exists in Svelte for versions prior to 4.2.19.
Svelte improperly escapes HTML on server-side rendering. It converts strings according to the following rules:
" -> "& -> &< -> <& -> &The assumption is that attributes will always stay as such, but in some situation the final DOM tree rendered on browsers is different from what Svelte expects on server-side rendering. This may be leveraged to perform XSS attacks. More specifically, this can occur when injecting malicious content into an attribute within a <noscript> tag.
A vulnerable page (+page.svelte):
<script>
import { page } from "$app/stores"
// user input
let href = $page.url.searchParams.get("href") ?? "https://example.com";
</script>
<noscript>
<a href={href}>test</a>
</noscript>
If a user accesses the following URL,
http://localhost:4173/?href=</noscript><script>alert(123)</script>
then, alert(123) will be executed.
XSS, when using an attribute within a noscript tag