svelte@5.55.7

sveltejs/sveltesvelte@5.55.7May 14, 2026by github-actions[bot]

AI Summary

Security-focused patch release that fixes an XSS vulnerability in `hydratable` content and hardens SSR attribute handling.

Key Highlights

Fix XSS on `hydratable` from user contents
Disallow empty attribute names during SSR
Move Svelte runtime properties to symbols
Bump devalue dependency

Full Release Notes

### Patch Changes

-   fix: prevent XSS on `hydratable` from user contents ([`a16ebc67bbcf8f708360195687e1b2719463e1a4`](https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4))

-   chore: bump devalue ([#18219](https://github.com/sveltejs/svelte/pull/18219))

-   fix: disallow empty attribute names during SSR ([`547853e2406a2147ad7fb5ffeba95b01bd9642da`](https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da))

-   fix: harden regex ([`d2375e2ebcab5c88feb5652f1a9d621b8f06b259`](https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259))

-   fix: move Svelte runtime properties to symbols ([`e1cbbd96441e82c9eb8a23a2903c0d06d3cda991`](https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991))