svelte@4.2.20
Review before merging.
6 known advisories (worst: moderate), no fixed version found on this major.
Why this verdict
- 6 known advisories (worst: moderate), no fixed version found on this major.Evidence
Confidence 100% · algorithm v1 · computed 2026-10-19. How verdicts work
Supply chain and security
- Malware reports
- None known (OSV)
- Known advisories
- 6 known
- License
- MIT
- Install scripts
- None
- Build provenance
- No provenance
- Weekly downloads
- 163,628
- GHSA-crpf-4hrx-3jrpSvelte SSR attribute spreading includes inherited properties from prototype chain
- GHSA-f7gr-6p89-r883Svelte affected by cross-site scripting via spread attributes in Svelte SSR
- GHSA-m56q-vw4c-c2cpSvelte SSR does not validate dynamic element tag names in `<svelte:element>`
- GHSA-phwv-c562-gvmhSvelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
- GHSA-pr6f-5x2q-rwfpSvelte SSR vulnerable to cross-site scripting via spread attributes
- GHSA-rcqx-6q8c-2c42Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
Compatibility
No compatibility boundary is crossed: this is a patch or minor release on a stable major.
0 issues mention this version in sveltejs/svelte within 14 days of release. See them on GitHub
Check the official release notes below for behaviour changes before merging.
Release notes
Read the Svelte changelog on Changes.Watch or the package page on npm for this version’s features and fixes.
Deprecations and deadlines
The maintainer has not deprecated this version on npm.