fix: always unset reactivity context after restoring it - #18453
Merged
Conversation
When calling `save`, we restore the context after the promise resolves. But we do not unset it after the subsequent synchronous execution. That means that until `unset_context` runs in `async_derived` we will not have the correct (nulled) context. That causes problems if the `save` isn't the last promise contributing to the `async_derived`, because it means the context is not properly unset until the promise _after_ the `save` within the `async_derived` settles. This can cause all sorts of mixups, including a wrong mutation error. fixes #18441
🦋 Changeset detectedLatest commit: 3677597 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
dummdidumm
commented
Jun 22, 2026
dummdidumm
left a comment
dummdidumm
left a comment
Member
Author
There was a problem hiding this comment.
Note: In very very unfortunate (and narrow) circumstances a queued microtask could resolve before our own queued one runs, and if that task contains a source write it could still cause problems. But it's unavoidable in the way this works I fear.
Contributor
|
Rich-Harris
approved these changes
Jun 22, 2026
Rich-Harris
left a comment
Rich-Harris
left a comment
Member
There was a problem hiding this comment.
another thing we could maybe do is pass a () => Promise to save rather than a Promise, and unset the context immediately after calling it. But this is probably the lesser evil
Merged
Rich-Harris
pushed a commit
that referenced
this pull request
Jun 23, 2026
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.56.4 ### Patch Changes - fix: include wrapping parentheses in `{@const}` declarator `end` position ([#18436](#18436)) - fix: always unset reactivity context after restoring it ([#18453](#18453)) - fix: don't notify `searchParams` subscribers when the URL changes without affecting the search string ([#18425](#18425)) - fix: strip `?` from optional parameters in `<script lang="ts">` so generated JavaScript is valid ([#18448](#18448)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
DevonCash
added a commit
to corvmc/corvmc.org
that referenced
this pull request
Jul 31, 2026
…153) * Upgrade svelte to 5.56.8 fixing dead create-band modal after SPA nav With compilerOptions.experimental.async, declarations after a page script's top-level await compile as "blocked": initialized in a post-await continuation, with dependent template expressions wrapped in async blocks. Svelte <=5.56.3 leaked reactivity context when restoring it around async work (sveltejs/svelte#18453); a client-side navigation to /member/bands during the member layout's settling window (e.g. right after login) could leave the create-band Modal's async block permanently uncommitted — the header button rendered and its onclick ran, but the Modal component never mounted, so the dialog appeared dead. Reproduced ~80% of the time in headless Chromium; timing usually hid it in headed browsers. The same bug family caused the production NotificationBell crash "Cannot read properties of undefined (reading 'f')" (Sentry Q/1A): the svelte:window click handler attached before the blocked declarations initialized, and the destroyed guard read undefined so it never protected. Bisect on the local repro: 5.56.2 fail, 5.56.3 fail (crash silenced by #18384 but modal still dead), 5.56.4 pass, 5.56.8 pass. Adds e2e/create-band-modal.e2e.ts, which navigates client-side immediately after login (the turbulent window) and asserts the dialog mounts with no page errors, and corrects the Q/1A root-cause note in the Sentry triage report. * Fix dead ?create=1 create-band modal; restore real click in e2e The sidebar "Create Band" links (?create=1) never opened the modal: the page's $effect-based URL wiring was declared after the top-level await, so it compiled as a blocked declaration whose async-gated wiring never fired — broken on every path (full load and client-side nav), no errors thrown. Declaring the state before the await and deriving it from the URL fixes the full-load and settled-navigation paths. One svelte experimental-async gap remains on 5.56.8: a client-side navigation that lands while the member layout's async queries are still settling commits the new page's DOM with working listeners but skips its init-time effects entirely (including bits-ui Portal's watch), so a dialog already open at subtree init can never mount its content. Verified empirically: $effect, $state-seeded-at-init, and writable-$derived wirings all fail in that window, while post-commit open flips (the header button) work. The sidebar links therefore carry data-sveltekit-reload — a full document load initializes deterministically. Nav.Item now forwards rest attributes to its anchor to support that. The band-onboarding e2e test now clicks the actual sidebar link immediately after login (the turbulent window) and asserts the dialog mounts, replacing the page.goto workaround that skipped the dialog assertion.
jquagga
added a commit
to jquagga/swa
that referenced
this pull request
Aug 2, 2026
* Remove github dependencies on the codeberg version
* Url changes to codeberg (#2)
Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/2
* chore(deps): update all non-major dependencies (#3)
* chore(deps): lock file maintenance (#4)
This PR contains the following updates:
| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |
🔧 This Pull Request updates lock files to use the latest dependency versions.
---
### Configuration
📅 **Schedule**: (in timezone America/New_York)
- Branch creation
- "before 4am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzYuNyIsInVwZGF0ZWRJblZlciI6IjQzLjE3Ni43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/4
* Switch from npm to pnpm for building (#5)
Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/5
* chore(deps): update dependency svelte to v5.55.7 [security] (#6)
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [svelte](https://svelte.dev) ([source](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte)) | [`5.55.5` → `5.55.7`](https://renovatebot.com/diffs/npm/svelte/5.55.5/5.55.7) |  |  |  |  |
---
### Svelte: ReDoS in `<svelte:element>` Tag Validation
[CVE-2026-42567](https://nvd.nist.gov/vuln/detail/CVE-2026-42567) / [GHSA-9rmh-mm8f-r9h6](https://github.com/advisories/GHSA-9rmh-mm8f-r9h6)
<details>
<summary>More information</summary>
#### Details
An internal regex in the Svelte runtime can take exponential time to test in `<svelte:element this={tag}></svelte:element>`. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their length before passing them to `svelte:element`, you are safe.
#### Severity
- CVSS Score: 5.9 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`
#### References
- [https://github.com/sveltejs/svelte/security/advisories/GHSA-9rmh-mm8f-r9h6](https://github.com/sveltejs/svelte/security/advisories/GHSA-9rmh-mm8f-r9h6)
- [https://github.com/sveltejs/svelte](https://github.com/sveltejs/svelte)
- [https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7](https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7)
This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-9rmh-mm8f-r9h6) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
---
### Svelte: SSR XSS via Insecure Promise Serialization in hydratable
[GHSA-f3cj-j4f6-wq85](https://github.com/advisories/GHSA-f3cj-j4f6-wq85)
<details>
<summary>More information</summary>
#### Details
Contents of `hydratable` promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:
- you are using `hydratable` (an experimental feature at the time of this report)
- you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. `hydratable('someKey', () => [synchronousValue, promiseValue])`
#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N`
#### References
- [https://github.com/sveltejs/svelte/security/advisories/GHSA-f3cj-j4f6-wq85](https://github.com/sveltejs/svelte/security/advisories/GHSA-f3cj-j4f6-wq85)
- [https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4](https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4)
- [https://github.com/sveltejs/svelte](https://github.com/sveltejs/svelte)
- [http://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7](http://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7)
This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-f3cj-j4f6-wq85) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
---
### Svelte SSR vulnerable to cross-site scripting via spread attributes
[CVE-2026-42599](https://nvd.nist.gov/vuln/detail/CVE-2026-42599) / [GHSA-pr6f-5x2q-rwfp](https://github.com/advisories/GHSA-pr6f-5x2q-rwfp)
<details>
<summary>More information</summary>
#### Details
When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability _only_ triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires.
This is similar to but different from [CVE-2026-27121](https://nvd.nist.gov/vuln/detail/CVE-2026-27121).
#### Severity
- CVSS Score: 5.1 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N`
#### References
- [https://github.com/sveltejs/svelte/security/advisories/GHSA-pr6f-5x2q-rwfp](https://github.com/sveltejs/svelte/security/advisories/GHSA-pr6f-5x2q-rwfp)
- [https://nvd.nist.gov/vuln/detail/CVE-2026-27121](https://nvd.nist.gov/vuln/detail/CVE-2026-27121)
- [https://github.com/sveltejs/svelte](https://github.com/sveltejs/svelte)
- [https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7](https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7)
This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-pr6f-5x2q-rwfp) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
---
### Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
[CVE-2026-42573](https://nvd.nist.gov/vuln/detail/CVE-2026-42573) / [GHSA-rcqx-6q8c-2c42](https://github.com/advisories/GHSA-rcqx-6q8c-2c42)
<details>
<summary>More information</summary>
#### Details
Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.
You are vulnerable if all of the following is true:
- you are using attribute spreading on a form element
- you are using attribute spreading or allow a dynamic value for the `name` attribute on an input or button element within that form
- both of these are simultaneously user-controllable
```svelte
<form {...spread1}>
<input {...spread2}>
</form>
```
#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N`
#### References
- [https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42](https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42)
- [https://github.com/sveltejs/svelte](https://github.com/sveltejs/svelte)
- [https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7](https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7)
This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-rcqx-6q8c-2c42) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>
---
### Release Notes
<details>
<summary>sveltejs/svelte (svelte)</summary>
### [`v5.55.7`](https://github.com/sveltejs/svelte/blob/HEAD/packages/svelte/CHANGELOG.md#5557)
[Compare Source](https://github.com/sveltejs/svelte/compare/svelte@5.55.6...svelte@5.55.7)
##### Patch Changes
- fix: prevent XSS on `hydratable` from user contents ([`a16ebc67bbcf8f708360195687e1b2719463e1a4`](https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4))
- chore: bump devalue ([#​18219](https://github.com/sveltejs/svelte/pull/18219))
- fix: disallow empty attribute names during SSR ([`547853e2406a2147ad7fb5ffeba95b01bd9642da`](https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da))
- fix: harden regex ([`d2375e2ebcab5c88feb5652f1a9d621b8f06b259`](https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259))
- fix: move Svelte runtime properties to symbols ([`e1cbbd96441e82c9eb8a23a2903c0d06d3cda991`](https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991))
### [`v5.55.6`](https://github.com/sveltejs/svelte/blob/HEAD/packages/svelte/CHANGELOG.md#5556)
[Compare Source](https://github.com/sveltejs/svelte/compare/svelte@5.55.5...svelte@5.55.6)
##### Patch Changes
- fix: leave stale promises to wait for a later resolution, instead of rejecting ([#​18180](https://github.com/sveltejs/svelte/pull/18180))
- fix: keep dependencies of `$state.eager/pending` ([#​18218](https://github.com/sveltejs/svelte/pull/18218))
- fix: reapply context after transforming error during SSR ([#​18099](https://github.com/sveltejs/svelte/pull/18099))
- fix: don't rebase just-created batches ([#​18117](https://github.com/sveltejs/svelte/pull/18117))
- chore: allow `null` for `pending` in typings ([#​18201](https://github.com/sveltejs/svelte/pull/18201))
- fix: flush eager effects in production ([#​18107](https://github.com/sveltejs/svelte/pull/18107))
- fix: rethrow error of failed iterable after calling `return()` ([#​18169](https://github.com/sveltejs/svelte/pull/18169))
- fix: account for proxified instance when updating `bind:this` ([#​18147](https://github.com/sveltejs/svelte/pull/18147))
- fix: ensure scheduled batch is flushed if not obsolete ([#​18131](https://github.com/sveltejs/svelte/pull/18131))
- fix: resolve stale deriveds with latest value ([#​18167](https://github.com/sveltejs/svelte/pull/18167))
- chore: remove unnecessary `increment_pending` calls ([#​18183](https://github.com/sveltejs/svelte/pull/18183))
- fix: correctly compile component member expressions for SSR ([#​18192](https://github.com/sveltejs/svelte/pull/18192))
- fix: reset `source.updated` stack traces after `flush` ([#​18196](https://github.com/sveltejs/svelte/pull/18196))
- fix: replacing async 'blocking' strategy with 'merging' ([#​18205](https://github.com/sveltejs/svelte/pull/18205))
- fix: allow `@debug` tags to reference awaited variables ([#​18138](https://github.com/sveltejs/svelte/pull/18138))
- fix: re-run fallback props if dependencies update ([#​18146](https://github.com/sveltejs/svelte/pull/18146))
- fix: abort running obsolete async branches ([#​18118](https://github.com/sveltejs/svelte/pull/18118))
- fix: ignore comments when reading CSS values ([#​18153](https://github.com/sveltejs/svelte/pull/18153))
- fix: wrap `Promise.all` in `save` during SSR ([#​18178](https://github.com/sveltejs/svelte/pull/18178))
- fix: ignore false-positive errors of `$inspect` dependencies ([#​18106](https://github.com/sveltejs/svelte/pull/18106))
</details>
---
### Configuration
📅 **Schedule**: (in timezone America/New_York)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4MC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJzZWN1cml0eSJdfQ==-->
Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/6
* chore(deps): update all non-major dependencies (#7)
* chore(deps): lock file maintenance (#8)
This PR contains the following updates:
| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |
🔧 This Pull Request updates lock files to use the latest dependency versions.
---
### Configuration
📅 **Schedule**: (in timezone America/New_York)
- Branch creation
- "before 4am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/8
* chore(deps): update all non-major dependencies (#9)
* chore(deps): update dependency svelte to v5.55.9 (#10)
* chore(deps): lock file maintenance (#11)
This PR contains the following updates:
| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |
🔧 This Pull Request updates lock files to use the latest dependency versions.
---
### Configuration
📅 **Schedule**: (in timezone America/New_York)
- Branch creation
- "before 4am on monday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/11
* chore(deps): update all non-major dependencies (#12)
* Small tidy updates (#13)
Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/13
* chore(deps): pin dependency @types/node to 25.9.1 (#14)
This PR contains the following updates:
| Package | Type | Update | Change | OpenSSF |
|---|---|---|---|---|
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | devDependencies | pin | [`^25.9.1` → `25.9.1`](https://renovatebot.com/diffs/npm/@types%2fnode/25.9.1/25.9.1) | [](https://securityscorecards.dev/viewer/?uri=github.com/DefinitelyTyped/DefinitelyTyped) |
⚠️ Renovate's pin functionality [does not currently](https://github.com/renovatebot/renovate/issues/40288) wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).
Add the preset `:preserveSemverRanges` to your config if you don't want to pin your dependencies.
---
### Configuration
📅 **Schedule**: (in timezone America/New_York)
- Branch creation
- "before 4am on sunday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDQuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIwNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/14
* Add setopt to the shellscript (#16)
Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/16
* chore(deps): lock file maintenance (#15)
* wrangler changes (#17)
Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/17
* renovate updates (#18)
Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/18
* Change User Agent to codeberg (#19)
Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/19
* chore(deps): update all dependencies (#20)
* chore(deps): update (#21)
This PR contains the following updates:
| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |
🔧 This Pull Request updates lock files to use the latest dependency versions.
---
### Configuration
📅 **Schedule**: (in timezone America/New_York)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTQuNiIsInVwZGF0ZWRJblZlciI6IjQzLjIxNC42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/21
* chore(deps): update all dependencies (#22)
* chore(deps): update (#23)
This PR contains the following updates:
| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |
🔧 This Pull Request updates lock files to use the latest dependency versions.
---
### Configuration
📅 **Schedule**: (in timezone America/New_York)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIyMi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/23
* chore(deps): update all dependencies (#24)
* chore(deps): update all dependencies (#25)
This PR contains the following updates:
| Package | Type | Update | Change | OpenSSF |
|---|---|---|---|---|
| [@sveltejs/kit](https://svelte.dev) ([source](https://github.com/sveltejs/kit/tree/HEAD/packages/kit)) | devDependencies | minor | [`2.66.0` → `2.68.0`](https://renovatebot.com/diffs/npm/@sveltejs%2fkit/2.66.0/2.68.0) | [](https://securityscorecards.dev/viewer/?uri=github.com/sveltejs/kit) |
| [@types/luxon](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/luxon) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/luxon)) | devDependencies | patch | [`3.7.1` → `3.7.2`](https://renovatebot.com/diffs/npm/@types%2fluxon/3.7.1/3.7.2) | [](https://securityscorecards.dev/viewer/?uri=github.com/DefinitelyTyped/DefinitelyTyped) |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | devDependencies | patch | [`25.9.3` → `25.9.4`](https://renovatebot.com/diffs/npm/@types%2fnode/25.9.3/25.9.4) | [](https://securityscorecards.dev/viewer/?uri=github.com/DefinitelyTyped/DefinitelyTyped) |
| [cookie](https://github.com/jshttp/cookie) | overrides | major | [`1.1.1` → `2.0.0`](https://renovatebot.com/diffs/npm/cookie/1.1.1/2.0.0) | [](https://securityscorecards.dev/viewer/?uri=github.com/jshttp/cookie) |
| [svelte](https://svelte.dev) ([source](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte)) | devDependencies | patch | [`5.56.3` → `5.56.4`](https://renovatebot.com/diffs/npm/svelte/5.56.3/5.56.4) | [](https://securityscorecards.dev/viewer/?uri=github.com/sveltejs/svelte) |
| [svelte-check](https://github.com/sveltejs/language-tools) | devDependencies | minor | [`4.6.0` → `4.7.1`](https://renovatebot.com/diffs/npm/svelte-check/4.6.0/4.7.1) | [](https://securityscorecards.dev/viewer/?uri=github.com/sveltejs/language-tools) |
| [vite](https://vite.dev) ([source](https://github.com/vitejs/vite/tree/HEAD/packages/vite)) | devDependencies | minor | [`8.0.16` → `8.1.0`](https://renovatebot.com/diffs/npm/vite/8.0.16/8.1.0) | [](https://securityscorecards.dev/viewer/?uri=github.com/vitejs/vite) |
| [wrangler](https://github.com/cloudflare/workers-sdk) ([source](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler)) | devDependencies | minor | [`4.102.0` → `4.105.0`](https://renovatebot.com/diffs/npm/wrangler/4.102.0/4.105.0) | [](https://securityscorecards.dev/viewer/?uri=github.com/cloudflare/workers-sdk) |
---
### Release Notes
<details>
<summary>sveltejs/kit (@​sveltejs/kit)</summary>
### [`v2.68.0`](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2680)
##### Minor Changes
- feat: expose `RemoteFormEnhanceInstance` and `RemoteFormEnhanceCallback` types ([#​15816](https://github.com/sveltejs/kit/pull/15816))
- feat: set value of `submit` fields when form is submitted ([#​15979](https://github.com/sveltejs/kit/pull/15979))
##### Patch Changes
- fix: skip `native_navigation` when `__data.json` returns 404 on a static fallback page ([#​16135](https://github.com/sveltejs/kit/pull/16135))
- fix: ignore third-party monkeypatches in `pushState`/`replaceState` warning detection ([#​15267](https://github.com/sveltejs/kit/pull/15267))
- fix: snapshot form fields on read ([#​16150](https://github.com/sveltejs/kit/pull/16150))
- fix: strip field prefix before erroring on duplicates ([#​16151](https://github.com/sveltejs/kit/pull/16151))
- fix: call reset function via prototype ([#​16138](https://github.com/sveltejs/kit/pull/16138))
- chore: fix navigation `type` hover info ([#​16147](https://github.com/sveltejs/kit/pull/16147))
### [`v2.67.0`](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2670)
[Compare Source](https://github.com/sveltejs/kit/compare/@sveltejs/kit@2.66.0...@sveltejs/kit@2.67.0)
##### Minor Changes
- feat: add `prerender.handleInvalidUrl` option for invalid URLs discovered while crawling ([#​16088](https://github.com/sveltejs/kit/pull/16088))
##### Patch Changes
- fix: support `exactOptionalPropertyTypes` for optional form schema fields ([#​15866](https://github.com/sveltejs/kit/pull/15866))
- fix: avoid unnecessarily overriding a user's Vite 8 `codeSplitting` setting ([#​16118](https://github.com/sveltejs/kit/pull/16118))
</details>
<details>
<summary>jshttp/cookie (cookie)</summary>
### [`v2.0.0`](https://github.com/jshttp/cookie/releases/tag/v2.0.0)
[Compare Source](https://github.com/jshttp/cookie/compare/v1.1.1...v2.0.0)
**Important:** This release moves the package to ESM only. In node 22+ you can `require(esm)`, and older node versions are not supported.
**Changed**
- Switch to ESM ([#​273](https://github.com/jshttp/cookie/pull/273))
- Remove deprecated code paths ([#​272](https://github.com/jshttp/cookie/pull/272))
- The old `parse` and `stringify` methods have been renamed: `parseCookie` and `stringifySetCookie`
- `stringifySetCookie` only supports object mode (e.g. `{ name: "", value: "" }`)
**Improvements**
- Faster stringify cookie ([#​262](https://github.com/jshttp/cookie/issues/262))
- Optimize encode performance ([#​269](https://github.com/jshttp/cookie/pull/269))
- Apply `encode` to empty cookie values ([#​277](https://github.com/jshttp/cookie/pull/277))
**Fixed**
- Omit leading semicolon when stringifying cookies with skipped values ([#​267](https://github.com/jshttp/cookie/issues/267))
</details>
<details>
<summary>sveltejs/svelte (svelte)</summary>
### [`v5.56.4`](https://github.com/sveltejs/svelte/blob/HEAD/packages/svelte/CHANGELOG.md#5564)
[Compare Source](https://github.com/sveltejs/svelte/compare/svelte@5.56.3...svelte@5.56.4)
##### Patch Changes
- fix: include wrapping parentheses in `{@​const}` declarator `end` position ([#​18436](https://github.com/sveltejs/svelte/pull/18436))
- fix: always unset reactivity context after restoring it ([#​18453](https://github.com/sveltejs/svelte/pull/18453))
- fix: don't notify `searchParams` subscribers when the URL changes without affecting the search string ([#​18425](https://github.com/sveltejs/svelte/pull/18425))
- fix: strip `?` from optional parameters in `<script lang="ts">` so generated JavaScript is valid ([#​18448](https://github.com/sveltejs/svelte/pull/18448))
</details>
<details>
<summary>sveltejs/language-tools (svelte-check)</summary>
### [`v4.7.1`](https://github.com/sveltejs/language-tools/releases/tag/svelte-check%404.7.1)
[Compare Source](https://github.com/sveltejs/language-tools/compare/svelte-check@4.7.0...svelte-check@4.7.1)
##### Patch Changes
- fix: correctly parse --tsgo-experimental-api flag ([#​3067](https://github.com/sveltejs/language-tools/pull/3067))
### [`v4.7.0`](https://github.com/sveltejs/language-tools/releases/tag/svelte-check%404.7.0)
[Compare Source](https://github.com/sveltejs/language-tools/compare/svelte-check@4.6.0...svelte-check@4.7.0)
##### Minor Changes
- feat: add `--config` option ([#​3066](https://github.com/sveltejs/language-tools/pull/3066))
- feat: svelte-check tsgo support with experimental api ([#​3036](https://github.com/sveltejs/language-tools/pull/3036))
##### Patch Changes
- fix: load esm version of Vite ([#​3065](https://github.com/sveltejs/language-tools/pull/3065))
- fix: stop excluding workspaces under dot-prefixed ancestors ([#​3037](https://github.com/sveltejs/language-tools/pull/3037))
- Updated dependencies \[[`7a3464b`](https://github.com/sveltejs/language-tools/commit/7a3464b54b997c703d5b60cc6ab1ed74c49efffc), [`a2561fc`](https://github.com/sveltejs/language-tools/commit/a2561fc2c52bdcd0bad746261222196fd94d5396)]:
- [@​sveltejs/load-config](https://github.com/sveltejs/load-config)@​0.2.0
</details>
<details>
<summary>vitejs/vite (vite)</summary>
### [`v8.1.0`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#810-2026-06-23)
[Compare Source](https://github.com/vitejs/vite/compare/v8.0.16...v8.1.0)
##### Features
- extend `server.fs.deny` list with common files ([#​22707](https://github.com/vitejs/vite/issues/22707)) ([61ba8fd](https://github.com/vitejs/vite/commit/61ba8fdc6500e8aa668021833ae5e6ebd200466d))
- update rolldown to 1.1.2 ([#​22695](https://github.com/vitejs/vite/issues/22695)) ([4f008a6](https://github.com/vitejs/vite/commit/4f008a6213014fe5e898f42561bdc621e103903e))
- use `~` for Rolldown ([#​22693](https://github.com/vitejs/vite/issues/22693)) ([9928722](https://github.com/vitejs/vite/commit/9928722f7d08de27907c48b65ddc071244166e05))
##### Bug Fixes
- **bundled-dev:** errors should be kept when incremental build fails ([#​22617](https://github.com/vitejs/vite/issues/22617)) ([9a0dd48](https://github.com/vitejs/vite/commit/9a0dd481ac2160078b8173879e0fa86e5e6af05d))
- cache falsy values in perEnvironmentState ([#​22715](https://github.com/vitejs/vite/issues/22715)) ([0e91e79](https://github.com/vitejs/vite/commit/0e91e79841b501d29dc86a6b7c0313660781196a))
- **glob:** respect caseSensitive option in hmr matcher ([#​22711](https://github.com/vitejs/vite/issues/22711)) ([65f525e](https://github.com/vitejs/vite/commit/65f525e643ba31faeaeafbc5d888b61465e6b48d))
- **html:** omit nonce on import map when cspNonce is unset ([#​22713](https://github.com/vitejs/vite/issues/22713)) ([8340bb5](https://github.com/vitejs/vite/commit/8340bb51cab703427a13d5df40b0005352c1b676))
- **optimizer:** skip null-valued exports in expandGlobIds glob resolution ([#​22611](https://github.com/vitejs/vite/issues/22611)) ([8b9f5cd](https://github.com/vitejs/vite/commit/8b9f5cd9f19f6002e1323b10155ab943219e86aa))
- resolved build options should be kept as a getter ([#​22691](https://github.com/vitejs/vite/issues/22691)) ([3527191](https://github.com/vitejs/vite/commit/3527191cad6c935a3d129506cc9a893c84009037))
- **server:** handle malformed URI in memory files middleware ([#​22714](https://github.com/vitejs/vite/issues/22714)) ([df9e0a5](https://github.com/vitejs/vite/commit/df9e0a589ff64e09c32beca9494bff4757d4ea37))
- use literal envPrefix queries for Vite Task ([#​22706](https://github.com/vitejs/vite/issues/22706)) ([da72733](https://github.com/vitejs/vite/commit/da727337b13ac6144e523eb06852b2a52c377f22))
- warn on deprecated envFile ([#​22555](https://github.com/vitejs/vite/issues/22555)) ([ed7b283](https://github.com/vitejs/vite/commit/ed7b28352e347dc7c95d590d2e696c3e5bd1e3d7))
##### Code Refactoring
- **client:** inline dev-id value in CSS selector ([#​22736](https://github.com/vitejs/vite/issues/22736)) ([57f59bc](https://github.com/vitejs/vite/commit/57f59bc843dd527a81c503684b7f408872edaef3))
- remove unused removeRawQuery util ([#​22724](https://github.com/vitejs/vite/issues/22724)) ([403cc60](https://github.com/vitejs/vite/commit/403cc608e4e8633b0335f5e8221c83dfca4994f8))
- use `rolldownOptions` property for chunkImportMap ([#​22692](https://github.com/vitejs/vite/issues/22692)) ([8e8816c](https://github.com/vitejs/vite/commit/8e8816ca9fa249d210150c5590bac06af3560aa7))
</details>
<details>
<summary>cloudflare/workers-sdk (wrangler)</summary>
### [`v4.105.0`](https://github.com/cloudflare/workers-sdk/blob/HEAD/packages/wrangler/CHANGELOG.md#41050)
[Compare Source](https://github.com/cloudflare/workers-sdk/compare/wrangler@4.104.0...wrangler@4.105.0)
##### Minor Changes
- [#​14311](https://github.com/cloudflare/workers-sdk/pull/14311) [`34e0cef`](https://github.com/cloudflare/workers-sdk/commit/34e0cefcd54130be4ca3f9cf4de1e9867252ead0) Thanks [@​sherryliu-lsy](https://github.com/sherryliu-lsy)! - Add Google Artifact Registry support to `containers registries configure`
`wrangler containers registries configure` now recognizes `*-docker.pkg.dev` (Google Artifact Registry) domains.
- The Google service account email is the public credential, supplied with `--gar-email`. It must match the `client_email` in the service account key.
- The service account JSON key is the private credential. It is provided via stdin (a file path, raw JSON, or base64) or an interactive prompt (a file path or base64) — never as a CLI flag, so it does not appear in shell history. The key is validated against `--gar-email` and stored base64-encoded.
- Secret reuse inherits the existence-first flow: when the target Secrets Store secret already exists, it is reused by reference and the key is not required. In that case the email cannot be verified locally; it is validated against the key when images are pulled.
```sh
<path-to-key>.json | npx wrangler@latest containers registries configure <region>-docker.pkg.dev --gar-email=<service-account-email> --secret-name=Google_Service_Account_JSON_Key
```
##### Patch Changes
- [#​14424](https://github.com/cloudflare/workers-sdk/pull/14424) [`5f40dd5`](https://github.com/cloudflare/workers-sdk/commit/5f40dd5d2897c4c8a1fb30f29af038baefcf67a4) Thanks [@​MattieTK](https://github.com/MattieTK)! - Bump `am-i-vibing` from 0.4.0 to 0.5.0
This updates the agentic environment detection library to the latest version, which adds detection for the Pi coding agent (`earendil-works/pi`).
- [#​14406](https://github.com/cloudflare/workers-sdk/pull/14406) [`3b743c1`](https://github.com/cloudflare/workers-sdk/commit/3b743c1b86ad80c40fd9d2d678cd5a8cb66e86fa) Thanks [@​dependabot](https://github.com/apps/dependabot)! - Update dependencies of "miniflare", "wrangler"
The following dependency versions have been updated:
| Dependency | From | To |
| ---------- | ------------ | ------------ |
| workerd | 1.20260623.1 | 1.20260625.1 |
- [#​14343](https://github.com/cloudflare/workers-sdk/pull/14343) [`daa5389`](https://github.com/cloudflare/workers-sdk/commit/daa5389863bd20ab655cf68a5f7cd63afeb30904) Thanks [@​th0m](https://github.com/th0m)! - Use digest-pinned image references for Dockerfile container deploys
Dockerfile-backed container deploys now use the pushed image digest when deploying the container application. This lets snapshot-enabled container apps pass Cloudchamber validation while keeping local, non-pushed builds and registry image URI deploys unchanged.
- [#​14394](https://github.com/cloudflare/workers-sdk/pull/14394) [`8a5cf8c`](https://github.com/cloudflare/workers-sdk/commit/8a5cf8c2e61bf3c01a836aad260fa3a5f29e1e7c) Thanks [@​Partha-Shankar](https://github.com/Partha-Shankar)! - fix(d1): escape `migrationsTableName` and filenames in SQLite queries
D1 migration commands in both `wrangler` and `@cloudflare/vitest-pool-workers` interpolated the `migrationsTableName` config value and migration filenames directly into SQL strings without any escaping. This meant:
- A table name such as `my"table` would produce invalid SQL in `CREATE TABLE`, `SELECT`, and `INSERT` statements, and
- A migration filename containing an apostrophe (e.g. `what's-new.sql`) would break the `INSERT INTO ... VALUES ('...')` statement appended after each migration in `wrangler`.
Both identifiers are now properly escaped before interpolation: `migrationsTableName` is wrapped in double-quotes with internal double-quotes doubled (SQL-standard identifier quoting), and migration filenames used as string literals have their single-quotes doubled before insertion.
- Updated dependencies \[[`3b743c1`](https://github.com/cloudflare/workers-sdk/commit/3b743c1b86ad80c40fd9d2d678cd5a8cb66e86fa)]:
- miniflare\@​4.20260625.0
### [`v4.104.0`](https://github.com/cloudflare/workers-sdk/blob/HEAD/packages/wrangler/CHANGELOG.md#41040)
[Compare Source](https://github.com/cloudflare/workers-sdk/compare/wrangler@4.103.0...wrangler@4.104.0)
##### Minor Changes
- [#​14369](https://github.com/cloudflare/workers-sdk/pull/14369) [`e312dec`](https://github.com/cloudflare/workers-sdk/commit/e312decf71f8d1a435ca178f209844363f24014a) Thanks [@​edmundhung](https://github.com/edmundhung)! - Add `getEnv()` to `createTestHarness()` Worker handles
Tests can now access the full `env` object for a Worker with `await server.getWorker<Env>().getEnv()`, including vars, secrets, and bindings.
##### Patch Changes
- [#​14364](https://github.com/cloudflare/workers-sdk/pull/14364) [`a085dec`](https://github.com/cloudflare/workers-sdk/commit/a085deca12d7126c21e500b3dd4298edfd13f8cd) Thanks [@​dependabot](https://github.com/apps/dependabot)! - Update dependencies of "miniflare", "wrangler"
The following dependency versions have been updated:
| Dependency | From | To |
| ---------- | ------------ | ------------ |
| workerd | 1.20260617.1 | 1.20260619.1 |
- [#​14383](https://github.com/cloudflare/workers-sdk/pull/14383) [`9a0de8f`](https://github.com/cloudflare/workers-sdk/commit/9a0de8f71f50bb7d1884288e376259082084a315) Thanks [@​dependabot](https://github.com/apps/dependabot)! - Update dependencies of "miniflare", "wrangler"
The following dependency versions have been updated:
| Dependency | From | To |
| ---------- | ------------ | ------------ |
| workerd | 1.20260619.1 | 1.20260621.1 |
- [#​14397](https://github.com/cloudflare/workers-sdk/pull/14397) [`fab565f`](https://github.com/cloudflare/workers-sdk/commit/fab565fdb1a912c73232d72ccdf1963fd96f9ad5) Thanks [@​dependabot](https://github.com/apps/dependabot)! - Update dependencies of "miniflare", "wrangler"
The following dependency versions have been updated:
| Dependency | From | To |
| ---------- | ------------ | ------------ |
| workerd | 1.20260621.1 | 1.20260623.1 |
- [#​14388](https://github.com/cloudflare/workers-sdk/pull/14388) [`3f02864`](https://github.com/cloudflare/workers-sdk/commit/3f028644284236fbfe36567052200cf00e707d85) Thanks [@​petebacondarwin](https://github.com/petebacondarwin)! - Stop erroring when `find_additional_modules` discovers a file that only matches a inactive module rule
Module rules assign module *types* to imported files — they are not include/exclude filters. Also, setting `fallthrough: false` in a rule will cause subsequent rules to become inactive. Previously, when `find_additional_modules` walked the filesystem and discovered a file whose only matching rule is inactive, Wrangler would throw an error and fail the build.
This meant that adding a user rule like the one below would break the build for any `.txt`, `.html`, `.sql`, `.bin` or `.wasm` file that didn't match the user-supplied globs but lived somewhere under the module root:
```jsonc
// wrangler.json
{
"rules": [
{
"type": "Text",
"globs": ["html/includeme.html"],
"fallthrough": false
}
]
}
```
Discovered files that only match an inactive rule are now silently skipped (a `debug`-level log records each skip for troubleshooting), so users can use `fallthrough: false` to narrow the set of files attached to their Worker without having to delete or move untouched files on disk.
The direct-import path is unchanged: importing a file in code that only matches an inactive rule is still a hard error, because the imported file genuinely needs a defined module type.
Fixes [#​14257](https://github.com/cloudflare/workers-sdk/issues/14257).
- [#​14358](https://github.com/cloudflare/workers-sdk/pull/14358) [`4ef872f`](https://github.com/cloudflare/workers-sdk/commit/4ef872fe530282d26ec8f2f8c52f23b8702ae757) Thanks [@​gabivlj](https://github.com/gabivlj)! - Fix container egress interception on arm64 Docker runtimes
Both `wrangler dev` and the Cloudflare Vite plugin no longer force the `proxy-everything` sidecar image to pull as `linux/amd64`, allowing Docker to select the native image from the multi-platform manifest. Set `MINIFLARE_CONTAINER_EGRESS_IMAGE_PLATFORM` to force a specific platform when needed.
- [#​14362](https://github.com/cloudflare/workers-sdk/pull/14362) [`2a02858`](https://github.com/cloudflare/workers-sdk/commit/2a028589543aa7692f99a053952bfc1c5eb8302f) Thanks [@​sherryliu-lsy](https://github.com/sherryliu-lsy)! - Don't require the private credential when reusing an existing Secrets Store secret in `containers registries configure`
`wrangler containers registries configure` now checks whether the target Secrets Store secret already exists before resolving the private credential. When the secret already exists it is reused by reference, so the private credential no longer needs to be supplied (via stdin in non-interactive mode, or via a prompt interactively). This applies to all external registries.
The new-secret path is unchanged: the credential is still required and stored. The only visible interactive change is that the secret prompt now appears last and only when a new secret is being created.
- Updated dependencies \[[`a085dec`](https://github.com/cloudflare/workers-sdk/commit/a085deca12d7126c21e500b3dd4298edfd13f8cd), [`9a0de8f`](https://github.com/cloudflare/workers-sdk/commit/9a0de8f71f50bb7d1884288e376259082084a315), [`fab565f`](https://github.com/cloudflare/workers-sdk/commit/fab565fdb1a912c73232d72ccdf1963fd96f9ad5)]:
- miniflare\@​4.20260623.0
### [`v4.103.0`](https://github.com/cloudflare/workers-sdk/blob/HEAD/packages/wrangler/CHANGELOG.md#41030)
[Compare Source](https://github.com/cloudflare/workers-sdk/compare/wrangler@4.102.0...wrangler@4.103.0)
##### Minor Changes
- [#​14295](https://github.com/cloudflare/workers-sdk/pull/14295) [`cfd6205`](https://github.com/cloudflare/workers-sdk/commit/cfd6205fe86f6afd74b5881f09524c93c83b8359) Thanks [@​dario-piotrowicz](https://github.com/dario-piotrowicz)! - Move `unstable_getWorkerNameFromProject` from wrangler to `@cloudflare/workers-utils`
The `unstable_getWorkerNameFromProject` export has been removed from the `wrangler` package. This function is now available as `getWorkerNameFromProject` (without the `unstable_` prefix) from `@cloudflare/workers-utils`. If you were importing this function from `wrangler`, update your import to use `@cloudflare/workers-utils` instead.
- [#​14295](https://github.com/cloudflare/workers-sdk/pull/14295) [`cfd6205`](https://github.com/cloudflare/workers-sdk/commit/cfd6205fe86f6afd74b5881f09524c93c83b8359) Thanks [@​dario-piotrowicz](https://github.com/dario-piotrowicz)! - Remove experimental autoconfig exports
The experimental autoconfig exports (`experimental_getDetailsForAutoConfig`, `experimental_runAutoConfig`, `experimental_AutoConfigFramework`) have been removed. This logic has been moved to the `@cloudflare/autoconfig` package (without the `experimental_` prefixes since the package itself is pre-v1).
##### Patch Changes
- [#​14366](https://github.com/cloudflare/workers-sdk/pull/14366) [`c6579d3`](https://github.com/cloudflare/workers-sdk/commit/c6579d30bd6fd7705fe3f10c7655d74a0476df86) Thanks [@​jamesopstad](https://github.com/jamesopstad)! - Resolve relative `cf-worker` entrypoint imports relative to the importing module
When loading the experimental `cloudflare.config.ts`, a relative entrypoint imported with `import ... with { type: "cf-worker" }` (e.g. `./src/index.ts`) is now anchored to the module where the import is written, rather than being passed through verbatim and later resolved against the top-level config file. This fixes incorrect resolution when the import lives in a file other than the entry config — for example a config that re-exports from a nested file.
Bare specifiers (such as `@scope/pkg`) and virtual modules (such as `virtual:foo`) are still left unresolved so that consumers can apply their own resolution.
- [#​14316](https://github.com/cloudflare/workers-sdk/pull/14316) [`444b75e`](https://github.com/cloudflare/workers-sdk/commit/444b75e75492738d10e7dc89ec645f7e2fad6b97) Thanks [@​matingathani](https://github.com/matingathani)! - Prevent `wrangler dev` crash when source-mapping a truncated error chunk
When a worker logs many errors in quick succession, the stderr chunks received by `wrangler dev` can be truncated mid-stack-frame, leaving a call site with an invalid column number. The source map library throws in that case, which was crashing the wrangler process entirely. The error is now caught and the original (un-source-mapped) text is returned instead.
- [#​14118](https://github.com/cloudflare/workers-sdk/pull/14118) [`b38823f`](https://github.com/cloudflare/workers-sdk/commit/b38823fb35a8bdcd00004e74404ab18d7b070dbf) Thanks [@​aicayzer](https://github.com/aicayzer)! - Fix `Uint8Array` step outputs in local Workflows being persisted with the full backing `ArrayBuffer`
A `Uint8Array` returned from a Workflows step under `wrangler dev` was serialised together with its full underlying `ArrayBuffer`, causing a raw `SQLITE_TOOBIG` error at view sizes well below the documented 1MiB step-output limit. For example, a 200KB view sliced from an 800KB buffer (a common pattern from `crypto.getRandomValues` or `arr.slice(...)` on a larger pool) would fail. The view's bytes are now copied to a tight buffer before persistence, bringing local behaviour in line with production. Fixes [#​14101](https://github.com/cloudflare/workers-sdk/issues/14101).
- Updated dependencies \[[`b38823f`](https://github.com/cloudflare/workers-sdk/commit/b38823fb35a8bdcd00004e74404ab18d7b070dbf)]:
- miniflare\@​4.20260617.1
</details>
---
### Configuration
📅 **Schedule**: (in timezone America/New_York)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDYuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI0Ni4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/25
* Correct duplicate alert IDs (#26)
Correct an issue when there are two alerts with the same properties issued at the same time. Previously we used the event name and issue date; now let's use event id and issue date as a unique identifier. This corrects a svelte for_each issue when two alerts have the same index. Basically add the upstream index to keep alerts unique.
Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/26
* Remove humidity check when calculating Heat Index. (#27)
It seems to clamp down in certain cases which isn't desireable.
Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/27
* chore(deps): update (#28)
This PR contains the following updates:
| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |
🔧 This Pull Request updates lock files to use the latest dependency versions.
---
### Configuration
📅 **Schedule**: (in timezone America/New_York)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTEuMyIsInVwZGF0ZWRJblZlciI6IjQzLjI1MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/28
* chore(deps): update all dependencies (#29)
* chore(deps): update (#30)
* chore(deps): update all dependencies (#31)
This PR contains the following updates:
| Package | Type | Update | Change | Pending | OpenSSF |
|---|---|---|---|---|---|
| [@sveltejs/kit](https://svelte.dev) ([source](https://github.com/sveltejs/kit/tree/HEAD/packages/kit)) | devDependencies | patch | [`2.69.1` → `2.69.2`](https://renovatebot.com/diffs/npm/@sveltejs%2fkit/2.69.1/2.69.2) | `2.69.3` | [](https://securityscorecards.dev/viewer/?uri=github.com/sveltejs/kit) |
| [@sveltejs/vite-plugin-svelte](https://github.com/sveltejs/vite-plugin-svelte) ([source](https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte)) | devDependencies | minor | [`7.1.2` → `7.2.0`](https://renovatebot.com/diffs/npm/@sveltejs%2fvite-plugin-svelte/7.1.2/7.2.0) | | [](https://securityscorecards.dev/viewer/?uri=github.com/sveltejs/vite-plugin-svelte) |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | devDependencies | patch | [`25.9.4` → `25.9.5`](https://renovatebot.com/diffs/npm/@types%2fnode/25.9.4/25.9.5) | | [](https://securityscorecards.dev/viewer/?uri=github.com/DefinitelyTyped/DefinitelyTyped) |
| [svelte-check](https://github.com/sveltejs/language-tools) | devDependencies | patch | [`4.7.1` → `4.7.2`](https://renovatebot.com/diffs/npm/svelte-check/4.7.1/4.7.2) | | [](https://securityscorecards.dev/viewer/?uri=github.com/sveltejs/language-tools) |
| [typescript](https://www.typescriptlang.org/) ([source](https://github.com/microsoft/TypeScript)) | devDependencies | major | [`6.0.3` → `7.0.2`](https://renovatebot.com/diffs/npm/typescript/6.0.3/7.0.2) | | [](https://securityscorecards.dev/viewer/?uri=github.com/microsoft/TypeScript) |
| [vite](https://vite.dev) ([source](https://github.com/vitejs/vite/tree/HEAD/packages/vite)) | devDependencies | patch | [`8.1.3` → `8.1.4`](https://renovatebot.com/diffs/npm/vite/8.1.3/8.1.4) | | [](https://securityscorecards.dev/viewer/?uri=github.com/vitejs/vite) |
| [wrangler](https://github.com/cloudflare/workers-sdk) ([source](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler)) | devDependencies | minor | [`4.107.0` → `4.110.0`](https://renovatebot.com/diffs/npm/wrangler/4.107.0/4.110.0) | | [](https://securityscorecards.dev/viewer/?uri=github.com/cloudflare/workers-sdk) |
---
### Release Notes
<details>
<summary>sveltejs/kit (@​sveltejs/kit)</summary>
### [`v2.69.2`](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2692)
[Compare Source](https://github.com/sveltejs/kit/compare/@sveltejs/kit@2.69.1...@sveltejs/kit@2.69.2)
##### Patch Changes
- fix: set `define` values on `globalThis` when running Vitest ([#​16246](https://github.com/sveltejs/kit/pull/16246))
</details>
<details>
<summary>sveltejs/vite-plugin-svelte (@​sveltejs/vite-plugin-svelte)</summary>
### [`v7.2.0`](https://github.com/sveltejs/vite-plugin-svelte/blob/HEAD/packages/vite-plugin-svelte/CHANGELOG.md#720)
[Compare Source](https://github.com/sveltejs/vite-plugin-svelte/compare/@sveltejs/vite-plugin-svelte@7.1.4...@sveltejs/vite-plugin-svelte@7.2.0)
##### Minor Changes
- feat(inspector): add a context menu with current component stack ([#​1370](https://github.com/sveltejs/vite-plugin-svelte/pull/1370))
### [`v7.1.4`](https://github.com/sveltejs/vite-plugin-svelte/blob/HEAD/packages/vite-plugin-svelte/CHANGELOG.md#714)
[Compare Source](https://github.com/sveltejs/vite-plugin-svelte/compare/@sveltejs/vite-plugin-svelte@7.1.3...@sveltejs/vite-plugin-svelte@7.1.4)
##### Patch Changes
- fix: enforce ltr styles for inspector ([#​1324](https://github.com/sveltejs/vite-plugin-svelte/pull/1324))
### [`v7.1.3`](https://github.com/sveltejs/vite-plugin-svelte/blob/HEAD/packages/vite-plugin-svelte/CHANGELOG.md#713)
[Compare Source](https://github.com/sveltejs/vite-plugin-svelte/compare/@sveltejs/vite-plugin-svelte@7.1.2...@sveltejs/vite-plugin-svelte@7.1.3)
##### Patch Changes
- fix: ensure the inspector is injected into the client correctly for Vite+ projects ([#​1355](https://github.com/sveltejs/vite-plugin-svelte/pull/1355))
</details>
<details>
<summary>sveltejs/language-tools (svelte-check)</summary>
### [`v4.7.2`](https://github.com/sveltejs/language-tools/releases/tag/svelte-check%404.7.2)
[Compare Source](https://github.com/sveltejs/language-tools/compare/svelte-check@4.7.1...svelte-check@4.7.2)
##### Patch Changes
- fix: resolve tsgo bin path with package.json ([#​3074](https://github.com/sveltejs/language-tools/pull/3074))
- fix: report tsconfig errors in --tsgo-experimental-api ([#​3070](https://github.com/sveltejs/language-tools/pull/3070))
</details>
<details>
<summary>microsoft/TypeScript (typescript)</summary>
### [`v7.0.2`](https://github.com/microsoft/TypeScript/compare/v6.0.3...2bd066d87f5bafd315be9f40889d0a60b9e58e0b)
[Compare Source](https://github.com/microsoft/TypeScript/compare/v6.0.3...2bd066d87f5bafd315be9f40889d0a60b9e58e0b)
</details>
<details>
<summary>vitejs/vite (vite)</summary>
### [`v8.1.4`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-814-2026-07-09-small)
[Compare Source](https://github.com/vitejs/vite/compare/v8.1.3...v8.1.4)
##### Features
- **legacy:** prefer oxc as minifier (fix [#​21973](https://github.com/vitejs/vite/issues/21973)) ([#​22468](https://github.com/vitejs/vite/issues/22468)) ([ab5dafa](https://github.com/vitejs/vite/commit/ab5dafa8e66296ef201f615489fb57954bb740ce))
##### Bug Fixes
- **build:** add workaround for building on stackblitz ([#​22840](https://github.com/vitejs/vite/issues/22840)) ([575c32c](https://github.com/vitejs/vite/commit/575c32c29925c554f4ef4068738ab89c6878f615))
- **build:** keep `import.meta.url` in preload function as-is ([#​22839](https://github.com/vitejs/vite/issues/22839)) ([f1f90ed](https://github.com/vitejs/vite/commit/f1f90ed4742b3cf453428c7e581a6016a4d47321))
- **deps:** update all non-major dependencies ([#​22865](https://github.com/vitejs/vite/issues/22865)) ([d4295a9](https://github.com/vitejs/vite/commit/d4295a9ffce428c0e51892373e00c07fccc0498a))
- **deps:** update rolldown-related dependencies ([#​22866](https://github.com/vitejs/vite/issues/22866)) ([7cf07e4](https://github.com/vitejs/vite/commit/7cf07e4c5f7a6af276012e0c2ec06e08499e951e))
- **html:** avoid backtracking in import-only check ([#​22848](https://github.com/vitejs/vite/issues/22848)) ([b5868c0](https://github.com/vitejs/vite/commit/b5868c01a124d345664450aaebd677bfba964c05))
- **optimizer:** avoid optimizer run for transform request before init ([#​22852](https://github.com/vitejs/vite/issues/22852)) ([72a5e21](https://github.com/vitejs/vite/commit/72a5e2192506f51a5efd09c059815a5c43a9eacb))
- **ssr:** align named export function call stacktrace column with Node ([#​22829](https://github.com/vitejs/vite/issues/22829)) ([173a1b6](https://github.com/vitejs/vite/commit/173a1b648c321e0f836e5a94fc47c4fa9b081bfc))
- strip pure CSS chunk imports when chunkImportMap is enabled ([#​22841](https://github.com/vitejs/vite/issues/22841)) ([648bd04](https://github.com/vitejs/vite/commit/648bd04933093d0aac9565f21a49811437776886))
##### Documentation
- fix incorrect `@default` for `server.cors` ([#​22859](https://github.com/vitejs/vite/issues/22859)) ([70435b2](https://github.com/vitejs/vite/commit/70435b2551ee4fe3a0d55c8a3bb61b96f44d2763))
##### Miscellaneous Chores
- **deps:** update dependency postcss-modules to v9 ([#​22867](https://github.com/vitejs/vite/issues/22867)) ([a9539d6](https://github.com/vitejs/vite/commit/a9539d69efc7a4ccf988bbf5da31c2b416ba990e))
##### Code Refactoring
- eliminate ineffectiveDynamicImport warn ([#​22876](https://github.com/vitejs/vite/issues/22876)) ([ea22fb3](https://github.com/vitejs/vite/commit/ea22fb352aad9a42c0a9d08f39d8a0bae8c111a5))
##### Tests
- avoid warnings ([#​22851](https://github.com/vitejs/vite/issues/22851)) ([af21ab6](https://github.com/vitejs/vite/commit/af21ab68adac3380dc9a854d2fe3f776654301cd))
##### Build System
- remove the custom onLog function ([#​22878](https://github.com/vitejs/vite/issues/22878)) ([2c4a217](https://github.com/vitejs/vite/commit/2c4a217a63dc0a7fcb10bc710a988f32b173f481))
- replace deprecated `onwarn` with `onLog` ([#​22741](https://github.com/vitejs/vite/issues/22741)) ([c581b55](https://github.com/vitejs/vite/commit/c581b5588cb8e94603d17bce2ff9fec8e8e0a3bf))
</details>
<details>
<summary>cloudflare/workers-sdk (wrangler)</summary>
### [`v4.110.0`](https://github.com/cloudflare/workers-sdk/blob/HEAD/packages/wrangler/CHANGELOG.md#41100)
[Compare Source](https://github.com/cloudflare/workers-sdk/compare/wrangler@4.109.0...wrangler@4.110.0)
##### Minor Changes
- [#​14591](https://github.com/cloudflare/workers-sdk/pull/14591) [`0283a1f`](https://github.com/cloudflare/workers-sdk/commit/0283a1fcdc635244f731010422e513e8b4ab0be3) Thanks [@​dario-piotrowicz](https://github.com/dario-piotrowicz)! - Send npm package dependency metadata with worker uploads
Wrangler now collects npm package dependency information from the project's `package.json` at deploy and version upload time, and includes it in the upload metadata sent to the Cloudflare API. This enables dependency analytics and future features like vulnerability alerting.
The collected data includes the package name, the version constraint from `package.json`, and the exact installed version from `node_modules`. Both `dependencies` and `devDependencies` are included, while workspace packages, local packages, and unresolvable packages are excluded. The list is capped at 200 entries per upload.
To opt out, set `dependencies_instrumentation.enabled` to `false` in your Wrangler configuration file:
```json
{
"dependencies_instrumentation": {
"enabled": false
}
}
```
- [#​14535](https://github.com/cloudflare/workers-sdk/pull/14535) [`1b965c5`](https://github.com/cloudflare/workers-sdk/commit/1b965c51babff16ae7657335d93badebd50c310f) Thanks [@​Naapperas](https://github.com/Naapperas)! - Support dynamic retry delays for Workflow steps in local dev
A step's `retries.delay` can now be a function that computes the delay per failed attempt, in addition to a static duration. The function receives `{ ctx, error }` and returns a delay (a number of milliseconds or a duration string like `"30 seconds"`), and its result is fed into the configured `backoff`.
```js
await step.do(
"call flaky API",
{
retries: {
limit: 5,
backoff: "constant",
delay: ({ ctx }) => ctx.attempt * 1000,
},
},
async () => {
/* ... */
}
);
```
The function is invoked once per failed attempt with a 5 second timeout. If it throws, times out, or returns an invalid value, the step fails without further retries.
##### Patch Changes
- [#​14589](https://github.com/cloudflare/workers-sdk/pull/14589) [`7b28392`](https://github.com/cloudflare/workers-sdk/commit/7b2839290a707e7ee22dde17de68116e88f8a2dc) Thanks [@​jamesopstad](https://github.com/jamesopstad)! - Fix runtime type caching when `wrangler dev` auto-regenerates types
When `dev.generate_types` (or `wrangler dev --types`) regenerated an out-of-date `worker-configuration.d.ts`, the written file omitted the `// Begin runtime types` marker (and the `/* eslint-disable */` header) that `wrangler types` writes. As a result, later runs could not detect the cached runtime types and always regenerated them. The auto-regenerated file now matches `wrangler types` output, restoring the cache.
- Updated dependencies \[[`1b965c5`](https://github.com/cloudflare/workers-sdk/commit/1b965c51babff16ae7657335d93badebd50c310f)]:
- miniflare\@​4.20260708.1
### [`v4.109.0`](https://github.com/cloudflare/workers-sdk/blob/HEAD/packages/wrangler/CHANGELOG.md#41090)
[Compare Source](https://github.com/cloudflare/workers-sdk/compare/wrangler@4.108.0...wrangler@4.109.0)
##### Minor Changes
- [#​14489](https://github.com/cloudflare/workers-sdk/pull/14489) [`e3f0cd6`](https://github.com/cloudflare/workers-sdk/commit/e3f0cd69e08c0eed9d75f61221d1076b6c287eef) Thanks [@​edmundhung](https://github.com/edmundhung)! - Add `listDurableObjectIds()` to `createTestHarness` Worker handles
Tests using `createTestHarness` can now list persisted Durable Object instance IDs for a Durable Object binding. This helps integration tests discover objects created by app behavior without adding test-only endpoints.
- [#​14465](https://github.com/cloudflare/workers-sdk/pull/14465) [`2fedb1f`](https://github.com/cloudflare/workers-sdk/commit/2fedb1fc811efb3f7544c569e57383cabd4f14f8) Thanks [@​vaishnav-mk](https://github.com/vaishnav-mk)! - Add rollback support when terminating Workflow instances
`WorkflowInstance.terminate({ rollback: true })` now runs registered rollback handlers before marking a local Workflow instance as terminated. Wrangler also supports this via `wrangler workflows instances terminate --rollback`, including local mode.
The rollback option is only sent for terminate operations and is rejected by the Local Explorer API for pause, resume, and restart actions.
- [#​14511](https://github.com/cloudflare/workers-sdk/pull/14511) [`17d2fc1`](https://github.com/cloudflare/workers-sdk/commit/17d2fc12989f72a2fcd42e62fb152f270d61ab38) Thanks [@​juleslemee](https://github.com/juleslemee)! - Add `wrangler turnstile widget` commands for managing Turnstile widgets
You can now create, list, inspect, update, and delete Turnstile widgets from the CLI:
```
wrangler turnstile widget create <name> --domain example.com --mode managed
wrangler turnstile widget list
wrangler turnstile widget get <sitekey>
wrangler turnstile widget update <sitekey> --name "Renamed"
wrangler turnstile widget delete <sitekey>
```
All five subcommands accept `--json` for machine-readable output (`get` prints a formatted view by default; the rest print a short human summary). `--domain` accepts comma-separ…
elliott-with-the-longest-name-on-github
pushed a commit
that referenced
this pull request
Aug 24, 2026
…gment (#18694) When an async expression resumes after a pickled `await`, the thunk returned by `save()` in `reactivity/async.js` calls `restore()` to re-arm `active_reaction` for the rest of the expression, then disarms it with `queue_micro_task(unset_context)`. Any microtask already queued before that one runs inside the restored context. If it writes to a source, `set()` throws `state_unsafe_mutation` in production, since the guard is not dev-only. #18453 introduced the queued disarm and noted this case in review as unavoidable. SvelteKit hits it in practice: its fetch continuations write to internal `$state` (sveltejs/kit#16914), and a user's `$derived((await q()).length)` resuming in the same tick makes that write throw and drops the update signal. The context restored by a `save` thunk now ends with the synchronous segment it was restored in. A `restored` flag is set by the thunk and consumed on entry to `save` and `track_reactivity_loss`, so every suspension ends it; once an expression contains a pickled await, the analysis pickles every later await in it too (`has_pickled_await` on `ExpressionMetadata`), so a trailing await compiles to `$.save` rather than a bare `await`. At the end of the body, `async_thunk` in `3-transform/client/utils.js` wraps the return expression in `$.unsave(...)` when the metadata has a pickled await. If the body throws instead, the context is unset by `async_derived`'s existing `finally`, as before. The queued microtask in `save` is removed. Output is unchanged for expressions that pickle nothing (`$derived(await a)` compiles byte for byte the same). Expressions with a pickled await gain one `$.unsave(` call per body, and their trailing await becomes a `$.save`, 4 to 6 bytes gzipped in the added tests. At runtime a boolean write replaces a queued microtask per resume. `bench:compare` shows no difference outside run-to-run noise. Two runtime tests reproduce the throw without any library involved, one in dev and one with the prod `await` shape, and fail on `main`. --------- Co-authored-by: Simon Holthausen <simon.holthausen@vercel.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When calling
save, we restore the context after the promise resolves. But we do not unset it after the subsequent synchronous execution. That means that untilunset_contextruns inasync_derivedwe will not have the correct (nulled) context. That causes problems if thesaveisn't the last promise contributing to theasync_derived, because it means the context is not properly unset until the promise after thesavewithin theasync_derivedsettles. This can cause all sorts of mixups, including a wrong mutation error.fixes #18441