chore(deps-dev): Bump svelte from 3.59.2 to 5.55.7 in /packages/svelte

[dependabot]

Bumps svelte from 3.59.2 to 5.55.7.

Release notes

Sourced from svelte's releases.

svelte@5.55.7

Patch Changes

• fix: prevent XSS on hydratable from user contents (a16ebc67bbcf8f708360195687e1b2719463e1a4)

• chore: bump devalue (#18219)

• fix: disallow empty attribute names during SSR (547853e2406a2147ad7fb5ffeba95b01bd9642da)

• fix: harden regex (d2375e2ebcab5c88feb5652f1a9d621b8f06b259)

• fix: move Svelte runtime properties to symbols (e1cbbd96441e82c9eb8a23a2903c0d06d3cda991)

svelte@5.55.6

Patch Changes

• fix: leave stale promises to wait for a later resolution, instead of rejecting (#18180)

• fix: keep dependencies of $state.eager/pending (#18218)

• fix: reapply context after transforming error during SSR (#18099)

• fix: don't rebase just-created batches (#18117)

• chore: allow null for pending in typings (#18201)

• fix: flush eager effects in production (#18107)

• fix: rethrow error of failed iterable after calling return() (#18169)

• fix: account for proxified instance when updating bind:this (#18147)

• fix: ensure scheduled batch is flushed if not obsolete (#18131)

• fix: resolve stale deriveds with latest value (#18167)

• chore: remove unnecessary increment_pending calls (#18183)

• fix: correctly compile component member expressions for SSR (#18192)

• fix: reset source.updated stack traces after flush (#18196)

• fix: replacing async 'blocking' strategy with 'merging' (#18205)

• fix: allow @debug tags to reference awaited variables (#18138)

• fix: re-run fallback props if dependencies update (#18146)

• fix: abort running obsolete async branches (#18118)

... (truncated)

Changelog

Sourced from svelte's changelog.

svelte

4.2.3

Patch Changes

• fix: improve a11y-click-events-have-key-events message (#9358)

• fix: more robust hydration of html tag (#9184)

4.2.2

Patch Changes

• fix: support camelCase properties on custom elements (#9328)

• fix: add missing plaintext-only value to contenteditable type (#9242)

• chore: upgrade magic-string to 0.30.4 (#9292)

• fix: ignore trailing comments when comparing nodes (#9197)

4.2.1

Patch Changes

• fix: update style directive when style attribute is present and is updated via an object prop (#9187)

• fix: css sourcemap generation with unicode filenames (#9120)

• fix: do not add module declared variables as dependencies (#9122)

• fix: handle svelte:element with dynamic this and spread attributes (#9112)

• fix: silence false positive reactive component warning (#9094)

• fix: head duplication when binding is present (#9124)

• fix: take custom attribute name into account when reflecting property (#9140)

• fix: add indeterminate to the list of HTMLAttributes (#9180)

• fix: recognize option value on spread attribute (#9125)

4.2.0

Minor Changes

• feat: move svelteHTML from language-tools into core to load the correct svelte/element types (#9070)

... (truncated)

Commits

• 4d8f99a Version Packages (#18220)
• 0552308 chore: bump devalue (#18219)
• e1cbbd9 Merge commit from fork
• a16ebc6 Merge commit from fork
• d2375e2 Merge commit from fork
• 547853e Merge commit from fork
• 55f9c85 Version Packages (#18158)
• a10e8e4 fix: keep dependencies of $state.eager/pending (alternative approach) (#1...
• ef4b97d fix: duplicated "of" in events.js comment (#18217)
• 5122936 fix: treat batches as a linked list (#18205)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svelte since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3fa8d38. Configure here.}

[cursor]

Major Svelte version bump breaks incompatible companion dependencies

High Severity

Bumping svelte from 3.59.2 to 5.55.7 without updating companion devDependencies creates an incompatible dependency set. @sveltejs/vite-plugin-svelte 1.4.0 only supports Svelte 3 (needs v5+ for Svelte 5), and @testing-library/svelte ^3.2.1 doesn't support Svelte 5 (needs v5+). This will break the test infrastructure entirely — vitest won't be able to compile Svelte components, and component rendering/interaction tests using $set() will fail.

Additional Locations (1)

• packages/svelte/package.json#L49-L51

 

^{Reviewed by Cursor Bugbot for commit 3fa8d38. Configure here.}

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.