build(deps-dev): bump svelte from 5.48.0 to 5.55.7 in /frontend

[dependabot]

Bumps svelte from 5.48.0 to 5.55.7.

Release notes

Sourced from svelte's releases.

[email protected]

Patch Changes

• fix: prevent XSS on hydratable from user contents (a16ebc67bbcf8f708360195687e1b2719463e1a4)

• chore: bump devalue (#18219)

• fix: disallow empty attribute names during SSR (547853e2406a2147ad7fb5ffeba95b01bd9642da)

• fix: harden regex (d2375e2ebcab5c88feb5652f1a9d621b8f06b259)

• fix: move Svelte runtime properties to symbols (e1cbbd96441e82c9eb8a23a2903c0d06d3cda991)

[email protected]

Patch Changes

• fix: leave stale promises to wait for a later resolution, instead of rejecting (#18180)

• fix: keep dependencies of $state.eager/pending (#18218)

• fix: reapply context after transforming error during SSR (#18099)

• fix: don't rebase just-created batches (#18117)

• chore: allow null for pending in typings (#18201)

• fix: flush eager effects in production (#18107)

• fix: rethrow error of failed iterable after calling return() (#18169)

• fix: account for proxified instance when updating bind:this (#18147)

• fix: ensure scheduled batch is flushed if not obsolete (#18131)

• fix: resolve stale deriveds with latest value (#18167)

• chore: remove unnecessary increment_pending calls (#18183)

• fix: correctly compile component member expressions for SSR (#18192)

• fix: reset source.updated stack traces after flush (#18196)

• fix: replacing async 'blocking' strategy with 'merging' (#18205)

• fix: allow @debug tags to reference awaited variables (#18138)

• fix: re-run fallback props if dependencies update (#18146)

• fix: abort running obsolete async branches (#18118)

... (truncated)

Changelog

Sourced from svelte's changelog.

5.55.7

Patch Changes

• fix: prevent XSS on hydratable from user contents (a16ebc67bbcf8f708360195687e1b2719463e1a4)

• chore: bump devalue (#18219)

• fix: disallow empty attribute names during SSR (547853e2406a2147ad7fb5ffeba95b01bd9642da)

• fix: harden regex (d2375e2ebcab5c88feb5652f1a9d621b8f06b259)

• fix: move Svelte runtime properties to symbols (e1cbbd96441e82c9eb8a23a2903c0d06d3cda991)

5.55.6

Patch Changes

• fix: leave stale promises to wait for a later resolution, instead of rejecting (#18180)

• fix: keep dependencies of $state.eager/pending (#18218)

• fix: reapply context after transforming error during SSR (#18099)

• fix: don't rebase just-created batches (#18117)

• chore: allow null for pending in typings (#18201)

• fix: flush eager effects in production (#18107)

• fix: rethrow error of failed iterable after calling return() (#18169)

• fix: account for proxified instance when updating bind:this (#18147)

• fix: ensure scheduled batch is flushed if not obsolete (#18131)

• fix: resolve stale deriveds with latest value (#18167)

• chore: remove unnecessary increment_pending calls (#18183)

• fix: correctly compile component member expressions for SSR (#18192)

• fix: reset source.updated stack traces after flush (#18196)

• fix: replacing async 'blocking' strategy with 'merging' (#18205)

• fix: allow @debug tags to reference awaited variables (#18138)

• fix: re-run fallback props if dependencies update (#18146)

... (truncated)

Commits

• 4d8f99a Version Packages (#18220)
• 0552308 chore: bump devalue (#18219)
• e1cbbd9 Merge commit from fork
• a16ebc6 Merge commit from fork
• d2375e2 Merge commit from fork
• 547853e Merge commit from fork
• 55f9c85 Version Packages (#18158)
• a10e8e4 fix: keep dependencies of $state.eager/pending (alternative approach) (#1...
• ef4b97d fix: duplicated "of" in events.js comment (#18217)
• 5122936 fix: treat batches as a linked list (#18205)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Greptile Summary

This is an automated Dependabot PR upgrading svelte from 5.48.0 to 5.55.7 in the frontend. The update includes a notable XSS security fix for the hydratable SSR path, along with a devalue bump and several async-reactivity bug fixes.

• Security fix: svelte 5.55.7 patches an XSS vulnerability affecting hydration of user-controlled content (hydratable) and hardens an internal regex; picking up this version is the primary motivation for merging promptly.
• Transitive bumps: devalue (5.6.2→5.8.1), esrap (2.2.2→2.2.8), and new @types/trusted-types dependency are pulled in; aria-query is now pinned to an exact version (5.3.1) inside svelte's own lockfile subtree.

Confidence Score: 5/5

Safe to merge — changes are limited to bumping a dev-only Svelte dependency that carries a security fix and runtime bug fixes with no breaking changes in the 5.48→5.55 range.

Only package.json and package-lock.json are touched. Svelte is a dev dependency used at build time, so the risk surface is narrow. The update closes an XSS issue in SSR hydration and ships numerous async-reactivity fixes that improve correctness. No application source files are changed.

No files require special attention.

Important Files Changed

Filename	Overview
frontend/package.json	Bumps svelte devDependency minimum from ^5.0.0 to ^5.55.7, picking up security and bug-fix releases
frontend/package-lock.json	Lockfile updated: svelte 5.48.0→5.55.7, devalue 5.6.2→5.8.1, esrap 2.2.2→2.2.8; aria-query pinned to exact 5.3.1; @types/trusted-types added as svelte dependency

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[svelte 5.48.0] -->|bump| B[svelte 5.55.7]
    B --> C[devalue 5.8.1]
    B --> D[esrap 2.2.8]
    B --> E[types-trusted-types 2.0.7]
    B --> F[aria-query 5.3.1 pinned]
    B --> G[XSS fix: hydratable SSR path]
    B --> H[Async reactivity bug fixes]

Loading

_{Reviews (1): Last reviewed commit: "build(deps-dev): bump svelte from 5.48.0..." | Re-trigger Greptile}

[dependabot]

Superseded by #50.