# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 58 → 58 (+0.4)
- Rubric changed (rubric-2026.09.11 → rubric-2026.09.18) — scores are not directly comparable.

## Lenses

- Code Health 60 → 62 (+1.6)
- Architecture 57 → 61 (+4.6)
- Maturity 54 → 54 (-0.4)
- Readiness 62 → 63 (+0.5)
- Security 65 → 66 (+1.4)
- Accessibility 87 → 75 (-11.9)
- Performance 60 (new)

## Resolved (24)

- Documentation: no usage examples (README.md)
- Hotspot: packages/svelte/src/compiler/phases/1-parse/acorn.js (packages/svelte/src/compiler/phases/1-parse/acorn.js)
- Hotspot: packages/svelte/src/compiler/phases/1-parse/state/element.js (packages/svelte/src/compiler/phases/1-parse/state/element.js)
- Hotspot: packages/svelte/src/compiler/phases/1-parse/state/tag.js (packages/svelte/src/compiler/phases/1-parse/state/tag.js)
- Hotspot: packages/svelte/src/compiler/phases/1-parse/utils/html.js (packages/svelte/src/compiler/phases/1-parse/utils/html.js)
- Hotspot: packages/svelte/src/compiler/phases/2-analyze/css/css-prune.js (packages/svelte/src/compiler/phases/2-analyze/css/css-prune.js)
- Hotspot: packages/svelte/src/compiler/phases/2-analyze/visitors/shared/utils.js (packages/svelte/src/compiler/phases/2-analyze/visitors/shared/utils.js)
- Hotspot: packages/svelte/src/compiler/phases/3-transform/client/utils.js (packages/svelte/src/compiler/phases/3-transform/client/utils.js)
- Hotspot: packages/svelte/src/compiler/phases/3-transform/client/visitors/AssignmentExpression.js (packages/svelte/src/compiler/phases/3-transform/client/visitors/AssignmentExpression.js)
- Hotspot: packages/svelte/src/compiler/phases/3-transform/client/visitors/shared/fragment.js (packages/svelte/src/compiler/phases/3-transform/client/visitors/shared/fragment.js)
- Hotspot: packages/svelte/src/compiler/phases/3-transform/client/visitors/shared/utils.js (packages/svelte/src/compiler/phases/3-transform/client/visitors/shared/utils.js)
- Hotspot: packages/svelte/src/compiler/phases/3-transform/server/visitors/shared/utils.js (packages/svelte/src/compiler/phases/3-transform/server/visitors/shared/utils.js)
- Hotspot: packages/svelte/src/compiler/phases/nodes.js (packages/svelte/src/compiler/phases/nodes.js)
- Hotspot: packages/svelte/src/compiler/utils/mapped_code.js (packages/svelte/src/compiler/utils/mapped_code.js)
- Hotspot: packages/svelte/src/internal/client/dom/elements/events.js (packages/svelte/src/internal/client/dom/elements/events.js)
- Hotspot: packages/svelte/src/internal/client/reactivity/deriveds.js (packages/svelte/src/internal/client/reactivity/deriveds.js)
- Hotspot: packages/svelte/src/internal/client/reactivity/effects.js (packages/svelte/src/internal/client/reactivity/effects.js)
- Hotspot: packages/svelte/src/internal/client/runtime.js (packages/svelte/src/internal/client/runtime.js)
- Hotspot: packages/svelte/src/internal/shared/attributes.js (packages/svelte/src/internal/shared/attributes.js)
- Off-boarding risk: anonymized user #1
- …and 4 more

## New (34)

- #handle_error (cognitive 17) (packages/svelte/src/internal/client/dom/blocks/boundary.js)
- Boundary.#handle_error (cyclomatic 16) (packages/svelte/src/internal/client/dom/blocks/boundary.js)
- Documentation: no project overview (README.md)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Hotspot: packages/svelte/src/internal/client/dom/blocks/boundary.js (packages/svelte/src/internal/client/dom/blocks/boundary.js)
- Hotspot: packages/svelte/src/internal/client/dom/elements/transitions.js (packages/svelte/src/internal/client/dom/elements/transitions.js)
- Hotspot: packages/svelte/src/internal/client/proxy.js (packages/svelte/src/internal/client/proxy.js)
- LetDirective.LetDirective (cyclomatic 18) (packages/svelte/src/compiler/phases/2-analyze/visitors/LetDirective.js)
- Medium: security finding (details withheld)
- Medium: security finding (details withheld)
- Off-boarding risk: anonymized user #1
- Outdated (npm): devalue
- Skipped (documented): (unnamed test) (packages/svelte/tests/compiler-errors/samples/let-directive-children-snippet-expression/_config.js)
- Skipped (documented): (unnamed test) (packages/svelte/tests/compiler-errors/samples/let-directive-children-snippet/_config.js)
- Skipped (documented): (unnamed test) (packages/svelte/tests/hydration/samples/boundary-mismatch-recovery/_config.js)
- Skipped (documented): (unnamed test) (packages/svelte/tests/hydration/samples/dynamic-element-child-mismatch/_config.js)
- Skipped (documented): (unnamed test) (packages/svelte/tests/runtime-browser/samples/dynamic-element-hydration-preserves-connection/_config.js)
- Skipped (documented): (unnamed test) (packages/svelte/tests/runtime-browser/samples/dynamic-element-hydration-preserves-connection/_config.js)
- Skipped (documented): (unnamed test) (packages/svelte/tests/runtime-browser/samples/spread-input-number-incomplete-value/_config.js)
- …and 14 more

## Changes since last survey

- 20 commits — 3 feature/other, 17 fixes

## By area

- packages/svelte — 17 commits
- .changeset/major-papayas-run.md — 1 commit
- .changeset/major-roses-help.md — 1 commit
- .changeset/short-radios-sneeze.md — 1 commit

## Notable commits

- fix: fix: avoid reinserting dynamic elements during hydration (#18855)
- fix: fix: bypass error boundaries for hydration recovery (#18841)
- fix: fix: don't hang `migrate` on a declaration that shares a line with its script tag (#18816)
- fix: fix: don't overwrite an unchanged spread `value` (#18864)
- fix: fix: don't warn about redundant `link` role on `<area>` without `href` (#18872)
- fix: fix: ensure hydration state restoration for custom element attribute updates (#18467)
- fix: fix: error at compile time when a declaration in a snippet redeclares one of its parameters (#18842)
- fix: fix: error when using `let:` directives on a component with a `children` snippet (#18873)
- fix: fix: flush anything pending before invoking flushSync callback function (#18878)
- fix: fix: handle deferred transitions aborted before initialization (#18776)
- fix: fix: ignore stale boundary resets after destruction (#18886)
- fix: fix: keep a reactive assignment with no dependencies when `migrate` cannot turn it into a declaration (#18817)
- fix: fix: make Object.hasOwn reactive for state proxies (#18838)
- fix: fix: preserve location information for `await` wrappers (#18859)
- fix: fix: prevent untracked derived reads from retaining dependencies (#18829)
- fix: fix: read batch-local array on each-block commit (#18879)
- fix: fix: remove incorrect special handling of :export pseudo-selectors (#18839)
- change: Version Packages (#18750)
- change: chore: extract some minor changes from #18861 (#18866)
- change: chore: fix typos in code comments (#18860)