Svelte 5.57

Apply the TypeScript 6.0 and JavaScript ES2026 prompts first. These rules cover Svelte 5.57.0 in the 5.57 release line; apply the host framework's controls separately for endpoints and sessions.

Compilation and builds

• Keep compiler and browser/server runtime on compatible, patched 5.57 dependencies and rebuild output after upgrades. Use maintained Node.js and browsers meeting toolchain needs; the package's Node.js >=18 floor declares compatibility, not security support.
• Compile only trusted component source and preprocessor configuration: .svelte scripts, template expressions, preprocessors, and dynamically selected components are executable code, and svelte/compiler doesn't sandbox user-authored components.
• Run svelte-check over .svelte files in CI with TypeScript isolatedModules; native <script lang="ts"> strips types without runtime validation or component type checking.
• Build production with dev: false and hmr: false. Review any experimental.async: true opt-in, which top-level script, derived, and markup await and hydratable require in this version; experimental behavior can change outside majors.

Rendering and props

• Render untrusted text with {expression}; treat {@html} and createRawSnippet render callbacks as raw HTML sinks, sanitizing untrusted input before rendering on server and client.
• Prefer bind:textContent or bind:innerText for plain-text editing. With bind:innerHTML, sanitize before initial or programmatic assignment and before storing or redisplaying edits; two-way binding doesn't make editor output