fix: don't hang on a tag whose expression ends with a trailing slash by baseballyama · Pull Request #18350 · sveltejs/svelte

baseballyama · 2026-06-01T00:30:35Z

close #18349

Before submitting the PR, please make sure you do the following

It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
Prefix your PR title with feat:, fix:, chore:, or docs:.
This message body should clearly illustrate what problems it solves.
Ideally, include a test that fails without this PR but passes with it.
If this PR changes code within packages/svelte/src, add a changeset (npx changeset).

Tests and linting

Run the tests with pnpm test and lint the project with pnpm lint

changeset-bot · 2026-06-01T00:30:38Z

🦋 Changeset detected

Latest commit: a9abde4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
svelte	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

`find_matching_bracket` never advanced `i` when a `/` was the last character of the input, spinning the parser forever. Advance past it so the parse fails with `unexpected_eof` instead of hanging.

Copilot

Pull request overview

This PR fixes a parser hang when a Svelte tag expression ends with a bare trailing /, allowing the compiler to terminate with an unexpected_eof error instead of looping indefinitely.

Changes:

Advances the bracket scanner past a terminal / in find_matching_bracket.
Adds a compiler error regression sample for {let x = a /.
Adds a patch changeset for the Svelte package.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
`packages/svelte/src/compiler/phases/1-parse/utils/bracket.js`	Ensures the `/` branch always makes forward progress at end of input.
`packages/svelte/tests/compiler-errors/samples/declaration-tag-trailing-slash/main.svelte`	Adds the malformed declaration tag regression input.
`packages/svelte/tests/compiler-errors/samples/declaration-tag-trailing-slash/_config.js`	Asserts the expected `unexpected_eof` compiler error and position.
`.changeset/fix-find-matching-bracket-infinite-loop.md`	Records the patch-level bug fix.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions · 2026-06-01T00:33:33Z

Playground

pnpm add https://pkg.pr.new/svelte@18350

svelte-docs-bot · 2026-06-01T00:35:48Z

Preview: https://svelte-dev-git-preview-svelte-18350-svelte.vercel.app/

dummdidumm

nice find 👍

parse_statement_at now drives the boundary with acorn, so an unterminated declaration tag (e.g. `{let x = a /`) surfaced acorn's generic js_parse_error instead of the unexpected_eof diagnostic the declaration-tag-trailing-slash test (sveltejs#18350) relies on. Remap acorn's end-of-input error (err.pos at the end of the source) back to unexpected_eof; other malformed-at-EOF inputs keep their more specific acorn message. Also cast the parsed Statement to acorn.Node for add_comments, resolving the TS2345 from estree Statement.start being number|undefined.

This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## svelte@5.56.1 ### Patch Changes - fix: error at compile time on duplicate snippet/declaration tag definitions ([#18351](#18351)) - fix: parse declaration tag contents more robustly ([#18353](#18353)) - fix: correctly transform references to earlier declarators in a declaration tag (e.g. `{let a = $state(0), b = $derived(a * 2)}`) ([#18348](#18348)) - fix: avoid spurious `state_referenced_locally` warnings for `$derived` declarations in declaration tags ([#18348](#18348)) - fix: tolerate whitespace before `let`/`const` in declaration tags ([#18348](#18348)) - fix: prevent infinite loop when a tag's expression ends with a trailing `/` at the end of the input ([#18350](#18350)) - fix: more robust parsing of declaration tags with regards to `type` ([#18330](#18330)) - fix: preserve newlines in spread input values when the `type` attribute is applied after `value` ([#18345](#18345)) - fix: update `SvelteURLSearchParams` when setting duplicate keys to the same joined value ([#18336](#18336)) - fix: check references for blockers on server, too ([#18352](#18352)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [svelte](https://svelte.dev) ([source](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte)) | [`5.56.0` → `5.56.1`](https://renovatebot.com/diffs/npm/svelte/5.56.0/5.56.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/svelte/5.56.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/svelte/5.56.0/5.56.1?slim=true) | --- ### Release Notes <details> <summary>sveltejs/svelte (svelte)</summary> ### [`v5.56.1`](https://github.com/sveltejs/svelte/blob/HEAD/packages/svelte/CHANGELOG.md#5561) [Compare Source](https://github.com/sveltejs/svelte/compare/svelte@5.56.0...svelte@5.56.1) ##### Patch Changes - fix: error at compile time on duplicate snippet/declaration tag definitions ([#18351](sveltejs/svelte#18351)) - fix: parse declaration tag contents more robustly ([#18353](sveltejs/svelte#18353)) - fix: correctly transform references to earlier declarators in a declaration tag (e.g. `{let a = $state(0), b = $derived(a * 2)}`) ([#18348](sveltejs/svelte#18348)) - fix: avoid spurious `state_referenced_locally` warnings for `$derived` declarations in declaration tags ([#18348](sveltejs/svelte#18348)) - fix: tolerate whitespace before `let`/`const` in declaration tags ([#18348](sveltejs/svelte#18348)) - fix: prevent infinite loop when a tag's expression ends with a trailing `/` at the end of the input ([#18350](sveltejs/svelte#18350)) - fix: more robust parsing of declaration tags with regards to `type` ([#18330](sveltejs/svelte#18330)) - fix: preserve newlines in spread input values when the `type` attribute is applied after `value` ([#18345](sveltejs/svelte#18345)) - fix: update `SvelteURLSearchParams` when setting duplicate keys to the same joined value ([#18336](sveltejs/svelte#18336)) - fix: check references for blockers on server, too ([#18352](sveltejs/svelte#18352)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled because a matching PR was automerged previously. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Co-authored-by: huskas-2189 <huskas-2189@noreply.codeberg.org> Reviewed-on: https://codeberg.org/huskas-2189/Bookmark/pulls/82

Copilot AI review requested due to automatic review settings June 1, 2026 00:30

Copilot started reviewing on behalf of baseballyama June 1, 2026 00:30 View session

fix: prevent infinite loop on a tag ending with a trailing slash

a2586e3

`find_matching_bracket` never advanced `i` when a `/` was the last character of the input, spinning the parser forever. Advance past it so the parse fails with `unexpected_eof` instead of hanging.

baseballyama force-pushed the fix-find-matching-bracket-infinite-loop branch from a9abde4 to a2586e3 Compare June 1, 2026 00:31

Copilot AI reviewed Jun 1, 2026

View reviewed changes

dummdidumm approved these changes Jun 1, 2026

View reviewed changes

dummdidumm merged commit b471c15 into main Jun 1, 2026
21 checks passed

dummdidumm deleted the fix-find-matching-bracket-infinite-loop branch June 1, 2026 08:04

github-actions Bot mentioned this pull request Jun 1, 2026

Version Packages #18346

Merged

hjaber mentioned this pull request Jun 1, 2026

fix: parse declaration tags with a division operator in the initializer #18353

Merged

github-actions Bot mentioned this pull request Jun 2, 2026

Upgrade Svelte submodule to 5.56.1 baseballyama/rsvelte#639

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: don't hang on a tag whose expression ends with a trailing slash#18350

fix: don't hang on a tag whose expression ends with a trailing slash#18350
dummdidumm merged 1 commit into
mainfrom
fix-find-matching-bracket-infinite-loop

baseballyama commented Jun 1, 2026

Uh oh!

changeset-bot Bot commented Jun 1, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Jun 1, 2026

Uh oh!

svelte-docs-bot Bot commented Jun 1, 2026

Uh oh!

dummdidumm left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

baseballyama commented Jun 1, 2026

Before submitting the PR, please make sure you do the following

Tests and linting

Uh oh!

changeset-bot Bot commented Jun 1, 2026

🦋 Changeset detected

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

github-actions Bot commented Jun 1, 2026

Uh oh!

svelte-docs-bot Bot commented Jun 1, 2026

Uh oh!

dummdidumm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants