Svelte: Support v4

[JReinhold]

What I did

• Expanded the dependency ranges to support Svelte v4

How to test

Checklist

• Make sure your changes are tested (stories and/or unit, integration, or end-to-end tests)
• Make sure to add/update documentation regarding your changes
• If you are deprecating/removing a feature, make sure to update
  MIGRATION.MD

Maintainers

• If this PR should be tested against many or all sandboxes,
  make sure to add the ci:merged or ci:daily GH label to it.
• Make sure this PR contains one of the labels below.

["cleanup", "BREAKING CHANGE", "feature request", "bug", "documentation", "maintenance", "dependencies", "other"]

[socket-security]

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

[JReinhold]

@shilman @yannbf this should be patched back to 7.0 (once everything is confirmed to be working ofc) because of the expanded version range, but I'm not sure if the changes to templates should too, since they now install svelte@next instead of latest. Will it have an affect on the CI we run for main/7.0, the status page, or something else?

[socket-security]

New and updated dependency changes detected. Learn more about Socket for GitHub ↗︎

[kasperpeulen]

Testing approval here

[JReinhold]

@kasperpeulen do you know why types are failing here? https://app.circleci.com/pipelines/github/storybookjs/storybook/52536/workflows/580c415a-ebab-4aa8-97e9-58cd32596d46/jobs/544399 (I can reproduce this locally)

It's failing here because it can't find the 'svelte/compiler' module, but I can't reproduce this outside of our Storybook repo. In a separate project, doing the same import (import { preprocess } from 'svelte/compiler';) and going to definition correctly takes you here: https://github.com/sveltejs/svelte/blob/master/src/compiler/preprocess/index.ts#L210

Are we configuring TypeScript in a way that doesn't support these direct-to-JS definitions, or something else?

cc @benmccann

[benmccann]

Thanks for testing! We'll release a new version in the next day or two, which should hopefully fix this

[benmccann]

4.0.0-next.2 is now out. Can you check if it fixes it?

[dummdidumm]

The svelte/internal thing failing is expected - we deliberatly removed those types to discourage their use. You can still use them, but you need to silence the type error. Probably best to talk about the need to use svelte/internal separately in Discord. I suspect there are more projects in the ecosystem resorting to internal methods to accomplish certain tasks, and we want to make sure they are properly supported in Svelte 5.

[JReinhold]

Thanks for the detailed description @dummdidumm. We're planning to remove this area of the code soon, so I wouldn't worry too much about looking into long term support of the internal features that we use there.

[shilman]

@JReinhold I don't feel great about patching this back to 7.0 since it's technically a breaking change. Before users did not have to have svelte installed, and now they do. It's a corner case, but I'd much rather have this only go out in a minor release. Are you ok with that?

[JReinhold]

@JReinhold I don't feel great about patching this back to 7.0 since it's technically a breaking change. Before users did not have to have svelte installed, and now they do. It's a corner case, but I'd much rather have this only go out in a minor release. Are you ok with that?

We discuss this a bit here. #22905 (comment)

I would consider this a bug fix more than a breaking change. And that any users that are affected by this are relying on a bug.
And for semver there's really no difference between patch and minor for most users.

But it's your call.

[shilman]

@JReinhold Ok I'm fine with that. Just wanted to discuss first