chore(deps): update dependency @sveltejs/kit to v3 [security] #7
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: TehRiehlDeal/skill-tree-portfolio#7
Reference in new issue
Block a user
This PR contains the following updates:
^2.49.1→^3.0.0@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)
CVE-2026-22803 / GHSA-j2f3-wq62-6q46
More information
Details
Summary
The experimental
formremote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion.Details
When a form is submitted to a remote function endpoint, the SvelteKit client encodes the data using a custom format, and POSTs it to the endpoint as a request with an
application/x-sveltekit-formdatacontent type.The first few bytes of the request body encode the length of the data. SvelteKit will attempt to read the request body up until the specified offset, but if the body is not yet available then an array buffer of that size will be created eagerly to accommodate it as it arrives.
An attacker can force this code path by sending a small payload that specifies a large data length, then stalling the connection. The resulting array buffer will be held in memory, potentially causing memory exhaustion.
Impact
experimental.remoteFunctionsenabled, and that expose a reachable Remote Form endpoint.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
CVE-2025-67647 / GHSA-j62c-4x62-9r35
More information
Details
Summary
Versions of SvelteKit are vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions.
Details
Affected versions from 2.44.0 onwards are vulnerable to DoS if:
export const prerender = true)Affected versions from 2.19.0 onwards are vulnerable to DoS and SSRF if:
export const prerender = true)adapter-nodewithout a configuredORIGINenvironment variable, and you are not using a reverse proxy that implements Host header validationImpact
The DoS causes the running server process to end.
The SSRF allows access to internal services that can be reached without authentication when fetched from SvelteKit's server runtime.
It is also possible to obtain an SXSS via cache poisoning, by forcing a potential CDN to cache an XSS returned by the attacker's server (the latter being able to specify the cache-control of their choice).
Credits
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
CPU exhaustion in SvelteKit remote form deserialization (experimental only)
CVE-2026-82261 / GHSA-88qp-p4qg-rqm6
More information
Details
Versions of
@sveltejs/kitprior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the server to become unresponsive while processing a request, resulting in denial of service.Only applications using both
experimental.remoteFunctionsandformare vulnerable.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Memory exhaustion in SvelteKit remote form deserialization (experimental only)
CVE-2026-82260 / GHSA-vrhm-gvg7-fpcf
More information
Details
Versions of
@sveltejs/kitprior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to crash due to excessive memory allocation, resulting in denial of service.Only applications using both
experimental.remoteFunctionsandformare vulnerable.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
SvelteKit has deserialization expansion in unvalidated
formremote function leading to Denial of Service (experimental only)CVE-2026-82259 / GHSA-fpg4-jhqr-589c
More information
Details
Some relatively small inputs can cause very large files arrays in
formhandlers. If the SvelteKit application code doesn't checkfiles.lengthor individual files' sizes and performs expensive processing with them, it can result in Denial of Service.Only users with
experimental.remoteFunctions: truewho are using theformfunction and are processing thefilesarray without validation are vulnerable.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass
CVE-2026-40073 / GHSA-2crg-3p73-43xp
More information
Details
Under certain circumstances, requests could bypass the
BODY_SIZE_LIMITon SvelteKit applications running withadapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service
CVE-2026-40074 / GHSA-3f6h-2hrp-w5wx
More information
Details
redirect, when called from inside thehandleserver hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandledTypeError. This could result in DoS on some platforms, especially if the location passed toredirectcontains unsanitized user input.Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
@sveltejs/kit:
query.batchcross-talkCVE-2026-82258 / GHSA-hgv7-v322-mmgr
More information
Details
query.batch()could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
CVE-2026-82257 / GHSA-866w-xmhq-wj7x
More information
Details
If you use remote form functions, have an input field of type
file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
SvelteKit: Big remote form function payloads can cause Node process to crash
CVE-2026-82256 / GHSA-wqjv-9729-c5q2
More information
Details
Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header
CVE-2026-66062 / GHSA-29g2-3rmr-qm68
More information
Details
Impact
SvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted
Acceptheaders. The impact is mitigated by default header length limits on most platforms, but in the case of raised or absent limits a denial of service is possible.Patches
The vulnerability is patched in
@sveltejs/kitversion 2.70.2.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
SvelteKit : XSS via untrusted cache-control header in prerendered page
CVE-2026-114061 / GHSA-27mw-82g8-phjj
More information
Details
Impact
Applications that prerender pages and use
setHeadersto set acache-controlheader from an untrusted source are vulnerable to cross-site scripting (XSS).SvelteKit inserts the header value into a
<meta http-equiv="cache-control">tag without escaping it. An attacker who can influence this value at prerender time can break out of thecontentattribute and inject HTML or JavaScript into the generated page. The injected code can then execute when users visit the page.Patches
The fix escapes the header value before inserting it into the generated HTML. Upgrade to
@sveltejs/kitversion 3.0.0 or later.Workarounds
Avoid forwarding untrusted
cache-controlheader values withsetHeaderson prerendered pages. Use a fixed, trusted cache policy instead.Severity
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
SvelteKit: URL redirection to untrusted site via enhanced form submission
CVE-2026-114060 / GHSA-pfhg-q3qv-9q6r
More information
Details
Impact
Applications using enhanced form actions (
use:enhance) on routes that accept paths beginning with//, such as catch-all routes, may be vulnerable to an open redirect.Patches
A fix has been prepared for
@sveltejs/kit3.0.0. Users should upgrade to 3.0.0 or later.The fix preserves leading double slashes in action paths without generating protocol-relative URLs, restricts non-redirect action navigation to the current origin, and includes the origin when comparing action locations with the current page.
Workarounds
Reject requests whose parsed URL pathname begins with
//before route resolution, for example in a reverse proxy or a SvelteKithandlehook.Alternatively, disable navigation for non-redirect enhanced form results by supplying a custom submission callback:
This applies non-redirect results to the current page instead of navigating to the action location.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
sveltejs/kit (@sveltejs/kit)
v3.0.0Compare Source
Major Changes
breaking: move remote function types to
$app/server(#16740)breaking: remove
experimental.handleRenderingErrorsflag (#16265)breaking: make
getRequestandsetResponsesynchronous (#16280)breaking: TypeScript 6 is now the minimum required version (#15930)
breaking: refresh all load functions/queries when clicking a link to the current URL (#16572)
breaking: move remote function types to
$app/server(#16764)breaking: upgrade to
cookiev2. Cookie names must now contain only ASCII characters (#13386)breaking: require Node 22 or newer (#12548)
major: error when a client-requested single-flight mutation isn't respected by the server, allow the server to explicitly ignore refreshes (#16892)
breaking: remove the
preloadStrategyoption.modulepreloadwill always be used (#15256)breaking: default the cookie
pathoption to'/'(#15398)breaking: remove
@sveltejs/kit/node/polyfills(#15430)breaking: add
config.kit.output.linkHeaderPreloadto preload using theLinkheader (#15939)breaking: require
@sveltejs/vite-plugin-sveltev7 (#15371)breaking: make
page.urlimmutable on a type level (#16256)breaking: remove
base,assets, andresolveRoutefrom$app/paths(#15507)breaking: remove
createEntriesfrom theBuilderobject passed to adapter functions (#15509)breaking: return no content for 204 responses (#16200)
breaking: rename
Pathnametype toPathandAssettoAssetPath(#16430)breaking: remove leading
/fromPathandAssetPathbreaking:
handle'sresolveis now typed to always return aPromise(#16352)breaking: remove
Serverconstructor andSSRManifestfrom public types (#16876)breaking: require Svelte config options to be passed through the Vite plugin (#16007)
breaking: form action responses now use the HTTP status code returned from
fail(#16200)breaking: write tsconfig to
node_modules/$app/tsconfig(#16458)breaking: move
defineParamsand associated types to@sveltejs/kit/params(#16716)breaking: remove the deprecated CSRF
checkOriginoption in favor oftrustedOrigins(#15437)breaking: the
deltaproperty now only exists forpopstatenavigation events (#15522)breaking: change
form.errortype fromanytoApp.Error | undefined(#16245)breaking: remove deprecated
pragmaheader in version polling for improved CORS support (#15428)breaking:
gotonow rejects when called with a URL that does not resolve to a route within the app, matching the existing behaviour for external URLs (#16164)breaking: run all errors through the
handleErrorhook (#16664)breaking: require Svelte 5.56.4 or newer (#15371)
breaking: error on
event.url,event.paramsandevent.routeaccess inside queries (#16452)breaking: enhanced cross-page form actions now navigate to the action page on success and failure, matching native form behavior (#16684)
breaking: delete
$service-workermodule (#16450)breaking: move
defineEnvVarsto@sveltejs/kit/env(#16375)breaking: nested server-only directories (#15685)
feat: allow adapters to provide additional Vite plugins (#16206)
breaking: replace the
$libalias with#liband removefiles.libconfig. (#16360)breaking: remove
#libdefinition frompaths; requires explicit module extensions as a result (#16736)chore: change
error,isHttpError,redirect, andisRedirectto refer to public type instead of internal class (#13036)breaking: move hooks-related types to
@sveltejs/kit/hooks(#16737)breaking: add 'error' result type to
preloadData(#12579)breaking: detect new deployments on data, remote, and form action responses, tab focus, and visibility change, and default
version.pollIntervalto 1 hour (#16496)breaking: disallow cross-origin form submissions without a
Content-Typeheader (#16347)breaking: Server-only directories (
/server/in the path) are now treated as server-only everywhere inside the project (exceptsrc/routesand the assets directory) (#16360)breaking:
configexported from a universal route file takes precedence over a server one (#16400)breaking: require Vite 8. Provides new functionality even for existing Vite 8 users such as faster builds with Vite hook filters and more powerful SvelteKit adapters with the Vite environment API (#15371)
breaking: remove
data-sveltekit-*option'off'in favour offalse(#15907)breaking: move tracing out of the experimental namespace and remove the instrumentation flag (#16260)
breaking: add
kit.paths.originconfig option, removekit.prerender.originand theadapter-nodeORIGINenvironment variable (#16161)breaking: move
Page,ReadonlyURLandReadonlyURLSearchParamsfrom@sveltejs/kitto$app/state(#16694)breaking: remove
$app/stores(#15499)breaking: add
refreshAlland deprecateinvalidateAll(#16289)breaking: reject query parameters beginning with
x-sveltekit-(#17125)breaking: disallow
*.remote.ts/jsfiles unlessexperimental.remoteFunctionsis enabled (#16247)breaking: replace the
noScrollandkeepFocusoptions ofgotowith a singleresetoption, and thedata-sveltekit-noscrollanddata-sveltekit-keepfocusattributes withdata-sveltekit-reset(#16558)breaking: don't abort navigation when calling
invalidate(All)during navigation (#16188)breaking: consistent special filename patterns (#16382)
breaking: allow
handleErrorto influence status code (#16162)breaking: delegate CORS handling to Vite for static directory requests during development (#16357)
breaking: require
vite@^8.0.12, the first Vite 8 release bundling stablerolldown1.0.0 (#16134)breaking: only include routes with a
+pageor+serverinRouteId(#16580)breaking: require Node 22.17 (#16597)
breaking: deprecate
error(status, {...})in favour oferror(status, message, {...})(#16540)breaking: replace the
builder.generateManifestwithbuilder.generateServerInstanceandbuilder.manifest(#16875)breaking: forbid external redirects by default (#16198)
breaking: separate adapter Vite plugins into
preandpost(#16711)breaking: remove param files in folder in favor of
params.js/tsfile (#16189)breaking: move env-related types to
@sveltejs/kit/env(#16739)breaking:
preloadCodenow takes a route ID (e.g./blog/[slug]) instead of a pathname. Route IDs are not prefixed withpaths.base(#16576)breaking: move
BeforeNavigate,OnNavigate,AfterNavigate,Navigation,NavigationTarget,NavigationType,GotoOptionsand theNavigation*variant types from@sveltejs/kitto$app/navigation(#16694)breaking: move
ActionResultandSubmitFunctionfrom@sveltejs/kitto$app/forms(#16694)breaking: remove
handleValidationErrorand pass remote function validation errors tohandleErrorwithkind: 'validation'(#16672)breaking: remove deprecated
.run()method from live queries (#16573)Minor Changes
feat: allow hyphens in param and matcher names (#16284)
feat: add
$app/manifestmodule withimmutable,assets,prerendered, androutesexports (#16372)feat: ignore files with + prefix if they contain test/spec/stories (#16715)
feat: add
ErrorPropsto generated types (#16272)feat: support sourcemaps in production (#16412)
feat: return the list of compressed files from
builder.compress(#16566)feat: better response logging (#16744)
feat: warn when tsconfig doesn't exclude service worker (#16645)
feat: validate that all remote form fields were created with form.fields.foo.as(...) (#16331)
feat: support function validators for environment variables (#16402)
feat: use
type: 'module'for service worker registrations (#16169)feat: allow adapters to receive the Svelte config as a function argument when adding Vite plugins (#16986)
feat: add shallow routing to
gotoand deprecatepushStateandreplaceState(#16449)feat: abort
request.signalwhen the response closes prematurely, via a newresponseoption forgetRequest(#16793)feat: make
$app/pathsimportable in service workers (#16441)feat: pass the project-relative source
filenameto thepreloadfilter for fonts (#16443)feat: preserve page state set through
goto(..., { state, persistState: true })across reloads (#16449)feat: reinstate
$env/static/private,$env/dynamic/private,$env/static/public,$env/dynamic/publicand$app/environmentas deprecated aliases for$app/env/private$app/env/publicand$app/env(#16334)feat: add
pageandendpointbooleans to$app/manifest'sroutes, and export aManifestRoutetype (#16594)feat:
$app/service-workermodule (#16458)feat: resolve paths using the Vite config
rootoption instead ofprocess.cwd()to better support monorepo configurations such as Vitest workspaces (#15469)feat: better error logging (#16374)
feat: add
PageRouteIdandEndpointRouteIdto$app/types(#16594)feat: better tsconfig validation (#16458)
feat: add
dirty()property to form fields (#16208)feat: support the
QUERYHTTP method in+server.js(#16782)feat: allow adapters to override
getRequestandsetResponseduringvite devandvite preview(#16753)chore: deprecate
Responsehelpers in favor of platform-provided alternatives (#15448)feat: add
cookies.parsemethod (#16203)chore: deprecate
export const snapshotin favour of thesnapshothelper (#16687)feat: add
snapshothelper to$app/navigation(#16685)feat: support custom values in
page.stateviatransporthook (#16662)fix: default cookies to
securetofalseduring development (#16462)feat: warn when naively proxying requests that result in responses with a
content-encodingheader (#16633)feat: accept the checked state as a third argument to
.as('radio', ...)and.as('checkbox', ...)so that these inputs reset to it after a submission (#16926)feat: add an
applyReroutehelper for adapters that support split serverless function deployments (#16665)Patch Changes
fix: prevent scheme-like path segments from causing off-site trailing-slash redirects (#17294)
chore: share the action error result between form actions and remote forms (#16835)
fix: persist global app state across module graph reloads (#16663)
fix: generate valid
Pathtypes for routes with optional or rest params, several params in one segment, or escape sequences (#16577)fix: coerce values typed into remote form fields, and only apply the default given to
.as()until the field is edited (#16939)fix: blur focused SVG elements before the DOM update on navigation (#16983)
fix: support bigint params in server-side route resolution (#17130)
chore: build streamed responses from async generators (#16847)
fix: generate types when dev server starts (#17034)
fix: allow
undefinedvalues to be passed to form field.as(...)where applicable (#15681)fix: respect
paths.relativeduring development for client files (#17053)fix: validate prerender concurrency (#17145)
chore: deprecate
builder.rimrafandbuilder.mkdirpin favour ofnode:fsmethods (#16610)fix: manipulate stack trace for errors that happen while generating prerender inputs (#17113)
fix: don't treat callable standard schemas as function param matchers (#16403)
fix: prevent non-redirect enhanced form results from navigating to another origin (#17293)
fix: clarify circular imports from
src/env(#17014)fix: keep memory flat when precompressing many files (#16993)
fix: render remote form actions while prerendering (#17139)
fix: ignore Vitest browser loader HTML transforms (#17092)
fix: prevent failed link preloads from causing unhandled promise rejections in production (#17181)
fix: resolve generated rootDirs from the project root (#17242)
fix: generate route resolution modules as siblings of
.htmlpages (#16674)perf: parse large streamed frames in linear time (#16489)
fix: keep at most one pending body read at a time when deserializing binary forms (#16783)
fix: escape cache-control headers in prerendered HTML (#17293)
fix: decode all numeric character references, including above
ffff, when crawling prerendered pages (#16611)fix: enforce request body size limits when Content-Type is absent (#17127)
fix: include queries refreshed from within another query in the serialized response (#16461)
fix: reject malformed streamed data encoding (#16423)
perf: cache the default cookie header parse and avoid allocations in
cookies.get(#16341)fix: exclude deleted cookies from
cookies.getAll()so it stays consistent withcookies.get()(#16297)fix: hide stack traces for internal errors like 404s (#16411)
chore: deduplicate repeated CSP directive handling (#16498)
fix: render the nearest error page when a form submission receives a non-ActionResult error response (#16308)
chore: bump
mrmimeto 2.0.1 (#16745)fix: correctly implement Vite plugin hook filters (#16760)
fix: ignore nested outDir files outside generated (#17150)
fix: defer
query.refresh()in server commands until after the command body completes (#16225)fix: drain unconsumed request bodies so keep-alive connections don't hang (#16170)
fix: keep
history.scrollRestorationset tomanualwhen leaving the page, so a document restored from the back/forward cache does not fall back to browser scroll restoration (#17244)fix: resolve service worker and
tsconfig.jsonbased on Viterootsetting (#16229)fix: rebuild the dev manifest when route files disappear during an incremental update (#16643)
breaking: populate env vars before
instrumentation.server.jsis evaluated and update the adapter instrumentation API (#16303)fix: only print prerender progress newline when necessary (#16766)
perf: match only unpaired surrogates when escaping HTML (#16407)
fix: treat
data:protocol URLs as external for redirect (#16392)chore: deduplicate request hashing for serialized fetch responses (#16499)
fix: don't treat
Object.prototypemembers as param matchers during validation (#16612)fix: generate a
neverPathtype when there are no routes (#17228)fix: follow HTTP redirects from authentication proxies when enhancing form submissions (#17106)
fix: don't report empty environment variables as missing (#16401)
chore: generate the env modules in a single pass (#16833)
fix: externalize
@opentelemetry/apito prevent bundler chunk colocation betweeninstrumentation.server.jsand application code (#16302)fix: support form fields named after Object prototype properties (#17136)
fix: exclude routes without a page or endpoint from
routesin$app/manifest, and remove directories with no route files fromLayoutParams(#16588)fix: record a history traversal before resolving its route (#16959)
fix: avoid Vite dev server reload on initial page request (#16553)
fix: don't set a
nullaccept-languageheader on internalfetchsub-requests when the incoming request has none (#16527)fix: reuse SSR-cached fetch responses during hydration when a cross-origin URL is not in canonical form (#16339)
fix: correctly detect prerendered paths in server
fetchwhenpaths.baseis set (#16525)chore: say what a valid remote form field name looks like when rejecting one (#16938)
chore: warn when remote form fields are enumerated in dev (#16940)
fix: populate
$app/env/*dynamic variables in contexts that don't run the dev server, such asvite-node(#16223)fix: resolve client manifest imports against the Vite root (#16803)
fix: properly handle Date objects in form.fields.set (#16168)
fix: return 404 for form actions and remote functions whose name is an
Object.prototypemember (#16072)fix: no longer throw "An impossible situation occurred" when a server-only module is imported by both server and client code (#16257)
fix: respect Vite default log level (#16767)
fix: set the focus starting point without a fragment navigation, which leaked a
hashchangeto app listeners (#16992)fix: keep a
form.forinstance registered when the derived that holds it disconnects and reconnects (#17230)fix: make cookie options optional (#17201)
fix: don't duplicate remote modules in the generated manifest (#16532)
fix: evict hashed fetch cache entries after mutations (#17146)
chore: reuse base64 and text decoding helpers (#16608)
fix: explain the removal of
$liband$service-workerwhen their imports fail to resolve (#16635)fix: tweak response logging for remote requests (#16865)
fix: correctly massage stack traces with async frames (#16633)
fix: mark
RequestEventproperties asreadonly(#16661)fix: render the nearest
+error.svelteat the depth it occupies when an error is thrown during rendering (#16526)fix: support coordinate objects from image inputs in remote forms (#16944)
fix: revert route metadata caching to regenerate missing root-route types during sync (#17281)
chore: bump
@sveltejs/acorn-typescriptto 1.0.12 (#16745)fix: update
matchparameter type (#16636)fix: generate sourcemaps for remote modules (#16440)
fix: keep hash-router links on the current document when resolving paths (#17107)
fix: avoid empty getElementById() call on hash routing navigation (#16448)
fix: resolve every module entry point using
kit.moduleExtensions(#17043)fix: serve
.icofiles withimage/x-iconContent-Type (#16234)chore: bump
magic-stringto 1.1.0 (#16745)fix: exclude inlined files from the page's
$app/manifestimmutable list (#16531)fix: discard invalidation results when a navigation completes while they load (#16852)
fix: avoid client-side code being bundled by Cloudflare Wrangler (#16364)
fix: wait for the redirect navigation before remote form submissions resolve (#16765)
fix: record the mime types of prerendered paths in the server manifest (#16564)
fix: only require the
svelte-trusted-htmltrusted-types policy when client-side code is shipped, allowing builds where all pages havecsr: false(#16928)chore: clarify which hooks run during server route resolution (#16397)
fix: yield to allow prerender updates to be visible (#16748)
fix: make
paths.origintype looser (#16215)chore: bump
devalueto 5.9.0 (#16745)feat: send periodic
keep-aliveSSE comments fromquery.liveto prevent idle-timeout errors (#16063)fix: send an explicit SSE Accept header for
query.liverequests to avoid buffering by proxies (#17104)fix: don't touch the
query.livestream controller after teardown, and make response cancellation observable via the generator'srequest.signal(#16790)fix: print
builder.log.warnmessages to stderr, as documented (#17253)fix: warn if hook files are spelled as "hook" instead of "hooks" (#16483)
fix: only suggest a
+prefix for route filenames that are valid with the file's extension (#16837)chore: only generate each route's resolution module once when prerendering (#16576)
fix: don't throw from remote form
validate()if the form unmounts while it is waiting for a tick (#16720)chore: share navigation completion between navigate and shallow routing (#16838)
fix: route dev-server response logging through Vite's logger so it respects
logLevelandcustomLogger(#16858)fix: skip clean fields when programmatically validating forms (#16208)
perf: skip import graph collection outside client environments (#16383)
breaking: experimental remote form
validate({ includeUntouched })option is nowall(#16208)fix: rerun load functions when the number of values of a tracked search parameter changes (#16495)
chore: read build-time config from defines on the server instead of carrying it in
options(#16873)fix: avoid client build warning about externalising
node:async_hooks(#16244)chore: stop externalizing
cookiedependency during build (#16936)fix: reinstate
$app/environmentas an alias for$app/env, in case dependencies import it (#15964)fix: preserve
paths.basewhenvite previewredirects a prerendered page to the correct trailing slash (#16836)fix: error when reading non-serialized
set-cookieheaders viagetSetCookieinload(#16614)fix: walk and copy directories without a stat per file (#16995)
perf: avoid quadratic remote form issue merging (#16493)
fix: widen remote form fields for union schemas and string enums (#16937)
chore: deprecate the
aliasoption (#16470)fix: don't attempt to serialize fetch responses when the request body is not a string or TypedArray (#16501)
fix: respond to
HEADrequests without a body (#17036)chore: replace deprecated Vite dev server APIs (#16961)
chore: iterate the query cache maps through a single generator (#16846)
fix: handle rejected streamed server data after delayed loads (#16268)
fix: don't crash on interactions inside a form whose controls shadow
nodeName(#16769)fix: don't replay a preloaded redirect when a later hop of the navigation returns to the route (#16955)
fix: prevent path traversal when previewing prerendered pages and data on Windows (#17293)
fix: settle a query's pending request in place when its value arrives through
set()(#16958)fix: render pages over sibling endpoints without GET or HEAD handlers (#16125)
fix: exit build workers after completing their tasks while allowing synchronous exit handlers to run (#17135)
fix: prevent infinite loops when server-side queries refresh each other in a cycle during the single-flight drain (#16461)
fix: populate
versionin service workers (#16434)feat: add field.touched() helper to remote form fields (#14692)
fix: respect
paths.relativefor server-side route resolution imports (#17056)fix: read the error status of
App.Errorin theprerenderandquery.liveremote functions (#16529)fix: resolve remote modules as external during dev prebundling so packages can re-export remote functions (#16426)
chore: standardize remote-function and shared form diagnostics (#17277)
fix: avoid
Promise.withResolversin client remote functions for older browser support (#16777)fix: propagate errors from prerendered remote responses instead of re-running the function (#16535)
chore: remove unused helpers (#16834)
fix: allow reserved words (e.g.
delete,class) as remote function export names (#16264)fix: reset failed
<svelte:boundary>on client navigation so a stale+error.svelteis torn down (#16296)fix: clear
navigatingwhen a shallow popstate aborts an in-flight navigation (#17118)fix: expand
[x+nn]and[u+nnnn]escape sequences when resolving a route id to a pathname (#16570)fix: respect user-set
server.corsandpreview.corsconfig instead of overriding them (#16924)fix: respect the status returned from
handleErroron the fallback error page served to error-page sub-requests (#16528)fix: restore scroll position after back-forward cache returns (#17255)
fix: warn if there are plugins using
transformIndexHtml(#16394)fix: refetch route-tracking server data when navigating away from an error page (#16381)
fix: allow routes to contain
[and]via the[x+5b]and[x+5d]escapes (#16569)chore: use
Response.jsoninstead of the deprecatedjsonhelper in runtime responses (#16804)fix: recommend safe include and exclude patterns in tsconfig warning (#17102)
chore: remove dependency on kleur (#12548)
fix: prevent server-side self-fetch fallbacks from following redirects (#17293)
fix: serialize
query(...).set(...)/query(...).refresh()values into the rendered HTML when called from within a query during SSR (#16461)chore: configure the server runtime in one place, deprecate
Serverin favour of theserverobject written bybuilder.generateServerInstance(#17000)chore: derive
content-lengthfrom fixed response bodies insetResponse(#16794)fix: correctly read zero-length files at the end of a binary form payload (#16783)
fix: reject fallback handlers on prerendered endpoints (#17140)
fix: don't destroy partial-line app output with the prerender progress line (#16750)
chore: remove virtual modules (#16813)
fix: surface prerender errors during development (#16507)
chore: bump
cookieto 2.0.1 (#16745)fix: detect
$app/serverand$app/env/privateclient imports when SvelteKit is installed inside the project root (#16648)chore: read
optionsfrom a single module instead of passing it through the server runtime (#16871)fix: wait for the redirect navigation before prerendered remote functions resolve (#16765)
fix: sort directory entries when building the route manifest so node indices are deterministic across runtimes (e.g. Bun and Node) (#16074)
fix: skip unnecessary
version.jsonchecks ifupdated.currentis alreadytrue(#16518)fix: allow generation of $app/tsconfig without TypeScript installed (#16534)
chore: remove dependency on
set-cookie-parser(#15384)chore: share the nearest error page walk between client and server (#16774)
fix: fall back to the page's form actions when a sibling endpoint has no POST handler (#16349)
fix: record client output extensions in
builder.mimeTypes(#16908)perf: use a
Setto check element ids when validating fragment links during prerendering (#16494)fix: preserve shared client chunk hashes when the app version changes (#16324)
fix: include hoisted packages in Vite's
server.fs.allowlist (#15998)chore: standardize app template diagnostics (#17250)
chore: standardize Vite plugin, build, prerender and adapter diagnostics (#17253)
chore: standardize client navigation, preload, snapshot and enhancement diagnostics (#17276)
chore: standardize configuration, environment and tsconfig diagnostics (#17251)
chore: standardize public API,
$app/*and deprecated module diagnostics (#17265)chore: standardize route discovery, parameter and route export diagnostics (#17252)
chore: standardize server request, hook and page diagnostics (#17275)
fix: preserve metadata on streamed page responses (#16935)
fix: only include
_app/immutablefiles in$app/manifest'simmutablein the service worker (#16531)chore: remove the dead
SSRState.fallbackfield and name the server state fork semantics (#16598)fix: atomically replace route metadata during sync (#17096)
fix: import resolved peer dependencies as file URLs so project-relative resolution works on Windows (#16618)
fix: preserve sourcemap source paths when adapters copy build output (#17082)
fix: log errors caught by the Vite dev server handler (#16550)
chore: bump
acornto 8.18.0 (#16745)fix: resolve
rootper instance of the SvelteKit Vite plugin (#16513)fix: report tsconfig parse errors on Windows (#17251)
fix: return root layout server data for error-page data requests to non-existent routes (#16376)
fix: prevent prerender crawler from hanging on unterminated unquoted attributes (#17141)
fix: prevent
await_reactivity_losswarning andstate_unsafe_mutationerror when the new version detector runs after anawait(#16915)fix: redact nested and typed underscore-prefixed remote form fields after invalid submissions (#17128)
fix: ignore path casing differences when warning about overridden Vite config on Windows (#16545)
fix: return a lightweight 404 instead of rendering the error page for subresource requests (#16463)
fix: preserve stripped path prefixes by making trailing-slash redirects relative (#16431)
fix: preserve the current URL search parameters when submitting a remote form without JavaScript (#16373)
fix: only treat files in node_modules as remote modules when the package has a peer dependency on @sveltejs/kit (#16492)
fix: treeshake prerendered remote functions in the right chunks (#16533)
fix: correctly serialize Node.js buffers returned from remote functions during SSR (#17158)
fix: preserve errors with read-only stack properties (#17180)
chore: deduplicate type-stripping logic in
tweak_types(#16454)fix: avoid infinite loop when building with
--watchflag (#16632)chore: unify the
walkandlist_filesfilesystem helpers (#16784)fix: error during development if the adapter does not support instrumentation and it exists (#16548)
fix: use mouseover+mousemove for preloading to reduce events (#16325)
fix: reject invalid binary form file metadata (#17149)
fix: error on server-only imports reachable from hooks or service worker files outside the project root (#16912)
fix: write generated tsconfig to
node_modules/$app/tsconfig.jsonso that tools with simplified tsconfig resolution can find it (#16589)chore: emit env modules to disk (#16807)
fix: more informative error message when running a command inside a query or prerender function (#17293)
fix: adjust error overload for optional
App.Errorparameters (#16725)fix: prerender and crawl pages whose
content-typeheader carries acharsetparameter (#16567)fix: stream promised
readresults lazily instead of eagerly buffering them (#16622)fix: copy worker files emitted by the server build to the client output directory (#16929)
chore: parse page options and remote modules with Vite's
parseSyncinstead ofacorn(#16947)fix: correctly decode
[u+nnnn]escape sequences aboveffff(#16611)fix: Reject all pending query promises when a query fails before resolving with a value for the first time (#16890)
v2.70.3Compare Source
Patch Changes
$app/statedependencies during module initialization (b61018d)v2.70.2Compare Source
Patch Changes
Acceptheader content negotiation (82712fc)v2.70.1Compare Source
Patch Changes
v2.70.0Compare Source
Minor Changes
defineEnvVarsto@sveltejs/kit/env(#16378)Patch Changes
NODE_ENVvalue (#16313)v2.69.3Compare Source
Patch Changes
fix: detect destructured
loadandactionsexports during type generation (#16329)fix: ensure CSS URL references are absolute when
paths.relativeisfalse(#16315)fix: align MAX_COOKIE_SIZE with RFC 6265bis (#16322)
v2.69.2Compare Source
Patch Changes
definevalues onglobalThiswhen running Vitest (#16246)v2.69.1Compare Source
Patch Changes
fix: prevent prototype pollution when deleting file inputs (#16218)
fix: prevent unhandled promise rejection (#16219)
v2.69.0Compare Source
Minor Changes
submittedproperty of remote forms (#14811)Patch Changes
fix: clear issues and touched states on form reset (#16163)
fix: return
undefinedfromfields.branch.issues()when onlyfields.branch.leafhas issues (#16187)v2.68.0Compare Source
Minor Changes
feat: expose
RemoteFormEnhanceInstanceandRemoteFormEnhanceCallbacktypes (#15816)feat: set value of
submitfields when form is submitted (#15979)Patch Changes
fix: skip
native_navigationwhen__data.jsonreturns 404 on a static fallback page (#16135)fix: ignore third-party monkeypatches in
pushState/replaceStatewarning detection (#15267)fix: snapshot form fields on read (#16150)
fix: strip field prefix before erroring on duplicates (#16151)
fix: call reset function via prototype (#16138)
chore: fix navigation
typehover info (#16147)v2.67.0Compare Source
Minor Changes
prerender.handleInvalidUrloption for invalid URLs discovered while crawling (#16088)Patch Changes
fix: dedupe remote data (#15991)
fix: skip client build if all routes have CSR disabled (#15936)
v2.66.0Compare Source
Minor Changes
feat: precompress prerendered
.mdand.mdxfiles (#15893)feat: warn the user when they forget to make boolean inputs optional in their form schemas (#15804)
Patch Changes
fix: blur active element before component update during navigation so that blur/focusout handlers fire while old component data is still valid (#15452)
fix: ensure
baseis available from$service-workerduring development (#15882)fix: use correct relative asset paths when rendering an error page for a missing
__data.jsonrequest (#15884)fix: preserve active
for awaitconsumers acrossquery.livereconnects (#16022)fix: settle
query.livereconnect promise on all exit paths, preventinginvalidateAll()from deadlocking when a live query is offline or interrupted (#16022)fix: preserve last value when a
query.livestream completes without yielding on reconnect (#16022)fix: remove
types: ['node']from generated tsconfig to avoid errors when@types/nodeis not installed (#15709)fix: prefer pages over endpoints when prerendering (#16076)
fix: restore snapshots after afterNavigate callbacks (#16066)
fix: support
ws:/wss:andtrusted-types-evalfor CSP sources (#15938)fix: omit empty
fileinputs from remote form data (#15898)fix: fail early if a route with
+pageand+serveris marked as prerenderable (#16075)fix: wait a tick before resetting forms (#15805)
fix:
preflightschemas apply correctly when chained beforefor(#15863)fix: blank page in SPA mode when root layout
load()throws (#15798)fix: pass all unknown options from the
sveltekitVite plugin through tovite-plugin-svelte(#16010)v2.65.2Compare Source
Patch Changes
fix: throw an error when prerendering a root +server.js that returns a non-HTML response (#15994)
fix: decode base64-serialized fetch bodies before caching them for client-side replay (#16034)
fix: correctly access explicit dynamic public environment variables from prerendered pages and service workers (#16024)
fix: allow
preloadCodeto be called during initial page load (#16028)fix: send
cache-control: private, no-storeon remote function responses so personalized query results can never be cached by shared caches (#16020)fix: preserve the HTTP status and error body when a remote function request fails in transport (e.g. a 401/403 from a
handlehook), instead of reporting a generic 500 (#16021)fix: avoid loading universal nodes during build analysis when the app uses a hash router (#16042)
fix: correctly serve client entry during development when using the pnpm global virtual store (#16045)
fix: normalize path separators when comparing config (#16037)
fix: ensure
buildingresolves correctly to allow avoiding build-time explicit environment variable validation (#16058)fix: prevent unhandled promise rejections when remote function failures are consumed via
current/errorinstead ofawait(#16018)v2.65.1Compare Source
Patch Changes
fix: avoid importing the Vite development client code into builds with a non-standard
NODE_ENV(#16023)fix: don't emit the unused bundle and stylesheet files when using
bundleStrategy: 'inline'(#16025)fix: reset queries before navigating when
invalidateAllis set (#16014)fix: regression in loading assets for absolute path apps (#16026)
v2.65.0Compare Source
Minor Changes
Patch Changes
fix: dedupe remote data (#15991)
fix: skip client build if all routes have CSR disabled (#15936)
v2.64.0Compare Source
Minor Changes
Fileobjects (#15978)Patch Changes
v2.63.1Compare Source
Patch Changes
fix: use SSE for
query.live(#15957)fix: use forward slashes in the generated
env.d.tsimport path on Windows (#15977)fix: allow
$app/environmentwith a warning whenexplicitEnvironmentVariablesis enabled (#15980)fix: avoid importing Vite while validating explicit environment variables (#15953)
docs: adjust the release version of explicit env vars (#15968)
fix: ensure
versionis defined when importing from$app/envwith explicit environment variables (#15971)v2.63.0Compare Source
Minor Changes
Patch Changes
fix: remove check for svelte.config.js before running
sync(#15946)fix: generate a placeholder tsconfig.json to squelch sync-time warnings (#15948)
fix: allow use of
$app/env/publicin service workers (#15950)v2.62.0Compare Source
Minor Changes
Patch Changes
fix: preserve multiple
Set-Cookieheaders on 304 responses (#15902)fix: preload for anchor elements that were just previously preloaded (#15915)
fix: catch load function streaming errors on the client (#15929)
fix: avoid generating the
_app/env.jsmodule if public dynamic environment variables are not used by the app (#15940)v2.61.1Compare Source
Patch Changes
v2.61.0Compare Source
Minor Changes
breaking: the
.run()method has been removed from remote queries on both the client and the server. Useawait query()directly instead — it now works everywhere (#15779)feat: remote queries can now be awaited in any context (event handlers, module scope, async callbacks), not just inside reactive contexts. The cache is shared across reactive and non-reactive subscribers, so awaiting a query in an event handler will dedupe with components that have already subscribed to the same query. (#15779)
feat: live query instances are now themselves async-iterable (#15878)
feat: add programmatic
submitmethod toformremote function instances (#15657)feat: pass
formremote function instance intoenhancecallback (#15657)Patch Changes
fix: resolve the app payload without using
process.env.NODE_ENV(#15852)fix: support
exactOptionalPropertyTypesfor optional route params (#15825)fix: correctly send
truevalue to the server for 'submit' and 'hidden' form fields (#15858)fix: avoid build warnings about undefined universal hooks (#15895)
fix: prefer default error page when failing to decode the URL pathname (#15744)
fix: disable link prefetching on slow internet connections (#15885)
fix: allow routes ending with optional parameters next to more specific routes (#15861)
fix: remove reliance on Content-Length header in deserialize_binary_form, which caused failures when proxies (e.g. Vercel, Azure) strip the header and use chunked transfer encoding (#15796)
v2.60.1Compare Source
Patch Changes
chore: bump
svelteanddevalue(#15836)fix: prevent
query.batchcross-talk (dadaefc)v2.60.0Compare Source
Minor Changes
feat: allow 'submit' and 'hidden' form fields to accept numbers and booleans (#15802)
feat: warn on unread
formremote function validation issues (#15653)Patch Changes
fix: abort navigation after async rendering if obsolete (#15811)
fix: skip refreshing queries on full-page reload form submissions (#15803)
v2.59.1Compare Source
Patch Changes
v2.59.0Compare Source
Minor Changes
feat: support
query.batchinrequested(...)(#15751)breaking: on the server, make the promise returned from
refreshrepresent adding the refresh to the map, not the time it takes to run the remote function (#15705)feat: experimental
query.livefunction (#15705)Patch Changes
fix: unwrap
PromiseinRemoteCommandoutput type (#15771)fix: empty call to
.updates()on a command/form invocation means "don't update anything" (#15705)fix:
form.fields.foo.as('checkbox', default_value)now works (#15752)fix: remote forms with default values defined by
field.as('text', defaultValue)now correctly reset to the provided default values once submitted (#15753)fix: make sure queries always get started correctly (#15705)
fix: allow plain functions as overrides in
updates(#15705)v2.58.0Compare Source
Minor Changes
breaking: require
limitinrequested(as originally intended) (#15739)feat:
RemoteQueryFunctiongains an optional third generic parameterValidated(defaulting toInput) that represents the argument type after schema validation/transformation (#15739)breaking:
requestednow yields{ arg, query }entries instead of the validated argument (#15739)Patch Changes
fix: allow
query().current,.error,.loading, and.readyto work in non-reactive contexts (#15699)fix: prevent
deep_setcrash on nullish nested values (#15600)fix: restore correct
RemoteFormFieldstyping for nullable array fields (e.g. when a schema uses.default([])), so.as('checkbox')and friends work again (#15723)fix: don't warn about removed SSI comments in
transformPageChunk(#15695)Server-side include (SSI) directives like
<!--#include virtual="..." -->are HTML comments that are replaced by servers such as nginx. Previously, removing them intransformPageChunkwould trigger a false positive warning about breaking Svelte's hydration. Since SSI comments always start with<!--#and Svelte's hydration comments never do, they can be safely excluded from the check.Change enhance function return type from void to MaybePromise. (#15710)
fix: throw an error when
resolveis called with an external URL (#15733)fix: avoid FOUC for CSR-only pages by loading styles and fonts before CSR starts (#15718)
fix: reset form result on redirect (#15724)
v2.57.1Compare Source
Patch Changes
fix: better validation for
redirectinputs (10d7b44)fix: enforce
BODY_SIZE_LIMITon chunked requests (3202ed6)fix: use default values as fallbacks (#15680)
fix: relax form typings for union types (#15687)
v2.57.0Compare Source
Minor Changes
submitto indicate submission validity for enhancedformremote functions (#15530)Patch Changes
fix: use array type for select fields that accept multiple values (#15591)
fix: silently 404 Chrome DevTools workspaces request in dev and preview (#15656)
fix:
config.kit.csp.directives['trusted-types']requires'svelte-trusted-html'(and'sveltekit-trusted-url'when a service worker is automatically registered) if it is configured (#15323)fix: avoid inlineDynamicImports ignored with codeSplitting warning when using Vite 8 (#15647)
fix: reimplement treeshaking non-dynamic prerendered remote functions (#15447)
v2.56.1Compare Source
Patch Changes
v2.56.0Compare Source
Minor Changes
breaking: rework client-driven refreshes (#15562)
breaking: stabilize remote function caching by sorting object keys (#15570)
breaking: add
run()method to queries, disallow awaiting queries outside render (#15533)feat: support TypeScript 6.0 (#15595)
breaking: isolate command-triggered query refresh failures per-query (#15562)
feat: use
hydratablefor remote function transport (#15533)feat: allow
formfields to specify a default value (field.as(type, value)) (#15577)Patch Changes
fix: don't request new data when
.refreshis called on a query with no cache entry (#15533)fix: allow using multiple remote functions within one async derived (#15561)
fix: avoid false-positive overridden Vite
basesetting warning when setting apaths.baseinsvelte.config.js(#15623)fix: manage queries in their own
$effect.root(#15533)fix: avoid
inlineDynamicImportsdeprecation warning when building the service worker with Vite 8 (#15550)fix: correctly escape backticks when precomputing CSS (#15593)
fix: discard obsolete forks before finishing navigation (#15634)
chore: tighten up override implementation (#15562)
fix: ensure the default Svelte 5
error.sveltefile uses runes mode (#15609)fix: deduplicate same-cache-key
batchcalls during SSR (#15533)fix: decrement pending_count when form callback doesn't call submit() (#15520)
v2.55.0Compare Source
Minor Changes
$app/types, leading to better type safety when working with params in$app/types,$app/state, and hooks. (#15502)v2.54.0Compare Source
Minor Changes
Patch Changes
chore: upgrade
devalue(#15535)fix: don't wait for remote functions that are not awaited in the template (#15280)
feat: allow
resolve()to accept pathnames with a search string and/or hash (#15458)chore: remove deprecation warnings for
config.kit.files.*options when validating the Svelte config file (#15482)fix: handles form target attribute in remote form redirects (#15457)
v2.53.4Compare Source
Patch Changes
codeSplittingoption (#15451)v2.53.3Compare Source
Patch Changes
form(faba869)v2.53.2Compare Source
Patch Changes
fix: server-render nested form value sets (#15378)
fix: use deep partial types for form remote functions
.value()and.set(...)(#14837)fix: provide correct url info to remote functions (#15418)
fix: allow optional types for remote query/command/prerender functions (#15293)
fix: allow commands in more places (#15288)
v2.53.1Compare Source
Patch Changes
inlineDynamicImportswhen using Vite 8 (#15403)v2.53.0Compare Source
Minor Changes
Patch Changes
fix: remove event listeners on form attachment cleanup (#15286)
fix: apply queries refreshed in a form remote function when a redirect is thrown (#15362)
v2.52.2Compare Source
Patch Changes
fix: validate
formfile information to prevent amplification attacks (3e607b3)chore: upgrade
devalueandsvelte(#15339)fix: parse file offset table more strictly (
f47c01b)v2.52.0Compare Source
Minor Changes
matchfunction to map a path back to a route id and params (#14997)Patch Changes
fix: respect scroll-margin when navigating to a url-supplied anchor (#15246)
fix:
resolvewill narrow types to follow trailing slash page settings (#15027)v2.51.0Compare Source
Minor Changes
feat: add
scrollproperty toNavigationTargetin navigation callbacks (#15248)Navigation callbacks (
beforeNavigate,onNavigate, andafterNavigate) now include scroll position information via thescrollproperty onfromandtotargets:from.scroll: The scroll position at the moment navigation was triggeredto.scroll: InbeforeNavigateandonNavigate, this is populated forpopstatenavigations (back/forward) with the scroll position that will be restored, andnullfor other navigation types. InafterNavigate, this is always the final scroll position after navigation completed.This enables use cases like animating transitions based on the target scroll position when using browser back/forward navigation.
feat:
hydratable's injected script now works with CSP (#15048)Patch Changes
fix: put preloads before styles (#15232)
fix: suppress false-positive inner content warning when children prop is forwarded to a child component (#15269)
fix:
fetchnot working when URL is same host but different thanpaths.base(#15291)fix: navigate to hash link when base element is present (#15236)
fix: avoid triggering
handleErrorwhen redirecting in a remote function (#15222)fix: include
testdirectory in generatedtsconfig.jsonalongside existingtestsentry (#15254)fix: generate
tsconfig.jsonusing the value ofkit.files.src(#15253)v2.50.2Compare Source
Patch Changes
fix: ensure inlined CSS follows
paths.assetsandpaths.relativesettings (#15153)fix: emit script CSP nonces when
unsafe-inlineis present ifstrict-dynamicis also present (#15221)fix: re-export browser/dev from esm-env (#15206)
fix: use validated args in batch resolver in both csr and ssr (#15215)
fix: ensure CSS inlining includes components that are conditionally rendered (#15153)
fix: only match rest params with matchers when the matcher matches (#15216)
fix: properly handle percent-encoded anchors (e.g.
<a href="#sparkles-%E2%9C%A8">) during prerendering. (#15231)v2.50.1Compare Source
Patch Changes
fix: include
hooks.serverandhooks.universalas explicit Vite build inputs to ensure assets imported by hooks files are correctly discovered (#15178)fix: improves fields type for generic components (#14974)
fix: preload links if href changes (#15191)
v2.50.0Compare Source
Minor Changes
buttonPropsfrom experimental remote form functions; use e.g.<button {...myForm.fields.action.as('submit', 'register')}>Register</button>button instead (#15144)v2.49.5Compare Source
Patch Changes
fix: avoid overriding Vite default
basewhen running Vitest 4 (#14866)fix: ensure url decoded pathnames are not mistaken as rerouted requests (
d9ae9b0)fix: add length checks to remote forms (
8ed8155)Configuration
📅 Schedule: (in timezone America/Los_Angeles)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below:
File name: package-lock.json
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.