SvelteKit

Major Changes

• major: error when a client-requested single-flight mutation isn't respected by the server, allow the server to explicitly ignore refreshes (#16892)

• breaking: remove Server constructor and SSRManifest from public types (#16876)

• breaking: replace the builder.generateManifest with builder.generateServerInstance and builder.manifest (#16875)

Minor Changes

• feat: allow adapters to receive the Svelte config as a function argument when adding Vite plugins (#16986)

• feat: allow adapters to override getRequest and setResponse during vite dev and vite preview (#16753)

Patch Changes

• fix: respect paths.relative during development for client files (#17053)

• fix: clarify circular imports from src/env (#17014)

• breaking: populate env vars before instrumentation.server.js is evaluated and update the adapter instrumentation API (#16303)

• fix: record a history traversal before resolving its route (#16959)

• fix: support coordinate objects from image inputs in remote forms (#16944)

• fix: walk and copy directories without a stat per file (#16995)

• fix: widen remote form fields for union schemas and string enums (#16937)

• fix: respond to HEAD requests without a body (#17036)

• chore: replace deprecated Vite dev server APIs (#16961)

• fix: settle a query's pending request in place when its value arrives through set() (#16958)

• fix: prevent await_reactivity_loss warning and state_unsafe_mutation error when the new version detector runs after an await (#16915)

• chore: parse page options and remote modules with Vite's parseSync instead of acorn (#16947)

Minor Changes

• feat: add an applyReroute helper for adapters that support split serverless function deployments (#16665)

Patch Changes

• chore: build streamed responses from async generators (#16847)

• fix: tweak response logging for remote requests (#16865)

• fix: discard invalidation results when a navigation completes while they load (#16852)

• fix: route dev-server response logging through Vite's logger so it respects logLevel and customLogger (#16858)

• chore: read build-time config from defines on the server instead of carrying it in options (#16873)

• chore: read options from a single module instead of passing it through the server runtime (#16871)

Minor Changes

• feat: pass the project-relative source filename to the preload filter for fonts (#16443)

• feat: support the QUERY HTTP method in +server.js (#16782)

Patch Changes

• chore: share the action error result between form actions and remote forms (#16835)

• perf: parse large streamed frames in linear time (#16489)

• fix: keep at most one pending body read at a time when deserializing binary forms (#16783)

• fix: render the nearest error page when a form submission receives a non-ActionResult error response (#16308)

• chore: generate the env modules in a single pass (#16833)

• fix: reuse SSR-cached fetch responses during hydration when a cross-origin URL is not in canonical form (#16339)

• fix: resolve client manifest imports against the Vite root (#16803)

• fix: render the nearest +error.svelte at the depth it occupies when an error is thrown during rendering (#16526)

• fix: wait for the redirect navigation before remote form submissions resolve (#16765)

• fix: only suggest a + prefix for route filenames that are valid with the file's extension (#16837)

• fix: don't throw from remote form validate() if the form unmounts while it is waiting for a tick (#16720)

• chore: share navigation completion between navigate and shallow routing (#16838)

• fix: rerun load functions when the number of values of a tracked search parameter changes (#16495)

• fix: preserve paths.base when vite preview redirects a prerendered page to the correct trailing slash (#16836)

• chore: iterate the query cache maps through a single generator (#16846)

• fix: don't crash on interactions inside a form whose controls shadow nodeName (#16769)

• chore: remove unused helpers (#16834)

• fix: correctly read zero-length files at the end of a binary form payload (#16783)

• chore: remove virtual modules (#16745)

• fix: wait for the redirect navigation before prerendered remote functions resolve (#16765)

• chore: share the nearest error page walk between client and server (#16774)

• fix: return root layout server data for error-page data requests to non-existent routes (#16376)

• chore: unify the walk and list_files filesystem helpers (#16784)

• chore: emit env modules to disk (#16745)

Patch Changes

• fix: avoid eagerly reading $app/state dependencies during module initialization (b61018d)

Patch Changes

• fix: only print prerender progress newline when necessary (#16766)

Patch Changes

• fix: respect Vite default log level (#16767)

Major Changes

• breaking: move remote function types and isValidationError to @sveltejs/kit/remote (#16764)

• breaking: move RequestEvent and Cookies to $app/server (#16751)

Patch Changes

• fix: correctly implement Vite plugin hook filters (#16760)

• fix: yield to allow prerender updates to be visible (#16748)

• fix: don't destroy partial-line app output with the prerender progress line (#16750)

Major Changes

• breaking: move remote function types to $app/server (#16740)

• breaking: remove #lib definition from paths; requires explicit module extensions as a result (#16736)

• breaking: move hooks-related types to @sveltejs/kit/hooks (#16737)

• breaking: move env-related types to @sveltejs/kit/env (#16739)

Minor Changes

• feat: better response logging (#16744)

Patch Changes

• chore: bump mrmime to 2.0.1 (#16745)

• chore: bump @sveltejs/acorn-typescript to 1.0.12 (#16745)

• chore: bump magic-string to 1.1.0 (#16745)

• chore: bump devalue to 5.9.0 (#16745)

• chore: bump cookie to 2.0.1 (#16745)

• chore: bump acorn to 8.18.0 (#16745)

• fix: avoid infinite loop when building with --watch flag (#16632)

Major Changes

• breaking: move defineParams and associated types to @sveltejs/kit/params (#16716)

• breaking: run all errors through the handleError hook (#16664)

• breaking: move Page, ReadonlyURL and ReadonlyURLSearchParams from @sveltejs/kit to $app/state (#16694)

• breaking: move BeforeNavigate, OnNavigate, AfterNavigate, Navigation, NavigationTarget, NavigationType, GotoOptions and the Navigation* variant types from @sveltejs/kit to $app/navigation (#16694)

• breaking: move ActionResult and SubmitFunction from @sveltejs/kit to $app/forms (#16694)

• breaking: remove handleValidationError and pass remote function validation errors to handleError with kind: 'validation' (#16672)

Minor Changes

• feat: ignore files with + prefix if they contain test/spec/stories (#16715)

Patch Changes

• fix: rebuild the dev manifest when route files disappear during an incremental update (#16643)

• fix: externalize @opentelemetry/api to prevent bundler chunk colocation between instrumentation.server.js and application code (#16302)

• fix: surface prerender errors during development (#16507)

• fix: adjust error overload for optional App.Error parameters (#16725)

Major Changes

• breaking: separate adapter Vite plugins into pre and post (#16711)

Major Changes

• breaking: enhanced cross-page form actions now navigate to the action page on success and failure, matching native form behavior (#16684)

Minor Changes

• chore: deprecate export const snapshot in favour of the snapshot helper (#16687)

• feat: add snapshot helper to $app/navigation (#16685)

Patch Changes

• fix: generate route resolution modules as siblings of .html pages (#16674)

Major Changes

• breaking: remove experimental.handleRenderingErrors flag

• breaking: make getRequest and setResponse synchronous

• breaking: TypeScript 6 is now the minimum required version

• breaking: refresh all load functions/queries when clicking a link to the current URL

• breaking: upgrade to cookie v2. Cookie names must now contain only ASCII characters

• breaking: require Node 22 or newer

• breaking: remove the preloadStrategy option. modulepreload will always be used

• breaking: default the cookie path option to '/'

• breaking: remove @sveltejs/kit/node/polyfills

• breaking: add config.kit.output.linkHeaderPreload to preload using the Link header

• breaking: require @sveltejs/vite-plugin-svelte v7

• breaking: make page.url immutable on a type level

• breaking: remove base, assets, and resolveRoute from $app/paths

• breaking: remove createEntries from the Builder object passed to adapter functions

• breaking: return no content for 204 responses

• breaking: rename Pathname type to Path and Asset to AssetPath breaking: remove leading / from Path and AssetPath

• breaking: handle's resolve is now typed to always return a Promise

• breaking: require Svelte config options to be passed through the Vite plugin

• breaking: form action responses now use the HTTP status code returned from fail

• breaking: write tsconfig to node_modules/$app/tsconfig

• breaking: remove the deprecated CSRF checkOrigin option in favor of trustedOrigins

• breaking: the delta property now only exists for popstate navigation events

• breaking: change form.error type from any to App.Error | undefined

• breaking: remove deprecated pragma header in version polling for improved CORS support

• breaking: goto now rejects when called with a URL that does not resolve to a route within the app, matching the existing behaviour for external URLs

• breaking: require Svelte 5.56.4 or newer

• breaking: error on event.url, event.params and event.route access inside queries

• breaking: delete $service-worker module

• breaking: move defineEnvVars to @sveltejs/kit/env

• breaking: nested server-only directories

• feat: allow adapters to provide additional Vite plugins

• breaking: replace the $lib alias with #lib and remove files.lib config.

• chore: change error, isHttpError, redirect, and isRedirect to refer to public type instead of internal class

• breaking: add 'error' result type to preloadData

• breaking: detect new deployments on data, remote, and form action responses, tab focus, and visibility change, and default version.pollInterval to 1 hour

• breaking: disallow cross-origin form submissions without a Content-Type header

• breaking: Server-only directories (/server/ in the path) are now treated as server-only everywhere inside the project (except src/routes and the assets directory)

• breaking: config exported from a universal route file takes precedence over a server one

• breaking: require Vite 8. Provides new functionality even for existing Vite 8 users such as faster builds with Vite hook filters and more powerful SvelteKit adapters with the Vite environment API

• breaking: remove data-sveltekit-* option 'off' in favour of false

• breaking: move tracing out of the experimental namespace and remove the instrumentation flag

• breaking: add kit.paths.origin config option, remove kit.prerender.origin and the adapter-node ORIGIN environment variable

• breaking: remove $app/stores

• breaking: add refreshAll and deprecate invalidateAll

• breaking: disallow *.remote.ts/js files unless experimental.remoteFunctions is enabled

• breaking: replace the noScroll and keepFocus options of goto with a single reset option, and the data-sveltekit-noscroll and data-sveltekit-keepfocus attributes with data-sveltekit-reset

• breaking: don't abort navigation when calling invalidate(All) during navigation

• breaking: consistent special filename patterns

• breaking: allow handleError to influence status code

• breaking: delegate CORS handling to Vite for static directory requests during development

• breaking: require vite@^8.0.12, the first Vite 8 release bundling stable rolldown 1.0.0

• breaking: only include routes with a +page or +server in RouteId

• breaking: require Node 22.17

• breaking: deprecate error(status, {...}) in favour of error(status, message, {...})

• breaking: forbid external redirects by default

• breaking: remove param files in folder in favor of params.js/ts file

• breaking: preloadCode now takes a route ID (e.g. /blog/[slug]) instead of a pathname. Route IDs are not prefixed with paths.base

• breaking: remove deprecated .run() method from live queries

Minor Changes

• feat: allow hyphens in param and matcher names

• feat: add $app/manifest module with immutable, assets, prerendered, and routes exports

• feat: add ErrorProps to generated types

• feat: support sourcemaps in production

• feat: return the list of compressed files from builder.compress

• feat: warn when tsconfig doesn't exclude service worker (#16645)

• feat: validate that all remote form fields were created with form.fields.foo.as(...)

• feat: support function validators for environment variables

• feat: use type: 'module' for service worker registrations

• feat: add shallow routing to goto and deprecate pushState and replaceState

• feat: make $app/paths importable in service workers

• feat: preserve page state set through goto(..., { state, persistState: true }) across reloads

• feat: reinstate $env/static/private, $env/dynamic/private, $env/static/public, $env/dynamic/public and $app/environment as deprecated aliases for $app/env/private $app/env/public and $app/env

• feat: add page and endpoint booleans to $app/manifest's routes, and export a ManifestRoute type

• feat: $app/service-worker module

• feat: resolve paths using the Vite config root option instead of process.cwd() to better support monorepo configurations such as Vitest workspaces

• feat: better error logging

• feat: add PageRouteId and EndpointRouteId to $app/types

• feat: better tsconfig validation

• feat: add dirty() property to form fields

• chore: deprecate Response helpers in favor of platform-provided alternatives

• feat: add cookies.parse method

• feat: support custom values in page.state via transport hook (#16662)

• fix: default cookies to secure to false during development

• feat: warn when naively proxying requests that result in responses with a content-encoding header (#16633)

Patch Changes

• fix: persist global app state across module graph reloads (#16663)

• fix: generate valid Path types for routes with optional or rest params, several params in one segment, or escape sequences

• fix: allow undefined values to be passed to form field .as(...) where applicable

• chore: deprecate builder.rimraf and builder.mkdirp in favour of node:fs methods (#16610)

• fix: don't treat callable standard schemas as function param matchers

• fix: decode all numeric character references, including above ffff, when crawling prerendered pages

• fix: include queries refreshed from within another query in the serialized response

• fix: reject malformed streamed data encoding

• perf: cache the default cookie header parse and avoid allocations in cookies.get

• fix: exclude deleted cookies from cookies.getAll() so it stays consistent with cookies.get()

• fix: hide stack traces for internal errors like 404s

• chore: deduplicate repeated CSP directive handling

• fix: defer query.refresh() in server commands until after the command body completes

• fix: drain unconsumed request bodies so keep-alive connections don't hang

• fix: resolve service worker and tsconfig.json based on Vite root setting

• perf: match only unpaired surrogates when escaping HTML

• fix: treat data: protocol URLs as external for redirect

• chore: deduplicate request hashing for serialized fetch responses

• fix: don't treat Object.prototype members as param matchers during validation

• fix: don't report empty environment variables as missing

• fix: exclude routes without a page or endpoint from routes in $app/manifest, and remove directories with no route files from LayoutParams

• fix: avoid Vite dev server reload on initial page request

• fix: don't set a null accept-language header on internal fetch sub-requests when the incoming request has none

• fix: correctly detect prerendered paths in server fetch when paths.base is set

• fix: populate $app/env/* dynamic variables in contexts that don't run the dev server, such as vite-node

• fix: properly handle Date objects in form.fields.set

• fix: return 404 for form actions and remote functions whose name is an Object.prototype member

• fix: no longer throw "An impossible situation occurred" when a server-only module is imported by both server and client code

• fix: don't duplicate remote modules in the generated manifest

• chore: reuse base64 and text decoding helpers

• fix: explain the removal of $lib and $service-worker when their imports fail to resolve (#16635)

• fix: correctly massage stack traces with async frames (#16633)

• fix: mark RequestEvent properties as readonly (#16661)

• fix: update match parameter type (#16636)

• fix: generate sourcemaps for remote modules

• fix: avoid empty getElementById() call on hash routing navigation

• fix: serve .ico files with image/x-icon Content-Type

• fix: exclude inlined files from the page's $app/manifest immutable list

• fix: avoid client-side code being bundled by Cloudflare Wrangler

• fix: record the mime types of prerendered paths in the server manifest

• chore: clarify which hooks run during server route resolution

• fix: make paths.origin type looser

• feat: send periodic keep-alive SSE comments from query.live to prevent idle-timeout errors

• fix: warn if hook files are spelled as "hook" instead of "hooks"

• chore: only generate each route's resolution module once when prerendering

• fix: skip clean fields when programmatically validating forms

• perf: skip import graph collection outside client environments

• breaking: experimental remote form validate({ includeUntouched }) option is now all

• fix: avoid client build warning about externalising node:async_hooks

• fix: reinstate $app/environment as an alias for $app/env, in case dependencies import it

• fix: error when reading non-serialized set-cookie headers via getSetCookie in load (#16614)

• perf: avoid quadratic remote form issue merging

• chore: deprecate the alias option

• fix: don't attempt to serialize fetch responses when the request body is not a string or TypedArray

• fix: handle rejected streamed server data after delayed loads

• fix: render pages over sibling endpoints without GET or HEAD handlers

• fix: prevent infinite loops when server-side queries refresh each other in a cycle during the single-flight drain

• fix: populate version in service workers

• feat: add field.touched() helper to remote form fields

• fix: read the error status of App.Error in the prerender and query.live remote functions

• fix: resolve remote modules as external during dev prebundling so packages can re-export remote functions

• fix: propagate errors from prerendered remote responses instead of re-running the function

• fix: allow reserved words (e.g. delete, class) as remote function export names

• fix: reset failed <svelte:boundary> on client navigation so a stale +error.svelte is torn down

• fix: expand [x+nn] and [u+nnnn] escape sequences when resolving a route id to a pathname

• fix: respect the status returned from handleError on the fallback error page served to error-page sub-requests

• fix: warn if there are plugins using transformIndexHtml

• fix: refetch route-tracking server data when navigating away from an error page

• fix: allow routes to contain [ and ] via the [x+5b] and [x+5d] escapes

• chore: remove dependency on kleur

• fix: serialize query(...).set(...)/query(...).refresh() values into the rendered HTML when called from within a query during SSR

• fix: detect $app/server and $app/env/private client imports when SvelteKit is installed inside the project root (#16648)

• fix: sort directory entries when building the route manifest so node indices are deterministic across runtimes (e.g. Bun and Node)

• fix: skip unnecessary version.json checks if updated.current is already true

• fix: allow generation of $app/tsconfig without TypeScript installed

• chore: remove dependency on set-cookie-parser

• fix: fall back to the page's form actions when a sibling endpoint has no POST handler

• perf: use a Set to check element ids when validating fragment links during prerendering

• fix: preserve shared client chunk hashes when the app version changes

• fix: include hoisted packages in Vite's server.fs.allow list

• fix: only include _app/immutable files in $app/manifest's immutable in the service worker

• chore: remove the dead SSRState.fallback field and name the server state fork semantics

• fix: import resolved peer dependencies as file URLs so project-relative resolution works on Windows

• fix: log errors caught by the Vite dev server handler

• fix: resolve root per instance of the SvelteKit Vite plugin

• fix: ignore path casing differences when warning about overridden Vite config on Windows

• fix: return a lightweight 404 instead of rendering the error page for subresource requests

• fix: preserve stripped path prefixes by making trailing-slash redirects relative

• fix: preserve the current URL search parameters when submitting a remote form without JavaScript

• fix: only treat files in node_modules as remote modules when the package has a peer dependency on @sveltejs/kit (#16492)

• fix: treeshake prerendered remote functions in the right chunks

• chore: deduplicate type-stripping logic in tweak_types

• fix: error during development if the adapter does not support instrumentation and it exists

• fix: use mouseover+mousemove for preloading to reduce events

• fix: write generated tsconfig to node_modules/$app/tsconfig.json so that tools with simplified tsconfig resolution can find it

• fix: more informative error message when running a command inside a query or prerender function

• fix: prerender and crawl pages whose content-type header carries a charset parameter

• fix: stream promised read results lazily instead of eagerly buffering them

• fix: correctly decode [u+nnnn] escape sequences above ffff

Major Changes

• breaking: refresh all load functions/queries when clicking a link to the current URL (#16572)

• breaking: only include routes with a +page or +server in RouteId (#16580)

• breaking: require Node 22.17 (#16597)

• breaking: preloadCode now takes a route ID (e.g. /blog/[slug]) instead of a pathname. Route IDs are not prefixed with paths.base (#16576)

• breaking: remove deprecated .run() method from live queries (#16573)

Minor Changes

• feat: return the list of compressed files from builder.compress (#16566)

• feat: add page and endpoint booleans to $app/manifest's routes, and export a ManifestRoute type (#16594)

• feat: add PageRouteId and EndpointRouteId to $app/types (#16594)

Patch Changes

• fix: generate valid Path types for routes with optional or rest params, several params in one segment, or escape sequences (#16577)

• fix: decode all numeric character references, including above ffff, when crawling prerendered pages (#16611)

• chore: deduplicate request hashing for serialized fetch responses (#16499)

• fix: don't treat Object.prototype members as param matchers during validation (#16612)

• fix: exclude routes without a page or endpoint from routes in $app/manifest, and remove directories with no route files from LayoutParams (#16588)

• chore: reuse base64 and text decoding helpers (#16608)

• fix: record the mime types of prerendered paths in the server manifest (#16564)

• chore: only generate each route's resolution module once when prerendering (#16576)

• fix: expand [x+nn] and [u+nnnn] escape sequences when resolving a route id to a pathname (#16570)

• fix: allow routes to contain [ and ] via the [x+5b] and [x+5d] escapes (#16569)

• chore: remove the dead SSRState.fallback field and name the server state fork semantics (#16598)

• fix: import resolved peer dependencies as file URLs so project-relative resolution works on Windows (#16618)

• fix: write generated tsconfig to node_modules/$app/tsconfig.json so that tools with simplified tsconfig resolution can find it (#16589)

• fix: prerender and crawl pages whose content-type header carries a charset parameter (#16567)

• fix: stream promised read results lazily instead of eagerly buffering them (#16622)

• fix: correctly decode [u+nnnn] escape sequences above ffff (#16611)

Patch Changes

• fix: prevent quadratic backtracking in Accept header content negotiation (#1)

Major Changes

• breaking: replace the noScroll and keepFocus options of goto with a single reset option, and the data-sveltekit-noscroll and data-sveltekit-keepfocus attributes with data-sveltekit-reset (#16558)

• breaking: deprecate error(status, {...}) in favour of error(status, message, {...}) (#16540)

Minor Changes

• feat: add shallow routing to goto and deprecate pushState and replaceState (#16449)

• feat: preserve page state set through goto(..., { state, persistState: true }) across reloads (#16449)

Patch Changes

• chore: deduplicate repeated CSP directive handling (#16498)

• fix: avoid Vite dev server reload on initial page request (#16553)

• fix: don't set a null accept-language header on internal fetch sub-requests when the incoming request has none (#16527)

• fix: correctly detect prerendered paths in server fetch when paths.base is set (#16525)

• fix: don't duplicate remote modules in the generated manifest (#16532)

• fix: exclude inlined files from the page's $app/manifest immutable list (#16531)

• perf: avoid quadratic remote form issue merging (#16493)

• fix: don't attempt to serialize fetch responses when the request body is not a string or TypedArray (#16501)

• fix: read the error status of App.Error in the prerender and query.live remote functions (#16529)

• fix: propagate errors from prerendered remote responses instead of re-running the function (#16535)

• fix: respect the status returned from handleError on the fallback error page served to error-page sub-requests (#16528)

• fix: skip unnecessary version.json checks if updated.current is already true (#16518)

• fix: allow generation of $app/tsconfig without TypeScript installed (#16534)

• perf: use a Set to check element ids when validating fragment links during prerendering (#16494)

• fix: only include _app/immutable files in $app/manifest's immutable in the service worker (#16531)

• fix: log errors caught by the Vite dev server handler (#16550)

• fix: resolve root per instance of the SvelteKit Vite plugin (#16513)

• fix: ignore path casing differences when warning about overridden Vite config on Windows (#16545)

• fix: preserve the current URL search parameters when submitting a remote form without JavaScript (#16373)

• fix: treeshake prerendered remote functions in the right chunks (#16533)

• fix: error during development if the adapter does not support instrumentation and it exists (#16548)

Major Changes

• breaking: rename Pathname type to Path and Asset to AssetPath (#16430) breaking: remove leading / from Path and AssetPath

• breaking: write tsconfig to node_modules/$app/tsconfig (#16458)

• breaking: error on event.url, event.params and event.route access inside queries (#16452)

• breaking: delete $service-worker module (#16450)

• breaking: detect new deployments on data, remote, and form action responses, tab focus, and visibility change, and default version.pollInterval to 1 hour (#16496)

Minor Changes

• feat: add $app/manifest module with immutable, assets, prerendered, and routes exports (#16372)

• feat: validate that all remote form fields were created with form.fields.foo.as(...) (#16331)

• feat: make $app/paths importable in service workers (#16441)

• feat: $app/service-worker module (#16458)

• feat: better tsconfig validation (#16458)

• fix: default cookies to secure to false during development (#16462)

Patch Changes

• fix: allow undefined values to be passed to form field .as(...) where applicable (#15681)

• fix: include queries refreshed from within another query in the serialized response (#16461)

• fix: generate sourcemaps for remote modules (#16440)

• fix: avoid empty getElementById() call on hash routing navigation (#16448)

• fix: warn if hook files are spelled as "hook" instead of "hooks" (#16483)

• chore: deprecate the alias option (#16470)

• fix: prevent infinite loops when server-side queries refresh each other in a cycle during the single-flight drain (#16461)

• fix: populate version in service workers (#16434)

• fix: resolve remote modules as external during dev prebundling so packages can re-export remote functions (#16426)

• fix: refetch route-tracking server data when navigating away from an error page (#16381)

• fix: serialize query(...).set(...)/query(...).refresh() values into the rendered HTML when called from within a query during SSR (#16461)

• fix: fall back to the page's form actions when a sibling endpoint has no POST handler (#16349)

• fix: return a lightweight 404 instead of rendering the error page for subresource requests (#16463)

• fix: preserve stripped path prefixes by making trailing-slash redirects relative (#16431)

• chore: deduplicate type-stripping logic in tweak_types (#16454)

• fix: more informative error message when running a command inside a query or prerender function (eb5c973)

Major Changes

• breaking: config exported from a universal route file takes precedence over a server one (#16400)

• breaking: consistent special filename patterns (#16382)

Minor Changes

• feat: support sourcemaps in production (#16412)

• feat: support function validators for environment variables (#16402)

• feat: better error logging (#16374)

Patch Changes

• fix: don't treat callable standard schemas as function param matchers (#16403)

• fix: reject malformed streamed data encoding (#16423)

• fix: hide stack traces for internal errors like 404s (#16411)

• perf: match only unpaired surrogates when escaping HTML (#16407)

• fix: don't report empty environment variables as missing (#16401)

• chore: clarify which hooks run during server route resolution (#16397)

Patch Changes

• docs: update links to hooks documentation (#16417)

Major Changes

• breaking: move defineEnvVars to @sveltejs/kit/env (#16375)

Patch Changes

• fix: treat data: protocol URLs as external for redirect (#16392)

• perf: skip import graph collection outside client environments (#16383)

• fix: warn if there are plugins using transformIndexHtml (#16394)

Major Changes

• breaking: handle's resolve is now typed to always return a Promise (#16352)

• breaking: replace the $lib alias with #lib and remove files.lib config. (#16360)

• breaking: disallow cross-origin form submissions without a Content-Type header (#16347)

• breaking: Server-only directories (/server/ in the path) are now treated as server-only everywhere inside the project (except src/routes and the assets directory) (#16360)

• breaking: delegate CORS handling to Vite for static directory requests during development (#16357)

Minor Changes

• feat: reinstate $env/static/private, $env/dynamic/private, $env/static/public, $env/dynamic/public and $app/environment as deprecated aliases for $app/env/private $app/env/public and $app/env (#16334)

Patch Changes

• perf: cache the default cookie header parse and avoid allocations in cookies.get (#16341)

• fix: avoid client-side code being bundled by Cloudflare Wrangler (#16364)

• fix: handle rejected streamed server data after delayed loads (#16268)

• fix: enable CSRF protection in builds with a non-production NODE_ENV value (#16313)

Minor Changes

• feat: move defineEnvVars to @sveltejs/kit/env (#16378)

Patch Changes

• fix: enable CSRF protection in builds with a non-production NODE_ENV value (#16313)

Major Changes

• breaking: remove experimental.handleRenderingErrors flag (#16265)

• breaking: make getRequest and setResponse synchronous (#16280)

• breaking: make page.url immutable on a type level (#16256)

• breaking: add refreshAll and deprecate invalidateAll (#16289)

Minor Changes

• feat: allow hyphens in param and matcher names (#16284)

• feat: add ErrorProps to generated types (#16272)

Patch Changes

• fix: detect destructured load and actions exports during type generation (#16329)

• fix: ensure CSS URL references are absolute when paths.relative is false (#16315)

• fix: exclude deleted cookies from cookies.getAll() so it stays consistent with cookies.get() (#16297)

• fix: reset failed <svelte:boundary> on client navigation so a stale +error.svelte is torn down (#16296)

• fix: preserve shared client chunk hashes when the app version changes (#16324)

• fix: align MAX_COOKIE_SIZE with RFC 6265bis (#16322)

• fix: use mouseover+mousemove for preloading to reduce events (#16325)

Patch Changes

• fix: detect destructured load and actions exports during type generation (#16329)

• fix: ensure CSS URL references are absolute when paths.relative is false (#16315)

• fix: align MAX_COOKIE_SIZE with RFC 6265bis (#16322)

Major Changes

• breaking: change form.error type from any to App.Error | undefined (#16245)

• feat: allow adapters to provide additional Vite plugins (#16206)

• breaking: move tracing out of the experimental namespace and remove the instrumentation flag (#16260)

• breaking: remove $app/stores (#15499)

• breaking: disallow *.remote.ts/js files unless experimental.remoteFunctions is enabled (#16247)

• breaking: remove param files in folder in favor of params.js/ts file (#16189)

Patch Changes

• fix: defer query.refresh() in server commands until after the command body completes (#16225)

• fix: resolve service worker and tsconfig.json based on Vite root setting (#16229)

• fix: populate $app/env/* dynamic variables in contexts that don't run the dev server, such as vite-node (#16223)

• fix: no longer throw "An impossible situation occurred" when a server-only module is imported by both server and client code (#16257)

• fix: set define values on globalThis when running Vitest (#16246)

• fix: serve .ico files with image/x-icon Content-Type (#16234)

• fix: make paths.origin type looser (#16215)

• fix: avoid client build warning about externalising node:async_hooks (#16244)

• fix: allow reserved words (e.g. delete, class) as remote function export names (#16264)

Patch Changes

• fix: set define values on globalThis when running Vitest (#16246)

Patch Changes

• fix: prevent prototype pollution when deleting file inputs (#16218)

• fix: prevent unhandled promise rejection (#16219)

Minor Changes

• feat: expose submitted property of remote forms (#14811)

Patch Changes

• fix: clear issues and touched states on form reset (#16163)

• fix: return undefined from fields.branch.issues() when only fields.branch.leaf has issues (#16187)

Minor Changes

• feat: expose RemoteFormEnhanceInstance and RemoteFormEnhanceCallback types (#15816)

• feat: set value of submit fields when form is submitted (#15979)

Patch Changes

• fix: skip native_navigation when __data.json returns 404 on a static fallback page (#16135)

• fix: ignore third-party monkeypatches in pushState/replaceState warning detection (#15267)

• fix: snapshot form fields on read (#16150)

• fix: strip field prefix before erroring on duplicates (#16151)

• fix: call reset function via prototype (#16138)

• chore: fix navigation type hover info (#16147)

Major Changes

• breaking: return no content for 204 responses (#16200)

• breaking: form action responses now use the HTTP status code returned from fail (#16200)

• breaking: nested server-only directories (#15685)

• breaking: add kit.paths.origin config option, remove kit.prerender.origin and the adapter-node ORIGIN environment variable (#16161)

• breaking: don't abort navigation when calling invalidate(All) during navigation (#16188)

• breaking: allow handleError to influence status code (#16162)

• breaking: forbid external redirects by default (#16198)

Minor Changes

• feat: use type: 'module' for service worker registrations (#16169)

• feat: add dirty() property to form fields (#16208)

• feat: add cookies.parse method (#16203)

Patch Changes

• fix: drain unconsumed request bodies so keep-alive connections don't hang (#16170)

• fix: properly handle Date objects in form.fields.set (#16168)

• fix: skip clean fields when programmatically validating forms (#16208)

• breaking: experimental remote form validate({ includeUntouched }) option is now all (#16208)

• fix: return undefined from fields.branch.issues() when only fields.branch.leaf has issues (#16187)

• feat: add field.touched() helper to remote form fields (#14692)

Major Changes

• breaking: remove base, assets, and resolveRoute from $app/paths (#15507)

• breaking: require Svelte config options to be passed through the Vite plugin (#16007)

• breaking: goto now rejects when called with a URL that does not resolve to a route within the app, matching the existing behaviour for external URLs (#16164)

• breaking: add 'error' result type to preloadData (#12579)

• breaking: require vite@^8.0.12, the first Vite 8 release bundling stable rolldown 1.0.0 (#16134)

Minor Changes

• feat: expose submitted property of remote forms (#14811)

Patch Changes

• fix: clear issues and touched states on form reset (#16163)

• fix: return 404 for form actions and remote functions whose name is an Object.prototype member (#16072)

• feat: send periodic keep-alive SSE comments from query.live to prevent idle-timeout errors (#16063)

• fix: render pages over sibling endpoints without GET or HEAD handlers (#16125)

• fix: sort directory entries when building the route manifest so node indices are deterministic across runtimes (e.g. Bun and Node) (#16074)

• fix: include hoisted packages in Vite's server.fs.allow list (#15998)

Minor Changes

• feat: add prerender.handleInvalidUrl option for invalid URLs discovered while crawling (#16088)

Patch Changes

• fix: support exactOptionalPropertyTypes for optional form schema fields (#15866)

• fix: avoid unnecessarily overriding a user's Vite 8 codeSplitting setting (#16118)

Minor Changes

• feat: precompress prerendered .md and .mdx files (#15893)

• feat: warn the user when they forget to make boolean inputs optional in their form schemas (#15804)

Patch Changes

• fix: blur active element before component update during navigation so that blur/focusout handlers fire while old component data is still valid (#15452)

• fix: ensure base is available from $service-worker during development (#15882)

• fix: use correct relative asset paths when rendering an error page for a missing __data.json request (#15884)

• fix: preserve active for await consumers across query.live reconnects (#16022)

• fix: settle query.live reconnect promise on all exit paths, preventing invalidateAll() from deadlocking when a live query is offline or interrupted (#16022)

• fix: preserve last value when a query.live stream completes without yielding on reconnect (#16022)

• fix: remove types: ['node'] from generated tsconfig to avoid errors when @types/node is not installed (#15709)

• fix: prefer pages over endpoints when prerendering (#16076)

• fix: restore snapshots after afterNavigate callbacks (#16066)

• fix: support ws:/wss: and trusted-types-eval for CSP sources (#15938)

• fix: omit empty file inputs from remote form data (#15898)

• fix: fail early if a route with +page and +server is marked as prerenderable (#16075)

• fix: wait a tick before resetting forms (#15805)

• fix: preflight schemas apply correctly when chained before for (#15863)

• fix: blank page in SPA mode when root layout load() throws (#15798)

• fix: pass all unknown options from the sveltekit Vite plugin through to vite-plugin-svelte (#16010)

Patch Changes

• fix: throw an error when prerendering a root +server.js that returns a non-HTML response (#15994)

• fix: decode base64-serialized fetch bodies before caching them for client-side replay (#16034)

• fix: correctly access explicit dynamic public environment variables from prerendered pages and service workers (#16024)

• fix: allow preloadCode to be called during initial page load (#16028)

• fix: send cache-control: private, no-store on remote function responses so personalized query results can never be cached by shared caches (#16020)

• fix: preserve the HTTP status and error body when a remote function request fails in transport (e.g. a 401/403 from a handle hook), instead of reporting a generic 500 (#16021)

• fix: avoid loading universal nodes during build analysis when the app uses a hash router (#16042)

• fix: correctly serve client entry during development when using the pnpm global virtual store (#16045)

• fix: normalize path separators when comparing config (#16037)

• fix: ensure building resolves correctly to allow avoiding build-time explicit environment variable validation (#16058)

• fix: prevent unhandled promise rejections when remote function failures are consumed via current/error instead of await (#16018)

Patch Changes

• fix: avoid importing the Vite development client code into builds with a non-standard NODE_ENV (#16023)

• fix: don't emit the unused bundle and stylesheet files when using bundleStrategy: 'inline' (#16025)

• fix: reset queries before navigating when invalidateAll is set (#16014)

• fix: regression in loading assets for absolute path apps (#16026)

Patch Changes

• fix: reset queries before navigating when invalidateAll is set (#16014)

Minor Changes

• feat: allow queries to refresh other queries (#16012)

Patch Changes

• fix: dedupe remote data (#15991)

• fix: skip client build if all routes have CSR disabled (#15936)

Minor Changes

• feat: allow queries to refresh other queries (#16012)

Patch Changes

• fix: dedupe remote data (#15991)

• fix: skip client build if all routes have CSR disabled (#15936)

Patch Changes

• fix: use SSE for query.live (#15957)

• fix: use forward slashes in the generated env.d.ts import path on Windows (#15977)

• fix: avoid importing Vite while validating explicit environment variables (#15953)

• docs: adjust the release version of explicit env vars (#15968)

• fix: ensure version is defined when importing from $app/env with explicit environment variables (#15971)

Minor Changes

• feat: allow commands to receive File objects (#15978)

Patch Changes

• fix: avoid server components from being bundled if SSR is turned off for a route (#15982)

Patch Changes

• fix: use SSE for query.live (#15957)

• fix: use forward slashes in the generated env.d.ts import path on Windows (#15977)

• fix: allow $app/environment with a warning when explicitEnvironmentVariables is enabled (#15980)

• fix: avoid importing Vite while validating explicit environment variables (#15953)

• docs: adjust the release version of explicit env vars (#15968)

• fix: ensure version is defined when importing from $app/env with explicit environment variables (#15971)

Patch Changes

• fix: reinstate $app/environment as an alias for $app/env, in case dependencies import it (#15964)

Major Changes

• breaking: TypeScript 6 is now the minimum required version (#15930)

• breaking: upgrade to cookie v1. Cookie names must now contain only ASCII characters (#13386)

• breaking: require Node 22 or newer (#12548)

• breaking: remove the preloadStrategy option. modulepreload will always be used (#15256)

• breaking: default the cookie path option to '/' (#15398)

• breaking: remove @sveltejs/kit/node/polyfills (#15430)

• breaking: add config.kit.output.linkHeaderPreload to preload using the Link header (#15939)

• breaking: require @sveltejs/vite-plugin-svelte v7 (#15371)

• breaking: remove createEntries from the Builder object passed to adapter functions (#15509)

• breaking: remove the deprecated CSRF checkOrigin option in favor of trustedOrigins (#15437)

• breaking: the delta property now only exists for popstate navigation events (#15522)

• breaking: remove deprecated pragma header in version polling for improved CORS support (#15428)

• breaking: require Svelte 5.48.0 or newer (#15371)

• chore: change error, isHttpError, redirect, and isRedirect to refer to public type instead of internal class (#15250)

• breaking: require Vite 8. Provides new functionality even for existing Vite 8 users such as faster builds with Vite hook filters and more powerful SvelteKit adapters with the Vite environment API (#15371)

• breaking: remove data-sveltekit-* option 'off' in favour of false (#15907)

Minor Changes

• feat: resolve paths using the Vite config root option instead of process.cwd() to better support monorepo configurations such as Vitest workspaces (#15469)

• chore: deprecate Response helpers in favor of platform-provided alternatives (#15448)

• feat: explicit env vars (#15934)

Patch Changes

• fix: remove check for svelte.config.js before running sync (#15946)

• fix: generate a placeholder tsconfig.json to squelch sync-time warnings (#15948)

• chore: remove dependency on kleur (#12548)

• chore: remove dependency on set-cookie-parser (#15384)

• fix: allow use of $app/env/public in service workers (#15950)

Minor Changes

• feat: explicit env vars (#15934)

Patch Changes

• fix: remove check for svelte.config.js before running sync (#15946)

• fix: generate a placeholder tsconfig.json to squelch sync-time warnings (#15948)

• fix: allow use of $app/env/public in service workers (#15950)

Minor Changes

• feat: support passing Svelte(Kit) config via Vite plugin (#15944)

Patch Changes

• fix: preserve multiple Set-Cookie headers on 304 responses (#15902)

• fix: preload for anchor elements that were just previously preloaded (#15915)

• fix: catch load function streaming errors on the client (#15929)

• fix: avoid generating the _app/env.js module if public dynamic environment variables are not used by the app (#15940)

Patch Changes

• fix: regression where routes starting and ending with a route group are not matched correctly (#15903)

Minor Changes

• breaking: the .run() method has been removed from remote queries on both the client and the server. Use await query() directly instead — it now works everywhere (#15779)

• feat: remote queries can now be awaited in any context (event handlers, module scope, async callbacks), not just inside reactive contexts. The cache is shared across reactive and non-reactive subscribers, so awaiting a query in an event handler will dedupe with components that have already subscribed to the same query. (#15779)

• feat: live query instances are now themselves async-iterable (#15878)

• feat: add programmatic submit method to form remote function instances (#15657)

• feat: pass form remote function instance into enhance callback (#15657)

Patch Changes

• fix: resolve the app payload without using process.env.NODE_ENV (#15852)

• fix: support exactOptionalPropertyTypes for optional route params (#15825)

• fix: correctly send true value to the server for 'submit' and 'hidden' form fields (#15858)

• fix: avoid build warnings about undefined universal hooks (#15895)

• fix: prefer default error page when failing to decode the URL pathname (#15744)

• fix: disable link prefetching on slow internet connections (#15885)

• fix: allow routes ending with optional parameters next to more specific routes (#15861)

• fix: remove reliance on Content-Length header in deserialize_binary_form, which caused failures when proxies (e.g. Vercel, Azure) strip the header and use chunked transfer encoding (#15796)

Patch Changes

• chore: bump svelte and devalue (#15836)

• fix: prevent query.batch cross-talk (dadaefc)

Minor Changes

• feat: allow 'submit' and 'hidden' form fields to accept numbers and booleans (#15802)

• feat: warn on unread form remote function validation issues (#15653)

Patch Changes

• fix: abort navigation after async rendering if obsolete (#15811)

• fix: skip refreshing queries on full-page reload form submissions (#15803)

Patch Changes

• fix: resolve paths to route files with the letter drive on Windows (#15793)

Minor Changes

• feat: support query.batch in requested(...) (#15751)

• breaking: on the server, make the promise returned from refresh represent adding the refresh to the map, not the time it takes to run the remote function (#15705)

• feat: experimental query.live function (#15705)

Patch Changes

• fix: unwrap Promise in RemoteCommand output type (#15771)

• fix: empty call to .updates() on a command/form invocation means "don't update anything" (#15705)

• fix: form.fields.foo.as('checkbox', default_value) now works (#15752)

• fix: remote forms with default values defined by field.as('text', defaultValue) now correctly reset to the provided default values once submitted (#15753)

• fix: make sure queries always get started correctly (#15705)

• fix: allow plain functions as overrides in updates (#15705)

Minor Changes

• breaking: require limit in requested (as originally intended) (#15739)

• feat: RemoteQueryFunction gains an optional third generic parameter Validated (defaulting to Input) that represents the argument type after schema validation/transformation (#15739)

• breaking: requested now yields { arg, query } entries instead of the validated argument (#15739)

Patch Changes

• fix: allow query().current, .error, .loading, and .ready to work in non-reactive contexts (#15699)

• fix: prevent deep_set crash on nullish nested values (#15600)

• fix: restore correct RemoteFormFields typing for nullable array fields (e.g. when a schema uses .default([])), so .as('checkbox') and friends work again (#15723)

• fix: don't warn about removed SSI comments in transformPageChunk (#15695)

  Server-side include (SSI) directives like <!--#include virtual="..." --> are HTML comments that are replaced by servers such as nginx. Previously, removing them in transformPageChunk would trigger a false positive warning about breaking Svelte's hydration. Since SSI comments always start with <!--# and Svelte's hydration comments never do, they can be safely excluded from the check.

• Change enhance function return type from void to MaybePromise. (#15710)

• fix: throw an error when resolve is called with an external URL (#15733)

• fix: avoid FOUC for CSR-only pages by loading styles and fonts before CSR starts (#15718)

• fix: reset form result on redirect (#15724)

Patch Changes

• fix: better validation for redirect inputs (10d7b44)

• fix: enforce BODY_SIZE_LIMIT on chunked requests (3202ed6)

• fix: use default values as fallbacks (#15680)

• fix: relax form typings for union types (#15687)

Minor Changes

• feat: return boolean from submit to indicate submission validity for enhanced form remote functions (#15530)

Patch Changes

• fix: use array type for select fields that accept multiple values (#15591)

• fix: silently 404 Chrome DevTools workspaces request in dev and preview (#15656)

• fix: config.kit.csp.directives['trusted-types'] requires 'svelte-trusted-html' (and 'sveltekit-trusted-url' when a service worker is automatically registered) if it is configured (#15323)

• fix: avoid inlineDynamicImports ignored with codeSplitting warning when using Vite 8 (#15647)

• fix: reimplement treeshaking non-dynamic prerendered remote functions (#15447)

Minor Changes

• breaking: rework client-driven refreshes (#15562)

• breaking: stabilize remote function caching by sorting object keys (#15570)

• breaking: add run() method to queries, disallow awaiting queries outside render (#15533)

• feat: support TypeScript 6.0 (#15595)

• breaking: isolate command-triggered query refresh failures per-query (#15562)

• feat: use hydratable for remote function transport (#15533)

• feat: allow form fields to specify a default value (field.as(type, value)) (#15577)

Patch Changes

• fix: don't request new data when .refresh is called on a query with no cache entry (#15533)

• fix: allow using multiple remote functions within one async derived (#15561)

• fix: avoid false-positive overridden Vite base setting warning when setting a paths.base in svelte.config.js (#15623)

• fix: manage queries in their own $effect.root (#15533)

• fix: avoid inlineDynamicImports deprecation warning when building the service worker with Vite 8 (#15550)

• fix: correctly escape backticks when precomputing CSS (#15593)

• fix: discard obsolete forks before finishing navigation (#15634)

• chore: tighten up override implementation (#15562)

• fix: ensure the default Svelte 5 error.svelte file uses runes mode (#15609)

• fix: deduplicate same-cache-key batch calls during SSR (#15533)

• fix: decrement pending_count when form callback doesn't call submit() (#15520)

Minor Changes

• feat: page and layout params with matchers are now type narrowed in $app/types, leading to better type safety when working with params in $app/types, $app/state, and hooks. (#15502)

Minor Changes

• feat: allow error boundaries to catch errors on the server (#15308)

Patch Changes

• chore: upgrade devalue (#15535)

• fix: don't wait for remote functions that are not awaited in the template (#15280)

• feat: allow resolve() to accept pathnames with a search string and/or hash (#15458)

• chore: remove deprecation warnings for config.kit.files.* options when validating the Svelte config file (#15482)

• fix: handles form target attribute in remote form redirects (#15457)

Patch Changes

• fix: avoid Vite warning about unknown codeSplitting option (#15451)

Patch Changes

• fix: prevent overlapping file metadata in remote functions form (faba869)

Patch Changes

• fix: server-render nested form value sets (#15378)

• fix: use deep partial types for form remote functions .value() and .set(...) (#14837)

• fix: provide correct url info to remote functions (#15418)

• fix: allow optional types for remote query/command/prerender functions (#15293)

• fix: allow commands in more places (#15288)

Patch Changes

• fix: address warning about inlineDynamicImports when using Vite 8 (#15403)