@sveltejs/kit

Minor Changes

• support report-sha256/report-sha384/report-sha512 CSP hash-reporting keywords

• emit a sveltekit.endpoint span for +server handlers when server tracing is enabled

Patch Changes

• don't treat every module as server-only when the project is inside a server directory

• continue deployment recovery when service worker updates fail

• infer prerendered MIME types from generated files

• leave generated files alone when their contents are unchanged

• leave focus in the parent page when an app in an unfocused iframe starts or navigates

• don't warn about Storybook's Vite plugins that use transformIndexHtml

Major Changes

• breaking

  move remote function types to $app/server

• breaking

  remove experimental.handleRenderingErrors flag

• breaking

  make getRequest and setResponse synchronous

• breaking

  TypeScript 6 is now the minimum required version

• breaking

  refresh all load functions/queries when clicking a link to the current URL

• breaking

  move remote function types to $app/server

• breaking

  upgrade to cookie v2. Cookie names must now contain only ASCII characters

• breaking

  require Node 22 or newer

• breaking

  error when a client-requested single-flight mutation isn't respected by the server, allow the server to explicitly ignore refreshes

• breaking

  remove the preloadStrategy option. modulepreload will always be used

• breaking

  default the cookie path option to '/'

• breaking

  remove @sveltejs/kit/node/polyfills

• breaking

  add config.kit.output.linkHeaderPreload to preload using the Link header

• breaking

  require @sveltejs/vite-plugin-svelte v7

• breaking

  make page.url immutable on a type level

• breaking

  remove base, assets, and resolveRoute from $app/paths

• breaking

  remove createEntries from the Builder object passed to adapter functions

• breaking

  return no content for 204 responses

• breaking

  rename Pathname type to Path and Asset to AssetPath
  breaking: remove leading / from Path and AssetPath

• breaking

  handle's resolve is now typed to always return a Promise

• breaking

  remove Server constructor and SSRManifest from public types

• breaking

  require Svelte config options to be passed through the Vite plugin

• breaking

  form action responses now use the HTTP status code returned from fail

• breaking

  write tsconfig to node_modules/$app/tsconfig

• breaking

  move defineParams and associated types to @sveltejs/kit/params

• breaking

  remove the deprecated CSRF checkOrigin option in favor of trustedOrigins

• breaking

  the delta property now only exists for popstate navigation events

• breaking

  change form.error type from any to App.Error | undefined

• breaking

  remove deprecated pragma header in version polling for improved CORS support

• breaking

  goto now rejects when called with a URL that does not resolve to a route within the app, matching the existing behaviour for external URLs

• breaking

  run all errors through the handleError hook

• breaking

  require Svelte 5.56.4 or newer

• breaking

  error on event.url, event.params and event.route access inside queries

• breaking

  enhanced cross-page form actions now navigate to the action page on success and failure, matching native form behavior

• breaking

  delete $service-worker module

• breaking

  move defineEnvVars to @sveltejs/kit/env

• breaking

  nested server-only directories

• breaking

  allow adapters to provide additional Vite plugins

• breaking

  replace the $lib alias with #lib and remove files.lib config.

• breaking

  remove #lib definition from paths; requires explicit module extensions as a result

• breaking

  change error, isHttpError, redirect, and isRedirect to refer to public type instead of internal class

• breaking

  move hooks-related types to @sveltejs/kit/hooks

• breaking

  add 'error' result type to preloadData

• breaking

  detect new deployments on data, remote, and form action responses, tab focus, and visibility change, and default version.pollInterval to 1 hour

• breaking

  disallow cross-origin form submissions without a Content-Type header

• breaking

  Server-only directories (/server/ in the path) are now treated as server-only everywhere inside the project (except src/routes and the assets directory)

• breaking

  config exported from a universal route file takes precedence over a server one

• breaking

  require Vite 8. Provides new functionality even for existing Vite 8 users such as faster builds with Vite hook filters and more powerful SvelteKit adapters with the Vite environment API

• breaking

  remove data-sveltekit-* option 'off' in favour of false

• breaking

  move tracing out of the experimental namespace and remove the instrumentation flag

• breaking

  add kit.paths.origin config option, remove kit.prerender.origin and the adapter-node ORIGIN environment variable

• breaking

  move Page, ReadonlyURL and ReadonlyURLSearchParams from @sveltejs/kit to $app/state

• breaking

  remove $app/stores

• breaking

  add refreshAll and deprecate invalidateAll

• breaking

  reject query parameters beginning with x-sveltekit-

• breaking

  disallow *.remote.ts/js files unless experimental.remoteFunctions is enabled

• breaking

  replace the noScroll and keepFocus options of goto with a single reset option, and the data-sveltekit-noscroll and data-sveltekit-keepfocus attributes with data-sveltekit-reset

• breaking

  don't abort navigation when calling invalidate(All) during navigation

• breaking

  consistent special filename patterns

• breaking

  allow handleError to influence status code

• breaking

  delegate CORS handling to Vite for static directory requests during development

• breaking

  require vite@^8.0.12, the first Vite 8 release bundling stable rolldown 1.0.0

• breaking

  only include routes with a +page or +server in RouteId

• breaking

  require Node 22.17

• breaking

  deprecate error(status, {...}) in favour of error(status, message, {...})

• breaking

  replace the builder.generateManifest with builder.generateServerInstance and builder.manifest

• breaking

  forbid external redirects by default

• breaking

  separate adapter Vite plugins into pre and post

• breaking

  remove param files in folder in favor of params.js/ts file

• breaking

  move env-related types to @sveltejs/kit/env

• breaking

  preloadCode now takes a route ID (e.g. /blog/[slug]) instead of a pathname. Route IDs are not prefixed with paths.base

• breaking

  move BeforeNavigate, OnNavigate, AfterNavigate, Navigation, NavigationTarget, NavigationType, GotoOptions and the Navigation* variant types from @sveltejs/kit to $app/navigation

• breaking

  move ActionResult and SubmitFunction from @sveltejs/kit to $app/forms

• breaking

  remove handleValidationError and pass remote function validation errors to handleError with kind: 'validation'

• breaking

  remove deprecated .run() method from live queries

Minor Changes

• allow hyphens in param and matcher names

• add $app/manifest module with immutable, assets, prerendered, and routes exports

• ignore files with + prefix if they contain test/spec/stories

• add ErrorProps to generated types

• support sourcemaps in production

• return the list of compressed files from builder.compress

• better response logging

• warn when tsconfig doesn't exclude service worker

• validate that all remote form fields were created with form.fields.foo.as(...)

• support function validators for environment variables

• use type: 'module' for service worker registrations

• allow adapters to receive the Svelte config as a function argument when adding Vite plugins

• deprecated

  add shallow routing to goto and deprecate pushState and replaceState

• abort request.signal when the response closes prematurely, via a new response option for getRequest

• make $app/paths importable in service workers

• pass the project-relative source filename to the preload filter for fonts

• preserve page state set through goto(..., { state, persistState: true }) across reloads

• reinstate $env/static/private, $env/dynamic/private, $env/static/public, $env/dynamic/public and $app/environment as deprecated aliases for $app/env/private $app/env/public and $app/env

• add page and endpoint booleans to $app/manifest's routes, and export a ManifestRoute type

• $app/service-worker module

• resolve paths using the Vite config root option instead of process.cwd() to better support monorepo configurations such as Vitest workspaces

• better error logging

• add PageRouteId and EndpointRouteId to $app/types

• better tsconfig validation

• add dirty() property to form fields

• support the QUERY HTTP method in +server.js

• allow adapters to override getRequest and setResponse during vite dev and vite preview

• add cookies.parse method

• add snapshot helper to $app/navigation

• support custom values in page.state via transport hook

• default cookies to secure to false during development

• warn when naively proxying requests that result in responses with a content-encoding header

• accept the checked state as a third argument to .as('radio', ...) and .as('checkbox', ...) so that these inputs reset to it after a submission

• add an applyReroute helper for adapters that support split serverless function deployments

Patch Changes

• prevent scheme-like path segments from causing off-site trailing-slash redirects

• persist global app state across module graph reloads

• generate valid Path types for routes with optional or rest params, several params in one segment, or escape sequences

• coerce values typed into remote form fields, and only apply the default given to .as() until the field is edited

• blur focused SVG elements before the DOM update on navigation

• support bigint params in server-side route resolution

• generate types when dev server starts

• allow undefined values to be passed to form field .as(...) where applicable

• respect paths.relative during development for client files

• validate prerender concurrency

• manipulate stack trace for errors that happen while generating prerender inputs

• don't treat callable standard schemas as function param matchers

• prevent non-redirect enhanced form results from navigating to another origin

• clarify circular imports from src/env

• keep memory flat when precompressing many files

• render remote form actions while prerendering

• ignore Vitest browser loader HTML transforms

• prevent failed link preloads from causing unhandled promise rejections in production

• resolve generated rootDirs from the project root

• generate route resolution modules as siblings of .html pages

• parse large streamed frames in linear time

• keep at most one pending body read at a time when deserializing binary forms

• escape cache-control headers in prerendered HTML

• decode all numeric character references, including above ffff, when crawling prerendered pages

• enforce request body size limits when Content-Type is absent

• include queries refreshed from within another query in the serialized response

• reject malformed streamed data encoding

• cache the default cookie header parse and avoid allocations in cookies.get

• exclude deleted cookies from cookies.getAll() so it stays consistent with cookies.get()

• hide stack traces for internal errors like 404s

• render the nearest error page when a form submission receives a non-ActionResult error response

• correctly implement Vite plugin hook filters

• ignore nested outDir files outside generated

• defer query.refresh() in server commands until after the command body completes

• drain unconsumed request bodies so keep-alive connections don't hang

• keep history.scrollRestoration set to manual when leaving the page, so a document restored from the back/forward cache does not fall back to browser scroll restoration

• resolve service worker and tsconfig.json based on Vite root setting

• rebuild the dev manifest when route files disappear during an incremental update

• breaking

  populate env vars before instrumentation.server.js is evaluated and update the adapter instrumentation API

• only print prerender progress newline when necessary

• match only unpaired surrogates when escaping HTML

• treat data: protocol URLs as external for redirect

• don't treat Object.prototype members as param matchers during validation

• generate a never Path type when there are no routes

• follow HTTP redirects from authentication proxies when enhancing form submissions

• don't report empty environment variables as missing

• externalize @opentelemetry/api to prevent bundler chunk colocation between instrumentation.server.js and application code

• support form fields named after Object prototype properties

• exclude routes without a page or endpoint from routes in $app/manifest, and remove directories with no route files from LayoutParams

• record a history traversal before resolving its route

• avoid Vite dev server reload on initial page request

• don't set a null accept-language header on internal fetch sub-requests when the incoming request has none

• reuse SSR-cached fetch responses during hydration when a cross-origin URL is not in canonical form

• correctly detect prerendered paths in server fetch when paths.base is set

• populate $app/env/* dynamic variables in contexts that don't run the dev server, such as vite-node

• resolve client manifest imports against the Vite root

• properly handle Date objects in form.fields.set

• return 404 for form actions and remote functions whose name is an Object.prototype member

• no longer throw "An impossible situation occurred" when a server-only module is imported by both server and client code

• respect Vite default log level

• set the focus starting point without a fragment navigation, which leaked a hashchange to app listeners

• keep a form.for instance registered when the derived that holds it disconnects and reconnects

• make cookie options optional

• don't duplicate remote modules in the generated manifest

• evict hashed fetch cache entries after mutations

• explain the removal of $lib and $service-worker when their imports fail to resolve

• tweak response logging for remote requests

• correctly massage stack traces with async frames

• mark RequestEvent properties as readonly

• render the nearest +error.svelte at the depth it occupies when an error is thrown during rendering

• support coordinate objects from image inputs in remote forms

• revert route metadata caching to regenerate missing root-route types during sync

• update match parameter type

• generate sourcemaps for remote modules

• keep hash-router links on the current document when resolving paths

• avoid empty getElementById() call on hash routing navigation

• resolve every module entry point using kit.moduleExtensions

• serve .ico files with image/x-icon Content-Type

• exclude inlined files from the page's $app/manifest immutable list

• discard invalidation results when a navigation completes while they load

• avoid client-side code being bundled by Cloudflare Wrangler

• wait for the redirect navigation before remote form submissions resolve

• record the mime types of prerendered paths in the server manifest

• only require the svelte-trusted-html trusted-types policy when client-side code is shipped, allowing builds where all pages have csr: false

• yield to allow prerender updates to be visible

• make paths.origin type looser

• send periodic keep-alive SSE comments from query.live to prevent idle-timeout errors

• send an explicit SSE Accept header for query.live requests to avoid buffering by proxies

• don't touch the query.live stream controller after teardown, and make response cancellation observable via the generator's request.signal

• print builder.log.warn messages to stderr, as documented

• warn if hook files are spelled as "hook" instead of "hooks"

• only suggest a + prefix for route filenames that are valid with the file's extension

• don't throw from remote form validate() if the form unmounts while it is waiting for a tick

• route dev-server response logging through Vite's logger so it respects logLevel and customLogger

• skip clean fields when programmatically validating forms

• skip import graph collection outside client environments

• breaking

  experimental remote form validate({ includeUntouched }) option is now all

• rerun load functions when the number of values of a tracked search parameter changes

• avoid client build warning about externalising node:async_hooks

• reinstate $app/environment as an alias for $app/env, in case dependencies import it

• preserve paths.base when vite preview redirects a prerendered page to the correct trailing slash

• error when reading non-serialized set-cookie headers via getSetCookie in load

• walk and copy directories without a stat per file

• avoid quadratic remote form issue merging

• widen remote form fields for union schemas and string enums

• don't attempt to serialize fetch responses when the request body is not a string or TypedArray

• respond to HEAD requests without a body

• handle rejected streamed server data after delayed loads

• don't crash on interactions inside a form whose controls shadow nodeName

• don't replay a preloaded redirect when a later hop of the navigation returns to the route

• security

  prevent path traversal when previewing prerendered pages and data on Windows

• settle a query's pending request in place when its value arrives through set()

• render pages over sibling endpoints without GET or HEAD handlers

• exit build workers after completing their tasks while allowing synchronous exit handlers to run

• prevent infinite loops when server-side queries refresh each other in a cycle during the single-flight drain

• populate version in service workers

• add field.touched() helper to remote form fields

• respect paths.relative for server-side route resolution imports

• read the error status of App.Error in the prerender and query.live remote functions

• resolve remote modules as external during dev prebundling so packages can re-export remote functions

• avoid Promise.withResolvers in client remote functions for older browser support

• propagate errors from prerendered remote responses instead of re-running the function

• allow reserved words (e.g. delete, class) as remote function export names

• reset failed <svelte:boundary> on client navigation so a stale +error.svelte is torn down

• clear navigating when a shallow popstate aborts an in-flight navigation

• expand [x+nn] and [u+nnnn] escape sequences when resolving a route id to a pathname

• respect user-set server.cors and preview.cors config instead of overriding them

• respect the status returned from handleError on the fallback error page served to error-page sub-requests

• restore scroll position after back-forward cache returns

• warn if there are plugins using transformIndexHtml

• refetch route-tracking server data when navigating away from an error page

• allow routes to contain [ and ] via the [x+5b] and [x+5d] escapes

• recommend safe include and exclude patterns in tsconfig warning

• prevent server-side self-fetch fallbacks from following redirects

• serialize query(...).set(...)/query(...).refresh() values into the rendered HTML when called from within a query during SSR

• correctly read zero-length files at the end of a binary form payload

• reject fallback handlers on prerendered endpoints

• don't destroy partial-line app output with the prerender progress line

• surface prerender errors during development

• detect $app/server and $app/env/private client imports when SvelteKit is installed inside the project root

• wait for the redirect navigation before prerendered remote functions resolve

• sort directory entries when building the route manifest so node indices are deterministic across runtimes (e.g. Bun and Node)

• skip unnecessary version.json checks if updated.current is already true

• allow generation of $app/tsconfig without TypeScript installed

• fall back to the page's form actions when a sibling endpoint has no POST handler

• record client output extensions in builder.mimeTypes

• use a Set to check element ids when validating fragment links during prerendering

• preserve shared client chunk hashes when the app version changes

• include hoisted packages in Vite's server.fs.allow list

• preserve metadata on streamed page responses

• only include _app/immutable files in $app/manifest's immutable in the service worker

• atomically replace route metadata during sync

• import resolved peer dependencies as file URLs so project-relative resolution works on Windows

• preserve sourcemap source paths when adapters copy build output

• log errors caught by the Vite dev server handler

• resolve root per instance of the SvelteKit Vite plugin

• report tsconfig parse errors on Windows

• return root layout server data for error-page data requests to non-existent routes

• prevent prerender crawler from hanging on unterminated unquoted attributes

• prevent await_reactivity_loss warning and state_unsafe_mutation error when the new version detector runs after an await

• redact nested and typed underscore-prefixed remote form fields after invalid submissions

• ignore path casing differences when warning about overridden Vite config on Windows

• return a lightweight 404 instead of rendering the error page for subresource requests

• preserve stripped path prefixes by making trailing-slash redirects relative

• preserve the current URL search parameters when submitting a remote form without JavaScript

• only treat files in node_modules as remote modules when the package has a peer dependency on @sveltejs/kit

• treeshake prerendered remote functions in the right chunks

• correctly serialize Node.js buffers returned from remote functions during SSR

• preserve errors with read-only stack properties

• avoid infinite loop when building with --watch flag

• error during development if the adapter does not support instrumentation and it exists

• use mouseover+mousemove for preloading to reduce events

• reject invalid binary form file metadata

• error on server-only imports reachable from hooks or service worker files outside the project root

• write generated tsconfig to node_modules/$app/tsconfig.json so that tools with simplified tsconfig resolution can find it

• more informative error message when running a command inside a query or prerender function

• adjust error overload for optional App.Error parameters

• prerender and crawl pages whose content-type header carries a charset parameter

• stream promised read results lazily instead of eagerly buffering them

• copy worker files emitted by the server build to the client output directory

• correctly decode [u+nnnn] escape sequences above ffff

• Reject all pending query promises when a query fails before resolving with a value for the first time