npm / @sveltejs/kit

@sveltejs/kit

What changed in @sveltejs/kit 2 to 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

80 breaking13 security8 deprecations28 new APIs and options8 behavior and defaults5 tooling35 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

@sveltejs/kit 3166 changes

Breaking changes 80

204 responses now return no content.
3.0.0release notes
Adapter Vite plugins are separated into pre and post.
3.0.0release notes
ActionResult and SubmitFunction move from @sveltejs/kit to $app/forms.
3.0.0release notes
Navigation-related types, including GotoOptions, move from @sveltejs/kit to $app/navigation.
3.0.0release notes
The base, assets, and resolveRoute exports are removed from $app/paths.
3.0.0release notes
Remote function types move to $app/server.
3.0.0release notes
Page, ReadonlyURL, and ReadonlyURLSearchParams move from @sveltejs/kit to $app/state.
3.0.0release notes
The $app/stores module is removed.
3.0.0release notes
The type is renamed from Asset to AssetPath; leading / is removed from AssetPath values.
3.0.0release notes
createEntries is removed from the Builder object passed to adapter functions.
3.0.0release notes
builder.generateManifest is replaced with builder.generateServerInstance and builder.manifest.
3.0.0release notes
The deprecated CSRF option is removed in favor of trustedOrigins.
3.0.0release notes
A config exported from a universal route file takes precedence over one exported from a server route file.
3.0.0release notes
The cookie dependency is upgraded to v2, which requires cookie names to contain only ASCII characters.
3.0.0release notes
The cookie path option now defaults to /.
3.0.0release notes
Cross-origin form submissions without a Content-Type header are disallowed.
3.0.0release notes
Enhanced cross-page form actions navigate to the action page on success and failure, matching native form behavior.
3.0.0release notes
Clicking a link to the current URL refreshes all load functions and queries.
3.0.0release notes
The option value off is removed in favor of false.
3.0.0release notes
The data-sveltekit-noscroll and data-sveltekit-keepfocus attributes are replaced by data-sveltekit-reset.
3.0.0release notes
The experimental.handleRenderingErrors flag is removed.
3.0.0release notes
External redirects are forbidden by default.
3.0.0release notes
Form action responses now use the HTTP status code returned from fail.
3.0.0release notes
The type changes from any to App.Error | undefined.
3.0.0release notes
getRequest is now synchronous.
3.0.0release notes
goto rejects when given a URL that does not resolve to a route within the app.
3.0.0release notes
The noScroll and keepFocus options are replaced by the reset option.
3.0.0release notes
handle's resolve is now typed to always return a Promise.
3.0.0release notes
All errors now pass through the handleError hook.
3.0.0release notes
handleError can influence the status code.
3.0.0release notes
handleValidationError is removed; remote function validation errors are passed to handleError with kind: 'validation'.
3.0.0release notes
HEAD requests are answered without a response body.
3.0.0release notes
Environment variables are populated before instrumentation.server.js is evaluated, and the adapter instrumentation API is updated.
3.0.0release notes
Calling invalidate or invalidateAll during navigation no longer aborts navigation.
3.0.0release notes
Adds kit.paths.origin; kit.prerender.origin and the adapter-node ORIGIN environment variable are removed.
3.0.0release notes
The $lib alias is replaced with #lib, and files.lib configuration is removed.
3.0.0release notes
The #lib definition is removed from paths, requiring explicit module extensions.
3.0.0release notes
The deprecated .run() method is removed from live queries.
3.0.0release notes
The delta property now exists only for popstate navigation events.
3.0.0release notes
The generated tsconfig is now written to node_modules/$app/tsconfig.
3.0.0release notes
Node 22.17 or newer is required.
3.0.0release notes
page.url is immutable at the type level.
3.0.0release notes
Param files in folders are removed in favor of a params.js/ts file.
3.0.0release notes
The type is renamed from Pathname to Path; leading / is removed from Path values.
3.0.0release notes
The deprecated pragma header is removed from version polling for improved CORS support.
3.0.0release notes
preloadCode takes a route ID instead of a pathname; route IDs are not prefixed with paths.base.
3.0.0release notes
The result type for preloadData now includes an error result.
3.0.0release notes
The option is removed; modulepreload is always used.
3.0.0release notes
Fallback handlers are rejected on prerendered endpoints.
3.0.0release notes
Programmatic form validation skips clean fields.
3.0.0release notes
Accessing event.url, event.params, or event.route inside queries now errors.
3.0.0release notes
Values set or refreshed from within a query during SSR are serialized into the rendered HTML.
3.0.0release notes
Submitting a remote form without JavaScript preserves the current URL search parameters.
3.0.0release notes
These files are disallowed unless experimental.remoteFunctions is enabled.
3.0.0release notes
Route ID escape sequences are expanded when resolving a route ID to a pathname.
3.0.0release notes
RouteId includes only routes with a +page or +server file.
3.0.0release notes
The Server constructor is removed from public types.
3.0.0release notes
Nested server-only directories are supported, and /server/ paths are treated as server-only throughout the project except in src/routes and the assets directory.
3.0.0release notes
Server-side self-fetch fallbacks no longer follow redirects.
3.0.0release notes
The $service-worker module is deleted.
3.0.0release notes
Service worker registrations use type: 'module'.
3.0.0release notes
setResponse is now synchronous.
3.0.0release notes
The server errors if it does not respect a client-requested single-flight mutation, and can explicitly ignore refreshes.
3.0.0release notes
SSRManifest is removed from public types.
3.0.0release notes
Subresource requests receive a lightweight 404 instead of rendering the error page.
3.0.0release notes
Svelte 5.56.4 or newer is required.
3.0.0release notes
Svelte config options must be passed through the Vite plugin.
3.0.0release notes
defineEnvVars moves to @sveltejs/kit/env.
3.0.0release notes
Environment-related types move to @sveltejs/kit/env.
3.0.0release notes
Hooks-related types move to @sveltejs/kit/hooks.
3.0.0release notes
The @sveltejs/kit/node/polyfills module is removed.
3.0.0release notes
defineParams and its associated types move to @sveltejs/kit/params.
3.0.0release notes
Version 7 is required.
3.0.0release notes
Tracing moves out of the experimental namespace, and the instrumentation flag is removed.
3.0.0release notes
Load functions rerun when the number of values of a tracked search parameter changes.
3.0.0release notes
TypeScript 6 is now the minimum required version.
3.0.0release notes
The experimental remote form option includeUntouched is replaced by all.
3.0.0release notes
The default polling interval is now one hour; deployment detection also occurs on data, remote, and form action responses, tab focus, and visibility changes.
3.0.0release notes
Vite 8 is required; its hook filters and environment API also enable faster builds and more powerful adapters.
3.0.0release notes
Query parameters beginning with x-sveltekit- are rejected.
3.0.0release notes

Security 2

Path traversal is prevented when previewing prerendered pages and data on Windows.
3.0.0release notes
Nested and typed underscore-prefixed remote form fields are redacted after invalid submissions.
3.0.0release notes

Deprecations 8

The alias option is deprecated.
3.0.0release notes
builder.mkdirp is deprecated in favor of node:fs methods.
3.0.0release notes
builder.rimraf is deprecated in favor of node:fs methods.
3.0.0release notes
The environment modules are reinstated as deprecated aliases for $app/env/private, $app/env/public, and $app/env.
3.0.0release notes
error(status, {...}) is deprecated in favor of error(status, message, {...}).
3.0.0release notes
Response helpers are deprecated in favor of platform-provided alternatives.
3.0.0release notes
Server is deprecated in favour of the server object written by builder.generateServerInstance.
3.0.0release notes
export const snapshot is deprecated in favor of the snapshot helper.
3.0.0release notes

New APIs and options 28

CSP hash-reporting keyword is supported.
3.1.0release notes
CSP hash-reporting keyword is supported.
3.1.0release notes
CSP hash-reporting keyword is supported.
3.1.0release notes
A sveltekit.endpoint span is emitted for +server handlers when server tracing is enabled.
3.1.0release notes
Adapters can provide additional Vite plugins and receive the Svelte config as a function argument when adding them.
3.0.0release notes
Adds $app/manifest with immutable, assets, prerendered, and routes exports.
3.0.0release notes
$app/paths can be imported in service workers.
3.0.0release notes
Adds the $app/service-worker module.
3.0.0release notes
Adds an applyReroute helper for adapters supporting split serverless function deployments.
3.0.0release notes
Adds an option to preload using the Link header.
3.0.0release notes
Adds the cookies.parse method.
3.0.0release notes
Adds PageRouteId and EndpointRouteId to $app/types.
3.0.0release notes
Function validators are supported for environment variables.
3.0.0release notes
Remote form fields gain a touched() helper.
3.0.0release notes
Adds a dirty() property to form fields.
3.0.0release notes
The checked state can be passed as a third argument to .as('radio', ...) and .as('checkbox', ...), so inputs reset to that state after submission.
3.0.0release notes
A new response option lets getRequest abort request.signal when a response closes prematurely.
3.0.0release notes
Adapters can override getRequest and setResponse during vite dev and vite preview.
3.0.0release notes
Page state set through goto(..., { state, persistState: true }) is preserved across reloads.
3.0.0release notes
Adds shallow routing to goto; pushState and replaceState are deprecated.
3.0.0release notes
Adds ManifestRoute and page and endpoint booleans to $app/manifest routes.
3.0.0release notes
Custom values in page.state are supported through the transport hook.
3.0.0release notes
Adds PageRouteId and EndpointRouteId to $app/types.
3.0.0release notes
The font preload filter receives the project-relative source filename.
3.0.0release notes
The QUERY HTTP method is supported in +server.js.
3.0.0release notes
refreshAll is added, and invalidateAll is deprecated.
3.0.0release notes
Remote form fields are widened to support union schemas and string enums.
3.0.0release notes
Adds the snapshot helper to $app/navigation.
3.0.0release notes

Behavior and default changes 8

builder.compress returns the list of compressed files.
3.0.0release notes
Cookies default to secure: false during development.
3.0.0release notes
Hyphens are allowed in param and matcher names.
3.0.0release notes
When a query value arrives through set(), its pending request is settled in place.
3.0.0release notes
All pending query promises are rejected when a query fails before first resolving with a value.
3.0.0release notes
Remote function exports may use reserved words such as delete and class.
3.0.0release notes
Routes can contain [ and ] using the [x+5b] and [x+5d] escapes.
3.0.0release notes
Pages render over sibling endpoints that have no GET or HEAD handlers.
3.0.0release notes

Tooling 5

Generated files are left unchanged when their contents have not changed.
3.1.0release notes
$app/tsconfig can be generated without TypeScript installed.
3.0.0release notes
Adds ErrorProps to generated types.
3.0.0release notes
Prerender errors are surfaced during development.
3.0.0release notes
Sourcemaps are supported in production.
3.0.0release notes

Fixes and other changes 35

Deployment recovery continues when service worker updates fail.
3.1.0release notes
Focus remains in the parent page when an app in an unfocused iframe starts or navigates.
3.1.0release notes
MIME types for prerendered files are inferred from generated files.
3.1.0release notes
Modules are no longer all treated as server-only when the project is inside a server directory.
3.1.0release notes
Warnings are no longer emitted for Storybook's Vite plugins that use transformIndexHtml.
3.1.0release notes
Relative imports in generated types now work with nodenext module resolution.
3.0.1release notes
Dynamic $app/env/* variables are populated in contexts that do not run the dev server, such as vite-node.
3.0.0release notes
$app/environment is restored as an alias for $app/env so dependencies importing it continue to work.
3.0.0release notes
The error status from App.Error is read in prerender and query.live remote functions.
3.0.0release notes
Server-side route resolution supports bigint params.
3.0.0release notes
Cookie options are optional.
3.0.0release notes
Deleted cookies are excluded from cookies.getAll(), keeping it consistent with cookies.get().
3.0.0release notes
Fetch responses are no longer serialized when the request body is not a string or TypedArray.
3.0.0release notes
The nearest error page renders when a form submission receives a non-ActionResult error response.
3.0.0release notes
The nearest +error.svelte renders at its occupied depth when an error is thrown during rendering.
3.0.0release notes
Where applicable, form field .as(...) accepts undefined values.
3.0.0release notes
Form fields can be named after Object prototype properties.
3.0.0release notes
form.fields.set properly handles Date objects.
3.0.0release notes
Reading non-serialized set-cookie headers via getSetCookie in load no longer errors.
3.0.0release notes
Global app state persists across module graph reloads.
3.0.0release notes
The prerender crawler no longer hangs on unterminated unquoted attributes.
3.0.0release notes
User-set preview.cors configuration is respected instead of being overridden.
3.0.0release notes
Values set or refreshed from within a query during SSR are serialized into the rendered HTML.
3.0.0release notes
query.live sends periodic keep-alive SSE comments to prevent idle-timeout errors.
3.0.0release notes
data: protocol URLs are treated as external for redirects.
3.0.0release notes
Validation checks that all remote form fields were created with form.fields.foo.as(...).
3.0.0release notes
Values typed into remote form fields are coerced, and .as() defaults apply only until the field is edited.
3.0.0release notes
Errors from prerendered remote responses are propagated instead of rerunning the function.
3.0.0release notes
Node.js buffers returned from remote functions during SSR are serialized correctly.
3.0.0release notes
RequestEvent properties are marked readonly.
3.0.0release notes
Route escape sequences above ffff are decoded correctly.
3.0.0release notes
Scheme-like path segments no longer cause off-site trailing-slash redirects.
3.0.0release notes
User-set server.cors configuration is respected instead of being overridden.
3.0.0release notes
The trusted-types policy is required only when client-side code is shipped, allowing builds where all pages have csr: false.
3.0.0release notes
Paths resolve using the Vite config root option instead of process.cwd(), improving monorepo support.
3.0.0release notes

@sveltejs/kit 211 changes

Security 11

SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header
2.70.2security advisory
SvelteKit: Big remote form function payloads can cause Node process to crash
2.69.1security advisory
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
2.69.1security advisory
@sveltejs/kit: query.batch cross-talk
2.60.1security advisory
@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass
2.57.1security advisory
@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service
2.57.1security advisory
SvelteKit has deserialization expansion in unvalidated form remote function leading to Denial of Service (experimental only)
2.53.3security advisory
CPU exhaustion in SvelteKit remote form deserialization (experimental only)
2.52.2security advisory
Memory exhaustion in SvelteKit remote form deserialization (experimental only)
2.52.2security advisory
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)
2.49.5security advisory
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
2.49.5security advisory