# What changed in @sveltejs/kit

> 177 changes in @sveltejs/kit 2 to 3 from its official release notes, upgrade guides and advisories: 80 breaking, 8 deprecations, 13 security, 28 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/@sveltejs/kit/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @sveltejs/kit 3

### Breaking changes

- 204 responses now return no content. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Adapter Vite plugins are separated into `pre` and `post`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `ActionResult` and `SubmitFunction` move from `@sveltejs/kit` to `$app/forms`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Navigation-related types, including `GotoOptions`, move from `@sveltejs/kit` to `$app/navigation`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The `base`, `assets`, and `resolveRoute` exports are removed from `$app/paths`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Remote function types move to `$app/server`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `Page`, `ReadonlyURL`, and `ReadonlyURLSearchParams` move from `@sveltejs/kit` to `$app/state`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The `$app/stores` module is removed. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The type is renamed from `Asset` to `AssetPath`; leading `/` is removed from `AssetPath` values. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `createEntries` is removed from the `Builder` object passed to adapter functions. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `builder.generateManifest` is replaced with `builder.generateServerInstance` and `builder.manifest`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The deprecated CSRF option is removed in favor of `trustedOrigins`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- A `config` exported from a universal route file takes precedence over one exported from a server route file. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The cookie dependency is upgraded to v2, which requires cookie names to contain only ASCII characters. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The cookie `path` option now defaults to `/`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Cross-origin form submissions without a `Content-Type` header are disallowed. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Enhanced cross-page form actions navigate to the action page on success and failure, matching native form behavior. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Clicking a link to the current URL refreshes all load functions and queries. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The option value `off` is removed in favor of `false`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The `data-sveltekit-noscroll` and `data-sveltekit-keepfocus` attributes are replaced by `data-sveltekit-reset`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The `experimental.handleRenderingErrors` flag is removed. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- External redirects are forbidden by default. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Form action responses now use the HTTP status code returned from `fail`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The type changes from `any` to `App.Error | undefined`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `getRequest` is now synchronous. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `goto` rejects when given a URL that does not resolve to a route within the app. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The `noScroll` and `keepFocus` options are replaced by the `reset` option. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `handle`'s `resolve` is now typed to always return a `Promise`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- All errors now pass through the `handleError` hook. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `handleError` can influence the status code. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `handleValidationError` is removed; remote function validation errors are passed to `handleError` with `kind: 'validation'`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `HEAD` requests are answered without a response body. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Environment variables are populated before `instrumentation.server.js` is evaluated, and the adapter instrumentation API is updated. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Calling `invalidate` or `invalidateAll` during navigation no longer aborts navigation. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Adds `kit.paths.origin`; `kit.prerender.origin` and the `adapter-node` `ORIGIN` environment variable are removed. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The `$lib` alias is replaced with `#lib`, and `files.lib` configuration is removed. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The `#lib` definition is removed from `paths`, requiring explicit module extensions. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The deprecated `.run()` method is removed from live queries. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The `delta` property now exists only for `popstate` navigation events. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The generated tsconfig is now written to `node_modules/$app/tsconfig`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Node 22.17 or newer is required. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `page.url` is immutable at the type level. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Param files in folders are removed in favor of a `params.js/ts` file. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The type is renamed from `Pathname` to `Path`; leading `/` is removed from `Path` values. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The deprecated `pragma` header is removed from version polling for improved CORS support. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `preloadCode` takes a route ID instead of a pathname; route IDs are not prefixed with `paths.base`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The result type for `preloadData` now includes an `error` result. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The option is removed; `modulepreload` is always used. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Fallback handlers are rejected on prerendered endpoints. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Programmatic form validation skips clean fields. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Accessing `event.url`, `event.params`, or `event.route` inside queries now errors. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Values set or refreshed from within a query during SSR are serialized into the rendered HTML. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Submitting a remote form without JavaScript preserves the current URL search parameters. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- These files are disallowed unless `experimental.remoteFunctions` is enabled. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Route ID escape sequences are expanded when resolving a route ID to a pathname. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `RouteId` includes only routes with a `+page` or `+server` file. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The `Server` constructor is removed from public types. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Nested server-only directories are supported, and `/server/` paths are treated as server-only throughout the project except in `src/routes` and the assets directory. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Server-side self-fetch fallbacks no longer follow redirects. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The `$service-worker` module is deleted. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Service worker registrations use `type: 'module'`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `setResponse` is now synchronous. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The server errors if it does not respect a client-requested single-flight mutation, and can explicitly ignore refreshes. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `SSRManifest` is removed from public types. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Subresource requests receive a lightweight 404 instead of rendering the error page. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Svelte 5.56.4 or newer is required. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Svelte config options must be passed through the Vite plugin. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `defineEnvVars` moves to `@sveltejs/kit/env`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Environment-related types move to `@sveltejs/kit/env`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Hooks-related types move to `@sveltejs/kit/hooks`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The `@sveltejs/kit/node/polyfills` module is removed. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `defineParams` and its associated types move to `@sveltejs/kit/params`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Version 7 is required. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Tracing moves out of the experimental namespace, and the instrumentation flag is removed. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Load functions rerun when the number of values of a tracked search parameter changes. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- TypeScript 6 is now the minimum required version. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The experimental remote form option `includeUntouched` is replaced by `all`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The default polling interval is now one hour; deployment detection also occurs on data, remote, and form action responses, tab focus, and visibility changes. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Vite 8 is required; its hook filters and environment API also enable faster builds and more powerful adapters. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Query parameters beginning with `x-sveltekit-` are rejected. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)

### Security

- Path traversal is prevented when previewing prerendered pages and data on Windows. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Nested and typed underscore-prefixed remote form fields are redacted after invalid submissions. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)

### Deprecations

- The `alias` option is deprecated. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `builder.mkdirp` is deprecated in favor of `node:fs` methods. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `builder.rimraf` is deprecated in favor of `node:fs` methods. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The environment modules are reinstated as deprecated aliases for `$app/env/private`, `$app/env/public`, and `$app/env`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `error(status, {...})` is deprecated in favor of `error(status, message, {...})`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Response helpers are deprecated in favor of platform-provided alternatives. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `Server` is deprecated in favour of the `server` object written by `builder.generateServerInstance`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `export const snapshot` is deprecated in favor of the `snapshot` helper. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)

### New APIs and options

- CSP hash-reporting keyword is supported. (3.1.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.0)
- CSP hash-reporting keyword is supported. (3.1.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.0)
- CSP hash-reporting keyword is supported. (3.1.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.0)
- A `sveltekit.endpoint` span is emitted for `+server` handlers when server tracing is enabled. (3.1.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.0)
- Adapters can provide additional Vite plugins and receive the Svelte config as a function argument when adding them. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Adds `$app/manifest` with `immutable`, `assets`, `prerendered`, and `routes` exports. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `$app/paths` can be imported in service workers. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Adds the `$app/service-worker` module. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Adds an `applyReroute` helper for adapters supporting split serverless function deployments. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Adds an option to preload using the `Link` header. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Adds the `cookies.parse` method. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Adds `PageRouteId` and `EndpointRouteId` to `$app/types`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Function validators are supported for environment variables. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Remote form fields gain a `touched()` helper. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Adds a `dirty()` property to form fields. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The checked state can be passed as a third argument to `.as('radio', ...)` and `.as('checkbox', ...)`, so inputs reset to that state after submission. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- A new `response` option lets `getRequest` abort `request.signal` when a response closes prematurely. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Adapters can override `getRequest` and `setResponse` during `vite dev` and `vite preview`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Page state set through `goto(..., { state, persistState: true })` is preserved across reloads. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Adds shallow routing to `goto`; `pushState` and `replaceState` are deprecated. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Adds `ManifestRoute` and `page` and `endpoint` booleans to `$app/manifest` routes. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Custom values in `page.state` are supported through the `transport` hook. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Adds `PageRouteId` and `EndpointRouteId` to `$app/types`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The font preload filter receives the project-relative source `filename`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The `QUERY` HTTP method is supported in `+server.js`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `refreshAll` is added, and `invalidateAll` is deprecated. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Remote form fields are widened to support union schemas and string enums. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Adds the `snapshot` helper to `$app/navigation`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)

### Behavior and default changes

- `builder.compress` returns the list of compressed files. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Cookies default to `secure: false` during development. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Hyphens are allowed in param and matcher names. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- When a query value arrives through `set()`, its pending request is settled in place. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- All pending query promises are rejected when a query fails before first resolving with a value. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Remote function exports may use reserved words such as `delete` and `class`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Routes can contain `[` and `]` using the `[x+5b]` and `[x+5d]` escapes. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Pages render over sibling endpoints that have no `GET` or `HEAD` handlers. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)

### Tooling

- Generated files are left unchanged when their contents have not changed. (3.1.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.0)
- `$app/tsconfig` can be generated without TypeScript installed. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Adds `ErrorProps` to generated types. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Prerender errors are surfaced during development. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Sourcemaps are supported in production. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)

### Fixes and other changes

- Deployment recovery continues when service worker updates fail. (3.1.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.0)
- Focus remains in the parent page when an app in an unfocused iframe starts or navigates. (3.1.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.0)
- MIME types for prerendered files are inferred from generated files. (3.1.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.0)
- Modules are no longer all treated as server-only when the project is inside a `server` directory. (3.1.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.0)
- Warnings are no longer emitted for Storybook's Vite plugins that use `transformIndexHtml`. (3.1.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.0)
- Relative imports in generated types now work with nodenext module resolution. (3.0.1) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.1)
- Dynamic `$app/env/*` variables are populated in contexts that do not run the dev server, such as `vite-node`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `$app/environment` is restored as an alias for `$app/env` so dependencies importing it continue to work. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The error status from `App.Error` is read in `prerender` and `query.live` remote functions. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Server-side route resolution supports bigint params. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Cookie options are optional. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Deleted cookies are excluded from `cookies.getAll()`, keeping it consistent with `cookies.get()`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Fetch responses are no longer serialized when the request body is not a string or TypedArray. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The nearest error page renders when a form submission receives a non-ActionResult error response. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The nearest `+error.svelte` renders at its occupied depth when an error is thrown during rendering. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Where applicable, form field `.as(...)` accepts `undefined` values. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Form fields can be named after `Object` prototype properties. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `form.fields.set` properly handles `Date` objects. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Reading non-serialized `set-cookie` headers via `getSetCookie` in `load` no longer errors. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Global app state persists across module graph reloads. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The prerender crawler no longer hangs on unterminated unquoted attributes. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- User-set `preview.cors` configuration is respected instead of being overridden. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Values set or refreshed from within a query during SSR are serialized into the rendered HTML. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `query.live` sends periodic `keep-alive` SSE comments to prevent idle-timeout errors. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `data:` protocol URLs are treated as external for redirects. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Validation checks that all remote form fields were created with `form.fields.foo.as(...)`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Values typed into remote form fields are coerced, and `.as()` defaults apply only until the field is edited. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Errors from prerendered remote responses are propagated instead of rerunning the function. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Node.js buffers returned from remote functions during SSR are serialized correctly. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- `RequestEvent` properties are marked `readonly`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Route escape sequences above `ffff` are decoded correctly. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Scheme-like path segments no longer cause off-site trailing-slash redirects. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- User-set `server.cors` configuration is respected instead of being overridden. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- The trusted-types policy is required only when client-side code is shipped, allowing builds where all pages have `csr: false`. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)
- Paths resolve using the Vite config `root` option instead of `process.cwd()`, improving monorepo support. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.0.0)

## @sveltejs/kit 2

### Security

- SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header (2.70.2) — [security advisory](https://github.com/advisories/GHSA-29G2-3RMR-QM68)
- SvelteKit: Big remote form function payloads can cause Node process to crash (2.69.1) — [security advisory](https://github.com/advisories/GHSA-WQJV-9729-C5Q2)
- SvelteKit: Prototype pollution in file input deletion path in remote-function forms (2.69.1) — [security advisory](https://github.com/advisories/GHSA-866W-XMHQ-WJ7X)
- @sveltejs/kit: `query.batch` cross-talk (2.60.1) — [security advisory](https://github.com/advisories/GHSA-HGV7-V322-MMGR)
- @sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass (2.57.1) — [security advisory](https://github.com/advisories/GHSA-2CRG-3P73-43XP)
- @sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service (2.57.1) — [security advisory](https://github.com/advisories/GHSA-3F6H-2HRP-W5WX)
- SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only) (2.53.3) — [security advisory](https://github.com/advisories/GHSA-FPG4-JHQR-589C)
- CPU exhaustion in SvelteKit remote form deserialization (experimental only) (2.52.2) — [security advisory](https://github.com/advisories/GHSA-88QP-P4QG-RQM6)
- Memory exhaustion in SvelteKit remote form deserialization (experimental only) (2.52.2) — [security advisory](https://github.com/advisories/GHSA-VRHM-GVG7-FPCF)
- @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata) (2.49.5) — [security advisory](https://github.com/advisories/GHSA-J2F3-WQ62-6Q46)
- SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering (2.49.5) — [security advisory](https://github.com/advisories/GHSA-J62C-4X62-9R35)