unstale

npm / @sveltejs/package

@sveltejs/package

What changed in @sveltejs/package 2 to 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-11-13.

1 breaking2 security1 behavior and defaults6 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.3.0 on npm

@sveltejs/package 38 changes

Breaking changes 1

Security 2

  • SvelteKit: URL redirection to untrusted site via enhanced form submission

    3.0.0security advisory

  • SvelteKit : XSS via untrusted cache-control header in prerendered page

    3.0.0security advisory

Behavior and default changes 1

  • Import aliases are transformed into relative imports in files.

    3.0.0release notes

Fixes and other changes 4

  • The process exits after packaging when preprocessors leave resources running.

    3.0.2release notes

  • Component types are emitted for the installed Svelte version rather than the oldest version allowed by the svelte dependency range.

    3.0.1release notes

  • TypeScript is declared as an optional peer dependency so svelte-package works under strict node-linkers.

    3.0.0release notes

  • Declarations are emitted when the tsconfig is located above the package root.

    3.0.0release notes

@sveltejs/package 22 changes

Fixes and other changes 2

  • When using rewriteRelativeImportExtensions, .ts extensions in import and export statements of Svelte files are transformed to .js.

    2.5.6release notes

  • Aliases are now resolved before transpiling for rewriteRelativeImportExtensions.

    2.5.5release notes