# What changed in @sveltejs/package

> 10 changes in @sveltejs/package 2 to 3 from its official release notes, upgrade guides and advisories: 1 breaking, 2 security. Each one cited. Sources checked 2026-11-13. HTML: https://unstale.sh/npm/@sveltejs/package/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @sveltejs/package 3

### Breaking changes

- Node.js 22 or newer is required. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%403.0.0)

### Security

- SvelteKit: URL redirection to untrusted site via enhanced form submission (3.0.0) — [security advisory](https://github.com/advisories/GHSA-PFHG-Q3QV-9Q6R)
- SvelteKit : XSS via untrusted cache-control header in prerendered page (3.0.0) — [security advisory](https://github.com/advisories/GHSA-27MW-82G8-PHJJ)

### Behavior and default changes

- Import aliases are transformed into relative imports in files. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%403.0.0)

### Fixes and other changes

- The process exits after packaging when preprocessors leave resources running. (3.0.2) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%403.0.2)
- Component types are emitted for the installed Svelte version rather than the oldest version allowed by the svelte dependency range. (3.0.1) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%403.0.1)
- TypeScript is declared as an optional peer dependency so svelte-package works under strict node-linkers. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%403.0.0)
- Declarations are emitted when the tsconfig is located above the package root. (3.0.0) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%403.0.0)

## @sveltejs/package 2

### Fixes and other changes

- When using rewriteRelativeImportExtensions, .ts extensions in import and export statements of Svelte files are transformed to .js. (2.5.6) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%402.5.6)
- Aliases are now resolved before transpiling for rewriteRelativeImportExtensions. (2.5.5) — [release notes](https://github.com/sveltejs/kit/releases/tag/%40sveltejs/package%402.5.5)