From 5512fdc5aac97b0fa920d2ca0e921a1662ad5122 Mon Sep 17 00:00:00 2001 From: Tee Ming Date: Mon, 16 Feb 2026 00:20:16 +0800 Subject: [PATCH 01/13] add failing test --- .../source/pages/csp-trusted-types/+page.svelte | 4 ++++ .../options/source/pages/csp-trusted-types/+page.ts | 2 ++ packages/kit/test/apps/options/test/test.js | 12 ++++++++++++ 3 files changed, 18 insertions(+) create mode 100644 packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.svelte create mode 100644 packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.ts diff --git a/packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.svelte b/packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.svelte new file mode 100644 index 000000000000..c8d09b12a589 --- /dev/null +++ b/packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.svelte @@ -0,0 +1,4 @@ +

+ this page uses csr only and will error when Svelte tries to set the innerHTML without a trusted + type +

diff --git a/packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.ts b/packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.ts new file mode 100644 index 000000000000..3117b65ade5b --- /dev/null +++ b/packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.ts @@ -0,0 +1,2 @@ +// we want only CSR to test Svelte setting innerHTML succesfully +export const ssr = false; diff --git a/packages/kit/test/apps/options/test/test.js b/packages/kit/test/apps/options/test/test.js index 87a6c02d7534..f12c9a1dc333 100644 --- a/packages/kit/test/apps/options/test/test.js +++ b/packages/kit/test/apps/options/test/test.js @@ -60,6 +60,18 @@ test.describe('CSP', () => { expect(hydratable_script_match).not.toBeNull(); expect(hydratable_script_match?.[1]).toBe(nonce); }); + + test('require-trusted-types-for', ({ page, javaScriptEnabled }) => { + test.skip(!javaScriptEnabled, 'trusted types only affects scripts'); + + const errors = []; + page.on('pageerror', (err) => { + errors.push(err.message); + }); + + page.goto('/path-base/csp-trusted-types'); + expect(errors.length).toEqual(0); + }); }); test.describe('Custom extensions', () => { From 91b2dae0ab3641e81e25eb5a66004197a44654e8 Mon Sep 17 00:00:00 2001 From: Tee Ming Date: Mon, 16 Feb 2026 00:43:40 +0800 Subject: [PATCH 02/13] add config option error depending on svelte version --- packages/kit/src/core/config/options.js | 17 ++++++++++++++--- packages/kit/src/core/sync/utils.js | 8 +++++++- 2 files changed, 21 insertions(+), 4 deletions(-) diff --git a/packages/kit/src/core/config/options.js b/packages/kit/src/core/config/options.js index d16ba4253582..b4a7217b38ab 100644 --- a/packages/kit/src/core/config/options.js +++ b/packages/kit/src/core/config/options.js @@ -1,7 +1,8 @@ +/** @import { Validator } from './types.js' */ + import process from 'node:process'; import colors from 'kleur'; - -/** @typedef {import('./types.js').Validator} Validator */ +import { supportsTrustedTypes } from '../sync/utils.js'; const directives = object({ 'child-src': string_array(), @@ -28,7 +29,17 @@ const directives = object({ 'navigate-to': string_array(), 'report-uri': string_array(), 'report-to': string_array(), - 'require-trusted-types-for': string_array(), + 'require-trusted-types-for': validate(undefined, (input, keypath) => { + if (!supportsTrustedTypes()) { + throw new Error( + `${keypath} is not supported by your version of Svelte. Please upgrade to Svelte 5.51.0 or later to use this directive.` + ); + } + + input = string_array()(input, keypath); + + return input; + }), 'trusted-types': string_array(), 'upgrade-insecure-requests': boolean(false), 'require-sri-for': string_array(), diff --git a/packages/kit/src/core/sync/utils.js b/packages/kit/src/core/sync/utils.js index be3ecc22b347..eb7d392fbd1f 100644 --- a/packages/kit/src/core/sync/utils.js +++ b/packages/kit/src/core/sync/utils.js @@ -6,6 +6,8 @@ import { import_peer } from '../../utils/import.js'; /** @type {{ VERSION: string }} */ const { VERSION } = await import_peer('svelte/compiler'); +const [MAJOR, MINOR] = VERSION.split('.').map(Number); + /** @type {Map} */ const previous_contents = new Map(); @@ -74,5 +76,9 @@ export function dedent(strings, ...values) { } export function isSvelte5Plus() { - return Number(VERSION[0]) >= 5; + return MAJOR >= 5; +} + +export function supportsTrustedTypes() { + return (MAJOR === 5 && MINOR >= 51) || MAJOR > 5; } From 540b46e9ea09439f605a1fe6c1297a0a8bd7e3c3 Mon Sep 17 00:00:00 2001 From: Tee Ming Date: Mon, 16 Feb 2026 00:45:00 +0800 Subject: [PATCH 03/13] bump svelte --- pnpm-lock.yaml | 322 ++++++++++++++++++++++---------------------- pnpm-workspace.yaml | 2 +- 2 files changed, 165 insertions(+), 159 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 917efd0b479a..bf8b7f5697a4 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -91,8 +91,8 @@ catalogs: specifier: ^3.0.0 version: 3.0.0 svelte: - specifier: ^5.48.4 - version: 5.48.4 + specifier: ^5.51.2 + version: 5.51.2 svelte-check: specifier: ^4.3.4 version: 4.3.4 @@ -127,7 +127,7 @@ importers: version: 1.58.2 '@sveltejs/eslint-config': specifier: 'catalog:' - version: 8.2.0(@stylistic/eslint-plugin-js@2.1.0(eslint@9.34.0(jiti@2.4.2)))(eslint-config-prettier@9.1.0(eslint@9.34.0(jiti@2.4.2)))(eslint-plugin-n@17.16.1(eslint@9.34.0(jiti@2.4.2))(typescript@5.8.3))(eslint-plugin-svelte@3.9.3(eslint@9.34.0(jiti@2.4.2))(svelte@5.48.4)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)))(eslint@9.34.0(jiti@2.4.2))(typescript-eslint@8.43.0(eslint@9.34.0(jiti@2.4.2))(typescript@5.8.3))(typescript@5.8.3) + version: 8.2.0(@stylistic/eslint-plugin-js@2.1.0(eslint@9.34.0(jiti@2.4.2)))(eslint-config-prettier@9.1.0(eslint@9.34.0(jiti@2.4.2)))(eslint-plugin-n@17.16.1(eslint@9.34.0(jiti@2.4.2))(typescript@5.8.3))(eslint-plugin-svelte@3.9.3(eslint@9.34.0(jiti@2.4.2))(svelte@5.51.2)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)))(eslint@9.34.0(jiti@2.4.2))(typescript-eslint@8.43.0(eslint@9.34.0(jiti@2.4.2))(typescript@5.8.3))(typescript@5.8.3) '@svitejs/changesets-changelog-github-compact': specifier: 'catalog:' version: 1.2.0 @@ -139,7 +139,7 @@ importers: version: 3.6.0 prettier-plugin-svelte: specifier: ^3.4.0 - version: 3.4.0(prettier@3.6.0)(svelte@5.48.4) + version: 3.4.0(prettier@3.6.0)(svelte@5.51.2) typescript-eslint: specifier: 'catalog:' version: 8.43.0(eslint@9.34.0(jiti@2.4.2))(typescript@5.8.3) @@ -151,7 +151,7 @@ importers: version: link:../kit '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) '@types/node': specifier: 'catalog:' version: 18.19.119 @@ -200,13 +200,13 @@ importers: version: link:../../../../kit '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) server-side-dep: specifier: file:server-side-dep version: file:packages/adapter-cloudflare/test/apps/pages/server-side-dep svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 vite: specifier: 'catalog:' version: 6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0) @@ -221,13 +221,13 @@ importers: version: link:../../../../kit '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) server-side-dep: specifier: file:server-side-dep version: file:packages/adapter-cloudflare/test/apps/workers/server-side-dep svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 vite: specifier: 'catalog:' version: 6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0) @@ -273,7 +273,7 @@ importers: version: link:../kit '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) '@types/node': specifier: 'catalog:' version: 18.19.119 @@ -294,10 +294,10 @@ importers: version: link:../../../../kit '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 vite: specifier: 'catalog:' version: 6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0) @@ -309,10 +309,10 @@ importers: version: link:../../../../kit '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 vite: specifier: 'catalog:' version: 6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0) @@ -340,7 +340,7 @@ importers: version: link:../kit '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) '@types/node': specifier: 'catalog:' version: 18.19.119 @@ -367,7 +367,7 @@ importers: version: link:../kit '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) '@types/node': specifier: 'catalog:' version: 18.19.119 @@ -376,7 +376,7 @@ importers: version: 3.0.2 svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 typescript: specifier: ^5.3.3 version: 5.8.3 @@ -391,13 +391,13 @@ importers: version: link:../../../../kit '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) sirv-cli: specifier: 'catalog:' version: 3.0.0 svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 vite: specifier: 'catalog:' version: 6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0) @@ -409,13 +409,13 @@ importers: version: link:../../../../kit '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) sirv-cli: specifier: 'catalog:' version: 3.0.0 svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 vite: specifier: 'catalog:' version: 6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0) @@ -434,7 +434,7 @@ importers: version: link:../kit '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) '@types/node': specifier: 'catalog:' version: 18.19.119 @@ -464,7 +464,7 @@ importers: version: 0.34.4 svelte-parse-markup: specifier: ^0.1.5 - version: 0.1.5(svelte@5.48.4) + version: 0.1.5(svelte@5.51.2) vite-imagetools: specifier: ^9.0.3 version: 9.0.3(rollup@4.57.1) @@ -474,7 +474,7 @@ importers: devDependencies: '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) '@types/estree': specifier: 'catalog:' version: 1.0.8 @@ -486,7 +486,7 @@ importers: version: 4.57.1 svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 typescript: specifier: ^5.6.3 version: 5.8.3 @@ -507,10 +507,10 @@ importers: version: link:../../../../kit '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 vite: specifier: 'catalog:' version: 6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0) @@ -565,7 +565,7 @@ importers: version: 1.58.2 '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) '@types/connect': specifier: 'catalog:' version: 3.4.38 @@ -583,10 +583,10 @@ importers: version: 4.57.1 svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-preprocess: specifier: 'catalog:' - version: 6.0.0(postcss-load-config@3.1.4(postcss@8.5.6)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)))(postcss@8.5.6)(svelte@5.48.4)(typescript@5.8.3) + version: 6.0.0(postcss-load-config@3.1.4(postcss@8.5.6)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)))(postcss@8.5.6)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.3.3 version: 5.8.3 @@ -607,16 +607,16 @@ importers: version: link:../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) dropcss: specifier: 'catalog:' version: 1.0.16 svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -631,13 +631,13 @@ importers: version: link:../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -664,16 +664,16 @@ importers: version: link:../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) '@vitest/browser-playwright': specifier: 'catalog:' version: 4.0.16(playwright@1.58.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0))(vitest@4.0.16) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) test-redirect-importer: specifier: workspace:* version: link:../../../../test-redirect-importer @@ -697,7 +697,7 @@ importers: version: link:../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) e2e-test-dep-error: specifier: file:./_test_dependencies/cjs-only version: e2e-test-dep-cjs-only@file:packages/kit/test/apps/dev-only/_test_dependencies/cjs-only @@ -730,10 +730,10 @@ importers: version: e2e-test-dep-cjs-only@file:packages/kit/test/apps/dev-only/_test_dependencies/cjs-only svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -748,13 +748,13 @@ importers: version: link:../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -769,13 +769,13 @@ importers: version: link:../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -790,13 +790,13 @@ importers: version: link:../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -814,13 +814,13 @@ importers: version: link:../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -838,13 +838,13 @@ importers: version: link:../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -865,13 +865,13 @@ importers: version: link:../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -886,13 +886,13 @@ importers: version: link:../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -907,13 +907,13 @@ importers: version: link:../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -937,13 +937,13 @@ importers: version: link:../../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -961,13 +961,13 @@ importers: version: link:../../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -985,13 +985,13 @@ importers: version: link:../../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1009,13 +1009,13 @@ importers: version: link:../../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1030,13 +1030,13 @@ importers: version: link:../../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1051,13 +1051,13 @@ importers: version: link:../../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1072,13 +1072,13 @@ importers: version: link:../../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1093,13 +1093,13 @@ importers: version: link:../../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1114,13 +1114,13 @@ importers: version: link:../../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1135,13 +1135,13 @@ importers: version: link:../../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1156,13 +1156,13 @@ importers: version: link:../../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1177,13 +1177,13 @@ importers: version: link:../../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1198,13 +1198,13 @@ importers: version: link:../../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1219,13 +1219,13 @@ importers: version: link:../../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1240,13 +1240,13 @@ importers: version: link:../../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1261,13 +1261,13 @@ importers: version: link:../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1285,13 +1285,13 @@ importers: version: link:../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1309,13 +1309,13 @@ importers: version: link:../../.. '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.4 version: 5.8.3 @@ -1342,11 +1342,11 @@ importers: version: 7.7.3 svelte2tsx: specifier: ~0.7.33 - version: 0.7.33(svelte@5.48.4)(typescript@5.8.3) + version: 0.7.33(svelte@5.51.2)(typescript@5.8.3) devDependencies: '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) '@types/node': specifier: 'catalog:' version: 18.19.119 @@ -1358,10 +1358,10 @@ importers: version: 3.6.0 svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-preprocess: specifier: 'catalog:' - version: 6.0.0(postcss-load-config@3.1.4(postcss@8.5.6)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)))(postcss@8.5.6)(svelte@5.48.4)(typescript@5.8.3) + version: 6.0.0(postcss-load-config@3.1.4(postcss@8.5.6)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)))(postcss@8.5.6)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.3.3 version: 5.8.3 @@ -1409,22 +1409,22 @@ importers: version: link:../../packages/package '@sveltejs/vite-plugin-svelte': specifier: 'catalog:' - version: 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + version: 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) prettier: specifier: ^3.3.2 version: 3.6.0 prettier-plugin-svelte: specifier: ^3.2.6 - version: 3.4.0(prettier@3.6.0)(svelte@5.48.4) + version: 3.4.0(prettier@3.6.0)(svelte@5.51.2) publint: specifier: 'catalog:' version: 0.3.0 svelte: specifier: 'catalog:' - version: 5.48.4 + version: 5.51.2 svelte-check: specifier: 'catalog:' - version: 4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3) + version: 4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3) typescript: specifier: ^5.5.0 version: 5.8.3 @@ -3262,6 +3262,9 @@ packages: '@types/triple-beam@1.3.5': resolution: {integrity: sha512-6WaYesThRMCl19iryMYP7/x2OVgCtbIVflDGFpWnb9irXI3UjYE4AzmYuiUKY1AJstGijoY+MgUszMgRxIYTYw==} + '@types/trusted-types@2.0.7': + resolution: {integrity: sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==} + '@types/yauzl@2.10.3': resolution: {integrity: sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q==} @@ -4106,8 +4109,8 @@ packages: resolution: {integrity: sha512-YQLXUplAwJgCydQ78IMJywZCceoqk1oH01OERdSAJc/7U2AylwjhSCLDEtqwg811idIS/9fIU5GjG73IgjKMVg==} engines: {node: '>=0.10'} - esrap@2.2.1: - resolution: {integrity: sha512-GiYWG34AN/4CUyaWAgunGt0Rxvr1PTMlGC0vvEov/uOQYWne2bpN03Um+k8jT+q3op33mKouP2zeJ6OlM+qeUg==} + esrap@2.2.3: + resolution: {integrity: sha512-8fOS+GIGCQZl/ZIlhl59htOlms6U8NvX6ZYgYHpRU/b6tVSh3uHkOHZikl3D4cMbYM0JlpBe+p/BkZEi8J9XIQ==} esrecurse@4.3.0: resolution: {integrity: sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==} @@ -5621,8 +5624,8 @@ packages: svelte: ^3.55 || ^4.0.0-next.0 || ^4.0 || ^5.0.0-next.0 typescript: ^4.9.4 || ^5.0.0 - svelte@5.48.4: - resolution: {integrity: sha512-JV3E7ckuQwxGVm9GbECVtgrs57E9uDz95H2mYpo38QIJd+ET2aR8zDK/iWI8J7VJtib4bwnJ3MMc6FKBJ0hGrQ==} + svelte@5.51.2: + resolution: {integrity: sha512-AqApqNOxVS97V4Ko9UHTHeSuDJrwauJhZpLDs1gYD8Jk48ntCSWD7NxKje+fnGn5Ja1O3u2FzQZHPdifQjXe3w==} engines: {node: '>=18'} svgo@4.0.0: @@ -7781,31 +7784,31 @@ snapshots: dependencies: acorn: 8.15.0 - '@sveltejs/eslint-config@8.2.0(@stylistic/eslint-plugin-js@2.1.0(eslint@9.34.0(jiti@2.4.2)))(eslint-config-prettier@9.1.0(eslint@9.34.0(jiti@2.4.2)))(eslint-plugin-n@17.16.1(eslint@9.34.0(jiti@2.4.2))(typescript@5.8.3))(eslint-plugin-svelte@3.9.3(eslint@9.34.0(jiti@2.4.2))(svelte@5.48.4)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)))(eslint@9.34.0(jiti@2.4.2))(typescript-eslint@8.43.0(eslint@9.34.0(jiti@2.4.2))(typescript@5.8.3))(typescript@5.8.3)': + '@sveltejs/eslint-config@8.2.0(@stylistic/eslint-plugin-js@2.1.0(eslint@9.34.0(jiti@2.4.2)))(eslint-config-prettier@9.1.0(eslint@9.34.0(jiti@2.4.2)))(eslint-plugin-n@17.16.1(eslint@9.34.0(jiti@2.4.2))(typescript@5.8.3))(eslint-plugin-svelte@3.9.3(eslint@9.34.0(jiti@2.4.2))(svelte@5.51.2)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)))(eslint@9.34.0(jiti@2.4.2))(typescript-eslint@8.43.0(eslint@9.34.0(jiti@2.4.2))(typescript@5.8.3))(typescript@5.8.3)': dependencies: '@stylistic/eslint-plugin-js': 2.1.0(eslint@9.34.0(jiti@2.4.2)) eslint: 9.34.0(jiti@2.4.2) eslint-config-prettier: 9.1.0(eslint@9.34.0(jiti@2.4.2)) eslint-plugin-n: 17.16.1(eslint@9.34.0(jiti@2.4.2))(typescript@5.8.3) - eslint-plugin-svelte: 3.9.3(eslint@9.34.0(jiti@2.4.2))(svelte@5.48.4)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)) + eslint-plugin-svelte: 3.9.3(eslint@9.34.0(jiti@2.4.2))(svelte@5.51.2)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)) globals: 15.15.0 typescript: 5.8.3 typescript-eslint: 8.43.0(eslint@9.34.0(jiti@2.4.2))(typescript@5.8.3) - '@sveltejs/vite-plugin-svelte-inspector@5.0.2(@sveltejs/vite-plugin-svelte@6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)))(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0))': + '@sveltejs/vite-plugin-svelte-inspector@5.0.2(@sveltejs/vite-plugin-svelte@6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)))(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0))': dependencies: - '@sveltejs/vite-plugin-svelte': 6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + '@sveltejs/vite-plugin-svelte': 6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) obug: 2.1.1 - svelte: 5.48.4 + svelte: 5.51.2 vite: 6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0) - '@sveltejs/vite-plugin-svelte@6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0))': + '@sveltejs/vite-plugin-svelte@6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0))': dependencies: - '@sveltejs/vite-plugin-svelte-inspector': 5.0.2(@sveltejs/vite-plugin-svelte@6.2.4(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)))(svelte@5.48.4)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) + '@sveltejs/vite-plugin-svelte-inspector': 5.0.2(@sveltejs/vite-plugin-svelte@6.2.4(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)))(svelte@5.51.2)(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) deepmerge: 4.3.1 magic-string: 0.30.21 obug: 2.1.1 - svelte: 5.48.4 + svelte: 5.51.2 vite: 6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0) vitefu: 1.1.1(vite@6.4.1(@types/node@18.19.119)(jiti@2.4.2)(lightningcss@1.30.1)(yaml@2.8.0)) @@ -7869,6 +7872,8 @@ snapshots: '@types/triple-beam@1.3.5': {} + '@types/trusted-types@2.0.7': {} + '@types/yauzl@2.10.3': dependencies: '@types/node': 18.19.119 @@ -8832,7 +8837,7 @@ snapshots: - supports-color - typescript - eslint-plugin-svelte@3.9.3(eslint@9.34.0(jiti@2.4.2))(svelte@5.48.4)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)): + eslint-plugin-svelte@3.9.3(eslint@9.34.0(jiti@2.4.2))(svelte@5.51.2)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)): dependencies: '@eslint-community/eslint-utils': 4.9.1(eslint@9.34.0(jiti@2.4.2)) '@jridgewell/sourcemap-codec': 1.5.5 @@ -8844,9 +8849,9 @@ snapshots: postcss-load-config: 3.1.4(postcss@8.5.6)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)) postcss-safe-parser: 7.0.1(postcss@8.5.6) semver: 7.7.3 - svelte-eslint-parser: 1.4.1(svelte@5.48.4) + svelte-eslint-parser: 1.4.1(svelte@5.51.2) optionalDependencies: - svelte: 5.48.4 + svelte: 5.51.2 transitivePeerDependencies: - ts-node @@ -8915,7 +8920,7 @@ snapshots: dependencies: estraverse: 5.3.0 - esrap@2.2.1: + esrap@2.2.3: dependencies: '@jridgewell/sourcemap-codec': 1.5.5 @@ -9964,10 +9969,10 @@ snapshots: prelude-ls@1.2.1: {} - prettier-plugin-svelte@3.4.0(prettier@3.6.0)(svelte@5.48.4): + prettier-plugin-svelte@3.4.0(prettier@3.6.0)(svelte@5.51.2): dependencies: prettier: 3.6.0 - svelte: 5.48.4 + svelte: 5.51.2 prettier@2.8.8: {} @@ -10375,19 +10380,19 @@ snapshots: supports-preserve-symlinks-flag@1.0.0: {} - svelte-check@4.3.4(picomatch@4.0.3)(svelte@5.48.4)(typescript@5.8.3): + svelte-check@4.3.4(picomatch@4.0.3)(svelte@5.51.2)(typescript@5.8.3): dependencies: '@jridgewell/trace-mapping': 0.3.25 chokidar: 4.0.3 fdir: 6.5.0(picomatch@4.0.3) picocolors: 1.1.1 sade: 1.8.1 - svelte: 5.48.4 + svelte: 5.51.2 typescript: 5.8.3 transitivePeerDependencies: - picomatch - svelte-eslint-parser@1.4.1(svelte@5.48.4): + svelte-eslint-parser@1.4.1(svelte@5.51.2): dependencies: eslint-scope: 8.4.0 eslint-visitor-keys: 4.2.1 @@ -10396,42 +10401,43 @@ snapshots: postcss-scss: 4.0.9(postcss@8.5.6) postcss-selector-parser: 7.1.1 optionalDependencies: - svelte: 5.48.4 + svelte: 5.51.2 - svelte-parse-markup@0.1.5(svelte@5.48.4): + svelte-parse-markup@0.1.5(svelte@5.51.2): dependencies: - svelte: 5.48.4 + svelte: 5.51.2 - svelte-preprocess@6.0.0(postcss-load-config@3.1.4(postcss@8.5.6)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)))(postcss@8.5.6)(svelte@5.48.4)(typescript@5.8.3): + svelte-preprocess@6.0.0(postcss-load-config@3.1.4(postcss@8.5.6)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)))(postcss@8.5.6)(svelte@5.51.2)(typescript@5.8.3): dependencies: detect-indent: 6.1.0 strip-indent: 3.0.0 - svelte: 5.48.4 + svelte: 5.51.2 optionalDependencies: postcss: 8.5.6 postcss-load-config: 3.1.4(postcss@8.5.6)(ts-node@10.9.2(@types/node@18.19.119)(typescript@5.8.3)) typescript: 5.8.3 - svelte2tsx@0.7.33(svelte@5.48.4)(typescript@5.8.3): + svelte2tsx@0.7.33(svelte@5.51.2)(typescript@5.8.3): dependencies: dedent-js: 1.0.1 pascal-case: 3.1.2 - svelte: 5.48.4 + svelte: 5.51.2 typescript: 5.8.3 - svelte@5.48.4: + svelte@5.51.2: dependencies: '@jridgewell/remapping': 2.3.5 '@jridgewell/sourcemap-codec': 1.5.5 '@sveltejs/acorn-typescript': 1.0.5(acorn@8.15.0) '@types/estree': 1.0.8 + '@types/trusted-types': 2.0.7 acorn: 8.15.0 aria-query: 5.3.2 axobject-query: 4.1.0 clsx: 2.1.1 devalue: 5.6.2 esm-env: 1.2.2 - esrap: 2.2.1 + esrap: 2.2.3 is-reference: 3.0.3 locate-character: 3.0.0 magic-string: 0.30.21 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 13157ffbcf9c..72140b55ed79 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -43,7 +43,7 @@ catalog: publint: ^0.3.0 semver: ^7.5.4 sirv-cli: ^3.0.0 - svelte: ^5.48.4 + svelte: ^5.51.2 svelte-check: ^4.3.4 svelte-preprocess: ^6.0.0 typescript-eslint: ^8.43.0 From 5eeaa0fa9a29960fad2e58d2689c2ef7715c981f Mon Sep 17 00:00:00 2001 From: Tee Ming Date: Mon, 16 Feb 2026 01:02:54 +0800 Subject: [PATCH 04/13] fix test --- .../test/apps/options/source/pages/+layout.svelte | 13 ------------- .../source/pages/csp-trusted-types/+page.svelte | 5 +---- .../options/source/pages/csp-trusted-types/+page.ts | 2 -- 3 files changed, 1 insertion(+), 19 deletions(-) delete mode 100644 packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.ts diff --git a/packages/kit/test/apps/options/source/pages/+layout.svelte b/packages/kit/test/apps/options/source/pages/+layout.svelte index 65d3d04b2070..5e1f1fed86c2 100644 --- a/packages/kit/test/apps/options/source/pages/+layout.svelte +++ b/packages/kit/test/apps/options/source/pages/+layout.svelte @@ -1,20 +1,7 @@ diff --git a/packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.svelte b/packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.svelte index c8d09b12a589..f0168f02432d 100644 --- a/packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.svelte +++ b/packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.svelte @@ -1,4 +1 @@ -

- this page uses csr only and will error when Svelte tries to set the innerHTML without a trusted - type -

+

this page will error when Svelte tries to set the innerHTML without a trusted type

diff --git a/packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.ts b/packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.ts deleted file mode 100644 index 3117b65ade5b..000000000000 --- a/packages/kit/test/apps/options/source/pages/csp-trusted-types/+page.ts +++ /dev/null @@ -1,2 +0,0 @@ -// we want only CSR to test Svelte setting innerHTML succesfully -export const ssr = false; From d0cd625c0c7f821b3126ca4a36e5a704fbafe14f Mon Sep 17 00:00:00 2001 From: Tee Ming Date: Mon, 16 Feb 2026 01:27:40 +0800 Subject: [PATCH 05/13] add missing await --- packages/kit/test/apps/options/test/test.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/kit/test/apps/options/test/test.js b/packages/kit/test/apps/options/test/test.js index f12c9a1dc333..ceefb0383b18 100644 --- a/packages/kit/test/apps/options/test/test.js +++ b/packages/kit/test/apps/options/test/test.js @@ -61,7 +61,7 @@ test.describe('CSP', () => { expect(hydratable_script_match?.[1]).toBe(nonce); }); - test('require-trusted-types-for', ({ page, javaScriptEnabled }) => { + test('require-trusted-types-for', async ({ page, javaScriptEnabled }) => { test.skip(!javaScriptEnabled, 'trusted types only affects scripts'); const errors = []; @@ -69,7 +69,7 @@ test.describe('CSP', () => { errors.push(err.message); }); - page.goto('/path-base/csp-trusted-types'); + await page.goto('/path-base/csp-trusted-types'); expect(errors.length).toEqual(0); }); }); From 3a70d22c5477779e13b775d843184818d5f84d3a Mon Sep 17 00:00:00 2001 From: Tee Ming Date: Mon, 16 Feb 2026 01:28:49 +0800 Subject: [PATCH 06/13] add validation error for trusted-types --- packages/kit/src/core/config/options.js | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/packages/kit/src/core/config/options.js b/packages/kit/src/core/config/options.js index b4a7217b38ab..a86e7ee381e8 100644 --- a/packages/kit/src/core/config/options.js +++ b/packages/kit/src/core/config/options.js @@ -30,17 +30,19 @@ const directives = object({ 'report-uri': string_array(), 'report-to': string_array(), 'require-trusted-types-for': validate(undefined, (input, keypath) => { - if (!supportsTrustedTypes()) { - throw new Error( - `${keypath} is not supported by your version of Svelte. Please upgrade to Svelte 5.51.0 or later to use this directive.` - ); - } - + assert_trusted_types_supported(keypath); + return string_array()(input, keypath); + }), + 'trusted-types': validate(undefined, (input, keypath) => { + assert_trusted_types_supported(keypath); input = string_array()(input, keypath); + if (!input.includes('svelte-trusted-html')) { + throw new Error(`${keypath} must include "svelte-trusted-html" for Svelte to work correctly`); + } + return input; }), - 'trusted-types': string_array(), 'upgrade-insecure-requests': boolean(false), 'require-sri-for': string_array(), 'block-all-mixed-content': boolean(false), @@ -496,4 +498,13 @@ function assert_string(input, keypath) { } } +/** @param {string} keypath */ +function assert_trusted_types_supported(keypath) { + if (!supportsTrustedTypes()) { + throw new Error( + `${keypath} is not supported by your version of Svelte. Please upgrade to Svelte 5.51.0 or later to use this directive.` + ); + } +} + export default options; From da2d347a6a858553c74fd5af06a6e67d68dfeb03 Mon Sep 17 00:00:00 2001 From: Tee Ming Date: Tue, 17 Feb 2026 02:24:30 +0800 Subject: [PATCH 07/13] fix service worker --- packages/kit/src/core/config/index.js | 17 +++++ packages/kit/src/core/config/options.js | 8 +-- .../kit/src/runtime/server/page/render.js | 8 ++- packages/kit/test/apps/options-2/package.json | 2 +- .../src/routes/csp-trusted-types/+page.svelte | 1 + .../kit/test/apps/options-2/svelte.config.js | 10 ++- .../options-2/test/service-worker.test.js | 54 +++++++++++++++ packages/kit/test/apps/options-2/test/test.js | 67 ++++--------------- .../kit/test/apps/options/svelte.config.js | 3 +- 9 files changed, 106 insertions(+), 64 deletions(-) create mode 100644 packages/kit/test/apps/options-2/src/routes/csp-trusted-types/+page.svelte create mode 100644 packages/kit/test/apps/options-2/test/service-worker.test.js diff --git a/packages/kit/src/core/config/index.js b/packages/kit/src/core/config/index.js index ae35a708132b..cef132be7193 100644 --- a/packages/kit/src/core/config/index.js +++ b/packages/kit/src/core/config/index.js @@ -125,6 +125,7 @@ export function validate_config(config) { ); } + /** @type {import('types').ValidatedConfig} */ const validated = options(config, 'config'); const files = validated.kit.files; @@ -151,5 +152,21 @@ export function validate_config(config) { } } + if (validated.kit.csp?.directives?.['require-trusted-types-for'].includes('script')) { + if (!validated.kit.csp?.directives?.['trusted-types']?.includes('svelte-trusted-html')) { + throw new Error( + "The `csp.directives['trusted-types']` option must include 'svelte-trusted-html'" + ); + } + if ( + validated.kit.serviceWorker?.register && + !validated.kit.csp?.directives?.['trusted-types']?.includes('sveltekit-trusted-url') + ) { + throw new Error( + "The `csp.directives['trusted-types']` option must include 'sveltekit-trusted-url' when `serviceWorker.register` is true" + ); + } + } + return validated; } diff --git a/packages/kit/src/core/config/options.js b/packages/kit/src/core/config/options.js index a86e7ee381e8..53a0dc0166b7 100644 --- a/packages/kit/src/core/config/options.js +++ b/packages/kit/src/core/config/options.js @@ -35,13 +35,7 @@ const directives = object({ }), 'trusted-types': validate(undefined, (input, keypath) => { assert_trusted_types_supported(keypath); - input = string_array()(input, keypath); - - if (!input.includes('svelte-trusted-html')) { - throw new Error(`${keypath} must include "svelte-trusted-html" for Svelte to work correctly`); - } - - return input; + return string_array()(input, keypath); }), 'upgrade-insecure-requests': boolean(false), 'require-sri-for': string_array(), diff --git a/packages/kit/src/runtime/server/page/render.js b/packages/kit/src/runtime/server/page/render.js index 4a6b80be0373..8ad2b2a51e55 100644 --- a/packages/kit/src/runtime/server/page/render.js +++ b/packages/kit/src/runtime/server/page/render.js @@ -549,8 +549,14 @@ export async function render_response({ // we use an anonymous function instead of an arrow function to support // older browsers (https://github.com/sveltejs/kit/pull/5417) blocks.push(`if ('serviceWorker' in navigator) { + const script_url = '${prefixed('service-worker.js')}'; + const policy = globalThis?.window?.trustedTypes?.createPolicy( + 'sveltekit-trusted-url', + { createScriptURL(url) { return url; } } + ); + const sanitised = policy?.createScriptURL(script_url) ?? script_url; addEventListener('load', function () { - navigator.serviceWorker.register('${prefixed('service-worker.js')}'${opts}); + navigator.serviceWorker.register(sanitised${opts}); }); }`); } diff --git a/packages/kit/test/apps/options-2/package.json b/packages/kit/test/apps/options-2/package.json index bb41653fb9f9..a660525133b6 100644 --- a/packages/kit/test/apps/options-2/package.json +++ b/packages/kit/test/apps/options-2/package.json @@ -10,7 +10,7 @@ "check": "svelte-kit sync && tsc && svelte-check", "test": "pnpm test:dev && pnpm test:build", "test:dev": "DEV=true playwright test", - "test:build": "playwright test" + "test:build": "playwright test && REGISTER_SERVICE_WORKER=true playwright test" }, "devDependencies": { "@sveltejs/adapter-node": "workspace:^", diff --git a/packages/kit/test/apps/options-2/src/routes/csp-trusted-types/+page.svelte b/packages/kit/test/apps/options-2/src/routes/csp-trusted-types/+page.svelte new file mode 100644 index 000000000000..4dcd9dd822b7 --- /dev/null +++ b/packages/kit/test/apps/options-2/src/routes/csp-trusted-types/+page.svelte @@ -0,0 +1 @@ +

this page will error when SvelteKit tries to register the service worker

diff --git a/packages/kit/test/apps/options-2/svelte.config.js b/packages/kit/test/apps/options-2/svelte.config.js index 1fee777858a0..04867a5b220b 100644 --- a/packages/kit/test/apps/options-2/svelte.config.js +++ b/packages/kit/test/apps/options-2/svelte.config.js @@ -1,12 +1,20 @@ +import process from 'node:process'; + /** @type {import('@sveltejs/kit').Config} */ const config = { kit: { + csp: { + directives: { + 'require-trusted-types-for': ['script'], + 'trusted-types': ['svelte-trusted-html', 'sveltekit-trusted-url'] + } + }, paths: { base: '/basepath', relative: true }, serviceWorker: { - register: false + register: !!process.env.REGISTER_SERVICE_WORKER }, env: { dir: '../../env' diff --git a/packages/kit/test/apps/options-2/test/service-worker.test.js b/packages/kit/test/apps/options-2/test/service-worker.test.js new file mode 100644 index 000000000000..2447abfa3e1c --- /dev/null +++ b/packages/kit/test/apps/options-2/test/service-worker.test.js @@ -0,0 +1,54 @@ +import path from 'node:path'; +import process from 'node:process'; +import { fileURLToPath } from 'node:url'; +import { expect } from '@playwright/test'; +import { test } from '../../../utils.js'; + +test.skip(({ javaScriptEnabled }) => !javaScriptEnabled || !process.env.REGISTER_SERVICE_WORKER); + +test('import proxy /basepath/service-worker.js', async ({ request }) => { + test.skip(!process.env.DEV); + + const __dirname = path.dirname(fileURLToPath(import.meta.url)); + const response = await request.get('/basepath/service-worker.js'); + const content = await response.text(); + expect(content).toEqual( + `import '${path.join('/basepath', '/@fs', __dirname, '../src/service-worker.js')}';` + ); +}); + +test('build /basepath/service-worker.js', async ({ baseURL, request }) => { + test.skip(!!process.env.DEV); + + const response = await request.get('/basepath/service-worker.js'); + const content = await response.text(); + + const fn = new Function('self', 'location', content); + + const self = { + addEventListener: () => {}, + base: null, + build: null + }; + + const pathname = '/basepath/service-worker.js'; + + fn(self, { + href: baseURL + pathname, + pathname + }); + + expect(self.base).toBe('/basepath'); + expect(self.build?.[0]).toMatch(/\/basepath\/_app\/immutable\/bundle\.[\w-]+\.js/); + expect(self.image_src).toMatch(/\/basepath\/_app\/immutable\/assets\/image\.[\w-]+\.jpg/); +}); + +test('works with CSP require-trusted-types-for', async ({ page }) => { + const errors = []; + page.on('pageerror', (err) => { + errors.push(err.message); + }); + + await page.goto('/basepath/csp-trusted-types'); + expect(errors.length).toEqual(0); +}); diff --git a/packages/kit/test/apps/options-2/test/test.js b/packages/kit/test/apps/options-2/test/test.js index f3df40146a8d..888645765dd0 100644 --- a/packages/kit/test/apps/options-2/test/test.js +++ b/packages/kit/test/apps/options-2/test/test.js @@ -1,10 +1,8 @@ -import path from 'node:path'; import process from 'node:process'; -import { fileURLToPath } from 'node:url'; import { expect } from '@playwright/test'; import { test } from '../../../utils.js'; -/** @typedef {import('@playwright/test').Response} Response */ +test.skip(() => !!process.env.REGISTER_SERVICE_WORKER); test.describe.configure({ mode: 'parallel' }); @@ -107,59 +105,22 @@ test.describe('paths', () => { }); test.describe('trailing slash', () => { - if (!process.env.DEV) { - test('trailing slash server prerendered without server load', async ({ - page, - clicknav, - javaScriptEnabled - }) => { - if (!javaScriptEnabled) return; - - await page.goto('/basepath/trailing-slash-server'); - - await clicknav('a[href="/basepath/trailing-slash-server/prerender"]'); - expect(await page.textContent('h2')).toBe('/basepath/trailing-slash-server/prerender/'); - }); - } + test('trailing slash server prerendered without server load', async ({ + page, + clicknav, + javaScriptEnabled + }) => { + test.skip(!javaScriptEnabled || !process.env.DEV); + + await page.goto('/basepath/trailing-slash-server'); + + await clicknav('a[href="/basepath/trailing-slash-server/prerender"]'); + expect(await page.textContent('h2')).toBe('/basepath/trailing-slash-server/prerender/'); + }); }); test.describe('Service worker', () => { - if (process.env.DEV) { - test('import proxy /basepath/service-worker.js', async ({ request }) => { - const __dirname = path.dirname(fileURLToPath(import.meta.url)); - const response = await request.get('/basepath/service-worker.js'); - const content = await response.text(); - expect(content).toEqual( - `import '${path.join('/basepath', '/@fs', __dirname, '../src/service-worker.js')}';` - ); - }); - - return; - } - - test('build /basepath/service-worker.js', async ({ baseURL, request }) => { - const response = await request.get('/basepath/service-worker.js'); - const content = await response.text(); - - const fn = new Function('self', 'location', content); - - const self = { - addEventListener: () => {}, - base: null, - build: null - }; - - const pathname = '/basepath/service-worker.js'; - - fn(self, { - href: baseURL + pathname, - pathname - }); - - expect(self.base).toBe('/basepath'); - expect(self.build?.[0]).toMatch(/\/basepath\/_app\/immutable\/bundle\.[\w-]+\.js/); - expect(self.image_src).toMatch(/\/basepath\/_app\/immutable\/assets\/image\.[\w-]+\.jpg/); - }); + test.skip(({ javaScriptEnabled }) => !javaScriptEnabled); test('does not register /basepath/service-worker.js', async ({ page }) => { await page.goto('/basepath'); diff --git a/packages/kit/test/apps/options/svelte.config.js b/packages/kit/test/apps/options/svelte.config.js index 4852cc71596d..da8cebe35818 100644 --- a/packages/kit/test/apps/options/svelte.config.js +++ b/packages/kit/test/apps/options/svelte.config.js @@ -8,7 +8,8 @@ const config = { csp: { directives: { 'script-src': ['self'], - 'require-trusted-types-for': ['script'] + 'require-trusted-types-for': ['script'], + 'trusted-types': ['svelte-trusted-html'] } }, files: { From b1658e749afcfc910b0fd76646f8bf1c421ea1be Mon Sep 17 00:00:00 2001 From: Tee Ming Date: Tue, 17 Feb 2026 02:27:38 +0800 Subject: [PATCH 08/13] fix config accessing undefined --- packages/kit/src/core/config/index.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/kit/src/core/config/index.js b/packages/kit/src/core/config/index.js index cef132be7193..8941b84da6f8 100644 --- a/packages/kit/src/core/config/index.js +++ b/packages/kit/src/core/config/index.js @@ -152,7 +152,7 @@ export function validate_config(config) { } } - if (validated.kit.csp?.directives?.['require-trusted-types-for'].includes('script')) { + if (validated.kit.csp?.directives?.['require-trusted-types-for']?.includes('script')) { if (!validated.kit.csp?.directives?.['trusted-types']?.includes('svelte-trusted-html')) { throw new Error( "The `csp.directives['trusted-types']` option must include 'svelte-trusted-html'" From 2c95ad743f4998155edb8476f613365e72e681b2 Mon Sep 17 00:00:00 2001 From: Tee Ming Date: Tue, 17 Feb 2026 02:34:27 +0800 Subject: [PATCH 09/13] check if service worker exists before validating trusted types --- packages/kit/src/core/config/index.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/packages/kit/src/core/config/index.js b/packages/kit/src/core/config/index.js index 8941b84da6f8..efc51abca72e 100644 --- a/packages/kit/src/core/config/index.js +++ b/packages/kit/src/core/config/index.js @@ -96,7 +96,7 @@ export async function load_config({ cwd = process.cwd() } = {}) { * @returns {import('types').ValidatedConfig} */ function process_config(config, { cwd = process.cwd() } = {}) { - const validated = validate_config(config); + const validated = validate_config(config, cwd); validated.kit.outDir = path.resolve(cwd, validated.kit.outDir); @@ -116,9 +116,10 @@ function process_config(config, { cwd = process.cwd() } = {}) { /** * @param {import('@sveltejs/kit').Config} config + * @param {string} cwd * @returns {import('types').ValidatedConfig} */ -export function validate_config(config) { +export function validate_config(config, cwd) { if (typeof config !== 'object') { throw new Error( 'The Svelte config file must have a configuration object as its default export. See https://svelte.dev/docs/kit/configuration' @@ -160,6 +161,7 @@ export function validate_config(config) { } if ( validated.kit.serviceWorker?.register && + fs.existsSync(path.resolve(cwd, validated.kit.files.serviceWorker)) && !validated.kit.csp?.directives?.['trusted-types']?.includes('sveltekit-trusted-url') ) { throw new Error( From e05d7cd72a8048c3309fd9e444ac33f6e67471ec Mon Sep 17 00:00:00 2001 From: Tee Ming Date: Tue, 17 Feb 2026 02:40:37 +0800 Subject: [PATCH 10/13] changeset --- .changeset/silent-sites-end.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/silent-sites-end.md diff --git a/.changeset/silent-sites-end.md b/.changeset/silent-sites-end.md new file mode 100644 index 000000000000..af6f74dd5ab8 --- /dev/null +++ b/.changeset/silent-sites-end.md @@ -0,0 +1,5 @@ +--- +'@sveltejs/kit': patch +--- + +fix: `config.kit.csp.directives['trusted-types']` requires `'svelte-trusted-html'` (and `'sveltekit-trusted-url'` when a service worker is automatically registered) if it is configured From ed8fa24807effa08d66819dddbd68668fa3873aa Mon Sep 17 00:00:00 2001 From: Vercel Date: Mon, 16 Feb 2026 18:42:31 +0000 Subject: [PATCH 11/13] Fix: Service worker file existence check uses `fs.existsSync` without handling file extensions, causing it to always fail when the default config path `src/service-worker` is used with actual files like `src/service-worker.js` or `src/service-worker.ts`. Co-authored-by: teemingc --- packages/kit/src/core/config/index.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/kit/src/core/config/index.js b/packages/kit/src/core/config/index.js index efc51abca72e..5be7d72f43d3 100644 --- a/packages/kit/src/core/config/index.js +++ b/packages/kit/src/core/config/index.js @@ -3,6 +3,7 @@ import path from 'node:path'; import process from 'node:process'; import * as url from 'node:url'; import options from './options.js'; +import { resolve_entry } from '../../utils/filesystem.js'; /** * Loads the template (src/app.html by default) and validates that it has the @@ -161,7 +162,7 @@ export function validate_config(config, cwd) { } if ( validated.kit.serviceWorker?.register && - fs.existsSync(path.resolve(cwd, validated.kit.files.serviceWorker)) && + resolve_entry(path.resolve(cwd, validated.kit.files.serviceWorker)) && !validated.kit.csp?.directives?.['trusted-types']?.includes('sveltekit-trusted-url') ) { throw new Error( From e5ccfd7f79c0948431139b5b22bbcc8dd81d8314 Mon Sep 17 00:00:00 2001 From: Tee Ming Date: Tue, 17 Feb 2026 03:09:55 +0800 Subject: [PATCH 12/13] fix test type errors --- packages/kit/src/core/config/index.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/kit/src/core/config/index.js b/packages/kit/src/core/config/index.js index 5be7d72f43d3..42146a89d4c3 100644 --- a/packages/kit/src/core/config/index.js +++ b/packages/kit/src/core/config/index.js @@ -117,10 +117,10 @@ function process_config(config, { cwd = process.cwd() } = {}) { /** * @param {import('@sveltejs/kit').Config} config - * @param {string} cwd + * @param {string} [cwd] * @returns {import('types').ValidatedConfig} */ -export function validate_config(config, cwd) { +export function validate_config(config, cwd = process.cwd()) { if (typeof config !== 'object') { throw new Error( 'The Svelte config file must have a configuration object as its default export. See https://svelte.dev/docs/kit/configuration' From cec100d98bc3bbd01cccbe416e82566e51c0ea47 Mon Sep 17 00:00:00 2001 From: Tee Ming Date: Tue, 17 Feb 2026 04:21:24 +0800 Subject: [PATCH 13/13] fix unit test --- packages/kit/test/prerendering/basics/test/tests.spec.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/kit/test/prerendering/basics/test/tests.spec.js b/packages/kit/test/prerendering/basics/test/tests.spec.js index e3972a1d369d..adc1d198154f 100644 --- a/packages/kit/test/prerendering/basics/test/tests.spec.js +++ b/packages/kit/test/prerendering/basics/test/tests.spec.js @@ -245,7 +245,7 @@ test('prerenders a page in a (group)', () => { test('injects relative service worker', () => { const content = read('index.html'); - expect(content).toMatch("navigator.serviceWorker.register('./service-worker.js'"); + expect(content).toMatch("const script_url = './service-worker.js';"); }); test('define service worker variables', () => {