Tessera
Folgen

Svelte

@svelte.dev

Web development for the rest of us. See also: - community: @sveltesociety.dev - starter pack: https://bsky.app/starter-pack/did:plc:nlvjelw3dy3pddq7qoglleko/3l6ucetngs423 - feed: https://bsky.app/profile/paolo.ricciuti.me/feed/svelte-feed

78 Posts7818 Follower1 Folgt
rich harris@rich-harris.dev · 2mo ago

SvelteKit arguably has a more sophisticated and flexible system for handling env vars than any other framework. We think we can do better though. Here's what we're working on: github.com/sveltejs/kit... Give it a read and let us know if you have feedback

feat: explicit environment variables by Rich-Harris · Pull Request #15934 · sveltejs/kit

Today, environment variables are implicitly available: anything in process.env can be imported directly (as long as the name is a valid identifier) from $env/static/private, or accessed via env imp...

github.com

Svelte@svelte.dev · 3mo ago

We've just published patch releases of devalue, Svelte, and SvelteKit that fix a number of vulnerabilities. No need to panic — they're all hard to exploit or reliant on experimental features — but we recommend updating as soon as you get a chance. More details in the advisories:

Elliott Johnson@ell.iott.dev · 6mo ago

We just released a number of security patches across the Svelte ecosystem. If you use SvelteKit, the Vercel adapter for SvelteKit, Svelte, or devalue, you should upgrade. The Vercel OSS Bug Bounty paid out over $14,000 for these reports!

Svelte@svelte.dev · 11mo ago

You've probably heard about the supply chain attack that affected a number of widely-used npm packages today. tl;dr: Don't panic. Notes: 1. Svelte, SvelteKit and their associated packages are not vulnerable to this attack, as they do not use any of the compromised dependencies in the browser

Elliott Johnson@ell.iott.dev · 12mo ago

OpenTelemetry tracing is live in SvelteKit! Huge s/o to @stracke.tech for all the help along the way. SvelteKit can now emit OTEL spans for all of its serverside constructs. It also provides an instrumentation file to easily set up trace exports. svelte.dev/blog/sveltek...

Introducing integrated observability in SvelteKit

SvelteKit apps can now emit OpenTelemetry traces and reliably set up observability instrumentation using instrumentation.server.ts

svelte.dev

Svelte@svelte.dev · last yr.

We just published an advisory for CVE-2025-32388, a moderate severity XSS vulnerability in SvelteKit. Please update to `@sveltejs/kit@2.20.6`. The vulnerability affects applications that iterate over all search parameters inside a server `load` function. More details in the advisory 👇

XSS via tracked search_params

### Summary Unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of `event.url.searchParams` inside a server `load` function. Attackers can ex...

github.com

rich harris@rich-harris.dev · last yr.

PSA for @svelte.dev users: we're planning to change how effect teardowns work to eliminate a common gotcha that affects signal-based frameworks. If the new behaviour would create problems for you, please let us know! github.com/sveltejs/sve...

fix: on teardown, use the last known value for the signal before the set by trueadm · Pull Request #15469 · sveltejs/svelte

PSA: we are changing how effect teardowns work! Today, if you read some state inside a teardown function, you get the latest state: $effect(() => { const prev = value; return () => { ...

github.com

Svelte Society@sveltesociety.dev · last yr.

Now that speakers have been selected we want to share with you our line-up for Svelte Summit Spring 2025! We will host 16 talks across different topics during the two day conference. In addition, @mainmatter.com will also host a workshop. More details on www.sveltesummit.com

Svelte Summit Spring 2025: Barcelona & online

The next in-person Svelte Summit will happen on May 8 and 9 in Barcelona, Spain! Get your tickets and submit your proposals now!

sveltesummit.com

Svelte Society@sveltesociety.dev · 2y ago

We are very excited to announce that the next Svelte Summit will finally be in-person again and happen on May 8 and 9, 2025 in Barcelona Spain! Tickets are now available and the Call for Proposals is open. Use code 'sveltmas2024' for a 20% discount until December 31. www.sveltesummit.com

Svelte Society@sveltesociety.dev · 2y ago

We've just sent out emails to everyone who submitted a proposal! Please read it carefully. See you at Svelte Summit Spring 2025!

Svelte Society@sveltesociety.dev · 2y ago

We are very excited to announce that the next Svelte Summit will finally be in-person again and happen on May 8 and 9, 2025 in Barcelona Spain! Tickets are now available and the Call for Proposals is open. Use code 'sveltmas2024' for a 20% discount until December 31. www.sveltesummit.com