Tessera
Folgen

Svelte

@svelte.dev

Web development for the rest of us. See also: - community: @sveltesociety.dev - starter pack: https://bsky.app/starter-pack/did:plc:nlvjelw3dy3pddq7qoglleko/3l6ucetngs423 - feed: https://bsky.app/profile/paolo.ricciuti.me/feed/svelte-feed

81 Posts7894 Follower1 Folgt
rich harris@rich-harris.dev · 4mo ago

SvelteKit arguably has a more sophisticated and flexible system for handling env vars than any other framework. We think we can do better though. Here's what we're working on: github.com/sveltejs/kit... Give it a read and let us know if you have feedback

feat: explicit environment variables by Rich-Harris · Pull Request #15934 · sveltejs/kit

Today, environment variables are implicitly available: anything in process.env can be imported directly (as long as the name is a valid identifier) from $env/static/private, or accessed via env imp...

github.com

Svelte@svelte.dev · 4mo ago

We've just published patch releases of devalue, Svelte, and SvelteKit that fix a number of vulnerabilities. No need to panic — they're all hard to exploit or reliant on experimental features — but we recommend updating as soon as you get a chance. More details in the advisories:

Elliott Johnson@ell.iott.dev · 7mo ago

We just released a number of security patches across the Svelte ecosystem. If you use SvelteKit, the Vercel adapter for SvelteKit, Svelte, or devalue, you should upgrade. The Vercel OSS Bug Bounty paid out over $14,000 for these reports!

Svelte@svelte.dev · last yr.

You've probably heard about the supply chain attack that affected a number of widely-used npm packages today. tl;dr: Don't panic. Notes: 1. Svelte, SvelteKit and their associated packages are not vulnerable to this attack, as they do not use any of the compromised dependencies in the browser

Elliott Johnson@ell.iott.dev · last yr.

OpenTelemetry tracing is live in SvelteKit! Huge s/o to @stracke.tech for all the help along the way. SvelteKit can now emit OTEL spans for all of its serverside constructs. It also provides an instrumentation file to easily set up trace exports. svelte.dev/blog/sveltek...

Introducing integrated observability in SvelteKit

SvelteKit apps can now emit OpenTelemetry traces and reliably set up observability instrumentation using instrumentation.server.ts

svelte.dev

Svelte@svelte.dev · last yr.

We just published an advisory for CVE-2025-32388, a moderate severity XSS vulnerability in SvelteKit. Please update to `@sveltejs/kit@2.20.6`. The vulnerability affects applications that iterate over all search parameters inside a server `load` function. More details in the advisory 👇

XSS via tracked search_params

### Summary Unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of `event.url.searchParams` inside a server `load` function. Attackers can ex...

github.com

rich harris@rich-harris.dev · 2y ago

PSA for @svelte.dev users: we're planning to change how effect teardowns work to eliminate a common gotcha that affects signal-based frameworks. If the new behaviour would create problems for you, please let us know! github.com/sveltejs/sve...

fix: on teardown, use the last known value for the signal before the set by trueadm · Pull Request #15469 · sveltejs/svelte

PSA: we are changing how effect teardowns work! Today, if you read some state inside a teardown function, you get the latest state: $effect(() => { const prev = value; return () => { ...

github.com