fix: regression from consolidating dev checks - #15852
Merged
Merged
Conversation
🦋 Changeset detectedLatest commit: b6ab6ae The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
teemingc
changed the title
![vercel[bot]](https://avatars.github.com/in/8329?s=60&v=4){kind=small}
This was referenced May 15, 2026
Merged
Rich-Harris
pushed a commit
that referenced
this pull request
May 22, 2026
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @sveltejs/kit@2.61.0 ### Minor Changes - breaking: the `.run()` method has been removed from remote queries on both the client and the server. Use `await query()` directly instead — it now works everywhere ([#15779](#15779)) - feat: remote queries can now be awaited in any context (event handlers, module scope, async callbacks), not just inside reactive contexts. The cache is shared across reactive and non-reactive subscribers, so awaiting a query in an event handler will dedupe with components that have already subscribed to the same query. ([#15779](#15779)) - feat: live query instances are now themselves async-iterable ([#15878](#15878)) - feat: add programmatic `submit` method to `form` remote function instances ([#15657](#15657)) - feat: pass `form` remote function instance into `enhance` callback ([#15657](#15657)) ### Patch Changes - fix: resolve the app payload without using `process.env.NODE_ENV` ([#15852](#15852)) - fix: support `exactOptionalPropertyTypes` for optional route params ([#15825](#15825)) - fix: correctly send `true` value to the server for 'submit' and 'hidden' form fields ([#15858](#15858)) - fix: avoid build warnings about undefined universal hooks ([#15895](#15895)) - fix: prefer default error page when failing to decode the URL pathname ([#15744](#15744)) - fix: disable link prefetching on slow internet connections ([#15885](#15885)) - fix: allow routes ending with optional parameters next to more specific routes ([#15861](#15861)) - fix: remove reliance on Content-Length header in deserialize_binary_form, which caused failures when proxies (e.g. Vercel, Azure) strip the header and use chunked transfer encoding ([#15796](#15796)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
6 tasks
teemingc
added a commit
that referenced
this pull request
Jul 14, 2026
…DE_ENV (#16313) The NODE_ENV saga continues. Any build where NODE_ENV isn't `production` currently ships with every origin check compiled out: ```js // respond.js if (!DEV) { // cross-site remote request check // cross-site form submission check (csrf.checkOrigin / trustedOrigins) } ``` `DEV` comes from esm-env, which kit bundles into apps resolved by NODE_ENV, so `NODE_ENV=staging vite build` produces a deployable server with CSRF protection silently disabled. Vite's docs list non-production builds as a supported workflow, and khromov raised this exact failure mode in #14335 when the gate was added. At the time `DEV` was assumed to only mean `vite dev`, which the esm-env consolidation in #14308 no longer guarantees (first leak #15632, fixed by #15852, second leak #16008, fixed by #16023). This applies the rule from the #15852 body ("reverting to the global constant where we want the code to only run during `vite dev` ... Every other place that uses DEV is meant to fire warnings ... and that should still happen if the user did `NODE_ENV=development vite build`") to two sites it missed: - the `respond.js` gate, `!DEV` to `!__SVELTEKIT_DEV__`, covering both the form CSRF check and the remote functions origin check that now shares it - the live-serving condition in `app/server/remote/prerender.js`, same one-token swap (prerendered remote functions were served live in these builds) The three validation `DEV` sites in `respond.js` (`validateHeaders`, `page_nodes.validate()`, `validate_server_exports`) are deliberately untouched. They are warning sites and should keep following NODE_ENV per the rule. The check internals are also untouched, so this stays out of the way of the `sec-fetch-site` idea in #15992. The new spec in `test/build-errors` builds a minimal fixture with `NODE_ENV=staging`, imports the generated server, and asserts a normal GET returns 200 while a forged cross-site form POST returns 403. It fails on main (the POST returns 200) and passes with the fix. The existing basics CSRF tests stay green in both modes, and dev behavior is unchanged. There are HMR-coupled `DEV` gates in `client.js` and the remote query modules from the same class. Left for a follow-up, `client.js` currently conflicts with #16307. --- ### Please don't delete this checklist! Before submitting the PR, please make sure you do the following: - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] This message body should clearly illustrate what problems it solves. - [x] Ideally, include a test that fails without this PR but passes with it. ### Tests - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint` and `pnpm check` ### Changesets - [x] If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running `pnpm changeset` and following the prompts. Changesets that add features should be `minor` and those that fix bugs should be `patch`. Please prefix changeset messages with `feat:`, `fix:`, or `chore:`. ### Edits - [x] Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed. --------- Co-authored-by: Tee Ming <chewteeming01@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fixes #15046
fixes #15632
This PR fixes a regression from #14308 where
esm-envreplaced the global constant for development checks by reverting to the global constant where we want the code to only run duringvite dev(rather than following theNODE_ENVvalue). It also consolidates other places that were incorrectly usingesm-env. Every other place that usesDEVis meant to fire warnings or avoid using the cache and that should still happen if the user didNODE_ENV=development vite buildPlease don't delete this checklist! Before submitting the PR, please make sure you do the following:
Tests
pnpm testand lint the project withpnpm lintandpnpm checkChangesets
pnpm changesetand following the prompts. Changesets that add features should beminorand those that fix bugs should bepatch. Please prefix changeset messages withfeat:,fix:, orchore:.Edits