fix: default cookies to `secure: false` during development by elliott-with-the-longest-name-on-github · Pull Request #16462 · sveltejs/kit

elliott-with-the-longest-name-on-github · 2026-07-21T19:48:52Z

pkg-svelte-dev · 2026-07-21T19:48:54Z

Install the latest version of @sveltejs/kit from 494c5cb:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/494c5cb9d19f909bb4388a836a25285781c54b1e

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/16462

changeset-bot · 2026-07-21T19:48:56Z

🦋 Changeset detected

Latest commit: 494c5cb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

svelte-docs-bot · 2026-07-21T19:51:00Z

Preview: https://svelte-dev-git-preview-kit-16462-svelte.vercel.app/

Co-authored-by: Tee Ming <chewteeming01@gmail.com>

elliott-with-the-longest-name-on-github · 2026-07-21T21:18:38Z

/autofix

teemingc · 2026-07-21T21:54:38Z

@@ -37,30 +37,38 @@ const cookies_setup = ({ href, headers } = {}) => {

 describe.skipIf(process.env.NODE_ENV === 'production')('cookies in dev', () => {
 	beforeAll(() => {
-		// @ts-expect-error
-		globalThis.__SVELTEKIT_DEV__ = true;
+		vi.stubGlobal('__SVELTEKIT_DEV__', true);


Hmm this doesn't seem to work as opposed to the previous hack. Not sure why. Do we need to import cookie.js after this?

Yeah I'm trying to figure that out, it's weird that it's not working... let me try another trick

What's really weird is that it works on Windows but not Linux or MacOS 😓

teemingc

LGTM. Should be able to merge whenever the test gets fixed

This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to version-3, this PR will be updated. ⚠️

⚠️

⚠️ `version-3` is currently in **pre mode** so this branch has prereleases rather than normal releases. If you want to exit prereleases, run `changeset pre exit` on `version-3`. ⚠️

⚠️

⚠️ # Releases ## @sveltejs/kit@3.0.0-next.12 ### Major Changes - breaking: rename `Pathname` type to `Path` and `Asset` to `AssetPath` ([#16430](#16430)) breaking: remove leading `/` from `Path` and `AssetPath` - breaking: write tsconfig to `node_modules/$app/tsconfig` ([#16458](#16458)) - breaking: error on `event.url`, `event.params` and `event.route` access inside queries ([#16452](#16452)) - breaking: delete `$service-worker` module ([#16450](#16450)) - breaking: detect new deployments on data, remote, and form action responses, tab focus, and visibility change, and default `version.pollInterval` to 1 hour ([#16496](#16496)) ### Minor Changes - feat: add `$app/manifest` module with `immutable`, `assets`, `prerendered`, and `routes` exports ([#16372](#16372)) - feat: validate that all remote form fields were created with form.fields.foo.as(...) ([#16331](#16331)) - feat: make `$app/paths` importable in service workers ([#16441](#16441)) - feat: `$app/service-worker` module ([#16458](#16458)) - feat: better tsconfig validation ([#16458](#16458)) - fix: default cookies to `secure` to `false` during development ([#16462](#16462)) ### Patch Changes - fix: allow `undefined` values to be passed to form field `.as(...)` where applicable ([#15681](#15681)) - fix: include queries refreshed from within another query in the serialized response ([#16461](#16461)) - fix: generate sourcemaps for remote modules ([#16440](#16440)) - fix: avoid empty getElementById() call on hash routing navigation ([#16448](#16448)) - fix: warn if hook files are spelled as "hook" instead of "hooks" ([#16483](#16483)) - chore: deprecate the `alias` option ([#16470](#16470)) - fix: prevent infinite loops when server-side queries refresh each other in a cycle during the single-flight drain ([#16461](#16461)) - fix: populate `version` in service workers ([#16434](#16434)) - fix: resolve remote modules as external during dev prebundling so packages can re-export remote functions ([#16426](#16426)) - fix: refetch route-tracking server data when navigating away from an error page ([#16381](#16381)) - fix: serialize `query(...).set(...)`/`query(...).refresh()` values into the rendered HTML when called from within a query during SSR ([#16461](#16461)) - fix: fall back to the page's form actions when a sibling endpoint has no POST handler ([#16349](#16349)) - fix: return a lightweight 404 instead of rendering the error page for subresource requests ([#16463](#16463)) - fix: preserve stripped path prefixes by making trailing-slash redirects relative ([#16431](#16431)) - chore: deduplicate type-stripping logic in `tweak_types` ([#16454](#16454)) - fix: more informative error message when running a command inside a query or prerender function ([`eb5c973`](eb5c973)) ## @sveltejs/adapter-cloudflare@8.0.0-next.3 ### Patch Changes - chore: bump `@cloudflare/workers-types` to `4.20260621.1` ([#16455](#16455)) - Updated dependencies [[`adc4c5b`](adc4c5b), [`ecb0701`](ecb0701), [`4b4cc60`](4b4cc60), [`7390dbe`](7390dbe), [`2e71340`](2e71340), [`c87bc3a`](c87bc3a), [`af15c6c`](af15c6c), [`c6fa431`](c6fa431), [`bfe4dea`](bfe4dea), [`df7dc72`](df7dc72), [`5ae11a1`](5ae11a1), [`781205c`](781205c), [`c87bc3a`](c87bc3a), [`a1bfeb9`](a1bfeb9), [`c87bc3a`](c87bc3a), [`9f0127d`](9f0127d), [`4b4cc60`](4b4cc60), [`8f5b9c7`](8f5b9c7), [`c9b5544`](c9b5544), [`fe1d4a4`](fe1d4a4), [`4b4cc60`](4b4cc60), [`5f78e95`](5f78e95), [`25510fc`](25510fc), [`c99a6cf`](c99a6cf), [`17a45ca`](17a45ca), [`2ca20c3`](2ca20c3), [`eb5c973`](eb5c973)]: - @sveltejs/kit@3.0.0-next.12 ## @sveltejs/adapter-netlify@7.0.0-next.4 ### Patch Changes - fix: await `init` on every request to prevent race condition ([#16467](#16467)) - chore: bump Rolldown to `1.2.0` ([#16455](#16455)) - Updated dependencies [[`adc4c5b`](adc4c5b), [`ecb0701`](ecb0701), [`4b4cc60`](4b4cc60), [`7390dbe`](7390dbe), [`2e71340`](2e71340), [`c87bc3a`](c87bc3a), [`af15c6c`](af15c6c), [`c6fa431`](c6fa431), [`bfe4dea`](bfe4dea), [`df7dc72`](df7dc72), [`5ae11a1`](5ae11a1), [`781205c`](781205c), [`c87bc3a`](c87bc3a), [`a1bfeb9`](a1bfeb9), [`c87bc3a`](c87bc3a), [`9f0127d`](9f0127d), [`4b4cc60`](4b4cc60), [`8f5b9c7`](8f5b9c7), [`c9b5544`](c9b5544), [`fe1d4a4`](fe1d4a4), [`4b4cc60`](4b4cc60), [`5f78e95`](5f78e95), [`25510fc`](25510fc), [`c99a6cf`](c99a6cf), [`17a45ca`](17a45ca), [`2ca20c3`](2ca20c3), [`eb5c973`](eb5c973)]: - @sveltejs/kit@3.0.0-next.12 ## @sveltejs/adapter-node@6.0.0-next.6 ### Patch Changes - fix: preserve stripped path prefixes by making trailing-slash redirects relative ([#16431](#16431)) - chore: bump Rolldown to `1.2.0` ([#16455](#16455)) - Updated dependencies [[`adc4c5b`](adc4c5b), [`ecb0701`](ecb0701), [`4b4cc60`](4b4cc60), [`7390dbe`](7390dbe), [`2e71340`](2e71340), [`c87bc3a`](c87bc3a), [`af15c6c`](af15c6c), [`c6fa431`](c6fa431), [`bfe4dea`](bfe4dea), [`df7dc72`](df7dc72), [`5ae11a1`](5ae11a1), [`781205c`](781205c), [`c87bc3a`](c87bc3a), [`a1bfeb9`](a1bfeb9), [`c87bc3a`](c87bc3a), [`9f0127d`](9f0127d), [`4b4cc60`](4b4cc60), [`8f5b9c7`](8f5b9c7), [`c9b5544`](c9b5544), [`fe1d4a4`](fe1d4a4), [`4b4cc60`](4b4cc60), [`5f78e95`](5f78e95), [`25510fc`](25510fc), [`c99a6cf`](c99a6cf), [`17a45ca`](17a45ca), [`2ca20c3`](2ca20c3), [`eb5c973`](eb5c973)]: - @sveltejs/kit@3.0.0-next.12 ## @sveltejs/adapter-vercel@7.0.0-next.3 ### Patch Changes - fix: await `init` on every request to prevent race condition ([#16467](#16467)) - chore: bump Rolldown to `1.2.0` ([#16455](#16455)) - Updated dependencies [[`adc4c5b`](adc4c5b), [`ecb0701`](ecb0701), [`4b4cc60`](4b4cc60), [`7390dbe`](7390dbe), [`2e71340`](2e71340), [`c87bc3a`](c87bc3a), [`af15c6c`](af15c6c), [`c6fa431`](c6fa431), [`bfe4dea`](bfe4dea), [`df7dc72`](df7dc72), [`5ae11a1`](5ae11a1), [`781205c`](781205c), [`c87bc3a`](c87bc3a), [`a1bfeb9`](a1bfeb9), [`c87bc3a`](c87bc3a), [`9f0127d`](9f0127d), [`4b4cc60`](4b4cc60), [`8f5b9c7`](8f5b9c7), [`c9b5544`](c9b5544), [`fe1d4a4`](fe1d4a4), [`4b4cc60`](4b4cc60), [`5f78e95`](5f78e95), [`25510fc`](25510fc), [`c99a6cf`](c99a6cf), [`17a45ca`](17a45ca), [`2ca20c3`](2ca20c3), [`eb5c973`](eb5c973)]: - @sveltejs/kit@3.0.0-next.12 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

fix: default cookies to secure: false during development

f3eba05

vercel Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread packages/kit/src/runtime/server/cookie.js Outdated

oops

92078cb

teemingc reviewed Jul 21, 2026

View reviewed changes

Apply suggestions from code review

0f03a4c

Co-authored-by: Tee Ming <chewteeming01@gmail.com>

elliott-with-the-longest-name-on-github added 3 commits July 21, 2026 15:21

oops

685f71b

ugh

73bd7f8

types

3f72e33

teemingc reviewed Jul 21, 2026

View reviewed changes

elliott-with-the-longest-name-on-github added 2 commits July 21, 2026 15:59

try this?

46af8cd

asldkfjlaskdjfklasjdflkjasdf

494c5cb

teemingc approved these changes Jul 21, 2026

View reviewed changes

elliott-with-the-longest-name-on-github merged commit 25510fc into version-3 Jul 21, 2026
20 of 21 checks passed

elliott-with-the-longest-name-on-github deleted the elliott/no-secure-cookie-when-dev branch July 21, 2026 22:28

github-actions Bot mentioned this pull request Jul 21, 2026

Version Packages (next) #16435

Merged

hyunbinseo mentioned this pull request Jul 22, 2026

Migrate to SvelteKit v3 hyunbinseo/svelte-kit-template#11

Open

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: default cookies to `secure: false` during development - #16462

fix: default cookies to `secure: false` during development#16462
elliott-with-the-longest-name-on-github merged 8 commits into
version-3from
elliott/no-secure-cookie-when-dev

elliott-with-the-longest-name-on-github commented Jul 21, 2026

Uh oh!

pkg-svelte-dev Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

svelte-docs-bot Bot commented Jul 21, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elliott-with-the-longest-name-on-github commented Jul 21, 2026

Uh oh!

teemingc Jul 21, 2026 •

edited

Loading

Uh oh!

elliott-with-the-longest-name-on-github Jul 21, 2026

Uh oh!

elliott-with-the-longest-name-on-github Jul 21, 2026

Uh oh!

teemingc left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

elliott-with-the-longest-name-on-github commented Jul 21, 2026

Uh oh!

pkg-svelte-dev Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

svelte-docs-bot Bot commented Jul 21, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elliott-with-the-longest-name-on-github commented Jul 21, 2026

Uh oh!

teemingc Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elliott-with-the-longest-name-on-github Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

elliott-with-the-longest-name-on-github Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

teemingc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pkg-svelte-dev Bot commented Jul 21, 2026 •

edited

Loading

changeset-bot Bot commented Jul 21, 2026 •

edited

Loading

teemingc Jul 21, 2026 •

edited

Loading