chore: remove __SVELTEKIT_DEV__ global - #14308
Merged
Merged
Conversation
added 2 commits
August 25, 2025 15:02
🦋 Changeset detectedLatest commit: 0582e98 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
teemingc
commented
Aug 25, 2025
Member
|
This seems reasonable but the test failures look legit. Haven't investigated them though |
Member
Author
|
Gah it was some lint error for not importing node's process explicitly. A shame that the eslint extension doesn't report it earlier. |
teemingc
commented
Aug 26, 2025
| test('injects relative service worker', () => { | ||
| const content = read('index.html'); | ||
| expect(content).toMatch("navigator.serviceWorker.register('./service-worker.js')"); | ||
| expect(content).toMatch("navigator.serviceWorker.register('./service-worker.js'"); |
Member
Author
There was a problem hiding this comment.
Removed the parentheses at the end so that this test passes whether it's ('./service-worker.js', { type: 'module' }) in dev or ('./service-worker.js') in prod
Rich-Harris
approved these changes
Aug 26, 2025
Merged
Copilot AI
pushed a commit
to Stadly/kit
that referenced
this pull request
Mar 6, 2026
* remove __SVELTEKIT_DEV__ global * changeset * group third party import statements * separate prod only tests * format * Apply suggestion from @eltigerchino * explicitly import process * adjust test to work in dev
6 tasks
teemingc
added a commit
that referenced
this pull request
May 15, 2026
fixes #15046 fixes #15632 This PR fixes a regression from #14308 where `esm-env` replaced the global constant for development checks by reverting to the global constant where we want the code to only run during `vite dev` (rather than following the `NODE_ENV` value). It also consolidates other places that were incorrectly using `esm-env`. Every other place that uses `DEV` is meant to fire warnings or avoid using the cache and that should still happen if the user did `NODE_ENV=development vite build` --- ### Please don't delete this checklist! Before submitting the PR, please make sure you do the following: - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] This message body should clearly illustrate what problems it solves. - [ ] Ideally, include a test that fails without this PR but passes with it. ### Tests - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint` and `pnpm check` ### Changesets - [x] If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running `pnpm changeset` and following the prompts. Changesets that add features should be `minor` and those that fix bugs should be `patch`. Please prefix changeset messages with `feat:`, `fix:`, or `chore:`. ### Edits - [x] Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.
6 tasks
teemingc
added a commit
that referenced
this pull request
Jul 14, 2026
…DE_ENV (#16313) The NODE_ENV saga continues. Any build where NODE_ENV isn't `production` currently ships with every origin check compiled out: ```js // respond.js if (!DEV) { // cross-site remote request check // cross-site form submission check (csrf.checkOrigin / trustedOrigins) } ``` `DEV` comes from esm-env, which kit bundles into apps resolved by NODE_ENV, so `NODE_ENV=staging vite build` produces a deployable server with CSRF protection silently disabled. Vite's docs list non-production builds as a supported workflow, and khromov raised this exact failure mode in #14335 when the gate was added. At the time `DEV` was assumed to only mean `vite dev`, which the esm-env consolidation in #14308 no longer guarantees (first leak #15632, fixed by #15852, second leak #16008, fixed by #16023). This applies the rule from the #15852 body ("reverting to the global constant where we want the code to only run during `vite dev` ... Every other place that uses DEV is meant to fire warnings ... and that should still happen if the user did `NODE_ENV=development vite build`") to two sites it missed: - the `respond.js` gate, `!DEV` to `!__SVELTEKIT_DEV__`, covering both the form CSRF check and the remote functions origin check that now shares it - the live-serving condition in `app/server/remote/prerender.js`, same one-token swap (prerendered remote functions were served live in these builds) The three validation `DEV` sites in `respond.js` (`validateHeaders`, `page_nodes.validate()`, `validate_server_exports`) are deliberately untouched. They are warning sites and should keep following NODE_ENV per the rule. The check internals are also untouched, so this stays out of the way of the `sec-fetch-site` idea in #15992. The new spec in `test/build-errors` builds a minimal fixture with `NODE_ENV=staging`, imports the generated server, and asserts a normal GET returns 200 while a forged cross-site form POST returns 403. It fails on main (the POST returns 200) and passes with the fix. The existing basics CSRF tests stay green in both modes, and dev behavior is unchanged. There are HMR-coupled `DEV` gates in `client.js` and the remote query modules from the same class. Left for a follow-up, `client.js` currently conflicts with #16307. --- ### Please don't delete this checklist! Before submitting the PR, please make sure you do the following: - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] This message body should clearly illustrate what problems it solves. - [x] Ideally, include a test that fails without this PR but passes with it. ### Tests - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint` and `pnpm check` ### Changesets - [x] If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running `pnpm changeset` and following the prompts. Changesets that add features should be `minor` and those that fix bugs should be `patch`. Please prefix changeset messages with `feat:`, `fix:`, or `chore:`. ### Edits - [x] Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed. --------- Co-authored-by: Tee Ming <chewteeming01@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR addresses one of the TODO comments by consolidating our dev environment checks to use
esm-envinstead of relying on the (probably legacy)__SVELTEKIT_DEV__global variable. It also adjusts some unit tests to run in production mode from the Vitest CLI where previously we just manipulated the global variable (but as far as I'm aware that's not possible to do inline in a test in Vitest to getesm-envto behave similarly)Not sure if this is breaking or not but if it is let me know so we can adjust the changeset or delay the merging of this PR.
Please don't delete this checklist! Before submitting the PR, please make sure you do the following:
Tests
pnpm testand lint the project withpnpm lintandpnpm checkChangesets
pnpm changesetand following the prompts. Changesets that add features should beminorand those that fix bugs should bepatch. Please prefix changeset messages withfeat:,fix:, orchore:.Edits