fix: don't emit the dev bootstrap into builds with a non-standard NODE_ENV - #16023
Merged
teemingc merged 6 commits intoJun 12, 2026
Merged
Conversation
🦋 Changeset detectedLatest commit: 68677b9 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
Author
|
One note on approach. The review discussion on #15971 raised that the #15574-style environment handling would be more fool proof than per-module |
6 tasks
teemingc
reviewed
Jun 12, 2026
…ub.com/nic-polumeyv/kit into fix-nonstandard-node-env-dev-bootstrap
teemingc
reviewed
Jun 12, 2026
| "test": "pnpm test:dev && pnpm test:build", | ||
| "test:dev": "DEV=true playwright test", | ||
| "test:build": "playwright test && REGISTER_SERVICE_WORKER=true playwright test" | ||
| "test:build": "NODE_ENV=custom playwright test && REGISTER_SERVICE_WORKER=true playwright test" |
Member
There was a problem hiding this comment.
This helps catch the reported issue after build
teemingc
approved these changes
Jun 12, 2026
teemingc
left a comment
Member
There was a problem hiding this comment.
Thanks! You're alright. The regression was my fault.
This was referenced Jun 12, 2026
Merged
teemingc
pushed a commit
that referenced
this pull request
Jun 14, 2026
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @sveltejs/kit@2.65.1 ### Patch Changes - fix: avoid importing the Vite development client code into builds with a non-standard `NODE_ENV` ([#16023](#16023)) - fix: don't emit the unused bundle and stylesheet files when using `bundleStrategy: 'inline'` ([#16025](#16025)) - fix: reset queries before navigating when `invalidateAll` is set ([#16014](#16014)) - fix: regression in loading assets for absolute path apps ([#16026](#16026)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
6 tasks
teemingc
added a commit
that referenced
this pull request
Jul 14, 2026
…DE_ENV (#16313) The NODE_ENV saga continues. Any build where NODE_ENV isn't `production` currently ships with every origin check compiled out: ```js // respond.js if (!DEV) { // cross-site remote request check // cross-site form submission check (csrf.checkOrigin / trustedOrigins) } ``` `DEV` comes from esm-env, which kit bundles into apps resolved by NODE_ENV, so `NODE_ENV=staging vite build` produces a deployable server with CSRF protection silently disabled. Vite's docs list non-production builds as a supported workflow, and khromov raised this exact failure mode in #14335 when the gate was added. At the time `DEV` was assumed to only mean `vite dev`, which the esm-env consolidation in #14308 no longer guarantees (first leak #15632, fixed by #15852, second leak #16008, fixed by #16023). This applies the rule from the #15852 body ("reverting to the global constant where we want the code to only run during `vite dev` ... Every other place that uses DEV is meant to fire warnings ... and that should still happen if the user did `NODE_ENV=development vite build`") to two sites it missed: - the `respond.js` gate, `!DEV` to `!__SVELTEKIT_DEV__`, covering both the form CSRF check and the remote functions origin check that now shares it - the live-serving condition in `app/server/remote/prerender.js`, same one-token swap (prerendered remote functions were served live in these builds) The three validation `DEV` sites in `respond.js` (`validateHeaders`, `page_nodes.validate()`, `validate_server_exports`) are deliberately untouched. They are warning sites and should keep following NODE_ENV per the rule. The check internals are also untouched, so this stays out of the way of the `sec-fetch-site` idea in #15992. The new spec in `test/build-errors` builds a minimal fixture with `NODE_ENV=staging`, imports the generated server, and asserts a normal GET returns 200 while a forged cross-site form POST returns 403. It fails on main (the POST returns 200) and passes with the fix. The existing basics CSRF tests stay green in both modes, and dev behavior is unchanged. There are HMR-coupled `DEV` gates in `client.js` and the remote query modules from the same class. Left for a follow-up, `client.js` currently conflicts with #16307. --- ### Please don't delete this checklist! Before submitting the PR, please make sure you do the following: - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] This message body should clearly illustrate what problems it solves. - [x] Ideally, include a test that fails without this PR but passes with it. ### Tests - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint` and `pnpm check` ### Changesets - [x] If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running `pnpm changeset` and following the prompts. Changesets that add features should be `minor` and those that fix bugs should be `patch`. Please prefix changeset messages with `feat:`, `fix:`, or `chore:`. ### Edits - [x] Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed. --------- Co-authored-by: Tee Ming <chewteeming01@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Since 2.63.1 (#15971), the init script's eager
import('/@vite/client')was gated onDEVfromesm-env, which folds onNODE_ENV— soNODE_ENV=staging vite buildshipped the dev bootstrap in production output (#16008). Sorry for the regression (awkward emoji face + that one emoji with a sweat drop) #15971.As @Rich-Harris suggested in #16008, this goes back to the
import.meta.hottrick, but in the generated clientapp.jsinstead of per kit module. All user client code is imported throughapp.js, so Vite injecting its client as that module's first dependency guarantees thedefineglobals exist beforehooks.client.js(or anything else) evaluates — static import order, with no possibility of the race the eagerimport()left open. This also keeps #13249 fixed. The start graph already has the same guarantee via the preamble inclient.js.render.jsnow emits no dev-only code at all. The remainingesm-envDEVgates in the runtime still fold with a non-standardNODE_ENV.Fixes #16008
Please don't delete this checklist! Before submitting the PR, please make sure you do the following:
Tests
pnpm testand lint the project withpnpm lintandpnpm checkChangesets
pnpm changesetand following the prompts. Changesets that add features should beminorand those that fix bugs should bepatch. Please prefix changeset messages withfeat:,fix:, orchore:.Edits