breaking: add paths.origin, remove prerender.origin - #16161
Merged
Conversation
🦋 Changeset detectedLatest commit: 5bf3da2 The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
elliott-with-the-longest-name-on-github
marked this pull request as ready for review
June 24, 2026 22:10
Contributor
Author
|
Not sure it's possible to have the docs build pass until we switch docs over to |
Rich-Harris
reviewed
Jun 26, 2026
Rich-Harris
reviewed
Jun 26, 2026
Rich-Harris
reviewed
Jun 26, 2026
Rich-Harris
reviewed
Jun 26, 2026
Resolved conflicts in: - packages/adapter-cloudflare/utils.spec.js: kept upstream's restructured test layout (new _redirects test, _routes.json describe block) and added origin: 'http://localhost' to paths config to satisfy RecursiveRequired - packages/kit/src/core/config/index.spec.js: updated test regexes to use config. instead of config.kit. (upstream added remove_kit_prefix helper) ▲ Created with [Vercel devbox](https://vercel.com/svelte/~/sandboxes/devboxes/qg7oetw8lrj1an64nxppzp9spsoh)
Rich-Harris
reviewed
Jun 30, 2026
Rich-Harris
reviewed
Jun 30, 2026
Rich-Harris
reviewed
Jun 30, 2026
Rich-Harris
reviewed
Jun 30, 2026
Rich-Harris
reviewed
Jun 30, 2026
Rich-Harris
reviewed
Jun 30, 2026
Rich-Harris
reviewed
Jun 30, 2026
Co-authored-by: Rich Harris <richard.a.harris@gmail.com>
Co-authored-by: Rich Harris <richard.a.harris@gmail.com>
|
Install the latest version of pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/5bf3da2b8ac58bfa8187ffabe7a3bf80b95475cfOpen in |
Rich-Harris
reviewed
Jul 1, 2026
| * `application/json`), so the check is solely on the request method and origin: | ||
| * a non-`GET` request is forbidden when its `Origin` header doesn't match the | ||
| * app's self-origin. Unlike `is_csrf_forbidden`, entries in `trusted_origins` | ||
| * are *not* honoured — remote function endpoints are an implementation detail, |
Member
There was a problem hiding this comment.
appreciate you using the correct spelling of 'honoured'
Contributor
Author
There was a problem hiding this comment.
personally I hate it but I do have to kiss up to you every once and a while just to keep the manager-developer relationship going
Member
There was a problem hiding this comment.
will be noted at perf review time
elliott-with-the-longest-name-on-github
force-pushed
the
elliott/paths-origin
branch
from
July 1, 2026 23:26
25a4957 to
5bf3da2
Compare
Rich-Harris
approved these changes
Jul 1, 2026
Rich-Harris
pushed a commit
that referenced
this pull request
Jul 2, 2026
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to version-3, this PR will be updated.⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ `version-3` is currently in **pre mode** so this branch has prereleases rather than normal releases. If you want to exit prereleases, run `changeset pre exit` on `version-3`.⚠️ ⚠️ ⚠️ ⚠️ ⚠️ ⚠️ # Releases ## @sveltejs/adapter-node@6.0.0-next.2 ### Major Changes - breaking: add `kit.paths.origin` config option, remove `kit.prerender.origin` and the `adapter-node` `ORIGIN` environment variable ([#16161](#16161)) ### Patch Changes - Updated dependencies [[`3c434fb`](3c434fb), [`a9284e8`](a9284e8), [`3726a7a`](3726a7a), [`f9d2240`](f9d2240), [`a9284e8`](a9284e8), [`7c040ba`](7c040ba), [`223eaad`](223eaad), [`223eaad`](223eaad), [`3b907d4`](3b907d4), [`fd628a5`](fd628a5), [`223eaad`](223eaad), [`6c1d035`](6c1d035), [`178eac0`](178eac0), [`c6562a9`](c6562a9), [`8eca2ab`](8eca2ab), [`61cf188`](61cf188)]: - @sveltejs/kit@3.0.0-next.6 ## @sveltejs/kit@3.0.0-next.6 ### Major Changes - breaking: return no content for 204 responses ([#16200](#16200)) - breaking: form action responses now use the HTTP status code returned from `fail` ([#16200](#16200)) - breaking: nested server-only directories ([#15685](#15685)) - breaking: add `kit.paths.origin` config option, remove `kit.prerender.origin` and the `adapter-node` `ORIGIN` environment variable ([#16161](#16161)) - breaking: don't abort navigation when calling `invalidate(All)` during navigation ([#16188](#16188)) - breaking: allow `handleError` to influence status code ([#16162](#16162)) - breaking: forbid external redirects by default ([#16198](#16198)) ### Minor Changes - feat: use `type: 'module'` for service worker registrations ([#16169](#16169)) - feat: add `dirty()` property to form fields ([#16208](#16208)) - feat: add `cookies.parse` method ([#16203](#16203)) ### Patch Changes - fix: drain unconsumed request bodies so keep-alive connections don't hang ([#16170](#16170)) - fix: properly handle Date objects in form.fields.set ([#16168](#16168)) - fix: skip clean fields when programmatically validating forms ([#16208](#16208)) - breaking: experimental remote form `validate({ includeUntouched })` option is now `all` ([#16208](#16208)) - fix: return `undefined` from `fields.branch.issues()` when only `fields.branch.leaf` has issues ([#16187](#16187)) - feat: add field.touched() helper to remote form fields ([#14692](#14692)) ## @sveltejs/adapter-cloudflare@8.0.0-next.1 ### Patch Changes - fix: avoid overriding user's existing `_headers` rules ([#16183](#16183)) - Updated dependencies [[`3c434fb`](3c434fb), [`a9284e8`](a9284e8), [`3726a7a`](3726a7a), [`f9d2240`](f9d2240), [`a9284e8`](a9284e8), [`7c040ba`](7c040ba), [`223eaad`](223eaad), [`223eaad`](223eaad), [`3b907d4`](3b907d4), [`fd628a5`](fd628a5), [`223eaad`](223eaad), [`6c1d035`](6c1d035), [`178eac0`](178eac0), [`c6562a9`](c6562a9), [`8eca2ab`](8eca2ab), [`61cf188`](61cf188)]: - @sveltejs/kit@3.0.0-next.6 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #14791
Removes
prerender.originin favor ofpaths.origin, which also applies to remote function and regular form CSRF checks. This also deprecates theORIGINenvironment variable foradapter-node.