fix: return a lightweight 404 instead of rendering the error page for subresource requests by Nic-Polumeyv · Pull Request #16463 · sveltejs/kit

Nic-Polumeyv · 2026-07-21T20:01:31Z

Diagnosis in the issue. Requests whose Sec-Fetch-Dest can never render HTML now get a plain Not Found with Vary: Sec-Fetch-Dest instead of the SSR'd error page, same shape as the /_app/ 404 a few lines up. Absent header, empty, document and unknown values are unchanged. Also fixes the stale Safari comment in errors.js (sec-fetch-dest ships since 16.4). Prior art: vercel/next.js#95930, vitejs/vite#20866.

Note: handleError no longer runs for these (the default hook discards them anyway).

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
This message body should clearly illustrate what problems it solves.
Ideally, include a test that fails without this PR but passes with it.

Tests

Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

Edits

Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

… subresource requests

pkg-svelte-dev · 2026-07-21T20:01:34Z

Install the latest version of @sveltejs/kit from cb9d6c3:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/cb9d6c3219d8c8cc15073efa95df6114f4c2228e

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/16463

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

changeset-bot · 2026-07-21T20:01:40Z

🦋 Changeset detected

Latest commit: cb9d6c3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

…c-fetch-dest

This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to version-3, this PR will be updated. ⚠️

⚠️

⚠️ `version-3` is currently in **pre mode** so this branch has prereleases rather than normal releases. If you want to exit prereleases, run `changeset pre exit` on `version-3`. ⚠️

⚠️

⚠️ # Releases ## @sveltejs/kit@3.0.0-next.12 ### Major Changes - breaking: rename `Pathname` type to `Path` and `Asset` to `AssetPath` ([#16430](#16430)) breaking: remove leading `/` from `Path` and `AssetPath` - breaking: write tsconfig to `node_modules/$app/tsconfig` ([#16458](#16458)) - breaking: error on `event.url`, `event.params` and `event.route` access inside queries ([#16452](#16452)) - breaking: delete `$service-worker` module ([#16450](#16450)) - breaking: detect new deployments on data, remote, and form action responses, tab focus, and visibility change, and default `version.pollInterval` to 1 hour ([#16496](#16496)) ### Minor Changes - feat: add `$app/manifest` module with `immutable`, `assets`, `prerendered`, and `routes` exports ([#16372](#16372)) - feat: validate that all remote form fields were created with form.fields.foo.as(...) ([#16331](#16331)) - feat: make `$app/paths` importable in service workers ([#16441](#16441)) - feat: `$app/service-worker` module ([#16458](#16458)) - feat: better tsconfig validation ([#16458](#16458)) - fix: default cookies to `secure` to `false` during development ([#16462](#16462)) ### Patch Changes - fix: allow `undefined` values to be passed to form field `.as(...)` where applicable ([#15681](#15681)) - fix: include queries refreshed from within another query in the serialized response ([#16461](#16461)) - fix: generate sourcemaps for remote modules ([#16440](#16440)) - fix: avoid empty getElementById() call on hash routing navigation ([#16448](#16448)) - fix: warn if hook files are spelled as "hook" instead of "hooks" ([#16483](#16483)) - chore: deprecate the `alias` option ([#16470](#16470)) - fix: prevent infinite loops when server-side queries refresh each other in a cycle during the single-flight drain ([#16461](#16461)) - fix: populate `version` in service workers ([#16434](#16434)) - fix: resolve remote modules as external during dev prebundling so packages can re-export remote functions ([#16426](#16426)) - fix: refetch route-tracking server data when navigating away from an error page ([#16381](#16381)) - fix: serialize `query(...).set(...)`/`query(...).refresh()` values into the rendered HTML when called from within a query during SSR ([#16461](#16461)) - fix: fall back to the page's form actions when a sibling endpoint has no POST handler ([#16349](#16349)) - fix: return a lightweight 404 instead of rendering the error page for subresource requests ([#16463](#16463)) - fix: preserve stripped path prefixes by making trailing-slash redirects relative ([#16431](#16431)) - chore: deduplicate type-stripping logic in `tweak_types` ([#16454](#16454)) - fix: more informative error message when running a command inside a query or prerender function ([`eb5c973`](eb5c973)) ## @sveltejs/adapter-cloudflare@8.0.0-next.3 ### Patch Changes - chore: bump `@cloudflare/workers-types` to `4.20260621.1` ([#16455](#16455)) - Updated dependencies [[`adc4c5b`](adc4c5b), [`ecb0701`](ecb0701), [`4b4cc60`](4b4cc60), [`7390dbe`](7390dbe), [`2e71340`](2e71340), [`c87bc3a`](c87bc3a), [`af15c6c`](af15c6c), [`c6fa431`](c6fa431), [`bfe4dea`](bfe4dea), [`df7dc72`](df7dc72), [`5ae11a1`](5ae11a1), [`781205c`](781205c), [`c87bc3a`](c87bc3a), [`a1bfeb9`](a1bfeb9), [`c87bc3a`](c87bc3a), [`9f0127d`](9f0127d), [`4b4cc60`](4b4cc60), [`8f5b9c7`](8f5b9c7), [`c9b5544`](c9b5544), [`fe1d4a4`](fe1d4a4), [`4b4cc60`](4b4cc60), [`5f78e95`](5f78e95), [`25510fc`](25510fc), [`c99a6cf`](c99a6cf), [`17a45ca`](17a45ca), [`2ca20c3`](2ca20c3), [`eb5c973`](eb5c973)]: - @sveltejs/kit@3.0.0-next.12 ## @sveltejs/adapter-netlify@7.0.0-next.4 ### Patch Changes - fix: await `init` on every request to prevent race condition ([#16467](#16467)) - chore: bump Rolldown to `1.2.0` ([#16455](#16455)) - Updated dependencies [[`adc4c5b`](adc4c5b), [`ecb0701`](ecb0701), [`4b4cc60`](4b4cc60), [`7390dbe`](7390dbe), [`2e71340`](2e71340), [`c87bc3a`](c87bc3a), [`af15c6c`](af15c6c), [`c6fa431`](c6fa431), [`bfe4dea`](bfe4dea), [`df7dc72`](df7dc72), [`5ae11a1`](5ae11a1), [`781205c`](781205c), [`c87bc3a`](c87bc3a), [`a1bfeb9`](a1bfeb9), [`c87bc3a`](c87bc3a), [`9f0127d`](9f0127d), [`4b4cc60`](4b4cc60), [`8f5b9c7`](8f5b9c7), [`c9b5544`](c9b5544), [`fe1d4a4`](fe1d4a4), [`4b4cc60`](4b4cc60), [`5f78e95`](5f78e95), [`25510fc`](25510fc), [`c99a6cf`](c99a6cf), [`17a45ca`](17a45ca), [`2ca20c3`](2ca20c3), [`eb5c973`](eb5c973)]: - @sveltejs/kit@3.0.0-next.12 ## @sveltejs/adapter-node@6.0.0-next.6 ### Patch Changes - fix: preserve stripped path prefixes by making trailing-slash redirects relative ([#16431](#16431)) - chore: bump Rolldown to `1.2.0` ([#16455](#16455)) - Updated dependencies [[`adc4c5b`](adc4c5b), [`ecb0701`](ecb0701), [`4b4cc60`](4b4cc60), [`7390dbe`](7390dbe), [`2e71340`](2e71340), [`c87bc3a`](c87bc3a), [`af15c6c`](af15c6c), [`c6fa431`](c6fa431), [`bfe4dea`](bfe4dea), [`df7dc72`](df7dc72), [`5ae11a1`](5ae11a1), [`781205c`](781205c), [`c87bc3a`](c87bc3a), [`a1bfeb9`](a1bfeb9), [`c87bc3a`](c87bc3a), [`9f0127d`](9f0127d), [`4b4cc60`](4b4cc60), [`8f5b9c7`](8f5b9c7), [`c9b5544`](c9b5544), [`fe1d4a4`](fe1d4a4), [`4b4cc60`](4b4cc60), [`5f78e95`](5f78e95), [`25510fc`](25510fc), [`c99a6cf`](c99a6cf), [`17a45ca`](17a45ca), [`2ca20c3`](2ca20c3), [`eb5c973`](eb5c973)]: - @sveltejs/kit@3.0.0-next.12 ## @sveltejs/adapter-vercel@7.0.0-next.3 ### Patch Changes - fix: await `init` on every request to prevent race condition ([#16467](#16467)) - chore: bump Rolldown to `1.2.0` ([#16455](#16455)) - Updated dependencies [[`adc4c5b`](adc4c5b), [`ecb0701`](ecb0701), [`4b4cc60`](4b4cc60), [`7390dbe`](7390dbe), [`2e71340`](2e71340), [`c87bc3a`](c87bc3a), [`af15c6c`](af15c6c), [`c6fa431`](c6fa431), [`bfe4dea`](bfe4dea), [`df7dc72`](df7dc72), [`5ae11a1`](5ae11a1), [`781205c`](781205c), [`c87bc3a`](c87bc3a), [`a1bfeb9`](a1bfeb9), [`c87bc3a`](c87bc3a), [`9f0127d`](9f0127d), [`4b4cc60`](4b4cc60), [`8f5b9c7`](8f5b9c7), [`c9b5544`](c9b5544), [`fe1d4a4`](fe1d4a4), [`4b4cc60`](4b4cc60), [`5f78e95`](5f78e95), [`25510fc`](25510fc), [`c99a6cf`](c99a6cf), [`17a45ca`](17a45ca), [`2ca20c3`](2ca20c3), [`eb5c973`](eb5c973)]: - @sveltejs/kit@3.0.0-next.12 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Nic-Polumeyv added 2 commits July 21, 2026 15:40

fix: return a lightweight 404 instead of rendering the error page for…

07113ab

… subresource requests

tweak comments, drop over-specific test assertion

37fc014

Nic-Polumeyv added 2 commits July 21, 2026 16:06

drop the old-browsers clause, every browser in v3's baseline sends se…

3ec7499

…c-fetch-dest

link the sec-fetch-dest reference

cb9d6c3

elliott-with-the-longest-name-on-github approved these changes Jul 21, 2026

View reviewed changes

elliott-with-the-longest-name-on-github merged commit c99a6cf into sveltejs:version-3 Jul 21, 2026
17 of 18 checks passed

github-actions Bot mentioned this pull request Jul 21, 2026

Version Packages (next) #16435

Merged

teemingc mentioned this pull request Jul 23, 2026

Render +error.svelte whenever possible #13646

Closed

Nic-Polumeyv mentioned this pull request Jul 23, 2026

breaking: render the root error page for handle and endpoint errors when the request expects HTML #16488

Closed

5 tasks

Nic-Polumeyv deleted the subresource-404 branch July 30, 2026 22:54

Navigation Menu

Uh oh!

Uh oh!

fix: return a lightweight 404 instead of rendering the error page for subresource requests - #16463

fix: return a lightweight 404 instead of rendering the error page for subresource requests#16463
elliott-with-the-longest-name-on-github merged 4 commits into
sveltejs:version-3from
Nic-Polumeyv:subresource-404

Nic-Polumeyv commented Jul 21, 2026

Uh oh!

pkg-svelte-dev Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

Nic-Polumeyv commented Jul 21, 2026

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

Tests

Changesets

Edits

Uh oh!

pkg-svelte-dev Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pkg-svelte-dev Bot commented Jul 21, 2026 •

edited

Loading

changeset-bot Bot commented Jul 21, 2026 •

edited

Loading