SvelteKit arguably has a more sophisticated and flexible system for handling env vars than any other framework. We think we can do better though. Here's what we're working on: github.com/sveltejs/kit... Give it a read and let us know if you have feedback

We've just published patch releases of devalue, Svelte, and SvelteKit that fix a number of vulnerabilities. No need to panic — they're all hard to exploit or reliant on experimental features — but we recommend updating as soon as you get a chance. More details in the advisories:

We just released a number of security patches across the Svelte ecosystem. If you use SvelteKit, the Vercel adapter for SvelteKit, Svelte, or devalue, you should upgrade. The Vercel OSS Bug Bounty paid out over $14,000 for these reports!

We've released fixes for 5 CVEs affecting the Svelte ecosystem. Please upgrade your apps! Read the post to learn if you're affected: svelte.dev/blog/cves-af...

🎅🎄🎁 ADVENT OF SVELTE 2025 🎅🎄🎁 24 days, 24 videos with tips, tricks and features you didn't know about we're hitting the ground running with the lesser-known $inspect(...) and $inspect.trace(...) runes (docs: svelte.dev/docs/svelte/...) follow along here! advent.sveltesociety.dev/2025

today we landed a @svelte.dev feature i'm pretty stoked about — we call it 'forking', and it lets you run state changes offscreen and later choose whether to commit them (e.g. user hovers on a link, preload data in case they click) - docs svelte.dev/docs/svelte/... - demo svelte.dev/playground/a...

lil' treat for all you weekend builders: Svelte now has an official MCP server, courtesy of resident bot wranglers @paolo.ricciuti.me and @khromov.se 🤖 it gives your LLM access to docs and compiler-driven diagnostics — give it a spin and let us know how you get on! svelte.dev/docs/mcp/ove...

Support Svelte development!

You can now use Svelte's async features in your Astro islands! Just update to the latest versions, opt in to the `experimental.async` flag, and you're off to the races svelte.dev/docs/svelte/...

@svelte.london is being hosted by Triver this evening! Check out the stream if you’re interested in low latency Svelte and using Svelte with Cloudflare www.youtube.com/live/odCWAAa...

You've probably heard about the supply chain attack that affected a number of widely-used npm packages today. tl;dr: Don't panic. Notes: 1. Svelte, SvelteKit and their associated packages are not vulnerable to this attack, as they do not use any of the compromised dependencies in the browser

OpenTelemetry tracing is live in SvelteKit! Huge s/o to @stracke.tech for all the help along the way. SvelteKit can now emit OTEL spans for all of its serverside constructs. It also provides an instrumentation file to easily set up trace exports. svelte.dev/blog/sveltek...

Svelte's security posture got better thanks to this. Glad I was part of it! github.blog/open-source/...

If this change would cause problems for you, please pipe up github.com/sveltejs/kit.... We'd like to remove these options altogether in SvelteKit 3

SvelteKit remote functions are now available under an experimental flag. Docs here: svelte.dev/docs/kit/rem...

long overdue but we made the SvelteKit router more type-safe. docs for `resolve(...)` and `asset(...)` at svelte.dev/docs/kit/$ap...

now available for your on-demand viewing pleasure

Async Svelte is coming! github.com/sveltejs/sve...

For those of you who have been wondering if and when the videos of Svelte Summit 2025 Barcelona will be freely available, we just published a blog post about it: svelte.dev/blog/svelte-...

We just published an advisory for CVE-2025-32388, a moderate severity XSS vulnerability in SvelteKit. Please update to `@sveltejs/[email protected]`. The vulnerability affects applications that iterate over all search parameters inside a server `load` function. More details in the advisory 👇

you can now use .ts files in the playground: svelte.dev/playground/7... caveat: only supports erasable syntax (www.typescriptlang.org/docs/handboo...). under the hood this uses bloomberg.github.io/ts-blank-spa... (note that typechecking/intellisense are TODO)

If you're using SvelteKit (or Svelte+Vite without SvelteKit) then we recommend updating your Vite version. Note that the vulnerability only exists if you're doing `vite dev --host` (or `server.host: true`) on an untrusted network, which you're probably not. But update anyway

As of @svelte.dev 5.25 you can temporarily override a derived value, which is very handy for optimistic UI • demo svelte.dev/playground/3... • docs svelte.dev/docs/svelte/...

last chance to grab tickets at the lower price!

PSA for @svelte.dev users: we're planning to change how effect teardowns work to eliminate a common gotcha that affects signal-based frameworks. If the new behaviour would create problems for you, please let us know! github.com/sveltejs/sve...

Now that speakers have been selected we want to share with you our line-up for Svelte Summit Spring 2025! We will host 16 talks across different topics during the two day conference. In addition, @mainmatter.com will also host a workshop. More details on www.sveltesummit.com

New in Svelte: A way to create a unique ID that is stable across client and server svelte.dev/docs/svelte/...

in case you missed it: the SvelteHack winners are up! many thanks to everyone who took part, and kudos to these outstanding projects in particular 👇

We've just sent out emails to everyone who submitted a proposal! Please read it carefully. See you at Svelte Summit Spring 2025!

Reminder: There are less than two weeks left to get a 20% discount on tickets for the next in-person Svelte Summit. Use the code sveltmas2024 at checkout or email us for group tickets. More details on the website. www.sveltesummit.com

shout-out to @didiercatz.com and @khromov.se for building this!

🚨 THIS IS NOT A DRILL 🚨 in-person Svelte Summit happening in May! get your (discounted) tickets and come hang out!

Aside from Advent of Svelte, we've also been shipping a bunch of minor bugfixes and improvements. For example, `if` blocks are now treeshakeable — if you have a condition that can be known statically, like `{#if BROWSER}`, then dead code will be eliminated by a minifier

🎅🎄🎁 ADVENT OF SVELTE 🎅🎄🎁 We're going to ship one thing a day every day from now until Christmas. Wish us luck! svelte.dev/blog/advent-... First up...

🦋 svelte.dev

<h1>hello world</h1>