Lightnews — Scholar-powered news

Svelte @svelte.dev · 4d

lil' treat for all you weekend builders: Svelte now has an official MCP server, courtesy of resident bot wranglers @paolo.ricciuti.me and @khromov.se 🤖

it gives your LLM access to docs and compiler-driven diagnostics — give it a spin and let us know how you get on!

svelte.dev/docs/mcp/ove...

Overview • Docs • Svelte

Overview • Svelte documentation

svelte.dev

1 20 87

Reposted by Svelte

Andy Rose LPC @andyrose12.bsky.social · 4d

Support Svelte development!

rich harris @rich-harris.dev · 4d

thank you so much! we have an Open Collective that funds a lot of essential maintenance, and every contribution makes a difference:

opencollective.com/svelte

Svelte - Open Collective

Web development for the rest of us

opencollective.com

2 14

Svelte @svelte.dev · 14d

(You can also use these features in SvelteKit, of course! Work continues apace on the final pieces of the puzzle)

bsky.app/profile/benm...

Ben McCann @benmccann.com · 16d

SvelteKit async SSR has landed! The future of Svelte is now here. Try it out along with the new remote functions!

See the PR for some unfinished rough edges. Work continues on it while it's behind an experimental flag, but you can now play around with it!

github.com/sveltejs/kit...

feat: async SSR by Rich-Harris · Pull Request #14447 · sveltejs/kit

This adds asynchronous SSR to an app that's using the latest version of Svelte (^5.39.3) and has opted in to the Svelte experimental.async option (and, ideally, the SvelteKit experimental.remot...

github.com

2 8

Svelte @svelte.dev · 14d

You can now use Svelte's async features in your Astro islands! Just update to the latest versions, opt in to the `experimental.async` flag, and you're off to the races svelte.dev/docs/svelte/...

3 4 26

Reposted by Svelte

Scott Spence @scottspence.dev · 20d

@svelte.london is being hosted by Triver this evening!

Check out the stream if you’re interested in low latency Svelte and using Svelte with Cloudflare

www.youtube.com/live/odCWAAa...

Svelte London - September 2025

YouTube video by Svelte Society

www.youtube.com

1 7 14

Svelte @svelte.dev · 29d

4. This is one of the reasons we keep our dependency graph small and you should too!

1 3 26

Svelte @svelte.dev · 29d

3. It's still _possible_ that you have these packages in your dependency graph (including transitively). The compromised packages have now been unpublished, but if you updated deps earlier today then it's possible your users are affected. List of affected packages here: socket.dev/blog/npm-aut...

npm Author Qix Compromised via Phishing Email in Major Suppl...

npm author Qix’s account was compromised, with malicious versions of popular packages like chalk-template, color-convert, and strip-ansi published.

socket.dev

1 6

Svelte @svelte.dev · 29d

2. The attack works by targeting users of browser extensions like MetaMask, patching `fetch` and `XMLHttpRequest` to steal crypto (excellent write-up here: jdstaerk.substack.com/p/we-just-fo...)

Anatomy of a Billion-Download NPM Supply-Chain Attack

A massive NPM supply chain attack has compromised foundational packages like Chalk, affecting over 1 billion weekly downloads. We dissect the crypto-stealing malware and show you how to protect your p...

jdstaerk.substack.com

1 1 6

Svelte @svelte.dev · 29d

You've probably heard about the supply chain attack that affected a number of widely-used npm packages today.

tl;dr: Don't panic. Notes:

1. Svelte, SvelteKit and their associated packages are not vulnerable to this attack, as they do not use any of the compromised dependencies in the browser

1 12 88

Reposted by Svelte

Elliott Johnson @ell.iott.dev · Aug 18

OpenTelemetry tracing is live in SvelteKit! Huge s/o to @stracke.tech for all the help along the way. SvelteKit can now emit OTEL spans for all of its serverside constructs. It also provides an instrumentation file to easily set up trace exports. svelte.dev/blog/sveltek...

Introducing integrated observability in SvelteKit

SvelteKit apps can now emit OpenTelemetry traces and reliably set up observability instrumentation using instrumentation.server.ts

svelte.dev

1 15 66

Reposted by Svelte

Simon H @dummdidumm.bsky.social · Aug 12

Svelte's security posture got better thanks to this. Glad I was part of it!

github.blog/open-source/...

Securing the supply chain at scale: Starting with 71 important open source projects

Learn how the GitHub Secure Open Source Fund helped 71 open source projects significantly improve their security posture.

github.blog

1 4 22

Svelte @svelte.dev · Aug 8

If this change would cause problems for you, please pipe up github.com/sveltejs/kit.... We'd like to remove these options altogether in SvelteKit 3

Deprecate `config.kit.files.*` · Issue #14151 · sveltejs/kit

Describe the problem For reasons that are lost to the mists of time, we allow you to configure the location of src/routes, src/lib and so on. It adds complexity and inconsistency for no good reason...

github.com

4 24

Svelte @svelte.dev · Jul 31

SvelteKit remote functions are now available under an experimental flag. Docs here: svelte.dev/docs/kit/rem...

Remote functions • Docs • Svelte

Remote functions • Svelte documentation

svelte.dev

1 14 78

Reposted by Svelte

rich harris @rich-harris.dev · Jul 24

long overdue but we made the SvelteKit router more type-safe. docs for `resolve(...)` and `asset(...)` at svelte.dev/docs/kit/$ap...

examples of type errors now surfaced by SvelteKit when you mess routes up

3 11 150

Svelte @svelte.dev · Jul 24

now available for your on-demand viewing pleasure

Jason Lengstorf @jason.energy · Jul 24

🔴 LIVE learn asynchronous @svelte.dev with @rich-harris.dev
www.youtube.com/watch?v=kL4T...

Asynchronous Svelte

YouTube video by CodeTV

www.youtube.com

6 26

Reposted by Svelte

Svelte Society @sveltesociety.dev · Apr 29

Async Svelte is coming! github.com/sveltejs/sve...

Asynchronous Svelte · sveltejs svelte · Discussion #15845

This is a long document; get yourself a cup of tea. tl;dr You can now use the await keyword in Svelte — in your <script>, inside $derived expressions, and in your markup — by installing the async b...

github.com

6 31 190

Reposted by Svelte

Svelte Society @sveltesociety.dev · May 21

For those of you who have been wondering if and when the videos of Svelte Summit 2025 Barcelona will be freely available, we just published a blog post about it: svelte.dev/blog/svelte-...

Bringing Svelte Summit to the whole community

We’re sponsoring the release of talks from Barcelona, starting this weekend

svelte.dev

1 12 68

Svelte @svelte.dev · Apr 14

We just published an advisory for CVE-2025-32388, a moderate severity XSS vulnerability in SvelteKit. Please update to `@sveltejs/[email protected]`.

The vulnerability affects applications that iterate over all search parameters inside a server `load` function. More details in the advisory 👇

XSS via tracked search_params

### Summary Unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of `event.url.searchParams` inside a server `load` function. Attackers can ex...

github.com

8 45

Svelte @svelte.dev · Apr 9

you can now use .ts files in the playground:

svelte.dev/playground/7...

caveat: only supports erasable syntax (www.typescriptlang.org/docs/handboo...). under the hood this uses bloomberg.github.io/ts-blank-spa...

(note that typechecking/intellisense are TODO)

TypeScript! • Playground • Svelte

Web development for the rest of us

svelte.dev

1 2 48

Svelte @svelte.dev · Mar 31

If you're using SvelteKit (or Svelte+Vite without SvelteKit) then we recommend updating your Vite version.

Note that the vulnerability only exists if you're doing `vite dev --host` (or `server.host: true`) on an untrusted network, which you're probably not. But update anyway

Vite @vite.dev · Mar 31

We published a CVE for a moderate dev server security vulnerability. Please update to the latest versions: 6.2.4, 6.1.3, 6.0.13, 5.4.16, 4.5.11.

`server.fs.deny` bypassed for `inline` and `raw` with `?import` query

### Summary The contents of arbitrary files can be returned to the browser. ### Impact Only apps explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` conf...

github.com

5 44

Reposted by Svelte

rich harris @rich-harris.dev · Mar 21

As of @svelte.dev 5.25 you can temporarily override a derived value, which is very handy for optimistic UI

• demo svelte.dev/playground/3...
• docs svelte.dev/docs/svelte/...

A screenshot of https://svelte.dev/playground/3de3a4446cd14bad884ea05fbd35363a?version=5.25.0 showing the new 'writable derived' feature

6 17 170

Svelte @svelte.dev · Mar 21

last chance to grab tickets at the lower price!

Svelte Society @sveltesociety.dev · Mar 17

Tickets are selling fast, and prices are about to go up – on March 22, to be exact! If you haven’t locked yours in yet, now’s the time. If you can't make it to Barcelona you can still join us online. Tickets for the live stream will go on sale soon. See you at Svelte Summit! www.sveltesummit.com

4

Reposted by Svelte

rich harris @rich-harris.dev · Mar 7

PSA for @svelte.dev users: we're planning to change how effect teardowns work to eliminate a common gotcha that affects signal-based frameworks. If the new behaviour would create problems for you, please let us know!

github.com/sveltejs/sve...

fix: on teardown, use the last known value for the signal before the set by trueadm · Pull Request #15469 · sveltejs/svelte

PSA: we are changing how effect teardowns work! Today, if you read some state inside a teardown function, you get the latest state: $effect(() => { const prev = value; return () => { ...

github.com

8 22 190

Reposted by Svelte

Svelte Society @sveltesociety.dev · Feb 14

Now that speakers have been selected we want to share with you our line-up for Svelte Summit Spring 2025! We will host 16 talks across different topics during the two day conference. In addition, @mainmatter.com will also host a workshop. More details on www.sveltesummit.com

11 28

Reposted by Svelte

Simon H @dummdidumm.bsky.social · Feb 12

New in Svelte: A way to create a unique ID that is stable across client and server svelte.dev/docs/svelte/...

3 11 100