[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@cloudflare/workers-types	5.20260929.1 → 5.20261001.1
@sveltejs/kit (source)	2.62.0 → 2.70.3

---

Release Notes

cloudflare/workerd (@​cloudflare/workers-types)

v5.20261001.1

Compare Source

v5.20260930.2

Compare Source

v5.20260930.1

Compare Source

sveltejs/kit (@​sveltejs/kit)

v2.70.3

Compare Source

Patch Changes

• fix: avoid eagerly reading $app/state dependencies during module initialization (b61018d)

v2.70.2

Compare Source

Patch Changes

• fix: prevent quadratic backtracking in Accept header content negotiation (#​1)

v2.70.1

Compare Source

Patch Changes

• docs: update links to hooks documentation (#​16417)

v2.70.0

Compare Source

Minor Changes

• feat: move defineEnvVars to @sveltejs/kit/env (#​16378)

Patch Changes

• fix: enable CSRF protection in builds with a non-production NODE_ENV value (#​16313)

v2.69.3

Compare Source

Patch Changes

• fix: detect destructured load and actions exports during type generation (#​16329)

• fix: ensure CSS URL references are absolute when paths.relative is false (#​16315)

• fix: align MAX_COOKIE_SIZE with RFC 6265bis (#​16322)

v2.69.2

Compare Source

Patch Changes

• fix: set define values on globalThis when running Vitest (#​16246)

v2.69.1

Compare Source

Patch Changes

• fix: prevent prototype pollution when deleting file inputs (#​16218)

• fix: prevent unhandled promise rejection (#​16219)

v2.69.0

Compare Source

Minor Changes

• feat: expose submitted property of remote forms (#​14811)

Patch Changes

• fix: clear issues and touched states on form reset (#​16163)

• fix: return undefined from fields.branch.issues() when only fields.branch.leaf has issues (#​16187)

v2.68.0

Compare Source

Minor Changes

• feat: expose RemoteFormEnhanceInstance and RemoteFormEnhanceCallback types (#​15816)

• feat: set value of submit fields when form is submitted (#​15979)

Patch Changes

• fix: skip native_navigation when __data.json returns 404 on a static fallback page (#​16135)

• fix: ignore third-party monkeypatches in pushState/replaceState warning detection (#​15267)

• fix: snapshot form fields on read (#​16150)

• fix: strip field prefix before erroring on duplicates (#​16151)

• fix: call reset function via prototype (#​16138)

• chore: fix navigation type hover info (#​16147)

v2.67.0

Compare Source

Minor Changes

• feat: add prerender.handleInvalidUrl option for invalid URLs discovered while crawling (#​16088)

Patch Changes

• fix: support exactOptionalPropertyTypes for optional form schema fields (#​15866)

• fix: avoid unnecessarily overriding a user's Vite 8 codeSplitting setting (#​16118)

v2.66.0

Compare Source

Minor Changes

• feat: precompress prerendered .md and .mdx files (#​15893)

• feat: warn the user when they forget to make boolean inputs optional in their form schemas (#​15804)

Patch Changes

• fix: blur active element before component update during navigation so that blur/focusout handlers fire while old component data is still valid (#​15452)

• fix: ensure base is available from $service-worker during development (#​15882)

• fix: use correct relative asset paths when rendering an error page for a missing __data.json request (#​15884)

• fix: preserve active for await consumers across query.live reconnects (#​16022)

• fix: settle query.live reconnect promise on all exit paths, preventing invalidateAll() from deadlocking when a live query is offline or interrupted (#​16022)

• fix: preserve last value when a query.live stream completes without yielding on reconnect (#​16022)

• fix: remove types: ['node'] from generated tsconfig to avoid errors when @types/node is not installed (#​15709)

• fix: prefer pages over endpoints when prerendering (#​16076)

• fix: restore snapshots after afterNavigate callbacks (#​16066)

• fix: support ws:/wss: and trusted-types-eval for CSP sources (#​15938)

• fix: omit empty file inputs from remote form data (#​15898)

• fix: fail early if a route with +page and +server is marked as prerenderable (#​16075)

• fix: wait a tick before resetting forms (#​15805)

• fix: preflight schemas apply correctly when chained before for (#​15863)

• fix: blank page in SPA mode when root layout load() throws (#​15798)

• fix: pass all unknown options from the sveltekit Vite plugin through to vite-plugin-svelte (#​16010)

v2.65.2

Compare Source

Patch Changes

• fix: throw an error when prerendering a root +server.js that returns a non-HTML response (#​15994)

• fix: decode base64-serialized fetch bodies before caching them for client-side replay (#​16034)

• fix: correctly access explicit dynamic public environment variables from prerendered pages and service workers (#​16024)

• fix: allow preloadCode to be called during initial page load (#​16028)

• fix: send cache-control: private, no-store on remote function responses so personalized query results can never be cached by shared caches (#​16020)

• fix: preserve the HTTP status and error body when a remote function request fails in transport (e.g. a 401/403 from a handle hook), instead of reporting a generic 500 (#​16021)

• fix: avoid loading universal nodes during build analysis when the app uses a hash router (#​16042)

• fix: correctly serve client entry during development when using the pnpm global virtual store (#​16045)

• fix: normalize path separators when comparing config (#​16037)

• fix: ensure building resolves correctly to allow avoiding build-time explicit environment variable validation (#​16058)

• fix: prevent unhandled promise rejections when remote function failures are consumed via current/error instead of await (#​16018)

v2.65.1

Compare Source

Patch Changes

• fix: avoid importing the Vite development client code into builds with a non-standard NODE_ENV (#​16023)

• fix: don't emit the unused bundle and stylesheet files when using bundleStrategy: 'inline' (#​16025)

• fix: reset queries before navigating when invalidateAll is set (#​16014)

• fix: regression in loading assets for absolute path apps (#​16026)

v2.65.0

Compare Source

Minor Changes

• feat: allow queries to refresh other queries (#​16012)

Patch Changes

• fix: dedupe remote data (#​15991)

• fix: skip client build if all routes have CSR disabled (#​15936)

v2.64.0

Compare Source

Minor Changes

• feat: allow commands to receive File objects (#​15978)

Patch Changes

• fix: avoid server components from being bundled if SSR is turned off for a route (#​15982)

v2.63.1

Compare Source

Patch Changes

• fix: use SSE for query.live (#​15957)

• fix: use forward slashes in the generated env.d.ts import path on Windows (#​15977)

• fix: allow $app/environment with a warning when explicitEnvironmentVariables is enabled (#​15980)

• fix: avoid importing Vite while validating explicit environment variables (#​15953)

• docs: adjust the release version of explicit env vars (#​15968)

• fix: ensure version is defined when importing from $app/env with explicit environment variables (#​15971)

v2.63.0

Compare Source

Minor Changes

• feat: explicit env vars (#​15934)

Patch Changes

• fix: remove check for svelte.config.js before running sync (#​15946)

• fix: generate a placeholder tsconfig.json to squelch sync-time warnings (#​15948)

• fix: allow use of $app/env/public in service workers (#​15950)

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 10am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​sveltejs/​kit@​2.62.0 ⏵ 2.70.3	+1	+4	+1	+1
	@​cloudflare/​workers-types@​5.20260929.1 ⏵ 5.20261001.1			+1

View full report

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://renovate-npm-packages-void-cloud.voidzero-docs.workers.dev (commit d65bd62)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://51cb8b4f-void-cloud.voidzero-docs.workers.dev	d65bd62	2026-10-05T01:17:08.024Z	Visit the dashboard ↗