Merge branch 'master' into legacy-builds

fix: prevent duplicate CSS files after build (#9382)

Co-authored-by: Bjorn Lu <bjornlu.dev@gmail.com>
Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>

fix: update broken link in error message

docs: update changelog with link to security advisory

Version Packages (#9601)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Merge pull request from GHSA-gv7g-x59x-wf8f

* fix: do a case-insensitive comparison when checking header value

* changeset

* remove export

* Update .changeset/happy-pots-move.md

fix(create): exclude tests in package.template.json (#9584)

* fix(create): exclude tests in package.template.json

* fix: tweak package.template.json

* chore: add changeset

* chore: fix changeset

* Update .changeset/large-pandas-swim.md

---------

Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>

chore: update changelog with published CVE

Version Packages (#9599)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Merge pull request from GHSA-5p75-vc5g-8rv2

* fix: address security advisory CVE-2023-29003 by enabling CSRF protection for plain/text requests

* Protect PUT/PATCH/DELETE. Add comment explicitly mentioning CSRF

* update docs

* update changeset

* Update packages/kit/types/index.d.ts

Co-authored-by: Conduitry <git@chor.date>
* Update packages/kit/types/index.d.ts

* Update cool-lies-fly.md

* Update packages/kit/src/utils/http.js

Co-authored-by: Dominik G. <dominik.goepel@gmx.de>
* Update packages/kit/types/index.d.ts

Co-authored-by: Dominik G. <dominik.goepel@gmx.de>
* test(csrf): include additional methods and content-types

---------

Co-authored-by: Conduitry <git@chor.date>
Co-authored-by: Dominik G. <dominik.goepel@gmx.de>

fix: pin undici to 5.20.0 (#9591)

chore(deps): update pnpm to v7.31.0 (#9597)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Version Packages (#9554)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

fix: throw error when file can't be found in Vite manifest (#9558)

Prevents an infinite loop which makes debugging such errors harder

fix: balance parentheses in error about wrong content type for action (#9513)

* Balance parantheses

* Add changeset

* Update .changeset/unlucky-garlics-yell.md

Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>
---------

Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>

chore: bump site-kit, use new components (#9535)

* chore: bump site-kit, use new components

- removed most of search as it's now part of site-kit
- use new shell/separator components
- adjust NavItem usages

* oops

* oh

* bump, use barrel exports

* fix type usage

chore(deps): update pnpm to v7.30.5 (#9536)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix: pass publicDir in ssr (#9565)

feat: expose stronger typed `SubmitFunction` (#9201)

partially implements #7161

---------

Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>

fix: make `error.message` enumerable (#9440)

fixes #9010

---------

Co-authored-by: Rich Harris <git@rich-harris.dev>
Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>

chore(deps): update pnpm to v7.30.3 (#9498)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Version Packages (#9507)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

create separate functions for ISR routes (#9504)

Co-authored-by: Rich Harris <git@rich-harris.dev>

Version Packages (#9485)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

add HMR to fallback error pages in dev (#9497)

* add HMR to fallback error pages in dev

* Update packages/kit/src/runtime/server/utils.js

---------

Co-authored-by: Rich Harris <git@rich-harris.dev>

chore(deps): update pnpm to v7.30.1 (#9493)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix: add `submitter` type to `SubmitFunction` input argument (#9484)

Fixes #9483

Version Packages (#9461)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

feat: upgrade to TypeScript 5 (#9435)

* feat: upgrade to TypeScript 5

* stick with NodeNext

---------

Co-authored-by: Rich Harris <git@rich-harris.dev>

chore: upgrade to Vite 4.2 (#9434)

* chore: upgrade to Vite 4.2

* Update .changeset/gentle-vans-kick.md

Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>
---------

Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>

add dark mode styles to default error page (#9460)

Co-authored-by: Rich Harris <git@rich-harris.dev>

reload after error (#9441)

* reload after error

* only apply to unexpected errors, and warn that the page will be reloaded

---------

Co-authored-by: Rich Harris <git@rich-harris.dev>

chore(deps): update pnpm to v7.30.0 (#9450)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Version Packages (#9433)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

chore: format

fix: enhance and tighten up Vercel adapter warnings (#9436)

- warn when prerender setting makes isr config useless
- don't show cron warning when everything's valid
- allow to set isr to false to clear isr config in leafs (else it's impossible to do so because config is merged at the top level)
- prefixed all warnings with "Warning:" which should help detect the Vercel log dashboard show these in condensed mode where only warnings/errors are shown
- prerender = 'auto' routes are now also excempt from further processing if we can determine that this is equal to prerender = true (because there are no dynamic routes)

---------

Co-authored-by: Rich Harris <richard.a.harris@gmail.com>

Merge branch 'master' into legacy-builds

Version Packages (#9391)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

throw error if isr route uses edge runtime (#9432)

* throw error if isr route uses edge runtime

* please prettier

---------

Co-authored-by: Rich Harris <git@rich-harris.dev>
Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>

fix: don't start debugger on 404s  (#9424)

docs: mention the types without types feature (#9397)

Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>

chore(deps): update all non-major dependencies (#9417)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>

feat: expose submitter in SubmitFunction (#9425)

closes #9414

docs: update data-sveltekit-keepfocus docs (#9421)

---------

Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>

fix(adapter-node): only send cache header when static resource is 200 (#9394)

fixes #9393

---------

Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>

fix: allow extending multiple other tsconfigs (#9413)

possible since typescript 5.0
closes #9412

---------

Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>

feat: add data-sveltekit-replacestate and -keepfocus options to links (#9019)

Closes #9014
Closes #7895

---------

Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>
Co-authored-by: Simon Holthausen <simon.holthausen@vercel.com>

fix: handle srcset attributes with newline after comma (#9388)

fixes #9369

Version Packages (#9366)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

chore: fix invalid changeset (#9365)

chore: upgrade changesets (#9364)

chore(deps): update pnpm to v7.29.1 (#9356)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore: replace deprecated property access in preparation for TS 5.0 (#9361)

fix: redirect when previewing prerendered pages (#9353)

closes #8839

fix: persist DOM state on beforeunload (#9345)

fixes #9098

feat: pause on debugger for full page reloads in dev (#9305)

closes #9284

feat: expose `base` via `$service-worker`, make paths relative (#9250)

closes #4714

---------

Co-authored-by: Simon Holthausen <simon.holthausen@vercel.com>
Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>

fix: account for server-emitted assets when prerendering (#9349)

fixes #9146

fix: don't automatically prerender non-SSR'd pages (#9352)

reverts #8131
This reverts the optimisation wherein pages with ssr = false and no explicit prerender = false would automatically be prerendered, as it turns out to be unsafe.

fixes #9275
fixes #8428

fix: update @clack/prompts (#9346)

return 308s instead of 301s when normalising paths (#9351)

* return 308s instead of 301s when normalising paths - fixes #9350

* remove only

run beforeNavigate callbacks after cancelled unloading navigation - closes #9170 (#9347)

don't discourage use of `adapter-vercel` (#9344)

* don't discourage use of `adapter-vercel`

* same for netlify

* changeset

avoid FOUC when using CSS modules in dev (#9323)

docs: update adapter-node.md (#9309)

* Update adapter-node.md

fix npm ci command line
extend ORIGIN samples

* Update documentation/docs/25-build-and-deploy/40-adapter-node.md

Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>
* Update documentation/docs/25-build-and-deploy/40-adapter-node.md

Co-authored-by: Rich Harris <hello@rich-harris.dev>
---------

Co-authored-by: Rich Harris <hello@rich-harris.dev>
Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>

fix: deal with fast consecutive promise resolutions when streaming (#9332)

* fix: deal with fast consecutive promise resolutions when streaming

fixes #9330

* Update packages/kit/src/utils/streaming.js

fix: remove buggy cookie path detection (#9298)

closes #9130

---------

Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>

Added BODY_SIZE_LIMIT to the env variables recognized by the node adapter (#9326)

* Added BODY_SIZE_LIMIT to the environment variables recognized by the node adapter

* Added changeset

* Update .changeset/perfect-brooms-hope.md

---------

Co-authored-by: Rich Harris <hello@rich-harris.dev>

Version Packages (#9329)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

fix: required parameters placed after missing optional parameters are no longer skipped (#9331)

* fix: required parameters placed after missing optional parameters are no longer skipped

* Update .changeset/loud-ghosts-worry.md

Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>
---------

Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>

chore(deps): update pnpm to v7.29.0 (#9327)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix respect `<base>` when crawling (#9257)

together with setting config.kit.paths.relative to false this closes #8559

fix: omit hash from global name during dev (#9310)

closes #9225
Also adds some docs explaining how to set version.name to the current commit hash

fix: reset scroll before resetting focus (#9311)

closes #9189

Version Packages (#9320)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

fix(create-svelte): add hint when scaffolding (#9318)

* fix(create-svelte): add hint when scaffolding

* chore: add changeset

* chore: apply suggestions

chore(deps): update dependency eslint-plugin-unicorn to v46 (#9308)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Version Packages (#9286)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

use es2022 instead of es2020 - closes #8980 (#9293)

always generate `404.html` (#9294)

* add fallback option to adapter-cloudflare

* always generate fallback

* Update packages/adapter-cloudflare/index.js

Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>
* format

---------

Co-authored-by: ajgeiss0702 <ajgeiss72@gmail.com>
Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>

chore: restore bug reporting section of readme (#9292)

* chore: restore bug reporting section of readme

* Update README.md

Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>
---------

Co-authored-by: Rich Harris <richard.a.harris@gmail.com>

SPA docs (#9291)

* SPA docs - closes #8631

* fixes

* make SPA docs less adapter-specific

always include `<link rel="stylesheet">` even if excluded from Link headers - closes #8238 (#9255)

chore: `dedent` (#9273)

* create dedent utility

* recursive dedenting

* use `dedent` when creating env declarations

* use dedent in manifest generation

* dedent more stuff

* oops

* use dedent for virtual modules

* add comment

* Update packages/kit/src/core/sync/utils.js

Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>
---------

Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>

tweak adapter-static docs (#9290)

feat: add `cookies.getAll` (#9287)

* implement `cookies.getAll`

* check domain and path

* oops

provide access to request context via `event.platform` (#9280)

* provide access to request context via `event.platform` - closes #8706

* cheat

set `form` to `null` before updating it with real values (#9267)

* set `form` to `null` before updating it with real values - fixes #8513

* changeset and test

Version Packages (#9279)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

use `node` export condition when bundling - closes #9264 (#9276)

fix: successive optional route parameters can now be empty (#9266)

* Optional chained parameters can be skipped - close #9261

* Update changeset description

Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>
---------

Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>

Version Packages (#9268)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

add catch-all route for framework 404s rather than platform 404s (#9265)

* add catch-all route for framework 404s rather than platform 404s - closes #8287

* Update packages/adapter-vercel/index.js

Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>
---------

Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>

Version Packages (#9258)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

fix: correct undefined reference to global var with Vitest (#9252)

docs: fix 70-packaging.md (#9254)

fix: Update Kit changelog (#9251)

* fix: Update Kit changelog

oops

* Update CHANGELOG.md

---------

Co-authored-by: Rich Harris <richard.a.harris@gmail.com>

Version Packages (#9249)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

feat: warn when calling depends(...) with special URI scheme (#9246)

* warn when using special scheme in depends(...)

* changeset

* DRY

---------

Co-authored-by: Rich Harris <hello@rich-harris.dev>

Version Packages (#9247)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>