Skip to content

breaking: remove the deprecated CSRF option#15437

Merged
elliott-with-the-longest-name-on-github merged 1 commit into
version-3from
rm-checkOrigin
Feb 26, 2026
Merged

breaking: remove the deprecated CSRF option#15437
elliott-with-the-longest-name-on-github merged 1 commit into
version-3from
rm-checkOrigin

Conversation

@benmccann

@benmccann benmccann commented Feb 26, 2026

Copy link
Copy Markdown
Member

Left it in the types so that it shows up in the reference docs for users who are still on SvelteKit 2

@changeset-bot

changeset-bot Bot commented Feb 26, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 3f4d01a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@sveltejs/kit Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@benmccann benmccann added this to the 3.0 milestone Feb 26, 2026
@svelte-docs-bot

Copy link
Copy Markdown

@vercel vercel Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Additional Suggestions:

  1. Test file expects checkOrigin: true in defaults but the option was removed, causing test assertion failures
  1. Test configurations still use checkOrigin: true which has been changed from deprecated to removed, causing config validation to throw an error.
Fix on Vercel

@benmccann benmccann force-pushed the rm-checkOrigin branch 2 times, most recently from 43f85fb to 5ab443b Compare February 26, 2026 21:58
@elliott-with-the-longest-name-on-github elliott-with-the-longest-name-on-github merged commit 87603d1 into version-3 Feb 26, 2026
21 checks passed
Rich-Harris pushed a commit that referenced this pull request Jun 5, 2026
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to version-3, this PR
will be updated.

⚠️⚠️⚠️⚠️⚠️⚠️

`version-3` is currently in **pre mode** so this branch has prereleases
rather than normal releases. If you want to exit prereleases, run
`changeset pre exit` on `version-3`.

⚠️⚠️⚠️⚠️⚠️⚠️

# Releases
## @sveltejs/adapter-auto@8.0.0-next.0

### Major Changes


- breaking: require SvelteKit 3
([#15506](#15506))


### Patch Changes

- Updated dependencies
[[`fa335bd`](fa335bd),
[`3031d89`](3031d89),
[`cb9d416`](cb9d416),
[`caf3a18`](caf3a18),
[`4777827`](4777827),
[`a2792e2`](a2792e2),
[`ba36148`](ba36148),
[`48e8710`](48e8710),
[`e2f3075`](e2f3075),
[`047d6a0`](047d6a0),
[`87603d1`](87603d1),
[`096962c`](096962c),
[`d545970`](d545970),
[`e2f3075`](e2f3075),
[`d06affc`](d06affc),
[`8af47eb`](8af47eb),
[`e2f3075`](e2f3075),
[`5c4d130`](5c4d130),
[`3f11f35`](3f11f35),
[`caf3a18`](caf3a18),
[`8823037`](8823037),
[`1d76212`](1d76212),
[`0dc0548`](0dc0548),
[`00d81fa`](00d81fa)]:
  - @sveltejs/kit@3.0.0-next.0
## @sveltejs/adapter-cloudflare@8.0.0-next.0

### Major Changes


- breaking: upgrade `@cloudflare/workers-types` to 4.20260219.0
([#15347](#15347))


- breaking: upgrade minimum `wrangler` version to ^4.67.0
([#15347](#15347))


- breaking: remove `platform.context` in favour of `platform.ctx`
([#15347](#15347))


- breaking: require SvelteKit 3
([#15506](#15506))


### Patch Changes


- chore: check the `WORKERS_CI` environment variable to determine if
we're building for Cloudflare Workers
([#13733](#13733))

- Updated dependencies
[[`fa335bd`](fa335bd),
[`3031d89`](3031d89),
[`cb9d416`](cb9d416),
[`caf3a18`](caf3a18),
[`4777827`](4777827),
[`a2792e2`](a2792e2),
[`ba36148`](ba36148),
[`48e8710`](48e8710),
[`e2f3075`](e2f3075),
[`047d6a0`](047d6a0),
[`87603d1`](87603d1),
[`096962c`](096962c),
[`d545970`](d545970),
[`e2f3075`](e2f3075),
[`d06affc`](d06affc),
[`8af47eb`](8af47eb),
[`e2f3075`](e2f3075),
[`5c4d130`](5c4d130),
[`3f11f35`](3f11f35),
[`caf3a18`](caf3a18),
[`8823037`](8823037),
[`1d76212`](1d76212),
[`0dc0548`](0dc0548),
[`00d81fa`](00d81fa)]:
  - @sveltejs/kit@3.0.0-next.0
## @sveltejs/adapter-netlify@7.0.0-next.0

### Major Changes


- chore: use `rolldown` for edge function bundling
([#15432](#15432))


- breaking: write output that conforms to the stable [Netlify Frameworks
API](https://docs.netlify.com/build/frameworks/frameworks-api/).
([#15294](#15294))
  
Deploying and previewing with Netlify CLI now requires
[v17.31.0](https://github.com/netlify/cli/releases/tag/v17.31.0) or
later. Run `npm i -g netlify-cli@latest` to upgrade.

- breaking: require SvelteKit 3
([#15506](#15506))


- breaking: edge function build target is now `es2022`
([#15432](#15432))


### Patch Changes

- Updated dependencies
[[`fa335bd`](fa335bd),
[`3031d89`](3031d89),
[`cb9d416`](cb9d416),
[`caf3a18`](caf3a18),
[`4777827`](4777827),
[`a2792e2`](a2792e2),
[`ba36148`](ba36148),
[`48e8710`](48e8710),
[`e2f3075`](e2f3075),
[`047d6a0`](047d6a0),
[`87603d1`](87603d1),
[`096962c`](096962c),
[`d545970`](d545970),
[`e2f3075`](e2f3075),
[`d06affc`](d06affc),
[`8af47eb`](8af47eb),
[`e2f3075`](e2f3075),
[`5c4d130`](5c4d130),
[`3f11f35`](3f11f35),
[`caf3a18`](caf3a18),
[`8823037`](8823037),
[`1d76212`](1d76212),
[`0dc0548`](0dc0548),
[`00d81fa`](00d81fa)]:
  - @sveltejs/kit@3.0.0-next.0
## @sveltejs/adapter-node@6.0.0-next.0

### Major Changes


- chore: migrate from rollup to rolldown
([#15297](#15297))


- breaking: require SvelteKit 3
([#15506](#15506))


### Patch Changes

- Updated dependencies
[[`fa335bd`](fa335bd),
[`3031d89`](3031d89),
[`cb9d416`](cb9d416),
[`caf3a18`](caf3a18),
[`4777827`](4777827),
[`a2792e2`](a2792e2),
[`ba36148`](ba36148),
[`48e8710`](48e8710),
[`e2f3075`](e2f3075),
[`047d6a0`](047d6a0),
[`87603d1`](87603d1),
[`096962c`](096962c),
[`d545970`](d545970),
[`e2f3075`](e2f3075),
[`d06affc`](d06affc),
[`8af47eb`](8af47eb),
[`e2f3075`](e2f3075),
[`5c4d130`](5c4d130),
[`3f11f35`](3f11f35),
[`caf3a18`](caf3a18),
[`8823037`](8823037),
[`1d76212`](1d76212),
[`0dc0548`](0dc0548),
[`00d81fa`](00d81fa)]:
  - @sveltejs/kit@3.0.0-next.0
## @sveltejs/adapter-static@4.0.0-next.0

### Major Changes


- breaking: require SvelteKit 3
([#15506](#15506))


### Patch Changes

- Updated dependencies
[[`fa335bd`](fa335bd),
[`3031d89`](3031d89),
[`cb9d416`](cb9d416),
[`caf3a18`](caf3a18),
[`4777827`](4777827),
[`a2792e2`](a2792e2),
[`ba36148`](ba36148),
[`48e8710`](48e8710),
[`e2f3075`](e2f3075),
[`047d6a0`](047d6a0),
[`87603d1`](87603d1),
[`096962c`](096962c),
[`d545970`](d545970),
[`e2f3075`](e2f3075),
[`d06affc`](d06affc),
[`8af47eb`](8af47eb),
[`e2f3075`](e2f3075),
[`5c4d130`](5c4d130),
[`3f11f35`](3f11f35),
[`caf3a18`](caf3a18),
[`8823037`](8823037),
[`1d76212`](1d76212),
[`0dc0548`](0dc0548),
[`00d81fa`](00d81fa)]:
  - @sveltejs/kit@3.0.0-next.0
## @sveltejs/adapter-vercel@7.0.0-next.0

### Major Changes


- chore: use `rolldown` for edge function bundling
([#15432](#15432))


- breaking: edge function build target is now `es2022`
([#15432](#15432))


### Patch Changes

- Updated dependencies
[[`fa335bd`](fa335bd),
[`3031d89`](3031d89),
[`cb9d416`](cb9d416),
[`caf3a18`](caf3a18),
[`4777827`](4777827),
[`a2792e2`](a2792e2),
[`ba36148`](ba36148),
[`48e8710`](48e8710),
[`e2f3075`](e2f3075),
[`047d6a0`](047d6a0),
[`87603d1`](87603d1),
[`096962c`](096962c),
[`d545970`](d545970),
[`e2f3075`](e2f3075),
[`d06affc`](d06affc),
[`8af47eb`](8af47eb),
[`e2f3075`](e2f3075),
[`5c4d130`](5c4d130),
[`3f11f35`](3f11f35),
[`caf3a18`](caf3a18),
[`8823037`](8823037),
[`1d76212`](1d76212),
[`0dc0548`](0dc0548),
[`00d81fa`](00d81fa)]:
  - @sveltejs/kit@3.0.0-next.0
## @sveltejs/enhanced-img@1.0.0-next.0

### Major Changes


- breaking: require Node 22 or newer
([#12548](#12548))


### Minor Changes


- breaking: require Vite 8 and `vite-plugin-svelte` 7
([#15542](#15542))
## @sveltejs/kit@3.0.0-next.0

### Major Changes


- breaking: TypeScript 6 is now the minimum required version
([#15930](#15930))


- breaking: upgrade to cookie v1. Cookie names must now contain only
ASCII characters ([#13386](#13386))


- breaking: require Node 22 or newer
([#12548](#12548))


- breaking: remove the `preloadStrategy` option. `modulepreload` will
always be used ([#15256](#15256))


- breaking: default the cookie `path` option to `'/'`
([#15398](#15398))


- breaking: remove `@sveltejs/kit/node/polyfills`
([#15430](#15430))


- breaking: add `config.kit.output.linkHeaderPreload` to preload using
the `Link` header ([#15939](#15939))


- breaking: require `@sveltejs/vite-plugin-svelte` v7
([#15371](#15371))


- breaking: remove `createEntries` from the `Builder` object passed to
adapter functions ([#15509](#15509))


- breaking: remove the deprecated CSRF `checkOrigin` option in favor of
`trustedOrigins` ([#15437](#15437))


- breaking: the `delta` property now only exists for `popstate`
navigation events ([#15522](#15522))


- breaking: remove deprecated `pragma` header in version polling for
improved CORS support
([#15428](#15428))


- breaking: require Svelte 5.48.0 or newer
([#15371](#15371))


- chore: change `error`, `isHttpError`, `redirect`, and `isRedirect` to
refer to public type instead of internal class
([#15250](#15250))


- breaking: require Vite 8. Provides new functionality even for existing
Vite 8 users such as faster builds with Vite hook filters and more
powerful SvelteKit adapters with the Vite environment API
([#15371](#15371))


- breaking: remove `data-sveltekit-*` option `'off'` in favour of
`false` ([#15907](#15907))


### Minor Changes


- feat: resolve paths using the Vite config `root` option instead of
`process.cwd()` to better support monorepo configurations such as Vitest
workspaces ([#15469](#15469))


- chore: deprecate `Response` helpers in favor of platform-provided
alternatives ([#15448](#15448))


- feat: explicit env vars
([#15934](#15934))


### Patch Changes


- fix: remove check for svelte.config.js before running `sync`
([#15946](#15946))


- fix: generate a placeholder tsconfig.json to squelch sync-time
warnings ([#15948](#15948))


- chore: remove dependency on kleur
([#12548](#12548))


- chore: remove dependency on `set-cookie-parser`
([#15384](#15384))


- fix: allow use of `$app/env/public` in service workers
([#15950](#15950))
## @sveltejs/package@3.0.0-next.0

### Major Changes


- breaking: require Node 22 or newer
([#12548](#12548))


### Patch Changes


- chore: remove dependency on kleur
([#12548](#12548))

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants