@sveltejs/kit 2.56.0 → 2.57.0

package/src/exports/vite/index.js

@@ -1,3 +1,6 @@
+/** @import { Options } from '@sveltejs/vite-plugin-svelte' */
+/** @import { PreprocessorGroup } from 'svelte/compiler' */
+/** @import { ConfigEnv, Manifest, Plugin, ResolvedConfig, UserConfig, ViteDevServer } from 'vite' */
 import fs from 'node:fs';
 import path from 'node:path';
 import process from 'node:process';
@@ -41,6 +44,7 @@ import {
 import { import_peer } from '../../utils/import.js';
 import { compact } from '../../utils/array.js';
 import { should_ignore, has_children } from './static_analysis/utils.js';
+import { treeshake_prerendered_remotes } from './build/remote.js';
 
 const cwd = posixify(process.cwd());
 
@@ -86,7 +90,7 @@ const options_regex = /(export\s+const\s+(prerender|csr|ssr|trailingSlash))\s*=/
 /** @type {Set<string>} */
 const warned = new Set();
 
-/** @type {import('svelte/compiler').PreprocessorGroup} */
+/** @type {PreprocessorGroup} */
 const warning_preprocessor = {
 	script: ({ content, filename }) => {
 		if (!filename) return;
@@ -129,12 +133,12 @@ const warning_preprocessor = {
 
 /**
  * Returns the SvelteKit Vite plugins.
- * @returns {Promise<import('vite').Plugin[]>}
+ * @returns {Promise<Plugin[]>}
  */
 export async function sveltekit() {
 	const svelte_config = await load_config();
 
-	/** @type {import('@sveltejs/vite-plugin-svelte').Options['preprocess']} */
+	/** @type {Options['preprocess']} */
 	let preprocess = svelte_config.preprocess;
 	if (Array.isArray(preprocess)) {
 		preprocess = [...preprocess, warning_preprocessor];
@@ -144,7 +148,7 @@ export async function sveltekit() {
 		preprocess = warning_preprocessor;
 	}
 
-	/** @type {import('@sveltejs/vite-plugin-svelte').Options} */
+	/** @type {Options} */
 	const vite_plugin_svelte_options = {
 		configFile: false,
 		extensions: svelte_config.extensions,
@@ -184,10 +188,10 @@ let build_metadata = undefined;
  * - https://rollupjs.org/guide/en/#output-generation-hooks
  *
  * @param {{ svelte_config: import('types').ValidatedConfig }} options
- * @return {Promise<import('vite').Plugin[]>}
+ * @return {Promise<Plugin[]>}
  */
 async function kit({ svelte_config }) {
-	/** @type {import('vite')} */
+	/** @type {typeof import('vite')} */
 	const vite = await import_peer('vite');
 
 	// @ts-ignore `vite.rolldownVersion` only exists in `vite 8`
@@ -198,10 +202,10 @@ async function kit({ svelte_config }) {
 
 	const version_hash = hash(kit.version.name);
 
-	/** @type {import('vite').ResolvedConfig} */
+	/** @type {ResolvedConfig} */
 	let vite_config;
 
-	/** @type {import('vite').ConfigEnv} */
+	/** @type {ConfigEnv} */
 	let vite_config_env;
 
 	/** @type {boolean} */
@@ -213,7 +217,7 @@ async function kit({ svelte_config }) {
 	/** @type {() => Promise<void>} */
 	let finalise;
 
-	/** @type {import('vite').UserConfig} */
+	/** @type {UserConfig} */
 	let initial_config;
 
 	const service_worker_entry_file = resolve_entry(kit.files.serviceWorker);
@@ -233,7 +237,7 @@ async function kit({ svelte_config }) {
 	const sourcemapIgnoreList = /** @param {string} relative_path */ (relative_path) =>
 		relative_path.includes('node_modules') || relative_path.includes(kit.outDir);
 
-	/** @type {import('vite').Plugin} */
+	/** @type {Plugin} */
 	const plugin_setup = {
 		name: 'vite-plugin-sveltekit-setup',
 
@@ -267,7 +271,7 @@ async function kit({ svelte_config }) {
 				const generated = path.posix.join(kit.outDir, 'generated');
 
 				// dev and preview config can be shared
-				/** @type {import('vite').UserConfig} */
+				/** @type {UserConfig} */
 				const new_config = {
 					resolve: {
 						alias: [
@@ -437,7 +441,7 @@ async function kit({ svelte_config }) {
 		}
 	};
 
-	/** @type {import('vite').Plugin} */
+	/** @type {Plugin} */
 	const plugin_virtual_modules = {
 		name: 'vite-plugin-sveltekit-virtual-modules',
 
@@ -561,7 +565,7 @@ async function kit({ svelte_config }) {
 	/**
 	 * Ensures that client-side code can't accidentally import server-side code,
 	 * whether in `*.server.js` files, `$app/server`, `$lib/server`, or `$env/[static|dynamic]/private`
-	 * @type {import('vite').Plugin}
+	 * @type {Plugin}
 	 */
 	const plugin_guard = {
 		name: 'vite-plugin-sveltekit-guard',
@@ -668,7 +672,7 @@ async function kit({ svelte_config }) {
 		}
 	};
 
-	/** @type {import('vite').ViteDevServer} */
+	/** @type {ViteDevServer} */
 	let dev_server;
 
 	/** @type {Array<{ hash: string, file: string }>} */
@@ -680,7 +684,7 @@ async function kit({ svelte_config }) {
 	/** @type {Set<string>} Track which remote hashes have already been emitted */
 	const emitted_remote_hashes = new Set();
 
-	/** @type {import('vite').Plugin} */
+	/** @type {Plugin} */
 	const plugin_remote = {
 		name: 'vite-plugin-sveltekit-remote',
 
@@ -809,7 +813,7 @@ async function kit({ svelte_config }) {
 		}
 	};
 
-	/** @type {import('vite').Plugin} */
+	/** @type {Plugin} */
 	const plugin_compile = {
 		name: 'vite-plugin-sveltekit-compile',
 
@@ -821,7 +825,7 @@ async function kit({ svelte_config }) {
 			// avoids overwriting the base setting that's also set by Vitest
 			order: 'pre',
 			handler(config) {
-				/** @type {import('vite').UserConfig} */
+				/** @type {UserConfig} */
 				let new_config;
 
 				const kit_paths_base = kit.paths.base || '/';
@@ -1063,13 +1067,13 @@ async function kit({ svelte_config }) {
 		 */
 		writeBundle: {
 			sequential: true,
-			async handler(_options) {
+			async handler(_options, server_bundle) {
 				if (secondary_build_started) return; // only run this once
 
 				const verbose = vite_config.logLevel === 'info';
 				const log = logger({ verbose });
 
-				/** @type {import('vite').Manifest} */
+				/** @type {Manifest} */
 				const server_manifest = JSON.parse(read(`${out}/server/.vite/manifest.json`));
 
 				/** @type {import('types').BuildData} */
@@ -1193,7 +1197,7 @@ async function kit({ svelte_config }) {
 					}
 				}
 
-				/** @type {import('vite').Manifest} */
+				/** @type {Manifest} */
 				const client_manifest = JSON.parse(read(`${out}/client/.vite/manifest.json`));
 
 				/**
@@ -1318,6 +1322,15 @@ async function kit({ svelte_config }) {
 					env: { ...env.private, ...env.public }
 				});
 
+				await treeshake_prerendered_remotes(
+					out,
+					remotes,
+					metadata,
+					cwd,
+					server_bundle,
+					vite_config.build.sourcemap
+				);
+
 				// generate a new manifest that doesn't include prerendered pages
 				fs.writeFileSync(
 					`${out}/server/manifest.js`,
@@ -1411,8 +1424,8 @@ async function kit({ svelte_config }) {
 }
 
 /**
- * @param {Record<string, any>} config
- * @param {Record<string, any>} resolved_config
+ * @param {UserConfig} config
+ * @param {UserConfig} resolved_config
  */
 function warn_overridden_config(config, resolved_config) {
 	const overridden = find_overridden_config(config, resolved_config, enforced_config, '', []);

package/src/exports/vite/preview/index.js

@@ -7,7 +7,7 @@ import { loadEnv, normalizePath } from 'vite';
 import { createReadableStream, getRequest, setResponse } from '../../../exports/node/index.js';
 import { installPolyfills } from '../../../exports/node/polyfills.js';
 import { SVELTE_KIT_ASSETS } from '../../../constants.js';
-import { not_found } from '../utils.js';
+import { is_chrome_devtools_request, not_found } from '../utils.js';
 
 /** @typedef {import('http').IncomingMessage} Req */
 /** @typedef {import('http').ServerResponse} Res */
@@ -102,6 +102,10 @@ export async function preview(vite, vite_config, svelte_config) {
 				return;
 			}
 
+			if (is_chrome_devtools_request(pathname, res)) {
+				return;
+			}
+
 			if (pathname.startsWith(base)) {
 				next();
 			} else {

package/src/exports/vite/utils.js

@@ -76,6 +76,24 @@ export function get_env(env_config, mode) {
 	};
 }
 
+/**
+ * Silently respond with 404 for Chrome DevTools workspaces request.
+ * Chrome always requests this at the root, regardless of base path.
+ * Users who want workspaces can install `vite-plugin-devtools-json`,
+ * which takes precedence as Vite plugin middleware runs first.
+ * @param {string} pathname
+ * @param {import('http').ServerResponse} res
+ * @returns {boolean} `true` if the request was handled
+ */
+export function is_chrome_devtools_request(pathname, res) {
+	if (pathname === '/.well-known/appspecific/com.chrome.devtools.json') {
+		res.writeHead(404);
+		res.end('not found');
+		return true;
+	}
+	return false;
+}
+
 /**
  * @param {import('http').IncomingMessage} req
  * @param {import('http').ServerResponse} res

package/src/runtime/app/forms.js

@@ -1,5 +1,6 @@
 import * as devalue from 'devalue';
 import { BROWSER, DEV } from 'esm-env';
+import { noop } from '../../utils/functions.js';
 import { invalidateAll } from './navigation.js';
 import { app as client_app, applyAction } from '../client/client.js';
 import { app as server_app } from '../server/app.js';
@@ -76,7 +77,7 @@ function clone(element) {
  * @param {HTMLFormElement} form_element The form element
  * @param {import('@sveltejs/kit').SubmitFunction<Success, Failure>} submit Submit callback
  */
-export function enhance(form_element, submit = () => {}) {
+export function enhance(form_element, submit = noop) {
 	if (DEV && clone(form_element).method !== 'post') {
 		throw new Error('use:enhance can only be used on <form> fields with method="POST"');
 	}

package/src/runtime/app/server/remote/prerender.js

@@ -5,6 +5,7 @@ import { error, json } from '@sveltejs/kit';
 import { DEV } from 'esm-env';
 import { get_request_store } from '@sveltejs/kit/internal/server';
 import { stringify, stringify_remote_arg } from '../../../shared.js';
+import { noop } from '../../../../utils/functions.js';
 import { app_dir, base } from '$app/paths/internal/server';
 import {
 	create_validator,
@@ -153,7 +154,7 @@ export function prerender(validate_or_fn, fn_or_options, maybe_options) {
 			return result;
 		})();
 
-		promise.catch(() => {});
+		promise.catch(noop);
 
 		return /** @type {RemoteResource<Output>} */ (promise);
 	};

package/src/runtime/app/server/remote/query.js

@@ -4,6 +4,7 @@
 import { get_request_store } from '@sveltejs/kit/internal/server';
 import { create_remote_key, stringify, stringify_remote_arg } from '../../../shared.js';
 import { prerendering } from '__sveltekit/environment';
+import { noop } from '../../../../utils/functions.js';
 import { create_validator, get_cache, get_response, run_remote_function } from './shared.js';
 import { handle_error_and_jsonify } from '../../../server/utils.js';
 import { HttpError, SvelteKitError } from '@sveltejs/kit/internal';
@@ -382,8 +383,5 @@ function update_refresh_value(
 		refreshes[refreshes_key] = promise;
 	}
 
-	return promise.then(
-		() => {},
-		() => {}
-	);
+	return promise.then(noop, noop);
 }

package/src/runtime/app/server/remote/requested.js

@@ -2,6 +2,7 @@
 /** @import { MaybePromise, RemoteQueryInternals } from 'types' */
 import { get_request_store } from '@sveltejs/kit/internal/server';
 import { create_remote_key, parse_remote_arg } from '../../../shared.js';
+import { noop } from '../../../../utils/functions.js';
 import { mark_argument_validated } from './query.js';
 
 /**
@@ -55,7 +56,7 @@ export function requested(query, limit = Infinity) {
 	 */
 	const record_failure = (payload, error) => {
 		const promise = Promise.reject(error);
-		promise.catch(() => {});
+		promise.catch(noop);
 
 		const key = create_remote_key(internals.id, payload);
 		refreshes[key] = promise;
@@ -156,7 +157,7 @@ async function* race_all(array, fn) {
 			value: result
 		}));
 
-		promise.catch(() => {});
+		promise.catch(noop);
 		pending.add(promise);
 	}
 

package/src/runtime/app/server/remote/shared.js

@@ -3,6 +3,7 @@
 import { parse } from 'devalue';
 import { error } from '@sveltejs/kit';
 import { with_request_store, get_request_store } from '@sveltejs/kit/internal/server';
+import { noop } from '../../../../utils/functions.js';
 import {
 	stringify_remote_arg,
 	create_remote_key,
@@ -93,7 +94,7 @@ export async function get_response(internals, arg, state, get_result) {
 			.then((value) => {
 				void unfriendly_hydratable(remote_key, () => stringify(value, state.transport));
 			})
-			.catch(() => {});
+			.catch(noop);
 	}
 
 	return entry.data;

package/src/runtime/client/client.js

@@ -39,6 +39,7 @@ import {
 	PAGE_URL_KEY
 } from './constants.js';
 import { validate_page_exports } from '../../utils/exports.js';
+import { noop } from '../../utils/functions.js';
 import { compact } from '../../utils/array.js';
 import {
 	INVALIDATED_PARAM,
@@ -166,7 +167,7 @@ function native_navigation(url, replace = false) {
 	} else {
 		location.href = url.href;
 	}
-	return new Promise(() => {});
+	return new Promise(noop);
 }
 
 /**
@@ -182,8 +183,6 @@ async function update_service_worker() {
 	}
 }
 
-function noop() {}
-
 /** @type {import('types').CSRRoute[]} All routes of the app. Only available when kit.router.resolution=client */
 let routes;
 /** @type {import('types').CSRPageNodeLoader} */
@@ -940,7 +939,7 @@ async function load_node({ loader, parent, url, params, route, server_data_node
 
 				return promise;
 			},
-			setHeaders: () => {}, // noop
+			setHeaders: noop,
 			depends,
 			parent() {
 				if (is_tracking) {
@@ -1118,8 +1117,8 @@ async function load_route({ id, invalidating, url, params, route, preload }) {
 	// preload modules to avoid waterfall, but handle rejections
 	// so they don't get reported to Sentry et al (we don't need
 	// to act on the failures at this point)
-	errors.forEach((loader) => loader?.().catch(() => {}));
-	loaders.forEach((loader) => loader?.[1]().catch(() => {}));
+	errors.forEach((loader) => loader?.().catch(noop));
+	loaders.forEach((loader) => loader?.[1]().catch(noop));
 
 	/** @type {import('types').ServerNodesResponse | import('types').ServerRedirectNode | null} */
 	let server_data = null;
@@ -1232,7 +1231,7 @@ async function load_route({ id, invalidating, url, params, route, preload }) {
 	});
 
 	// if we don't do this, rejections will be unhandled
-	for (const p of branch_promises) p.catch(() => {});
+	for (const p of branch_promises) p.catch(noop);
 
 	/** @type {Array<import('./types.js').BranchNode | undefined>} */
 	const branch = [];
@@ -3229,7 +3228,7 @@ function create_navigation(current, intent, url, type, target_scroll = null) {
 	});
 
 	// Handle any errors off-chain so that it doesn't show up as an unhandled rejection
-	complete.catch(() => {});
+	complete.catch(noop);
 
 	/** @type {(import('@sveltejs/kit').Navigation | import('@sveltejs/kit').AfterNavigate) & { type: T }} */
 	const navigation = /** @type {any} */ ({

package/src/runtime/client/fetcher.js

@@ -1,11 +1,12 @@
 import { BROWSER, DEV } from 'esm-env';
+import { noop } from '../../utils/functions.js';
 import { hash } from '../../utils/hash.js';
 import { base64_decode } from '../utils.js';
 
 let loading = 0;
 
 /** @type {typeof fetch} */
-const native_fetch = BROWSER ? window.fetch : /** @type {any} */ (() => {});
+const native_fetch = BROWSER ? window.fetch : /** @type {any} */ (noop);
 
 export function lock_fetch() {
 	loading += 1;

package/src/runtime/client/remote-functions/form.svelte.js

@@ -156,6 +156,7 @@ export function form(id) {
 			}
 
 			try {
+				// eslint-disable-next-line @typescript-eslint/await-thenable -- `callback` is typed as returning `void` to allow returning e.g. `Promise<boolean>`
 				await callback({
 					form,
 					data,
@@ -172,7 +173,7 @@ export function form(id) {
 
 		/**
 		 * @param {FormData} data
-		 * @returns {Promise<any> & { updates: (...args: any[]) => any }}
+		 * @returns {Promise<boolean> & { updates: (...args: any[]) => Promise<boolean> }}
 		 */
 		function submit(data) {
 			// Store a reference to the current instance and increment the usage count for the duration
@@ -193,7 +194,7 @@ export function form(id) {
 			/** @type {Error | undefined} */
 			let updates_error;
 
-			/** @type {Promise<any> & { updates: (...args: RemoteQueryUpdate[]) => Promise<any> }} */
+			/** @type {Promise<boolean> & { updates: (...args: RemoteQueryUpdate[]) => Promise<boolean> }} */
 			const promise = (async () => {
 				try {
 					await Promise.resolve();
@@ -230,14 +231,17 @@ export function form(id) {
 
 					if (form_result.type === 'result') {
 						({ issues: raw_issues = [], result } = devalue.parse(form_result.result, app.decoders));
+						const succeeded = raw_issues.length === 0;
 
-						if (!issues.$) {
+						if (succeeded) {
 							if (form_result.refreshes) {
 								apply_refreshes(form_result.refreshes);
 							} else {
 								void invalidateAll();
 							}
 						}
+
+						return succeeded;
 					} else if (form_result.type === 'redirect') {
 						const stringified_refreshes = form_result.refreshes ?? '';
 						if (stringified_refreshes) {
@@ -245,6 +249,7 @@ export function form(id) {
 						}
 						// Use internal version to allow redirects to external URLs
 						void _goto(form_result.location, { invalidateAll: !stringified_refreshes }, 0);
+						return true;
 					} else {
 						throw new HttpError(form_result.status ?? 500, form_result.error);
 					}
@@ -460,8 +465,8 @@ export function form(id) {
 
 		instance[createAttachmentKey()] = create_attachment(
 			form_onsubmit(({ submit, form }) =>
-				submit().then(() => {
-					if (!issues.$) {
+				submit().then((succeeded) => {
+					if (succeeded) {
 						form.reset();
 					}
 				})

package/src/runtime/client/remote-functions/query.svelte.js

@@ -12,6 +12,7 @@ import {
 import * as devalue from 'devalue';
 import { HttpError, Redirect } from '@sveltejs/kit/internal';
 import { DEV } from 'esm-env';
+import { noop } from '../../../utils/functions.js';
 import { with_resolvers } from '../../../utils/promise.js';
 import { tick, untrack } from 'svelte';
 import { create_remote_key, stringify_remote_arg, unfriendly_hydratable } from '../../shared.js';
@@ -30,7 +31,7 @@ import { create_remote_key, stringify_remote_arg, unfriendly_hydratable } from '
  */
 function is_in_effect() {
 	try {
-		$effect.pre(() => {});
+		$effect.pre(noop);
 		return true;
 	} catch {
 		return false;
@@ -371,7 +372,7 @@ export class Query {
 
 		const promise = Promise.reject(error);
 
-		promise.catch(() => {});
+		promise.catch(noop);
 		this.#promise = promise;
 	}
 

package/src/runtime/client/utils.js

@@ -2,6 +2,7 @@ import { BROWSER, DEV } from 'esm-env';
 import { writable } from 'svelte/store';
 import { assets } from '$app/paths';
 import { version } from '__sveltekit/environment';
+import { noop } from '../../utils/functions.js';
 import { PRELOAD_PRIORITIES } from './constants.js';
 
 /* global __SVELTEKIT_APP_VERSION_FILE__, __SVELTEKIT_APP_VERSION_POLL_INTERVAL__ */
@@ -242,7 +243,7 @@ export function notifiable_store(value) {
 }
 
 export const updated_listener = {
-	v: () => {}
+	v: noop
 };
 
 export function create_updated_store() {

package/src/runtime/server/fetch.js

@@ -1,4 +1,5 @@
 import * as set_cookie_parser from 'set-cookie-parser';
+import { noop } from '../../utils/functions.js';
 import { respond } from './respond.js';
 import * as paths from '$app/paths/internal/server';
 import { read_implementation } from '__sveltekit/server';
@@ -175,11 +176,11 @@ export function create_fetch({ event, options, manifest, state, get_cookie_heade
 	};
 
 	// Don't make this function `async`! Otherwise, the user has to `catch` promises they use for streaming responses or else
-	// it will be an unhandled rejection. Instead, we add a `.catch(() => {})` ourselves below to prevent this from happening.
+	// it will be an unhandled rejection. Instead, we add a `.catch(noop)` ourselves below to prevent this from happening.
 	return (input, init) => {
 		// See docs in fetch.js for why we need to do this
 		const response = server_fetch(input, init);
-		response.catch(() => {});
+		response.catch(noop);
 		return response;
 	};
 }
@@ -210,7 +211,7 @@ async function internal_fetch(request, options, manifest, state) {
 			throw new DOMException('The operation was aborted.', 'AbortError');
 		}
 
-		let remove_abort_listener = () => {};
+		let remove_abort_listener = noop;
 		/** @type {Promise<never>} */
 		const abort_promise = new Promise((_, reject) => {
 			const on_abort = () => {

package/src/runtime/server/index.js

@@ -1,4 +1,5 @@
 /** @import { PromiseWithResolvers } from '../../utils/promise.js' */
+import { noop } from '../../utils/functions.js';
 import { with_resolvers } from '../../utils/promise.js';
 import { IN_WEBCONTAINER } from './constants.js';
 import { respond } from './respond.js';
@@ -126,7 +127,7 @@ export class Server {
 							console.error('Remote function schema validation failed:', issues);
 							return { message: 'Bad Request' };
 						}),
-					reroute: module.reroute || (() => {}),
+					reroute: module.reroute || noop,
 					transport: module.transport || {}
 				};
 
@@ -150,7 +151,7 @@ export class Server {
 						handleValidationError: () => {
 							return { message: 'Bad Request' };
 						},
-						reroute: () => {},
+						reroute: noop,
 						transport: {}
 					};
 

package/src/runtime/server/page/index.js

@@ -2,6 +2,7 @@ import { text } from '@sveltejs/kit';
 import { HttpError, Redirect } from '@sveltejs/kit/internal';
 import { compact } from '../../../utils/array.js';
 import { get_status, normalize_error } from '../../../utils/error.js';
+import { noop } from '../../../utils/functions.js';
 import { add_data_suffix } from '../../pathname.js';
 import { redirect_response, static_error_page, handle_error_and_jsonify } from '../utils.js';
 import {
@@ -239,8 +240,8 @@ export async function render_page(
 		});
 
 		// if we don't do this, rejections will be unhandled
-		for (const p of server_promises) p.catch(() => {});
-		for (const p of load_promises) p.catch(() => {});
+		for (const p of server_promises) p.catch(noop);
+		for (const p of load_promises) p.catch(noop);
 
 		for (let i = 0; i < nodes.data.length; i += 1) {
 			const node = nodes.data[i];

package/src/runtime/server/page/load_data.js

@@ -1,4 +1,5 @@
 import { DEV } from 'esm-env';
+import { noop } from '../../../utils/functions.js';
 import { disable_search, make_trackable } from '../../../utils/url.js';
 import { validate_depends, validate_load_response } from '../../shared.js';
 import { with_request_store, merge_tracing } from '@sveltejs/kit/internal/server';
@@ -243,7 +244,7 @@ export async function load_data({
 					route: event.route,
 					fetch: create_universal_fetch(event, state, fetched, csr, resolve_opts),
 					setHeaders: event.setHeaders,
-					depends: () => {},
+					depends: noop,
 					parent,
 					untrack: (fn) => fn(),
 					tracing: traced_event.tracing
@@ -477,11 +478,11 @@ export function create_universal_fetch(event, state, fetched, csr, resolve_opts)
 	};
 
 	// Don't make this function `async`! Otherwise, the user has to `catch` promises they use for streaming responses or else
-	// it will be an unhandled rejection. Instead, we add a `.catch(() => {})` ourselves below to this from happening.
+	// it will be an unhandled rejection. Instead, we add a `.catch(noop)` ourselves below to this from happening.
 	return (input, init) => {
 		// See docs in fetch.js for why we need to do this
 		const response = universal_fetch(input, init);
-		response.catch(() => {});
+		response.catch(noop);
 		return response;
 	};
 }

package/src/runtime/server/page/render.js

@@ -614,8 +614,14 @@ export async function render_response({
 			// we use an anonymous function instead of an arrow function to support
 			// older browsers (https://github.com/sveltejs/kit/pull/5417)
 			blocks.push(`if ('serviceWorker' in navigator) {
+						const script_url = '${prefixed('service-worker.js')}';
+						const policy = globalThis?.window?.trustedTypes?.createPolicy(
+							'sveltekit-trusted-url',
+							{ createScriptURL(url) { return url; } }
+						);
+						const sanitised = policy?.createScriptURL(script_url) ?? script_url;
 						addEventListener('load', function () {
-							navigator.serviceWorker.register('${prefixed('service-worker.js')}'${opts});
+							navigator.serviceWorker.register(sanitised${opts});
 						});
 					}`);
 		}