@sveltejs/kit 2.7.4 → 2.7.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sveltejs/kit",
-  "version": "2.7.4",
+  "version": "2.7.5",
   "description": "SvelteKit is the fastest way to build Svelte apps",
   "keywords": [
     "framework",

package/src/exports/vite/index.js

@@ -349,6 +349,22 @@ async function kit({ svelte_config }) {
 		 * Stores the final config.
 		 */
 		configResolved(config) {
+			// we search for this plugin by name because we can't detect it
+			// since it doesn't directly modify the https config unlike the mkcert plugin
+			const vite_basic_ssl = config.plugins.find(({ name }) => name === 'vite:basic-ssl');
+
+			// by default, when enabling HTTPS in Vite, it also enables HTTP/2
+			// however, undici has not yet enabled HTTP/2 by default: https://github.com/nodejs/undici/issues/2750
+			// we set a no-op proxy config to force Vite to downgrade to TLS-only
+			// see https://vitejs.dev/config/#server-https
+			if ((config.server.https || vite_basic_ssl) && !config.server.proxy) {
+				config.server.proxy = {};
+			}
+
+			if ((config.preview.https || vite_basic_ssl) && !config.preview.proxy) {
+				config.preview.proxy = {};
+			}
+
 			vite_config = config;
 		}
 	};

package/src/runtime/server/cookie.js

@@ -1,6 +1,9 @@
 import { parse, serialize } from 'cookie';
 import { add_data_suffix, normalize_path, resolve } from '../../utils/url.js';
 
+// eslint-disable-next-line no-control-regex -- control characters are invalid in cookie names
+const INVALID_COOKIE_CHARACTER_REGEX = /[\x00-\x1F\x7F()<>@,;:"/[\]?={} \t]/;
+
 /**
  * Tracks all cookies set during dev mode so we can emit warnings
  * when we detect that there's likely cookie misusage due to wrong paths
@@ -113,6 +116,14 @@ export function get_cookies(request, url, trailing_slash) {
 		 * @param {import('./page/types.js').Cookie['options']} options
 		 */
 		set(name, value, options) {
+			// TODO: remove this check in 3.0
+			const illegal_characters = name.match(INVALID_COOKIE_CHARACTER_REGEX);
+			if (illegal_characters) {
+				console.warn(
+					`The cookie name "${name}" will be invalid in SvelteKit 3.0 as it contains ${illegal_characters.join(' and ')}. See RFC 2616 for more details https://datatracker.ietf.org/doc/html/rfc2616#section-2.2`
+				);
+			}
+
 			validate_options(options);
 			set_internal(name, value, { ...defaults, ...options });
 		},

package/src/version.js

@@ -1,4 +1,4 @@
 // generated during release, do not modify
 
 /** @type {string} */
-export const VERSION = '2.7.4';
+export const VERSION = '2.7.5';