I used Gemini to compare the minimized output of the Rollup vs Rolldown JavaScript bundlers to find locations where the latter was not yet at the same degree of optimization. It was astoundingly good and I'm not sure how I would have been able to accomplish the task without an LLM as an available tool.
The e18e community are reducing dependencies in popular libraries and building tools to prevent and reduce the impact of such attacks. Join if you want to help out! https://e18e.dev/
There are plenty of people in the community who would help reduce the number of dependencies, but it really requires the maintainers to make it a priority. Otherwise the only way to address it is to switch to another solution like oxlint.
Rich and Simon are incredibly important, but they're in it for Svelte and the community more so than a paycheck from Vercel. Tee has been doing most of the maintenance on SvelteKit currently funded by community donations. And this isn't counting other infrastructure like vite-plugin-svelte or the Svelte CLI which are entirely maintained by volunteers. I don't think Vercel funds a majority of the work on Svelte even if it might be close to it.
Only 3/40 Svelte maintainers work at Vercel and they mainly finance work on Svelte core. SvelteKit day-to-day is primarily maintained by folks outside Vercel
It's neither true that Svelte has few users or that we can easily break things. Tons of sites are built with Svelte like Yahoo Finance and Apple Music. Svelte 5 was the only big change in syntax in the past five years and we made sure that there's a good migration tool, etc. to minimize the amount of hardship and upgrade might cause. As a result the majority of users have already upgraded to Svelte 5.
That being said, Svelte absolutely does continue to innovate. We'll be introducing a new async primitive, RPC mechanism, etc. in the near future: https://m.youtube.com/watch?v=1dATE70wlHc
NextAuth certainly needs some competition. However, I wish better-auth didn't have so many dependencies. I feel like it shouldn't be necessary to depend on things like kysley and Typescript.
By default, SvelteKit does SSR for the first page and client-side routing thereafter. This is fully configurable. Perhaps it's worth an additional mention on the routing page. I'll take a look later. Thanks for the suggestion.
You should only access credentials in `.server` files. We have a built-in feature that checks that you only access credentials in `.server` files to try to prevent newcomers from accidentally making any mistake in that regard.
Vite does statically replace the `browser` variable with `true` or `false` based on whether you're on the client or server, but this shouldn't affect the correctness of your code. It does allow Vite to remove any unused code, however. E.g. `if (browser)` turns into `if (false)` on the server and any code within that block can be removed. This can avoid shipping unused code to the client.
Astro is also built in top of Vite and the same thing happens there. If you reference `import.meta.env.SSR` it is statically replaced during build and unused code is tree-shaken out: https://vite.dev/guide/env-and-mode#env-variables
Files with `.server` in the name run only on the server. The remaining files run on the client and server. This is mentioned in the introduction on https://svelte.dev/docs/kit/routing
What's confusing about this and what could we do to help?
Snippets are far more powerful than slots and so the change is not merely cosmetic. Snippets give you a way to create reusable HTML fragments within a component.