feat: warn when using a `.server.` file or file inside a `server` directory without importing a server-only module by dummdidumm · Pull Request #16266 · sveltejs/kit

dummdidumm · 2026-07-07T21:18:50Z

#12529 was opened a while ago, and since then things have changed. We do check all files now, but we do not error on .server. files or files inside server directories if they're outside the cwd.

We decided we want to keep that logic. Things outside it (or inside node_modules) still will fail if they e.g. import $app/server or $app/env/private. We decided that this is the desired behavior - and it already is that way today. This PR therefore only adds additional validation to @sveltejs/package to hint at this, and thereby closes #12529

We said we may investigate creating an npm package which you can also use and establish it as somewhat of a standard across the Vite ecosystem, but that will happen separately.

…ectory without importing a server-only module #12529 was opened a while ago, and since then things have changed. We do check _all_ files now, but we do not error on `.server.` files or files inside `server` directories if they're outside the cwd. We decided we want to keep that logic. Things outside it (or inside node_modules) still will fail if they e.g. import `$app/server` or `$app/env/private`. We decided that this is the desired behavior. This PR therefore only adds additional validation to `@sveltejs/package` to hint at this, and thereby closes #12529 We said we may investigate creating an npm package which you can also use and establish it as somewhat of a standard across the Vite ecosystem, but that will happen separately.

pkg-svelte-dev · 2026-07-07T21:18:53Z

Install the latest version of @sveltejs/kit from 09c3b44:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/09c3b443d8313c76b85a24dbff44c89b1dddcf3d

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/16266

changeset-bot · 2026-07-07T21:18:55Z

🦋 Changeset detected

Latest commit: 09c3b44

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/package	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

svelte-docs-bot · 2026-07-07T21:20:51Z

Preview: https://svelte-dev-git-preview-kit-16266-svelte.vercel.app/

Rich-Harris · 2026-07-08T14:10:28Z

+		const is_server_only = name.includes('.server.') || /(^|\/)server\//.test(name);
+		unprotected_server_only_files.set(name, is_server_only && !has_guard_import);


couldn't this be a Set?

Suggested change

const is_server_only = name.includes('.server.') || /(^|\/)server\//.test(name);

unprotected_server_only_files.set(name, is_server_only && !has_guard_import);

if (!has_guard_import && (name.includes('.server.') || /(^|\/)server\//.test(name))) {

unprotected_server_only_files.add(name);

}

Rich-Harris · 2026-07-08T14:21:27Z

Should we account for transitive deps? You can imagine a scenario like this:

// src/server/api.js
import { db } from './db.js';

export function getThings() {
  return db.select().from(things);
}

// src/server/db.js';
import { DATABASE_URL } from '$app/env/private';
import { createClient } from 'database-library';

export const db = createClient(DATABASE_URL);

api.js is protected, but we can't determine that in isolation. A warning here would be annoying; I don't want to add a phantom import for no reason.

Rich-Harris

small suggestion but otherwise LGTM

Co-authored-by: Rich Harris <richard.a.harris@gmail.com>

Rich-Harris · 2026-07-10T17:32:55Z

/autofix

This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to version-3, this PR will be updated. ⚠️

⚠️

⚠️ `version-3` is currently in **pre mode** so this branch has prereleases rather than normal releases. If you want to exit prereleases, run `changeset pre exit` on `version-3`. ⚠️

⚠️

⚠️ # Releases ## @sveltejs/kit@3.0.0-next.8 ### Major Changes - breaking: remove `experimental.handleRenderingErrors` flag ([#16265](#16265)) - breaking: make `getRequest` and `setResponse` synchronous ([#16280](#16280)) - breaking: make `page.url` immutable on a type level ([#16256](#16256)) - breaking: add `refreshAll` and deprecate `invalidateAll` ([#16289](#16289)) ### Minor Changes - feat: allow hyphens in param and matcher names ([#16284](#16284)) - feat: add `ErrorProps` to generated types ([#16272](#16272)) ### Patch Changes - fix: detect destructured `load` and `actions` exports during type generation ([#16329](#16329)) - fix: ensure CSS URL references are absolute when `paths.relative` is `false` ([#16315](#16315)) - fix: exclude deleted cookies from `cookies.getAll()` so it stays consistent with `cookies.get()` ([#16297](#16297)) - fix: reset failed `<svelte:boundary>` on client navigation so a stale `+error.svelte` is torn down ([#16296](#16296)) - fix: preserve shared client chunk hashes when the app version changes ([#16324](#16324)) - fix: align MAX_COOKIE_SIZE with RFC 6265bis ([#16322](#16322)) - fix: use mouseover+mousemove for preloading to reduce events ([#16325](#16325)) ## @sveltejs/package@3.0.0-next.2 ### Minor Changes - feat: warn when using a `.server.` file or file inside a `server` directory without importing a server-only module ([#16266](#16266)) ## @sveltejs/adapter-auto@8.0.0-next.1 ### Patch Changes - fix: allow prerelease versions of SvelteKit 3 to satisfy the peer dependency range ([#16286](#16286)) - Updated dependencies [[`737d119`](737d119), [`fa78efb`](fa78efb), [`07c207e`](07c207e), [`a47071b`](a47071b), [`14d7d5a`](14d7d5a), [`5c38e51`](5c38e51), [`0702baa`](0702baa), [`e1938c6`](e1938c6), [`8293144`](8293144), [`f76d7d9`](f76d7d9), [`ab5c253`](ab5c253), [`b557b1b`](b557b1b), [`4a513e2`](4a513e2)]: - @sveltejs/kit@3.0.0-next.8 ## @sveltejs/adapter-cloudflare@8.0.0-next.2 ### Patch Changes - fix: allow prerelease versions of SvelteKit 3 to satisfy the peer dependency range ([#16286](#16286)) - Updated dependencies [[`737d119`](737d119), [`fa78efb`](fa78efb), [`07c207e`](07c207e), [`a47071b`](a47071b), [`14d7d5a`](14d7d5a), [`5c38e51`](5c38e51), [`0702baa`](0702baa), [`e1938c6`](e1938c6), [`8293144`](8293144), [`f76d7d9`](f76d7d9), [`ab5c253`](ab5c253), [`b557b1b`](b557b1b), [`4a513e2`](4a513e2)]: - @sveltejs/kit@3.0.0-next.8 ## @sveltejs/adapter-netlify@7.0.0-next.3 ### Patch Changes - fix: include `utils.js` in package.json `files` ([#16298](#16298)) - Updated dependencies [[`737d119`](737d119), [`fa78efb`](fa78efb), [`07c207e`](07c207e), [`a47071b`](a47071b), [`14d7d5a`](14d7d5a), [`5c38e51`](5c38e51), [`0702baa`](0702baa), [`e1938c6`](e1938c6), [`8293144`](8293144), [`f76d7d9`](f76d7d9), [`ab5c253`](ab5c253), [`b557b1b`](b557b1b), [`4a513e2`](4a513e2)]: - @sveltejs/kit@3.0.0-next.8 ## @sveltejs/adapter-node@6.0.0-next.3 ### Patch Changes - fix: allow prerelease versions of SvelteKit 3 to satisfy the peer dependency range ([#16286](#16286)) - Updated dependencies [[`737d119`](737d119), [`fa78efb`](fa78efb), [`07c207e`](07c207e), [`a47071b`](a47071b), [`14d7d5a`](14d7d5a), [`5c38e51`](5c38e51), [`0702baa`](0702baa), [`e1938c6`](e1938c6), [`8293144`](8293144), [`f76d7d9`](f76d7d9), [`ab5c253`](ab5c253), [`b557b1b`](b557b1b), [`4a513e2`](4a513e2)]: - @sveltejs/kit@3.0.0-next.8 ## @sveltejs/adapter-static@4.0.0-next.1 ### Patch Changes - fix: allow prerelease versions of SvelteKit 3 to satisfy the peer dependency range ([#16286](#16286)) - Updated dependencies [[`737d119`](737d119), [`fa78efb`](fa78efb), [`07c207e`](07c207e), [`a47071b`](a47071b), [`14d7d5a`](14d7d5a), [`5c38e51`](5c38e51), [`0702baa`](0702baa), [`e1938c6`](e1938c6), [`8293144`](8293144), [`f76d7d9`](f76d7d9), [`ab5c253`](ab5c253), [`b557b1b`](b557b1b), [`4a513e2`](4a513e2)]: - @sveltejs/kit@3.0.0-next.8 ## @sveltejs/adapter-vercel@7.0.0-next.2 ### Patch Changes - fix: allow prerelease versions of SvelteKit 3 to satisfy the peer dependency range ([#16286](#16286)) - Updated dependencies [[`737d119`](737d119), [`fa78efb`](fa78efb), [`07c207e`](07c207e), [`a47071b`](a47071b), [`14d7d5a`](14d7d5a), [`5c38e51`](5c38e51), [`0702baa`](0702baa), [`e1938c6`](e1938c6), [`8293144`](8293144), [`f76d7d9`](f76d7d9), [`ab5c253`](ab5c253), [`b557b1b`](b557b1b), [`4a513e2`](4a513e2)]: - @sveltejs/kit@3.0.0-next.8 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Rich-Harris reviewed Jul 8, 2026

View reviewed changes

transitive

b0601d4

vercel Bot reviewed Jul 8, 2026

View reviewed changes

Comment thread packages/package/src/validate.js

teemingc linked an issue Jul 9, 2026 that may be closed by this pull request

Protect *.server.* files in workspace #12529

Closed

Rich-Harris reviewed Jul 10, 2026

View reviewed changes

Comment thread packages/package/src/validate.js Outdated

Rich-Harris approved these changes Jul 10, 2026

View reviewed changes

Update packages/package/src/validate.js

0fa9975

Co-authored-by: Rich Harris <richard.a.harris@gmail.com>

chore: autofix lint

09c3b44

Rich-Harris merged commit 065ce4a into version-3 Jul 10, 2026
17 of 18 checks passed

Rich-Harris deleted the package-server-only-warning branch July 10, 2026 19:13

github-actions Bot mentioned this pull request Jul 10, 2026

Version Packages (next) #16282

Merged

teemingc mentioned this pull request Jul 10, 2026

Protect *.server.* files in workspace #12529

Closed

Nic-Polumeyv mentioned this pull request Jul 14, 2026

Restructure hooks docs #16337

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat: warn when using a `.server.` file or file inside a `server` directory without importing a server-only module#16266

feat: warn when using a `.server.` file or file inside a `server` directory without importing a server-only module#16266
Rich-Harris merged 4 commits into
version-3from
package-server-only-warning

dummdidumm commented Jul 7, 2026 •

edited

Loading

Uh oh!

pkg-svelte-dev Bot commented Jul 7, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jul 7, 2026 •

edited

Loading

Uh oh!

svelte-docs-bot Bot commented Jul 7, 2026

Uh oh!

Rich-Harris Jul 8, 2026

Uh oh!

Rich-Harris commented Jul 8, 2026

Uh oh!

Uh oh!

Uh oh!

Rich-Harris left a comment

Uh oh!

Rich-Harris commented Jul 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		const is_server_only = name.includes('.server.') \|\| /(^\|\/)server\//.test(name);
		unprotected_server_only_files.set(name, is_server_only && !has_guard_import);

Uh oh!

Uh oh!

Conversation

dummdidumm commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-svelte-dev Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

svelte-docs-bot Bot commented Jul 7, 2026

Uh oh!

Rich-Harris Jul 8, 2026

Choose a reason for hiding this comment

Uh oh!

Rich-Harris commented Jul 8, 2026

Uh oh!

Uh oh!

Uh oh!

Rich-Harris left a comment

Choose a reason for hiding this comment

Uh oh!

Rich-Harris commented Jul 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dummdidumm commented Jul 7, 2026 •

edited

Loading

pkg-svelte-dev Bot commented Jul 7, 2026 •

edited

Loading

changeset-bot Bot commented Jul 7, 2026 •

edited

Loading