fix: load the URL shown in the address bar when returning to a pushState/replaceState history entry#16307
Closed
Nic-Polumeyv wants to merge 2 commits into
Closed
Conversation
|
Install the latest version of pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/83d6bb7dc6cb515dccc04d2379469a3edafccb89Open in Note This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed. |
🦋 Changeset detectedLatest commit: 83d6bb7 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
6 tasks
teemingc
reviewed
Jul 10, 2026
teemingc
reviewed
Jul 10, 2026
teemingc
requested changes
Jul 10, 2026
Nic-Polumeyv
force-pushed
the
fix-shallow-history-url
branch
from
July 10, 2026 18:59
fc3a5e5 to
30677e6
Compare
1 task
Nic-Polumeyv
force-pushed
the
fix-shallow-history-url
branch
from
July 11, 2026 01:19
dc5938f to
0abc5b7
Compare
6 tasks
teemingc
added a commit
that referenced
this pull request
Jul 14, 2026
…DE_ENV (#16313) The NODE_ENV saga continues. Any build where NODE_ENV isn't `production` currently ships with every origin check compiled out: ```js // respond.js if (!DEV) { // cross-site remote request check // cross-site form submission check (csrf.checkOrigin / trustedOrigins) } ``` `DEV` comes from esm-env, which kit bundles into apps resolved by NODE_ENV, so `NODE_ENV=staging vite build` produces a deployable server with CSRF protection silently disabled. Vite's docs list non-production builds as a supported workflow, and khromov raised this exact failure mode in #14335 when the gate was added. At the time `DEV` was assumed to only mean `vite dev`, which the esm-env consolidation in #14308 no longer guarantees (first leak #15632, fixed by #15852, second leak #16008, fixed by #16023). This applies the rule from the #15852 body ("reverting to the global constant where we want the code to only run during `vite dev` ... Every other place that uses DEV is meant to fire warnings ... and that should still happen if the user did `NODE_ENV=development vite build`") to two sites it missed: - the `respond.js` gate, `!DEV` to `!__SVELTEKIT_DEV__`, covering both the form CSRF check and the remote functions origin check that now shares it - the live-serving condition in `app/server/remote/prerender.js`, same one-token swap (prerendered remote functions were served live in these builds) The three validation `DEV` sites in `respond.js` (`validateHeaders`, `page_nodes.validate()`, `validate_server_exports`) are deliberately untouched. They are warning sites and should keep following NODE_ENV per the rule. The check internals are also untouched, so this stays out of the way of the `sec-fetch-site` idea in #15992. The new spec in `test/build-errors` builds a minimal fixture with `NODE_ENV=staging`, imports the generated server, and asserts a normal GET returns 200 while a forged cross-site form POST returns 403. It fails on main (the POST returns 200) and passes with the fix. The existing basics CSRF tests stay green in both modes, and dev behavior is unchanged. There are HMR-coupled `DEV` gates in `client.js` and the remote query modules from the same class. Left for a follow-up, `client.js` currently conflicts with #16307. --- ### Please don't delete this checklist! Before submitting the PR, please make sure you do the following: - [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs - [x] This message body should clearly illustrate what problems it solves. - [x] Ideally, include a test that fails without this PR but passes with it. ### Tests - [x] Run the tests with `pnpm test` and lint the project with `pnpm lint` and `pnpm check` ### Changesets - [x] If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running `pnpm changeset` and following the prompts. Changesets that add features should be `minor` and those that fix bugs should be `patch`. Please prefix changeset messages with `feat:`, `fix:`, or `chore:`. ### Edits - [x] Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed. --------- Co-authored-by: Tee Ming <chewteeming01@gmail.com>
…ate/replaceState history entry
Nic-Polumeyv
force-pushed
the
fix-shallow-history-url
branch
from
July 15, 2026 01:07
0abc5b7 to
68acb5f
Compare
Nic-Polumeyv
force-pushed
the
fix-shallow-history-url
branch
from
July 17, 2026 04:49
0ee794b to
83d6bb7
Compare
Member
|
Thank you, but this isn't right - when you go back you want to preserve the shallow navigation state. Therefore closing. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #11465
pushStateandreplaceStatewrite one URL to the address bar and store a different one in the history entry:When you later return to that entry, the popstate handler feeds
PAGE_URL_KEYtonavigate, soloadruns with the old URL while the address bar shows the pushed one. That's the report in the issue,url.searchParamsinloadmissing params that are visibly in the URL after going back.Both functions now store the same resolved URL they push. This follows teemingc's comment on the issue, keep the page store URL at push time but update the URL that subsequent loads run with.
One existing assertion changes. "Replaces state on a new URL" expected that going forward to a replaced entry renders the old page under the new URL, which is the inconsistency being fixed. It now expects the route the address bar shows, with
page.statestill restored. A new test covers the reported sequence, push, navigate away, go back, and fails on main.This doesn't touch the invalidate-after-pushState case from #11503. That needs a decision on push-time load semantics, and an existing test ("Invalidates the correct route after pushing state to a new URL") deliberately locks in the current behavior, so I left it alone. Happy to take it as a follow-up if there's an agreed direction.
Please don't delete this checklist! Before submitting the PR, please make sure you do the following:
Tests
pnpm testand lint the project withpnpm lintandpnpm checkChangesets
pnpm changesetand following the prompts. Changesets that add features should beminorand those that fix bugs should bepatch. Please prefix changeset messages withfeat:,fix:, orchore:.Edits