Svelte

We've just published patch releases of devalue, Svelte, and SvelteKit that fix a number of vulnerabilities. No need to panic — they're all hard to exploit or reliant on experimental features — but we recommend updating as soon as you get a chance. More details in the advisories:

🎅🎄🎁 ADVENT OF SVELTE 2025 🎅🎄🎁 24 days, 24 videos with tips, tricks and features you didn't know about we're hitting the ground running with the lesser-known $inspect(...) and $inspect.trace(...) runes (docs: svelte.dev/docs/svelte/...) follow along here! advent.sveltesociety.dev/2025

day 23 — @paolo.ricciuti.me is back to show you how to give your 🤖 super powers with the Svelte MCP server docs: svelte.dev/docs/mcp/ove...

🎅🎄🎁 ADVENT OF SVELTE 2025 🎅🎄🎁 24 days, 24 videos with tips, tricks and features you didn't know about we're hitting the ground running with the lesser-known $inspect(...) and $inspect.trace(...) runes (docs: svelte.dev/docs/svelte/...) follow along here! advent.sveltesociety.dev/2025

day 21 — special guest mrs @paolo.ricciuti.me teaches us all about creating type-safe component context with the new `createContext` utility. no more `getContext(key) as MyContext`! www.youtube.com/shorts/ouM0c...

🎅🎄🎁 ADVENT OF SVELTE 2025 🎅🎄🎁 24 days, 24 videos with tips, tricks and features you didn't know about we're hitting the ground running with the lesser-known $inspect(...) and $inspect.trace(...) runes (docs: svelte.dev/docs/svelte/...) follow along here! advent.sveltesociety.dev/2025

day 19 — @paolo.ricciuti.me is back with a demo of streaming file uploads, which let you handle bigger files (no need to buffer everything on the server) and validate your forms instantly no docs for this one! just update to the latest version of SvelteKit

🎅🎄🎁 ADVENT OF SVELTE 2025 🎅🎄🎁 24 days, 24 videos with tips, tricks and features you didn't know about we're hitting the ground running with the lesser-known $inspect(...) and $inspect.trace(...) runes (docs: svelte.dev/docs/svelte/...) follow along here! advent.sveltesociety.dev/2025

day 17 — Babbo Natale, sorry, I mean @paolo.ricciuti.me — is... eager to bring you a gift. if you've been nice, that is docs: svelte.dev/docs/svelte/...

🎅🎄🎁 ADVENT OF SVELTE 2025 🎅🎄🎁 24 days, 24 videos with tips, tricks and features you didn't know about we're hitting the ground running with the lesser-known $inspect(...) and $inspect.trace(...) runes (docs: svelte.dev/docs/svelte/...) follow along here! advent.sveltesociety.dev/2025

day 14: remote functions part three! today: the `prerender` function, which (unlike the existing prerender page config) lets you mix and match static and dynamic data docs: svelte.dev/docs/kit/rem...

🎅🎄🎁 ADVENT OF SVELTE 2025 🎅🎄🎁 24 days, 24 videos with tips, tricks and features you didn't know about we're hitting the ground running with the lesser-known $inspect(...) and $inspect.trace(...) runes (docs: svelte.dev/docs/svelte/...) follow along here! advent.sveltesociety.dev/2025

day 12: @dummdidumm.bsky.social brings us the first of several videos introducing remote functions, starting with `query`. expect to hear more about these in 2026! docs: svelte.dev/docs/kit/rem...

🎅🎄🎁 ADVENT OF SVELTE 2025 🎅🎄🎁 24 days, 24 videos with tips, tricks and features you didn't know about we're hitting the ground running with the lesser-known $inspect(...) and $inspect.trace(...) runes (docs: svelte.dev/docs/svelte/...) follow along here! advent.sveltesociety.dev/2025

day 10: @kenthropic.com shows us how to make our unrefined code presentable to society, with `class` docs: svelte.dev/docs/svelte/...

🎅🎄🎁 ADVENT OF SVELTE 2025 🎅🎄🎁 24 days, 24 videos with tips, tricks and features you didn't know about we're hitting the ground running with the lesser-known $inspect(...) and $inspect.trace(...) runes (docs: svelte.dev/docs/svelte/...) follow along here! advent.sveltesociety.dev/2025

day 8: setting up your editor like a pro, with @fubits.dev. if you're a VS Code or VS Code-ish user you won't want to miss this one also ft. @dominikg.dev's vite-plugin-svelte inspector (docs: github.com/sveltejs/vit...)

🎅🎄🎁 ADVENT OF SVELTE 2025 🎅🎄🎁 24 days, 24 videos with tips, tricks and features you didn't know about we're hitting the ground running with the lesser-known $inspect(...) and $inspect.trace(...) runes (docs: svelte.dev/docs/svelte/...) follow along here! advent.sveltesociety.dev/2025

day 6: @rich-harris.dev has been awaiting you docs: svelte.dev/docs/svelte/...

🎅🎄🎁 ADVENT OF SVELTE 2025 🎅🎄🎁 24 days, 24 videos with tips, tricks and features you didn't know about we're hitting the ground running with the lesser-known $inspect(...) and $inspect.trace(...) runes (docs: svelte.dev/docs/svelte/...) follow along here! advent.sveltesociety.dev/2025

day 4: @kevinak.se introduces the brand-new @sveltesociety.dev website, and the (slightly less new, but still shiny) packages hub - sveltesociety.dev - svelte.dev/packages

🎅🎄🎁 ADVENT OF SVELTE 2025 🎅🎄🎁 24 days, 24 videos with tips, tricks and features you didn't know about we're hitting the ground running with the lesser-known $inspect(...) and $inspect.trace(...) runes (docs: svelte.dev/docs/svelte/...) follow along here! advent.sveltesociety.dev/2025

day 2: everything you can do with the Svelte CLI svelte.dev/docs/cli/ove...

You can now use Svelte's async features in your Astro islands! Just update to the latest versions, opt in to the `experimental.async` flag, and you're off to the races svelte.dev/docs/svelte/...

You've probably heard about the supply chain attack that affected a number of widely-used npm packages today. tl;dr: Don't panic. Notes: 1. Svelte, SvelteKit and their associated packages are not vulnerable to this attack, as they do not use any of the compromised dependencies in the browser

3. It's still _possible_ that you have these packages in your dependency graph (including transitively). The compromised packages have now been unpublished, but if you updated deps earlier today then it's possible your users are affected. List of affected packages here: socket.dev/blog/npm-aut...

You've probably heard about the supply chain attack that affected a number of widely-used npm packages today. tl;dr: Don't panic. Notes: 1. Svelte, SvelteKit and their associated packages are not vulnerable to this attack, as they do not use any of the compromised dependencies in the browser