[Project516]

Replaces #123. Its @sveltejs/kit 3.1.0 bump does not install or build without more changes to the example app.

Website (apps/website/pnpm-lock.yaml)

Lockfile from #123, unchanged: fast-uri 3.1.9, serialize-javascript 7.1.4, body-parser 1.20.9, launch-editor 2.14.2, qs 6.16.2, undici 7.30.1. All are patch or minor releases, and each clears an open Dependabot alert.

SvelteKit example (apps/sveltekit-app)

The kit alerts (open redirect in enhanced form submission, XSS through a prerendered cache-control header) are fixed only in 3.0.0. Kit 3 needs:

• vite ^8, @sveltejs/vite-plugin-svelte ^7, typescript ^6, and adapter-auto 8. The app pinned Vite 6, plugin 6, TS 5 and adapter-auto 3, so this PR bumps them too.
• Config passed to the sveltekit() Vite plugin. Kit 3 refuses to start when svelte.config.js exists, so the adapter and preprocess options moved into vite.config.ts.
• tsconfig.json extending $app/tsconfig with an explicit include, which kit 3 checks at build time.

The app uses none of the APIs kit 3 removed or changed.

Testing

In a clean install of the app (Node 24):

• vite build gets through kit 3's config checks and builds the server bundle. The client build then fails on the published @project516/ffmpeg-wasm 0.17.0, which Vite cannot bundle. This is not new: the app on master with Vite 6 fails with the same error. Pass a literal worker type so Vite can bundle the ESM build #124 fixes it, and with that change the app builds and emits the worker chunk.
• vitest run passes.
• svelte-check reports the same 6 errors as on master, and no new ones.

CI does not build the example apps.

Noticed, not fixed

• svelte-check errors in the example on master and here: vite.config.ts has untyped middleware parameters and no @types/node, and FFmpegDemo.svelte passes an ArrayBufferLike to Blob.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 42 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ef5ed9ef-fadf-4f05-ae3e-bf45b2c232cd

Commits

Reviewing files that changed from the base of the PR and between b05c356 and 77b6723.

Files ignored due to path filters: 1

• apps/website/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 4

• apps/sveltekit-app/package.json
• apps/sveltekit-app/svelte.config.js
• apps/sveltekit-app/tsconfig.json
• apps/sveltekit-app/vite.config.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[project516-review-bot]

This PR migrates the SvelteKit example app to Kit 3.1.0 by updating dependencies (adapter-auto 8, vite-plugin-svelte 7, TypeScript 6, Vite 8), moving adapter and preprocess config from svelte.config.js into vite.config.ts, and updating tsconfig.json to extend $app/tsconfig with explicit includes. It also updates the website lockfile to patch/minor releases that clear Dependabot alerts. Testing confirms Kit 3 config checks pass, server bundle builds, vitest passes, and svelte-check shows no new errors.

---

_{review-bot, model nvidia/nemotron-3-ultra-550b-a55b:free, verdict approve}