Repository navigation
fix: ignore Range headers on static HEAD requests - #17602
Merged
Merged
Conversation
Signed-off-by: Charan Rathore <[email protected]>
|
Install the latest version of pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/b419df89c59416d7c3fce2bc79fe9b8ead02c45eOpen in Note This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed. |
🦋 Changeset detectedLatest commit: b419df8 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
teemingc
reviewed
Nov 2, 2026
Merged
teemingc
pushed a commit
that referenced
this pull request
Nov 10, 2026
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @sveltejs/[email protected] ### Minor Changes - feat: Add clickable links to remote function invocation in dev server logs ([#17547](#17547)) ### Patch Changes - fix: reject URL inputs in `resolve` ([#17627](#17627)) - fix: respond with JSON instead of rendering the error page for a `__data.json` request to a missing route ([#17630](#17630)) - fix: resolve relative paths against the page URL in data requests when `paths.relative` is `true` ([#17630](#17630)) - fix: reject binary remote forms referencing files with an empty file-offset table as 400 Bad Request ([#17579](#17579)) - fix: correctly populate route and params for `afterNavigate` during hydration ([#17577](#17577)) - fix: include assets imported through dynamic imports, remote functions and param matchers in `builder.findServerAssets` so that `read` can find them ([#17505](#17505)) - fix: set `navigation.from` to `null` in `afterNavigate` on start when SSR is disabled ([#17587](#17587)) - fix: include remote function name and declaration file in schema validation failure logs ([#17495](#17495)) - fix: reuse SSR results of remote functions from packages during hydration in dev ([#17604](#17604)) - fix: remove empty type output directories for removed routes ([#17472](#17472)) - fix: use the UTF-8 byte length when reading inline assets ([#17590](#17590)) - chore: simplify a few server and build helpers ([#17531](#17531)) - fix: ignore the query string and hash of an imported asset's URL when using `read` ([#17507](#17507)) - fix: avoid reloading unrelated server modules when saving files during development ([#17462](#17462)) ## @sveltejs/[email protected] ### Patch Changes - fix: apply the Vite config and plugins of the detected adapter ([#17572](#17572)) - Updated dependencies: - @sveltejs/[email protected] ## @sveltejs/[email protected] ### Patch Changes - fix: serve client and prerendered files whichever way the request path is percent-encoded, and allow `*` and a leading `:` in their filenames ([#17123](#17123)) - perf: let Bun serve immutable files without calling into JavaScript ([#17123](#17123)) - fix: support the `ORIGIN` environment variable when `paths.origin` is not set ([#17632](#17632)) - Updated dependencies: - @sveltejs/[email protected] ## @sveltejs/[email protected] ### Patch Changes - fix: ignore `Range` headers on `HEAD` requests for static assets ([#17602](#17602)) - fix: respond with a 500 instead of crashing the server when handling a request fails unexpectedly ([#17696](#17696)) - fix: support the `ORIGIN` environment variable when `paths.origin` is not set ([#17632](#17632)) - Updated dependencies: - @sveltejs/[email protected] ## @sveltejs/[email protected] ### Patch Changes - fix: accept every Node.js version from 26 (`nodejs27.x`, `nodejs28.x`, ...), not only even ones ([#17584](#17584)) - fix: serve prerendered pages when `paths.base` is set ([#17525](#17525)) - Updated dependencies: - @sveltejs/[email protected] ## @sveltejs/[email protected] ### Patch Changes - fix: compute the missing `width` or `height` at runtime for images imported in the script, instead of outputting `NaN` ([#17499](#17499)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
dadezzz
pushed a commit
to dadezzz/events-cash-register
that referenced
this pull request
Nov 13, 2026
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@sveltejs/adapter-node](https://svelte.dev/docs/kit/adapter-node) ([source](https://github.com/sveltejs/kit/tree/HEAD/packages/adapter-node)) | [`6.0.1` → `6.0.2`](https://renovatebot.com/diffs/npm/@sveltejs%2fadapter-node/6.0.1/6.0.2) |  |  | --- ### Release Notes <details> <summary>sveltejs/kit (@​sveltejs/adapter-node)</summary> ### [`v6.0.2`](https://github.com/sveltejs/kit/blob/HEAD/packages/adapter-node/CHANGELOG.md#602) [Compare Source](https://github.com/sveltejs/kit/compare/@sveltejs/[email protected]...@sveltejs/[email protected]) ##### Patch Changes - fix: ignore `Range` headers on `HEAD` requests for static assets ([#​17602](sveltejs/kit#17602)) - fix: respond with a 500 instead of crashing the server when handling a request fails unexpectedly ([#​17696](sveltejs/kit#17696)) - fix: support the `ORIGIN` environment variable when `paths.origin` is not set ([#​17632](sveltejs/kit#17632)) - Updated dependencies: - [@​sveltejs/kit](https://github.com/sveltejs/kit)@3.2.0 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMzcuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjIzNy4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
github-actions Bot
added a commit
to clement-songis/sveltekit-adapter-bun
that referenced
this pull request
Nov 14, 2026
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @sveltejs/[email protected] ### Minor Changes - feat: Add clickable links to remote function invocation in dev server logs ([#17547](sveltejs/kit#17547)) ### Patch Changes - fix: reject URL inputs in `resolve` ([#17627](sveltejs/kit#17627)) - fix: respond with JSON instead of rendering the error page for a `__data.json` request to a missing route ([#17630](sveltejs/kit#17630)) - fix: resolve relative paths against the page URL in data requests when `paths.relative` is `true` ([#17630](sveltejs/kit#17630)) - fix: reject binary remote forms referencing files with an empty file-offset table as 400 Bad Request ([#17579](sveltejs/kit#17579)) - fix: correctly populate route and params for `afterNavigate` during hydration ([#17577](sveltejs/kit#17577)) - fix: include assets imported through dynamic imports, remote functions and param matchers in `builder.findServerAssets` so that `read` can find them ([#17505](sveltejs/kit#17505)) - fix: set `navigation.from` to `null` in `afterNavigate` on start when SSR is disabled ([#17587](sveltejs/kit#17587)) - fix: include remote function name and declaration file in schema validation failure logs ([#17495](sveltejs/kit#17495)) - fix: reuse SSR results of remote functions from packages during hydration in dev ([#17604](sveltejs/kit#17604)) - fix: remove empty type output directories for removed routes ([#17472](sveltejs/kit#17472)) - fix: use the UTF-8 byte length when reading inline assets ([#17590](sveltejs/kit#17590)) - chore: simplify a few server and build helpers ([#17531](sveltejs/kit#17531)) - fix: ignore the query string and hash of an imported asset's URL when using `read` ([#17507](sveltejs/kit#17507)) - fix: avoid reloading unrelated server modules when saving files during development ([#17462](sveltejs/kit#17462)) ## @sveltejs/[email protected] ### Patch Changes - fix: apply the Vite config and plugins of the detected adapter ([#17572](sveltejs/kit#17572)) - Updated dependencies: - @sveltejs/[email protected] ## @sveltejs/[email protected] ### Patch Changes - fix: serve client and prerendered files whichever way the request path is percent-encoded, and allow `*` and a leading `:` in their filenames ([#17123](sveltejs/kit#17123)) - perf: let Bun serve immutable files without calling into JavaScript ([#17123](sveltejs/kit#17123)) - fix: support the `ORIGIN` environment variable when `paths.origin` is not set ([#17632](sveltejs/kit#17632)) - Updated dependencies: - @sveltejs/[email protected] ## @sveltejs/[email protected] ### Patch Changes - fix: ignore `Range` headers on `HEAD` requests for static assets ([#17602](sveltejs/kit#17602)) - fix: respond with a 500 instead of crashing the server when handling a request fails unexpectedly ([#17696](sveltejs/kit#17696)) - fix: support the `ORIGIN` environment variable when `paths.origin` is not set ([#17632](sveltejs/kit#17632)) - Updated dependencies: - @sveltejs/[email protected] ## @sveltejs/[email protected] ### Patch Changes - fix: accept every Node.js version from 26 (`nodejs27.x`, `nodejs28.x`, ...), not only even ones ([#17584](sveltejs/kit#17584)) - fix: serve prerendered pages when `paths.base` is set ([#17525](sveltejs/kit#17525)) - Updated dependencies: - @sveltejs/[email protected] ## @sveltejs/[email protected] ### Patch Changes - fix: compute the missing `width` or `height` at runtime for images imported in the script, instead of outputting `NaN` ([#17499](sveltejs/kit#17499)) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ignore
Rangewhen serving a static asset for a HEAD request. RFC 9110 section 14.2 requires servers to ignore Range on methods other than GET.Currently, a HEAD request with a satisfiable range receives 206 with a partial Content-Length. An out-of-bounds range receives 416. This can make a header-only asset check report the wrong size or reject an existing file. The adapter now evaluates byte ranges only for GET; HEAD keeps the selected representation's full headers and no body. GET ranges and conditional responses keep their existing behavior.
The regression uses the existing static-file tests and a real Node HTTP server. It covers satisfiable, suffix and unsatisfiable HEAD ranges across identity, gzip and Brotli representations, with absent, matching and stale If-Range validators. It also checks that matching If-None-Match still returns 304.
Please don't delete this checklist! Before submitting the PR, please make sure you do the following:
This is a small HTTP semantics fix found while checking the static handler; no separate issue was filed.
Tests
pnpm testand lint the project withpnpm lintandpnpm checkPassed locally on Node 22.23.4:
pnpm format,pnpm lint,pnpm check.pnpm -F @sveltejs/kit test:unit: 77 files, 1,136 passed, one skipped.pnpm --filter @sveltejs/adapter-node test:unit: 31 passed.pnpm --filter @sveltejs/adapter-node test:build: three passed.The added regression fails on the unchanged source: three failed, 12 passed. It passes with the fix: 15 passed. A separate packaged-app check used
pnpm deploy, a production Vite build and the generated Node server, with native HTTP requests against both source versions. On the base, HEAD withbytes=0-1returned 206/length 2 and an unsatisfiable range returned 416. With the fix, both return 200/length 10, no Content-Range and no body. The GET range control remains 206 with body01.The initial root lint run exhausted Node's default heap. I ran the same ESLint checks in smaller groups to populate its cache, then the exact root
pnpm lintcommand passed. The fullpnpm testbrowser/platform matrix was not run, so the aggregate checkbox remains unchecked.Changesets
pnpm changesetand following the prompts. Changesets that add features should beminorand those that fix bugs should bepatch. Please prefix changeset messages withfeat:,fix:, orchore:.Edits