Skip to content

fix: ignore Range headers on static HEAD requests - #17602

Merged
teemingc merged 3 commits into
sveltejs:mainfrom
charan-rathore:fix/head-static-range
Nov 2, 2026
Merged

teemingc merged 3 commits into
sveltejs:mainfrom
charan-rathore:fix/head-static-range

Conversation

@charan-rathore

Copy link
Copy Markdown
Contributor

Ignore Range when serving a static asset for a HEAD request. RFC 9110 section 14.2 requires servers to ignore Range on methods other than GET.

Currently, a HEAD request with a satisfiable range receives 206 with a partial Content-Length. An out-of-bounds range receives 416. This can make a header-only asset check report the wrong size or reject an existing file. The adapter now evaluates byte ranges only for GET; HEAD keeps the selected representation's full headers and no body. GET ranges and conditional responses keep their existing behavior.

The regression uses the existing static-file tests and a real Node HTTP server. It covers satisfiable, suffix and unsatisfiable HEAD ranges across identity, gzip and Brotli representations, with absent, matching and stale If-Range validators. It also checks that matching If-None-Match still returns 304.


Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

This is a small HTTP semantics fix found while checking the static handler; no separate issue was filed.

Tests

  • Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Passed locally on Node 22.23.4:

  • pnpm format, pnpm lint, pnpm check.
  • pnpm -F @sveltejs/kit test:unit: 77 files, 1,136 passed, one skipped.
  • pnpm --filter @sveltejs/adapter-node test:unit: 31 passed.
  • pnpm --filter @sveltejs/adapter-node test:build: three passed.

The added regression fails on the unchanged source: three failed, 12 passed. It passes with the fix: 15 passed. A separate packaged-app check used pnpm deploy, a production Vite build and the generated Node server, with native HTTP requests against both source versions. On the base, HEAD with bytes=0-1 returned 206/length 2 and an unsatisfiable range returned 416. With the fix, both return 200/length 10, no Content-Range and no body. The GET range control remains 206 with body 01.

The initial root lint run exhausted Node's default heap. I ran the same ESLint checks in smaller groups to populate its cache, then the exact root pnpm lint command passed. The full pnpm test browser/platform matrix was not run, so the aggregate checkbox remains unchecked.

Changesets

  • If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

Edits

  • Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

@pkg-svelte-dev

pkg-svelte-dev Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

Install the latest version of @sveltejs/kit from b419df8:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/b419df89c59416d7c3fce2bc79fe9b8ead02c45e

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/17602

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

@changeset-bot

changeset-bot Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: b419df8

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@sveltejs/adapter-node Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Comment thread .changeset/goofy-baboons-grab.md Resolved

@teemingc teemingc left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you

@teemingc
teemingc merged commit 9d89a52 into sveltejs:main Nov 2, 2026
37 of 38 checks passed
@github-actions github-actions Bot mentioned this pull request Nov 2, 2026
teemingc pushed a commit that referenced this pull request Nov 10, 2026
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @sveltejs/[email protected]

### Minor Changes

- feat: Add clickable links to remote function invocation in dev server
logs ([#17547](#17547))

### Patch Changes

- fix: reject URL inputs in `resolve`
([#17627](#17627))

- fix: respond with JSON instead of rendering the error page for a
`__data.json` request to a missing route
([#17630](#17630))

- fix: resolve relative paths against the page URL in data requests when
`paths.relative` is `true`
([#17630](#17630))

- fix: reject binary remote forms referencing files with an empty
file-offset table as 400 Bad Request
([#17579](#17579))

- fix: correctly populate route and params for `afterNavigate` during
hydration ([#17577](#17577))

- fix: include assets imported through dynamic imports, remote functions
and param matchers in `builder.findServerAssets` so that `read` can find
them ([#17505](#17505))

- fix: set `navigation.from` to `null` in `afterNavigate` on start when
SSR is disabled ([#17587](#17587))

- fix: include remote function name and declaration file in schema
validation failure logs
([#17495](#17495))

- fix: reuse SSR results of remote functions from packages during
hydration in dev ([#17604](#17604))

- fix: remove empty type output directories for removed routes
([#17472](#17472))

- fix: use the UTF-8 byte length when reading inline assets
([#17590](#17590))

- chore: simplify a few server and build helpers
([#17531](#17531))

- fix: ignore the query string and hash of an imported asset's URL when
using `read` ([#17507](#17507))

- fix: avoid reloading unrelated server modules when saving files during
development ([#17462](#17462))
## @sveltejs/[email protected]

### Patch Changes

- fix: apply the Vite config and plugins of the detected adapter
([#17572](#17572))
- Updated dependencies:
  - @sveltejs/[email protected]
## @sveltejs/[email protected]

### Patch Changes

- fix: serve client and prerendered files whichever way the request path
is percent-encoded, and allow `*` and a leading `:` in their filenames
([#17123](#17123))

- perf: let Bun serve immutable files without calling into JavaScript
([#17123](#17123))

- fix: support the `ORIGIN` environment variable when `paths.origin` is
not set ([#17632](#17632))
- Updated dependencies:
  - @sveltejs/[email protected]
## @sveltejs/[email protected]

### Patch Changes

- fix: ignore `Range` headers on `HEAD` requests for static assets
([#17602](#17602))

- fix: respond with a 500 instead of crashing the server when handling a
request fails unexpectedly
([#17696](#17696))

- fix: support the `ORIGIN` environment variable when `paths.origin` is
not set ([#17632](#17632))
- Updated dependencies:
  - @sveltejs/[email protected]
## @sveltejs/[email protected]

### Patch Changes

- fix: accept every Node.js version from 26 (`nodejs27.x`, `nodejs28.x`,
...), not only even ones
([#17584](#17584))

- fix: serve prerendered pages when `paths.base` is set
([#17525](#17525))
- Updated dependencies:
  - @sveltejs/[email protected]
## @sveltejs/[email protected]

### Patch Changes

- fix: compute the missing `width` or `height` at runtime for images
imported in the script, instead of outputting `NaN`
([#17499](#17499))

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
dadezzz pushed a commit to dadezzz/events-cash-register that referenced this pull request Nov 13, 2026
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@sveltejs/adapter-node](https://svelte.dev/docs/kit/adapter-node) ([source](https://github.com/sveltejs/kit/tree/HEAD/packages/adapter-node)) | [`6.0.1` → `6.0.2`](https://renovatebot.com/diffs/npm/@sveltejs%2fadapter-node/6.0.1/6.0.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@sveltejs%2fadapter-node/6.0.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@sveltejs%2fadapter-node/6.0.1/6.0.2?slim=true) |

---

### Release Notes

<details>
<summary>sveltejs/kit (@&#8203;sveltejs/adapter-node)</summary>

### [`v6.0.2`](https://github.com/sveltejs/kit/blob/HEAD/packages/adapter-node/CHANGELOG.md#602)

[Compare Source](https://github.com/sveltejs/kit/compare/@sveltejs/[email protected]...@sveltejs/[email protected])

##### Patch Changes

- fix: ignore `Range` headers on `HEAD` requests for static assets ([#&#8203;17602](sveltejs/kit#17602))

- fix: respond with a 500 instead of crashing the server when handling a request fails unexpectedly ([#&#8203;17696](sveltejs/kit#17696))

- fix: support the `ORIGIN` environment variable when `paths.origin` is not set ([#&#8203;17632](sveltejs/kit#17632))

- Updated dependencies:
  - [@&#8203;sveltejs/kit](https://github.com/sveltejs/kit)@3.2.0

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMzcuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjIzNy4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
github-actions Bot added a commit to clement-songis/sveltekit-adapter-bun that referenced this pull request Nov 14, 2026
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @sveltejs/[email protected]

### Minor Changes

- feat: Add clickable links to remote function invocation in dev server
logs ([#17547](sveltejs/kit#17547))

### Patch Changes

- fix: reject URL inputs in `resolve`
([#17627](sveltejs/kit#17627))

- fix: respond with JSON instead of rendering the error page for a
`__data.json` request to a missing route
([#17630](sveltejs/kit#17630))

- fix: resolve relative paths against the page URL in data requests when
`paths.relative` is `true`
([#17630](sveltejs/kit#17630))

- fix: reject binary remote forms referencing files with an empty
file-offset table as 400 Bad Request
([#17579](sveltejs/kit#17579))

- fix: correctly populate route and params for `afterNavigate` during
hydration ([#17577](sveltejs/kit#17577))

- fix: include assets imported through dynamic imports, remote functions
and param matchers in `builder.findServerAssets` so that `read` can find
them ([#17505](sveltejs/kit#17505))

- fix: set `navigation.from` to `null` in `afterNavigate` on start when
SSR is disabled ([#17587](sveltejs/kit#17587))

- fix: include remote function name and declaration file in schema
validation failure logs
([#17495](sveltejs/kit#17495))

- fix: reuse SSR results of remote functions from packages during
hydration in dev ([#17604](sveltejs/kit#17604))

- fix: remove empty type output directories for removed routes
([#17472](sveltejs/kit#17472))

- fix: use the UTF-8 byte length when reading inline assets
([#17590](sveltejs/kit#17590))

- chore: simplify a few server and build helpers
([#17531](sveltejs/kit#17531))

- fix: ignore the query string and hash of an imported asset's URL when
using `read` ([#17507](sveltejs/kit#17507))

- fix: avoid reloading unrelated server modules when saving files during
development ([#17462](sveltejs/kit#17462))
## @sveltejs/[email protected]

### Patch Changes

- fix: apply the Vite config and plugins of the detected adapter
([#17572](sveltejs/kit#17572))
- Updated dependencies:
  - @sveltejs/[email protected]
## @sveltejs/[email protected]

### Patch Changes

- fix: serve client and prerendered files whichever way the request path
is percent-encoded, and allow `*` and a leading `:` in their filenames
([#17123](sveltejs/kit#17123))

- perf: let Bun serve immutable files without calling into JavaScript
([#17123](sveltejs/kit#17123))

- fix: support the `ORIGIN` environment variable when `paths.origin` is
not set ([#17632](sveltejs/kit#17632))
- Updated dependencies:
  - @sveltejs/[email protected]
## @sveltejs/[email protected]

### Patch Changes

- fix: ignore `Range` headers on `HEAD` requests for static assets
([#17602](sveltejs/kit#17602))

- fix: respond with a 500 instead of crashing the server when handling a
request fails unexpectedly
([#17696](sveltejs/kit#17696))

- fix: support the `ORIGIN` environment variable when `paths.origin` is
not set ([#17632](sveltejs/kit#17632))
- Updated dependencies:
  - @sveltejs/[email protected]
## @sveltejs/[email protected]

### Patch Changes

- fix: accept every Node.js version from 26 (`nodejs27.x`, `nodejs28.x`,
...), not only even ones
([#17584](sveltejs/kit#17584))

- fix: serve prerendered pages when `paths.base` is set
([#17525](sveltejs/kit#17525))
- Updated dependencies:
  - @sveltejs/[email protected]
## @sveltejs/[email protected]

### Patch Changes

- fix: compute the missing `width` or `height` at runtime for images
imported in the script, instead of outputting `NaN`
([#17499](sveltejs/kit#17499))

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants