Elliott Johnson

Elliott Johnson

@ell.iott.dev

Svelte Core Team @ Vercel

267 followers16 following177 posts

Elliott Johnson
@ell.iott.dev

Why yes, leasing office, I would just love to attend the amazing event you've planned with soda and cheap snacks so that I can be ambushed by whatever insane internet/insurance/dentist's office sales team you've decided to foist upon our complex today

Elliott Johnson
@ell.iott.dev

Just merged a relatively significant set of changes to remote functions, especially `query`. It's fairly likely your next upgrade will break your app if you're doing anything decently advanced, but the errors should be pretty helpful/descriptive.

Elliott Johnson
@ell.iott.dev

I'm updating the docs ASAP as well. (See PR for a good description of the changes in the meantime: github.com/sveltejs/kit...)

github.comfeat: `hydratable` and a more consistent remote functions model by elliott-with-the-longest-name-on-github · Pull Request #15533 · sveltejs/kitThis PR makes a number of substantial changes to how remote queries work. hydratable Implementation-wise, it replaces our custom transport solution with hydratable for queries that are used during ...
Elliott Johnson
@ell.iott.dev

We just released a number of security patches across the Svelte ecosystem. If you use SvelteKit, the Vercel adapter for SvelteKit, Svelte, or devalue, you should upgrade. The Vercel OSS Bug Bounty paid out over $14,000 for these reports!

View full thread
Elliott Johnson
@ell.iott.dev

The `@sveltejs/adapter-vercel` patches are available in 6.3.2. If you're on Vercel, you should upgrade. We deployed WAF protections for most exploit patterns, but the only way to immunize yourself to this one is by upgrading or being lucky enough to have an app configuration that prevents it.

Elliott Johnson
@ell.iott.dev

Huge thanks to everyone involved, and a special shoutout for the security team at Vercel for working with us to pay our reporters and managing this new bug bounty!

Elliott Johnson
@ell.iott.dev

We just released a number of security patches across the Svelte ecosystem. If you use SvelteKit, the Vercel adapter for SvelteKit, Svelte, or devalue, you should upgrade. The Vercel OSS Bug Bounty paid out over $14,000 for these reports!

View full thread
Elliott Johnson
@ell.iott.dev

The `@sveltejs/kit` patches are available in version 2.52.2. Only applications using both `experimental.remoteFunctions` and `form` are vulnerable.

Elliott Johnson
@ell.iott.dev

We just released a number of security patches across the Svelte ecosystem. If you use SvelteKit, the Vercel adapter for SvelteKit, Svelte, or devalue, you should upgrade. The Vercel OSS Bug Bounty paid out over $14,000 for these reports!

Elliott Johnson
@ell.iott.dev

The `svelte` security patches are available in version 5.51.5. All of these had to do with SSR escaping issues. Thankfully, they're all very difficult to exploit in practice. (Most of them would require upstream system compromise along with some level of knowledge of the application's internals).

Elliott Johnson
@ell.iott.dev

It's official, you can now get paid up to $10,000 for finding security issues in Svelte and SvelteKit! Big thanks to both the security team at Vercel and the Svelte maintainers' group for coming together to make this possible. Learn more: vercel.com/blog/the-ver...

vercel.comThe Vercel OSS Bug Bounty program is now available - VercelVercel is opening its open source software bug bounty program to the public for researchers find vulnerabilities and make OSS safer
Elliott Johnson
@ell.iott.dev

These beautiful projects have changed my life for the better — through them, I not only learned web development, but software engineering as a whole. I really have Svelte to thank for my entire career at this point. Rich and Simon, and many of the other maintainers, have been the #1 influence…

Elliott Johnson
@ell.iott.dev

…on my software engineering skills. I’m so excited for the next year working on the project. I get to learn from some of the best engineers I’ve ever met, and can’t wait to show you all that we’ve got planned. Cheers to the next year, everyone!

Elliott Johnson
@ell.iott.dev

After way too many rounds of review, `hydratable` is out! This new low-level Svelte API isn’t one you’ll find yourself reaching for often, but it’s extremely useful to libraries. During SSR, function results are serialized alongside your HTML…

Elliott Johnson
@ell.iott.dev

Crazy things I somehow managed to get past Rich's review and into @svelte.dev core this year: - Introduced the first yield* into the svelte core - Introduced a variable called `pickled_awaits` that makes me happy every time I see it Stay tuned for whatever other ridiculous things I can get in

Elliott Johnson
@ell.iott.dev

I am literally so jazzed to exist in the near future when everything has meshed together and exited the experimental phase.

rich harris@rich-harris.dev

today we landed a @svelte.dev feature i'm pretty stoked about — we call it 'forking', and it lets you run state changes offscreen and later choose whether to commit them (e.g. user hovers on a link, preload data in case they click) - docs svelte.dev/docs/svelte/... - demo svelte.dev/playground/a...

svelte.devforking monkeys • Playground • SvelteWeb development for the rest of us
Elliott Johnson
@ell.iott.dev

not my normal content, but i just need you all to know i delivered liquid lacquer to the mask maker in silksong on my first try. this might be my life’s greatest accomplishment and i’m unsure i’ll ever see this high again

Elliott Johnson
@ell.iott.dev

Super excited to announce the experimental release of asynchronous SSR in Svelte! github.com/sveltejs/sve... `await` expressions in your Svelte components can now be rendered on the server, meaning you don't need to render them inside boundaries with a `pending` snippet. Next up, streaming SSR!

github.comAsync SSR · sveltejs svelte · Discussion #16784The Svelte team has been hard at work on asynchronous rendering, with client-side support and remote functions as our first two efforts. It’s time for the third: SSR. Background There are three cor...
Elliott Johnson
@ell.iott.dev

OpenTelemetry tracing is live in SvelteKit! Huge s/o to @stracke.tech for all the help along the way. SvelteKit can now emit OTEL spans for all of its serverside constructs. It also provides an instrumentation file to easily set up trace exports. svelte.dev/blog/sveltek...

svelte.devIntroducing integrated observability in SvelteKitSvelteKit apps can now emit OpenTelemetry traces and reliably set up observability instrumentation using instrumentation.server.ts
Elliott Johnson
@ell.iott.dev

h/t @dummdidumm.bsky.social -- insane work getting this put together

rich harris@rich-harris.dev

hard to overstate how excited i am about this RFC — @dummdidumm.bsky.social is doing incredible work. this raises the bar for data fetching in frameworks, and unlocks some very cool new use cases for SvelteKit. we have a lot more ideas that will build on top of this work github.com/sveltejs/kit...

github.comRemote Functions · sveltejs kit · Discussion #13897tl;dr Remote functions are a new concept in SvelteKit that allow you to declare functions inside a .remote.ts file, import them inside Svelte components and call them like regular functions. On the...
Elliott Johnson
@ell.iott.dev

@khromov.se has been doing amazing work in the AI space for Svelte -- what a champion!

Stanislav@khromov.se

👀 What if every AI model could have updated Svelte 5 documentation? I created an experimental MCP server, give it a try! It's free and open source. SSE (Claude Desktop): svelte-llm.khromov.se/mcp/sse, Streamable HTTP (most others): svelte-llm.khromov.se/mcp/mcp

You are up to date.