It's official, you can now get paid up to $10,000 for finding security issues in Svelte and SvelteKit! Big thanks to both the security team at Vercel and the Svelte maintainers' group for coming together to make this possible. Learn more:

We've released fixes for 5 CVEs affecting the Svelte ecosystem. If you're using devalue, SvelteKit, Svelte, or the Node adapter for SvelteKit, you should upgrade. More details:

Advent of Svelte, day 6: `await`! What I’ve taken to calling the “async vision” for Svelte really is the coolest way to build interactive, asynchronous UIs, and it all revolves around how we can enable you to “just await” your asynchronous work:

For anyone who's missed it, Svelte is running an advent calendar of short informative videos on relatively new / unknown features this year. Here's today's, on `svelte:boundary`:

u know when rich is going HARD

https://t.co/rKQcOVKL5A

During hydration on the client, the results are pulled from the serialized data synchronously, so you don’t have to do your async work again. If used outside of hydration, `hydratable` just runs its callback. This API will power SvelteKit’s remote functions very soon!

After way too many rounds of review, `hydratable` is out! This new low-level Svelte API isn’t one you’ll find yourself reaching for often, but it’s extremely useful to libraries. During SSR, function results are serialized alongside your HTML…

my mouse is slowly breaking and i'm trying to make it to black friday every third or fourth click doesn't work. i never know when it just didn't click or an app is loading slowly i'm slowly going insane

the people who have like 100k+ followers always blow my mind... like, are you sure 100k people actually exist. have you met that many people

watch out, they've got an outage planned for the 3rd

For those wondering, we didn't go with the `vercel.json#bunVersion` API because it's currently experimental and doing so would tie the vercel adapter's semver to it -- meaning if Vercel decides to change it before GA we would have to bump the adapter a major version.

Adapter docs:

This is supported in the SvelteKit adapter for Vercel. You'll need to set `experimental_bun1.x` in your adapter config, or you can `export const config = { runtime: 'exeperimental_bun1.x' }` to opt in a single route (or group of routes if you export it from a layout).

Remote Functions now also work with server side rendering!

`await` expressions in your Svelte components can now be rendered on the server, meaning you don't need to render them inside boundaries with a `pending` snippet. Next up, streaming SSR!

https://t.co/heaQqWiL8c

It's time! Async SSR in Svelte is here!

so excited to share the latest svelte development with all of you 👀

Read more on the blog post and in the docs: