Merge branch 'sveltejs:main' into main

Author: 0x221A

.changeset/clean-wolves-bathe.md

@@ -0,0 +1,5 @@
+---
+"create-svelte": minor
+---
+
+feat: mark scripts in libraries as being side effect free by default

.github/workflows/audit.yml

@@ -13,6 +13,8 @@ permissions:
 
 jobs:
   Audit:
+    # prevents this action from running on forks
+    if: github.repository == 'sveltejs/kit'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/ci.yml

@@ -59,6 +59,8 @@ jobs:
       - run: pnpm playwright install ${{ matrix.e2e-browser }}
       - run: pnpm run sync-all
       - run: pnpm test:kit
+      - name: Print flaky test report
+        run: node scripts/print-flaky-test-report.js
       - name: Archive test results
         if: failure()
         shell: bash
@@ -115,6 +117,8 @@ jobs:
       - run: pnpm playwright install ${{ matrix.e2e-browser }}
       - run: pnpm run sync-all
       - run: pnpm test:cross-platform:${{ matrix.mode }}
+      - name: Print flaky test report
+        run: node scripts/print-flaky-test-report.js
       - name: Archive test results
         if: failure()
         shell: bash

.github/workflows/release.yml

@@ -12,6 +12,7 @@ jobs:
     if: github.repository == 'sveltejs/kit'
     permissions:
       contents: write # to create release (changesets/action)
+      id-token: write # OpenID Connect token needed for provenance
       pull-requests: write # to create pull request (changesets/action)
     name: Release
     runs-on: ubuntu-latest
@@ -39,6 +40,7 @@ jobs:
           version: pnpm changeset:version
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           UPDATE_TEMPLATE_SSH_KEY: ${{ secrets.UPDATE_TEMPLATE_SSH_KEY }}
 

documentation/docs/10-getting-started/index.md

@@ -0,0 +1,3 @@
+---
+title: Getting started
+---

documentation/docs/10-getting-started/meta.json

@@ -664,6 +664,7 @@ To summarize, a `load` function will rerun in the following situations:
 - It references a property of `url` (such as `url.pathname` or `url.search`) whose value has changed. Properties in `request.url` are _not_ tracked
 - It calls `url.searchParams.get(...)`, `url.searchParams.getAll(...)` or `url.searchParams.has(...)` and the parameter in question changes. Accessing other properties of `url.searchParams` will have the same effect as accessing `url.search`.
 - It calls `await parent()` and a parent `load` function reran
+- A child `load` function calls `await parent()` and is rerunning, and the parent is a server load function
 - It declared a dependency on a specific URL via [`fetch`](#making-fetch-requests) (universal load only) or [`depends`](types#public-types-loadevent), and that URL was marked invalid with [`invalidate(url)`](modules#$app-navigation-invalidate)
 - All active `load` functions were forcibly rerun with [`invalidateAll()`](modules#$app-navigation-invalidateall)
 

documentation/docs/20-core-concepts/20-load.md

@@ -329,6 +329,8 @@ The easiest way to progressively enhance a form is to add the `use:enhance` acti
 +<form method="POST" use:enhance>
 ```
 
+> `use:enhance` can only be used with forms that have `method="POST"`. It will not work with `method="GET"`, which is the default for forms without a specified method. Attempting to use `use:enhance` on forms without `method="POST"` will result in an error.
+
 > Yes, it's a little confusing that the `enhance` action and `<form action>` are both called 'action'. These docs are action-packed. Sorry.
 
 Without an argument, `use:enhance` will emulate the browser-native behaviour, just without the full-page reloads. It will:

documentation/docs/20-core-concepts/30-form-actions.md

@@ -0,0 +1,3 @@
+---
+title: Core concepts
+---