v4.18.1

Now built on upstream v4.17.2, SST's latest release. 4.18.0 was built on 4.17.1. This release also fixes server routes next to prerendered pages, the visitor's address in SvelteKit apps, and JWT auth on WebSocket APIs.

⚠️ Before you upgrade

• Node.js 22 or later is still required, as since 4.18.0. The package now says so in its engines field: npm, pnpm and Bun warn when you install it on an older Node.js, and Yarn 1 refuses to install it. Upgrade Node.js everywhere you run sst, CI included.
• An ApiGatewayWebSocket with JWT auth now stops at sst diff and sst dev, not only at deploy. It could never deploy: API Gateway only supports JWT authorizers on HTTP APIs. Use a Lambda authorizer that verifies the token instead; the docs now show one. (#51, anomalyco/sst#6041)

SST 4.17.2

SST 4.17.2 has one change, which guards a function's description in sst dev against a missing value (anomalyco/sst#6984). The fork has had the same fix since 4.17.3 (#14), so nothing changes for you. sst version now shows built on SST 4.17.2.

Fixes

• Server routes in a folder with prerendered pages no longer get a 403. An SsrSite sent a whole asset folder to S3, so when a folder held a prerendered page, the server routes in it got S3's 403. In SvelteKit, a prerendered page or endpoint in such a folder could 403 too. Those folders' files are now listed one by one, so each request goes to S3 or to the server as it should. This applies to SvelteKit, SolidStart and Astro with a server. (#35, anomalyco/sst#6143)
• getClientAddress() in a SvelteKit app returns the visitor's address behind CloudFront, from CloudFront-Viewer-Address. It used to return CloudFront's own address, which changes from request to request, so rate limiting and logging saw the wrong address. It's in @sst-community/svelte-kit-sst 3.0.1. The value can only be trusted when requests come through CloudFront: if you use it to allow or block clients, set protection on the SvelteKit component, or on the Router that serves it. (#50)

Changes

• ApiGatewayWebSocket documents how to accept a JWT, such as a Cognito token: a Lambda authorizer that verifies it with aws-jwt-verify. Its jwt, payload and response options are deprecated, since WebSocket APIs don't support or use them. (#51)
• To update the SvelteKit adapter: npm install svelte-kit-sst@npm:@sst-community/svelte-kit-sst@3.0.1.

Docs

• The landing page, the README and the docs intro say Node.js 22 or later is required.

Install

npm install sst@npm:@sst-community/sst@4.18.1

To switch an existing project:

1. Check that node --version shows v22 or later, wherever you run sst, CI included.
2. Set its dependency to "sst": "npm:@sst-community/sst@4.18.1" and reinstall.

For a project that isn't JavaScript, install the CLI globally. It still needs Node.js 22 or later, to run sst.config.ts:

curl -fsSL https://raw.githubusercontent.com/sst-community/sst/main/install | bash