fix: keep vite out of the $app/env runtime validator by hjaber · Pull Request #15953 · sveltejs/kit

hjaber · 2026-06-04T08:07:43Z

Problem

Enabling explicit environment variables (experimental.explicitEnvironmentVariables) pulls Vite into the production server runtime, which breaks any deployment that compiles or bundles the server into a self-contained artifact without node_modules.

The runtime env validator @sveltejs/kit/internal/env runs at server startup — Server.init() → set_env() → validate() / handle_issues(). It imports stackless from exports/vite/utils.js, whose top-level imports include import { loadEnv } from 'vite'. So importing the validator drags all of Vite into the server bundle.

Concretely, compiling the SvelteKit server to a standalone binary with bun build --compile:

the build fails to resolve Vite's lazy import("esbuild") (esbuild is an optional peer of Vite 8), and
once that's worked around, the binary crashes at startup — Vite reads its own version via new URL('../../package.json', import.meta.url), which resolves to /package.json inside the compiled binary's virtual filesystem → ENOENT.

This very likely also affects pruned production runtimes (e.g. adapter-node deployed with npm ci --omit=dev), where Vite — a build-time/dev dependency — isn't installed but the runtime tries to import it.

Fix

stackless is a tiny, dependency-free helper (it just creates an Error with no stack trace). Move it to src/utils/stackless.js and import it from there in internal/env.js. exports/vite/utils.js re-exports it, so the build-time caller (exports/vite/index.js) is unchanged. This removes Vite from the runtime env validator's import graph entirely.

Test

Adds packages/kit/src/exports/internal/env.spec.js, which statically walks the import graph of internal/env.js (via acorn) and asserts it reaches neither vite nor any module under exports/vite/. It fails on main (internal/env.js → ../vite/utils.js → vite) and passes with this change.

This message body clearly illustrates the problem this PR solves.
Includes a test that fails without this PR and passes with it (verified the graph-walk both ways: fails on main, passes here).
Changeset: none — explicit env vars are unreleased.
Please ensure that 'Allow edits from maintainers' is checked.

changeset-bot · 2026-06-04T08:07:48Z

🦋 Changeset detected

Latest commit: e32358b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

`@sveltejs/kit/internal/env` runs at server startup but imported `stackless` from `exports/vite/utils.js`, which imports `vite` — pulling Vite into the production server bundle and breaking deploys that compile/bundle the server without `node_modules` (e.g. `bun build --compile`). Move `stackless` to a dependency-free `utils/stackless.js` (re-exported from the vite utils so build-time callers are unchanged) and add a regression test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

teemingc · 2026-06-04T08:53:29Z

 import { negotiate } from '../../utils/http.js';
 import { filter_env } from '../../utils/env.js';
 import { escape_html } from '../../utils/escape.js';
+import { stackless } from '../../utils/stackless.js';


Can we avoid the re-export and instead change the files to import directly?

teemingc · 2026-06-04T08:55:20Z

Is it possible to rename this to error.js if there isn’t one already?

teemingc

We might need a changeset now. Explicit env vars was just released

Addresses review feedback: drop the re-export from exports/vite/utils.js and import `stackless` directly from utils/stackless.js in exports/vite/index.js. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- merge stackless into the existing utils/error.js (per review) and import it directly from there; delete the standalone utils/stackless.js - harden the regression test to follow @sveltejs/kit/* self-imports, so a Vite pull reaching internal/env *through* @sveltejs/kit/internal can't slip past - add the patch changeset (explicit env vars is now released) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hjaber · 2026-06-04T09:19:56Z

Thanks @teemingc, all addressed in the latest commits:

Dropped the re-export. internal/env, vite/index, and vite/utils now import stackless directly.
Moved it into utils/error.js and deleted the standalone file. That adds an @sveltejs/kit/internal edge to the validator's graph, but that's runtime-only (and already loaded in every server), confirmed Vite-free with no cycle back to env/error, so it doesn't reintroduce the issue.
Added a patch changeset.

One extra thing: since error.js reaches @sveltejs/kit/internal, I taught the regression test to follow @sveltejs/kit/* self-imports too (via the exports map), not just relative ones, so a Vite import that ever sneaks in through internal would still be caught, not only direct exports/vite/* imports.

teemingc · 2026-06-04T10:19:15Z

Thank you so much! I’ll have another look once I can get to my laptop if another maintainer doesn’t beat me to it

elliott-with-the-longest-name-on-github · 2026-06-05T04:09:21Z

I'll let other maintainers weigh in on this but I wonder if this should just be a custom ESLint rule -- we typically shouldn't be importing from the vite folder in other places in the first place.

This hit me while working on another PR too. Might be worth adding one. We already have one for kit internals

It'd probably be better than adding it as a test because it'd give us much broader coverage

I agree. I tried to build this just now but I don't have the patience to coax ESLint into doing something useful. (I don't think I'd run pnpm eslint 'packages/kit/src/**/*.js' locally before just now; hooboy is it slow. We really should switch to Oxlint if we can.)

For now I'll remove this test so that we can fix the immediate issue but we should definitely follow this up

hjaber force-pushed the fix/explicit-env-runtime-no-vite branch from 691d402 to 978edfb Compare June 4, 2026 08:30

hjaber force-pushed the fix/explicit-env-runtime-no-vite branch from 978edfb to 2814641 Compare June 4, 2026 08:49

teemingc reviewed Jun 4, 2026

View reviewed changes

teemingc requested changes Jun 4, 2026

View reviewed changes

hjaber and others added 2 commits June 4, 2026 08:58

review: import stackless directly instead of re-exporting it

7ad1b85

Addresses review feedback: drop the re-export from exports/vite/utils.js and import `stackless` directly from utils/stackless.js in exports/vite/index.js. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

elliott-with-the-longest-name-on-github reviewed Jun 5, 2026

View reviewed changes

Rich-Harris mentioned this pull request Jun 5, 2026

Create ESLint rule preventing accidental Vite imports #15963

Open

remove test

e32358b

Rich-Harris approved these changes Jun 5, 2026

View reviewed changes

Rich-Harris merged commit f0ba6e0 into sveltejs:main Jun 5, 2026
25 of 26 checks passed

github-actions Bot mentioned this pull request Jun 5, 2026

Version Packages #15962

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: keep vite out of the $app/env runtime validator#15953

fix: keep vite out of the $app/env runtime validator#15953
Rich-Harris merged 4 commits into
sveltejs:mainfrom
hjaber:fix/explicit-env-runtime-no-vite

hjaber commented Jun 4, 2026

Uh oh!

changeset-bot Bot commented Jun 4, 2026 •

edited

Loading

Uh oh!

teemingc Jun 4, 2026

Uh oh!

teemingc Jun 4, 2026

Uh oh!

teemingc left a comment

Uh oh!

hjaber commented Jun 4, 2026

Uh oh!

teemingc commented Jun 4, 2026 •

edited

Loading

Uh oh!

elliott-with-the-longest-name-on-github Jun 5, 2026

Uh oh!

teemingc Jun 5, 2026

Uh oh!

elliott-with-the-longest-name-on-github Jun 5, 2026

Uh oh!

Rich-Harris Jun 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

hjaber commented Jun 4, 2026

Problem

Fix

Test

Uh oh!

changeset-bot Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

teemingc Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

teemingc Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

teemingc left a comment

Choose a reason for hiding this comment

Uh oh!

hjaber commented Jun 4, 2026

Uh oh!

teemingc commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elliott-with-the-longest-name-on-github Jun 5, 2026

Choose a reason for hiding this comment

Uh oh!

teemingc Jun 5, 2026

Choose a reason for hiding this comment

Uh oh!

elliott-with-the-longest-name-on-github Jun 5, 2026

Choose a reason for hiding this comment

Uh oh!

Rich-Harris Jun 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

changeset-bot Bot commented Jun 4, 2026 •

edited

Loading

teemingc commented Jun 4, 2026 •

edited

Loading