SvelteKit 3.1 adds CSP hash-reporting keywords and tracing spans for server endpoints

Victoria Shinder15 October 2026, 06:371 min read

The Svelte team released @sveltejs/kit 3.1.0 on 14 October 2026. The release notes list two minor features and six patch fixes.

Two new features.

• CSP hash reporting: SvelteKit now supports the report-sha256, report-sha384 and report-sha512 keywords in its Content Security Policy configuration (pull request #17398).
• Endpoint tracing: with server tracing enabled, SvelteKit emits a sveltekit.endpoint span for +server handlers (#17325).

Fixes worth checking against your project.

• A project located inside a directory named server no longer has every module treated as server-only (#17376).
• Deployment recovery continues when service-worker updates fail (#17440).
• MIME types for prerendered files are now inferred from the generated files (#17381).
• Generated files are left alone when their contents are unchanged (#17310).
• When an app runs in an unfocused iframe and starts or navigates, focus stays in the parent page (#17297).
• SvelteKit no longer warns about Storybook's Vite plugins that use transformIndexHtml (#17373).

The same day the project published @sveltejs/package 3.0.1, @sveltejs/adapter-vercel 7.0.1 and @sveltejs/adapter-cloudflare 8.0.1. The 3.1.0 notes do not list breaking changes.

Source: SvelteKit release notes, "@sveltejs/kit@3.1.0" — https://github.com/sveltejs/kit/releases/tag/%40sveltejs/kit%403.1.0