[svelte-triage-bot]

• match(string) read event.url.origin, triggering the protected getter inside remote queries even when given an explicit pathname or absolute URL.
• Preserve origin-aware rerouting introduced in feat: provide match function to allow the opposite of resolve #14997 by taking the origin from event.request.url; keep root-relative string normalization and the no-request fallback.
• Reject using a dummy origin, which breaks domain-aware rerouting, or weakening the query restrictions from breaking: error on event.url, event.params and event.route access inside queries #16452, which prevent stale page-dependent cache results.
• The shared server matching helper covers query variants and nested calls without changing client matching or page-dependent relative asset resolution. Cover SSR/client requests, nested batches, explicit URL origins, and continued denial of page URL access.

Fixes #17384

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from 7b7fcd1:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/7b7fcd10c478317270f5b7880bc2b4a67762675a

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/17387

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[changeset-bot]

🦋 Changeset detected

Latest commit: 7b7fcd1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[ottomated]

I think we wanted to instead allow access to event.url, and only block the pathname and search properties