Repository: sveltejs/kit (js)

Issue:
`Access-Control-Allow-Origin` header is not set on static files in dev mode
### Describe the bug

In dev mode, the server is supposed to set `Access-Control-Allow-Origin: *` on every request. This is the case for some older versions of SvelteKit, like `1.0.0-next.193`. However, in new versions, this header is omitted on static assets.

### Reproduction

```
$ npm create svelte@latest my-app 

create-svelte version 2.0.0-next.190

Welcome to SvelteKit!

This is release candidate software; expect bugs and missing features.

Problems? Open an issue on https://github.com/sveltejs/kit/issues if none exists already.

✔ Which Svelte app template? › SvelteKit demo app
✔ Add type checking with TypeScript? › Yes, using TypeScript syntax
✔ Add ESLint for code linting? … No / Yes
✔ Add Prettier for code formatting? … No / Yes
✔ Add Playwright for browser testing? … No / Yes
[... snip ...]

$ cd my-app
$ npm install && npm run dev

  VITE v3.2.3  ready in 737 ms

  ➜  Local:   http://localhost:5176/
  ➜  Network: use --host to expose
```

Then, in other window:

```
$ curl -I http://localhost:5176
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
content-type: text/html
etag: "ww3y0i"
x-sveltekit-page: true
Date: Tue, 15 Nov 2022 13:50:53 GMT
Connection: keep-alive
Keep-Alive: timeout=5

$ curl -I http://localhost:5176/favicon.png
HTTP/1.1 200 OK
Content-Length: 1571
Content-Type: image/png
Last-Modified: Tue, 15 Nov 2022 13:49:27 GMT
ETag: W/"1571-1668520167945"
Cache-Control: no-cache
Date: Tue, 15 Nov 2022 13:51:26 GMT
Connection: keep-alive
Keep-Alive: timeout=5
```

### Logs

_No response_

### System Info

```Shell
System:
    OS: Linux 5.15 Ubuntu 20.04.5 LTS (Focal Fossa)
    CPU: (16) x64 Intel(R) Core(TM) i9-9880H CPU @ 2.30GHz
    Memory: 11.29 GB / 62.49 GB
    Container: Yes
    Shell: 5.0.17 - /bin/bash
  Binaries:
    Node: 16.17.1 - /usr/bin/node
    Yarn: 1.22.19 - /usr/bin/yarn
    npm: 8.15.0 - /usr/bin/npm
  Browsers:
    Chrome: 106.0.5249.119
    Firefox: 105.0
  npmPackages:
    @sveltejs/adapter-auto: next => 1.0.0-next.87 
    @sveltejs/kit: next => 1.0.0-next.546 
    svelte: ^3.46.0 => 3.53.1 
    vite: ^3.1.0 => 3.2.3
```


### Severity

blocking an upgrade

### Additional Information

_No response_

Pull request:
add ACAO: * to static assets in dev
closes #7664. we might just want to wait for #7543 instead depending on ETA (@benmccann?)

### Please don't delete this checklist! Before submitting the PR, please make sure you do the following:
- [x] It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
- [x] This message body should clearly illustrate what problems it solves.
- [x] Ideally, include a test that fails without this PR but passes with it.

### Tests
- [ ] Run the tests with `pnpm test` and lint the project with `pnpm lint` and `pnpm check`

### Changesets
- [x] If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running `pnpm changeset` and following the prompts. All changesets should be `patch` until SvelteKit 1.0


Patch:
diff --git a/.changeset/clever-students-report.md b/.changeset/clever-students-report.md
new file mode 100644
index 000000000..49cd156bf
--- /dev/null
+++ b/.changeset/clever-students-report.md
@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+Add `Access-Control-Allow-Origin: *` to static assets in dev
diff --git a/.changeset/gentle-rocks-run.md b/.changeset/gentle-rocks-run.md
new file mode 100644
index 000000000..5730b5b8f
--- /dev/null
+++ b/.changeset/gentle-rocks-run.md
@@ -0,0 +1,5 @@
+---
+'@sveltejs/package': patch
+---
+
+[feat] warn if svelte not found in dependencies or peerDependencies
diff --git a/documentation/docs/30-advanced/10-advanced-routing.md b/documentation/docs/30-advanced/10-advanced-routing.md
index 92eac003c..53f646b96 100644
--- a/documentation/docs/30-advanced/10-advanced-routing.md
+++ b/documentation/docs/30-advanced/10-advanced-routing.md
@@ -160,6 +160,8 @@ src/routes/🤪/+page.svelte
 
 The format for a Unicode escape sequence is `[u+nnnn]` where `nnnn` is a valid value between `0000` and `10ffff`. (Unlike JavaScript string escaping, there's no need to use surrogate pairs to represent code points above `ffff`.) To learn more about Unicode encodings, consult [Programming with Unicode](https://unicodebook.readthedocs.io/unicode_encodings.html).
 
+> Since TypeScript [struggles](https://github.com/microsoft/TypeScript/issues/13399) with directories with a leading `.` character, you may find it useful to encode these characters when creating e.g. [`.well-known`](https://en.wikipedia.org/wiki/Well-known_URI) routes: `src/routes/[x+2e]well-known/...`
+
 ### Advanced layouts
 
 By default, the _layout hierarchy_ mirrors the _route hierarchy_. In some cases, that might not be what you want.
diff --git a/packages/kit/package.json b/packages/kit/package.json
index 472b9252a..70a2a4329 100644
--- a/packages/kit/package.json
+++ b/packages/kit/package.json
@@ -31,7 +31,7 @@
 		"@types/node": "^16.11.68",
 		"@types/sade": "^1.7.4",
 		"@types/set-cookie-parser": "^2.4.2",
-		"marked": "^4.1.1",
+		"marked": "^4.2.2",
 		"rollup": "^2.79.1",
 		"svelte": "^3.52.0",
 		"svelte-preprocess": "^4.10.7",
diff --git a/packages/kit/src/exports/vite/dev/index.js b/packages/kit/src/exports/vite/dev/index.js
index 6944f30dd..ef8f28cf0 100644
--- a/packages/kit/src/exports/vite/dev/index.js
+++ b/packages/kit/src/exports/vite/dev/index.js
@@ -236,7 +236,10 @@ export async function dev(vite, vite_config, svelte_config) {
 		dev: true,
 		etag: true,
 		maxAge: 0,
-		extensions: []
+		extensions: [],
+		setHeaders: (res) => {
+			res.setHeader('access-control-allow-origin', '*');
+		}
 	});
 
 	vite.middlewares.use(async (req, res, next) => {
diff --git a/packages/package/src/index.js b/packages/package/src/index.js
index d751537bf..e7af57df8 100644
--- a/packages/package/src/index.js
+++ b/packages/package/src/index.js
@@ -32,6 +32,12 @@ export async function build(config, cwd = process.cwd()) {
 
 	const pkg = generate_pkg(cwd, files);
 
+	if (!pkg.dependencies?.svelte && !pkg.peerDependencies?.svelte) {
+		console.warn(
+			'Svelte libraries should include "svelte" in either "dependencies" or "peerDependencies".'
+		);
+	}
+
 	if (!pkg.svelte && files.some((file) => file.is_svelte)) {
 		// Several heuristics in Kit/vite-plugin-svelte to tell Vite to mark Svelte packages
 		// rely on the "svelte" property. Vite/Rollup/Webpack plugin can all deal with it.
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index c4f3b6710..d9b076e84 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -274,7 +274,7 @@ importers:
       devalue: ^4.2.0
       kleur: ^4.1.5
       magic-string: ^0.26.7
-      marked: ^4.1.1
+      marked: ^4.2.2
       mime: ^3.0.0
       rollup: ^2.79.1
       sade: ^1.8.1
@@ -710,7 +710,7 @@ importers:
       '@types/node': ^16.11.68
       flexsearch: ^0.7.31
       magic-string: ^0.26.7
-      marked: ^4.1.1
+      marked: ^4.2.2
       prism-svelte: ^0.5.0
       prismjs: ^1.29.0
       shiki-twoslash: ^3.1.0
diff --git a/sites/kit.svelte.dev/package.json b/sites/kit.svelte.dev/package.json
index 9dade35a9..7dc0b5640 100644
--- a/sites/kit.svelte.dev/package.json
+++ b/sites/kit.svelte.dev/package.json
@@ -17,7 +17,7 @@
 		"@types/node": "^16.11.68",
 		"flexsearch": "^0.7.31",
 		"magic-string": "^0.26.7",
-		"marked": "^4.1.1",
+		"marked": "^4.2.2",
 		"prism-svelte": "^0.5.0",
 		"prismjs": "^1.29.0",
 		"shiki-twoslash": "^3.1.0",


Test patch:
diff --git a/packages/kit/test/apps/basics/test/server.test.js b/packages/kit/test/apps/basics/test/server.test.js
index 2f56b508a..97f6bceff 100644
--- a/packages/kit/test/apps/basics/test/server.test.js
+++ b/packages/kit/test/apps/basics/test/server.test.js
@@ -372,6 +372,8 @@ test.describe('Static files', () => {
 		response = await request.get('/subdirectory/static.json');
 		expect(await response.json()).toBe('subdirectory file');
 
+		expect(response.headers()['access-control-allow-origin']).toBe('*');
+
 		response = await request.get('/favicon.ico');
 		expect(response.status()).toBe(200);
 	});