fix: reject malformed streamed data encoding

[scarab-systems]

Related to #15511.

Summary

Thanks for SvelteKit. I really appreciate the care that goes into this project.

This PR tightens streamed __data.json parsing so newline-delimited JSON data is decoded with fatal UTF-8 handling. Previously, malformed UTF-8 bytes could be decoded as replacement characters and then surface later as JSON.parse syntax errors. With this change, malformed stream encoding is rejected at the decoding boundary instead of being parsed as corrupted JSON text.

The diagnostic path that led to this patch traced the streamed response across the raw bytes -> UTF-8 text -> NDJSON record -> JSON parse boundary. That pointed at the byte-to-text transition as the useful place to fail fast, rather than changing the later JSON parsing path.

I also added regression coverage for the streamed-data parser:

• split UTF-8 code points across chunks still parse correctly
• malformed UTF-8 is rejected before JSON parsing

I did not have a reliable end-to-end reproduction of the original timing/network conditions described in #15511. The issue notes that the full problem has been difficult to reproduce, so this PR focuses on the malformed UTF-8 / NDJSON boundary shown by the replacement-character failures in the report. Happy to adjust the scope, wording, or test shape if you would prefer a different framing.

Validation

Passed:

• pnpm -F @sveltejs/kit test:unit
• pnpm lint after rerunning with a larger Node heap because the default local heap hit an OOM during repo-wide ESLint
• pnpm check
• git diff --check

Also run:

• KIT_E2E_BROWSER=chromium pnpm run test:kit

That package-level browser/integration run reached the Chromium Playwright tests, but failed in packages/kit/test/apps/async on an existing direct http.get / Playwright webServer readiness case with ECONNREFUSED 127.0.0.1:5173. I did not change that area; the new unit regression passed in the focused and full @sveltejs/kit unit runs.

---

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
• This message body should clearly illustrate what problems it solves.
• Ideally, include a test that fails without this PR but passes with it.

Tests

• Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

• If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

Edits

• Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

Disclosure: I used AI-assisted coding tools while preparing this PR. I reviewed the changes myself, tested them, and take responsibility for the implementation and any follow-up revisions needed.

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from 3338528:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/3338528cdaec3a69658fc87f7b86ee026a90ce30

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/16423

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[changeset-bot]

🦋 Changeset detected

Latest commit: 3338528

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[Rich-Harris]

thank you!

[scarab-systems]

thank you!

Woohoo! You're Welcome! so pleased we could help with this one!