---
'@sveltejs/kit': patch
---

[breaking] block cross-site form POSTs by default. disable with config.kit.csrf.checkOrigin