fix(sveltekit): repair entgo-sveltekit build and bound the cookie override

[ReneWerner87]

Follow-up to #5290, which noted that pnpm run build fails in entgo-sveltekit/template. Three separate breakages turned out to be stacked on top of each other. All of them reproduce on master without these changes.

1. @sveltejs/vite-plugin-svelte stuck at 2.5.3

Same root cause as the esbuild/yaml issue in #5290: the plugin is an auto-installed peer dependency, so pnpm resolved it once and never revisited it. 2.5.3 is far outside the ^3 || ^4 || ^5 || ^6 || ^7 range that @sveltejs/kit@2.70.1 requires, hence The requested module '@sveltejs/kit/vite' does not provide an export named 'vitePreprocess'.

Declared it explicitly at ^7.2.0 in both templates and moved the import to @sveltejs/vite-plugin-svelte, where vitePreprocess now lives.

2. Unbounded cookie override resolving to a breaking major

"cookie": ">=0.7.0" had resolved to cookie 2.0.1, which no longer exports parse/serialize, breaking SvelteKit's server runtime at build time:

[MISSING_EXPORT] "parse" is not exported by cookie@2.0.1
  @sveltejs/kit/src/runtime/server/cookie.js:1:10

This is precisely the failure mode an open-ended manual override invites, the pattern #5290 described, now actually biting. Bounded to ^0.7.2: still above the GHSA-pxg6-pf52-xh8x fix line, but API-compatible with what SvelteKit expects.

The override is still required and is not removed: @sveltejs/kit depends on cookie@^0.6.0, which resolves to a vulnerable version on its own.

3. Tailwind CSS 3 to 4 bumped without the config migration

Dependabot bumped tailwindcss across the major boundary, but the v3-style PostCSS setup was never migrated, so the build died on "It looks like you're trying to use tailwindcss directly as a PostCSS plugin."

Migrated entgo-sveltekit to the @tailwindcss/vite plugin (the documented v4 plus Vite setup):

• vite.config.ts, added the tailwindcss() plugin
• src/lib/assets/post.css, @tailwind base/components/utilities becomes @import "tailwindcss"
• removed postcss.config.cjs, tailwind.config.cjs, autoprefixer and postcss-load-config, all redundant under v4 (content is auto-detected, vendor prefixing is built in)

Going through @tailwindcss/postcss instead does not work here. Vite's postcss-import tries to resolve @import "tailwindcss" as a file path and fails with ENOENT. The Vite plugin sidesteps that pipeline entirely.

Result

pnpm run build completes successfully in entgo-sveltekit/template, and pnpm install --frozen-lockfile passes, so the lockfile matches the manifest.

sveltekit-embed still does not build

Fixes 1 and 2 are applied there too, since they are correct regardless. The template remains blocked on a separate problem: @skeletonlabs/skeleton was bumped 2 to 5, which removed AppShell, AppBar, LightSwitch and storeHighlightJs, along with the tailwind/skeleton.cjs and styles/skeleton.css entry points the recipe imports. None of these exist in the v5 package, whose only exports are ., ./package.json and ./themes/*.

That is handled in #5302, which is stacked on this PR. The Tailwind v4 migration is deliberately not applied to that template here, since it would land half-finished.

Summary by CodeRabbit

• New Features

  • Updated the template styling setup to use Tailwind CSS through the Vite build process.
  • Simplified Tailwind integration with a single stylesheet import.

• Bug Fixes

  • Updated Svelte preprocessing configuration for improved compatibility with current tooling.

• Chores

  • Removed obsolete Tailwind and PostCSS configuration files from the templates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fc74378e-1981-4d73-81e7-4d828c3fce26

📥 Commits

Reviewing files that changed from the base of the PR and between 71fb336 and de9e973.

⛔ Files ignored due to path filters (4)

• entgo-sveltekit/template/package.json is excluded by !**/*.json
• entgo-sveltekit/template/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !**/*.yaml
• sveltekit-embed/template/package.json is excluded by !**/*.json
• sveltekit-embed/template/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !**/*.yaml

📒 Files selected for processing (6)

• entgo-sveltekit/template/postcss.config.cjs
• entgo-sveltekit/template/src/lib/assets/post.css
• entgo-sveltekit/template/svelte.config.js
• entgo-sveltekit/template/tailwind.config.cjs
• entgo-sveltekit/template/vite.config.ts
• sveltekit-embed/template/svelte.config.js

💤 Files with no reviewable changes (2)

• entgo-sveltekit/template/tailwind.config.cjs
• entgo-sveltekit/template/postcss.config.cjs

🚧 Files skipped from review as they are similar to previous changes (4)

• entgo-sveltekit/template/svelte.config.js
• sveltekit-embed/template/svelte.config.js
• entgo-sveltekit/template/vite.config.ts
• entgo-sveltekit/template/src/lib/assets/post.css

📜 Recent review details

⏰ Context from checks skipped due to timeout. (5)

• GitHub Check: copilot-pull-request-reviewer
• GitHub Check: Analyze (go)
• GitHub Check: Analyze (actions)
• GitHub Check: Analyze (javascript-typescript)
• GitHub Check: builds (1.26.x)

---

📝 Walkthrough

Walkthrough

The templates migrate Tailwind CSS from configuration files and directives to the Tailwind Vite plugin. Both Svelte configurations update the vitePreprocess import source.

Changes

Tailwind Vite migration

Layer / File(s)	Summary
Tailwind Vite integration entgo-sveltekit/template/src/lib/assets/post.css, entgo-sveltekit/template/vite.config.ts, entgo-sveltekit/template/postcss.config.cjs, entgo-sveltekit/template/tailwind.config.cjs	The stylesheet imports Tailwind directly. Vite registers the Tailwind plugin. The PostCSS and Tailwind configuration files are deleted.
Svelte preprocess imports entgo-sveltekit/template/svelte.config.js, sveltekit-embed/template/svelte.config.js	Both templates import vitePreprocess from @sveltejs/vite-plugin-svelte.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: copilot

Poem

A rabbit hops through Vite’s bright trail,
Tailwind blooms without old config mail.
Svelte preprocess finds its new way,
CSS imports the sunlit array.
“Hop,” says the rabbit, “clean builds today!”

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the build repair and cookie override changes described in the pull request objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/sveltekit-template-build-fix

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR fixes pnpm run build for the entgo-sveltekit/template by updating SvelteKit/Vite preprocess integration, bounding the cookie pnpm override to an API-compatible patched version, and migrating the template’s Tailwind setup to Tailwind v4’s Vite plugin approach.

Changes:

• Explicitly declare @sveltejs/vite-plugin-svelte@^7.2.0 and switch vitePreprocess imports to the new source.
• Bound pnpm cookie override from an open-ended range to ^0.7.2 to avoid breaking majors while staying past the security fix line.
• Migrate entgo-sveltekit/template Tailwind integration to @tailwindcss/vite, removing the v3-style PostCSS/Tailwind config files and updating CSS entrypoint.

Reviewed changes

Copilot reviewed 8 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
sveltekit-embed/template/svelte.config.js	Updates vitePreprocess import to @sveltejs/vite-plugin-svelte.
sveltekit-embed/template/package.json	Adds explicit @sveltejs/vite-plugin-svelte and bounds cookie override.
sveltekit-embed/template/pnpm-lock.yaml	Locks cookie to 0.7.2 and updates Svelte plugin resolution accordingly.
entgo-sveltekit/template/vite.config.ts	Adds @tailwindcss/vite plugin to Vite config.
entgo-sveltekit/template/svelte.config.js	Updates vitePreprocess import to @sveltejs/vite-plugin-svelte.
entgo-sveltekit/template/src/lib/assets/post.css	Switches Tailwind directives to Tailwind v4-style @import "tailwindcss".
entgo-sveltekit/template/postcss.config.cjs	Removes PostCSS plugin configuration no longer used under the v4 Vite plugin setup.
entgo-sveltekit/template/tailwind.config.cjs	Removes Tailwind v3-era config file as part of v4 migration.
entgo-sveltekit/template/package.json	Adds @sveltejs/vite-plugin-svelte and @tailwindcss/vite, and bounds cookie override.
entgo-sveltekit/template/pnpm-lock.yaml	Locks updated dependency graph including bounded cookie and Tailwind v4 Vite plugin stack.

Files not reviewed (2)

• entgo-sveltekit/template/pnpm-lock.yaml: Generated file
• sveltekit-embed/template/pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 10 changed files in this pull request and generated no new comments.

Files not reviewed (2)

• entgo-sveltekit/template/pnpm-lock.yaml: Generated file
• sveltekit-embed/template/pnpm-lock.yaml: Generated file

Suppressed comments (1)

entgo-sveltekit/template/src/lib/assets/post.css:2

• The header comment still says this file is written in PostCSS syntax, but the Tailwind v4 setup now uses the Vite plugin and a plain CSS @import "tailwindcss". Update the comment to avoid misleading template users.

/* Write your global styles here, in PostCSS syntax */
@import "tailwindcss";

[Copilot]

Pull request overview

Copilot reviewed 8 out of 10 changed files in this pull request and generated no new comments.

Files not reviewed (2)

• entgo-sveltekit/template/pnpm-lock.yaml: Generated file
• sveltekit-embed/template/pnpm-lock.yaml: Generated file

Suppressed comments (1)

entgo-sveltekit/template/src/lib/assets/post.css:1

• The header comment says this file is written "in PostCSS syntax", but it now contains a standard CSS @import "tailwindcss" (Tailwind v4) and no longer uses Tailwind's PostCSS directives. Updating the comment avoids confusion for template users.

/* Write your global styles here, in PostCSS syntax */