Better document that server load function fetches aren't tracked

Server fetches not being tracked is documented in https://svelte.dev/docs/kit/load#Rerunning-load-functions-When-do-load-functions-rerun and https://svelte.dev/docs/kit/load#Rerunning-load-functions-Manual-invalidation but could also be mentioned in the fetch and depends functions of https://svelte.dev/docs/kit/@sveltejs-kit#LoadEvent and https://svelte.dev/docs/kit/$app-navigation#invalidate

The comment in https://github.com/sveltejs/kit/blob/969ec95c1baeb8a0b070fcbc7dae38d577242030/packages/kit/src/runtime/server/page/load_data.js#L83 could also be updated to mention what those "security concerns" are. e.g., leaking secrets like the current documentation suggests

Discussed in https://github.com/sveltejs/kit/discussions/13798

^{Originally posted by pjeziorowski May 16, 2025}
Quick question: Will calling invalidate(myBackendEndpoint) on the client side invalidate or rerun a backend (.server.ts) load function that uses SvelteKit's fetch to get data from myBackendEndpoint?

I've noticed that invalidate(myBackendEndpoint) works well when I load data in +page.ts, but it doesn't seem to invalidate when the data loading is moved to +page.server.ts. I also noticed that this server loader isn't dependent on any URL, even though it makes a fetch call to myBackendEndpoint 🤔

Is this the expected behavior? I looked for more information in the documentation, but it doesn't seem to be explicitly covered there.

Start with the linked LoadEvent fetch and depends documentation, the invalidate documentation, and the referenced packages/kit/src/runtime/server/page/load_data.js comment. Confirm how server fetches and manual invalidation are described, then make the tracking behavior and security concerns explicit in those locations. Done means the documentation and comment consistently explain that server fetches are not tracked and may expose secrets.