Vite dev server errors loading assets in monorepo

Describe the bug

In a monorepo, node_modules package may be a symlink to a local folder.

Svelte incorrectly configures Vite's dev server allow list in such cases, leading to 403 Forbidden errors when a monorepo package tries to load an asset (like a font).

Reproduction

https://github.com/maxpatiiuk/svelte-monorepo-serve-error

1. Clone this repo

   git clone https://github.com/maxpatiiuk/svelte-monorepo-serve-error
   cd svelte-monorepo-serve-error
   

2. Install dependencies

   # To keep reproduction size minimal, I hardcoded a minimal root-level node_modules
   # So, install Svelte dependencies only in the app folder:
   cd app
   npm install
   

3. Start the development server in the app folder

   npm run dev
   

   See this error in the browser console:

   (index):45  GET http://localhost:5174/@fs/Users/.../svelte-monorepo-serve-error/monorepo-utils/NotoSans.ttf net::ERR_ABORTED 403 (Forbidden)
   

Related details:

• Setting server.fs.preserveSymlinks: true in the Vite config does not help.
• This does not error for .svg assets because they are inlined (or maybe assets beyond size threshold are inlined?).
• Everything works correctly during build

Logs

> npm run dev 

> svelte-app@0.0.1 dev
> vite dev

Port 5173 is in use, trying another one...

  VITE v7.1.3  ready in 411 ms

  ➜  Local:   http://localhost:5174/
  ➜  Network: use --host to expose
  ➜  press h + enter to show help

Google Chrome is requesting /.well-known/appspecific/com.chrome.devtools.json to automatically configure devtools project settings. To learn why, and how to prevent this message, see https://svelte.dev/docs/cli/devtools-json

The request id "/Users/mak13180/site/esri/svelte-monorepo-serve-error/monorepo-utils/NotoSans.ttf" is outside of Vite serving allow list.

- /Users/mak13180/site/esri/svelte-monorepo-serve-error/app/src/lib
- /Users/mak13180/site/esri/svelte-monorepo-serve-error/app/src/routes
- /Users/mak13180/site/esri/svelte-monorepo-serve-error/app/.svelte-kit
- /Users/mak13180/site/esri/svelte-monorepo-serve-error/app/src
- /Users/mak13180/site/esri/svelte-monorepo-serve-error/app/node_modules
- /Users/mak13180/site/esri/svelte-monorepo-serve-error/node_modules

Refer to docs https://vite.dev/config/server-options.html#server-fs-allow for configurations and more details.

The request id "/Users/mak13180/site/esri/svelte-monorepo-serve-error/monorepo-utils/NotoSans.ttf" is outside of Vite serving allow list.

System Info

System:
    OS: macOS 15.5
    CPU: (10) arm64 Apple M1 Pro
    Memory: 130.69 MB / 32.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 22.16.0 - ~/.local/state/fnm_multishells/38353_1756222520134/bin/node
    Yarn: 1.22.19 - ~/.local/state/fnm_multishells/38353_1756222520134/bin/yarn
    npm: 10.9.2 - ~/.local/state/fnm_multishells/38353_1756222520134/bin/npm
    pnpm: 8.9.0 - ~/.local/state/fnm_multishells/38353_1756222520134/bin/pnpm
  Browsers:
    Chrome: 139.0.7258.139
    Safari: 18.5
  npmPackages:
    @sveltejs/adapter-auto: ^6.0.0 => 6.1.0 
    @sveltejs/kit: ^2.22.0 => 2.36.2 
    @sveltejs/vite-plugin-svelte: ^6.0.0 => 6.1.3 
    svelte: ^5.0.0 => 5.38.3 
    vite: ^7.0.4 => 7.1.3

Severity

serious, but I can work around it

Additional Information

If you run the dev server with Vite config logging (DEBUG=vite:config npx ng serve), you will see that the dev server was allowed to serve only the package-level node_modules folder:

  vite:config   server: {
  vite:config     ...
  vite:config     fs: {
  vite:config       ...
  vite:config       allow: [
  vite:config         '/Users/.../svelte-monorepo-serve-error/app/src/lib',
  vite:config         '/Users/.../svelte-monorepo-serve-error/app/src/routes',
  vite:config         '/Users/.../svelte-monorepo-serve-error/app/.svelte-kit',
  vite:config         '/Users/.../svelte-monorepo-serve-error/app/src',
  vite:config         '/Users/.../svelte-monorepo-serve-error/app/node_modules',
  vite:config         '/Users/.../svelte-monorepo-serve-error/node_modules'
  vite:config       ]
  vite:config     },

By default, in monorepo setups, Vite permits serving files from any folder in the monorepo (/Users/.../svelte-monorepo-serve-error/). Svelte overrides that behavior.

Vite's default behavior is implemented here:

https://github.com/vitejs/vite/blob/e899bc7c73a27cdf327875e5d696c50d396a7fc2/packages/vite/src/node/server/index.ts#L1126-L1127

Their default calls searchForWorkspaceRoot(), which is exposed by Vite and can be called manually as documented in https://vite.dev/config/server-options.html#server-fs-allow.

Start with the linked reproduction and inspect SvelteKit’s Vite dev-server configuration, comparing it with Vite’s server/index.ts workspace-root behavior and searchForWorkspaceRoot documentation. Done means the monorepo package’s font asset loads during development without a 403 while the existing build still works.