/_app/version.json is marked immutable and cached forever

[georgecrawford]

Describe the bug

As mentioned in #4188 (comment), I suspect recent changes to the way that /_app/version.json is served have caused it to be treated as a static asset.

Reproduction

See this simple repro: https://stackblitz.com/edit/sveltejs-kit-template-default-nwjzok?file=package.json&terminal=dev

The offending network requests are visible every 10 seconds:

Example request

curl 'https://sveltejs-kit-template-default-nwjzok--3000.local.webcontainer.io/_app/version.json' \
  -H 'sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="100", "Google Chrome";v="100"' \
  -H 'pragma: no-cache' \
  -H 'cache-control: no-cache' \
  -H 'Referer: https://sveltejs-kit-template-default-nwjzok--3000.local.webcontainer.io/' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36' \
  -H 'sec-ch-ua-platform: "macOS"' \
  --compressed

Example response headers

cache-control: public,max-age=31536000,immutable
connection: keep-alive
content-length: 24
content-type: application/json
date: Fri, 06 May 2022 08:28:08 GMT
etag: W/"24-1651825319850"
keep-alive: timeout=5
last-modified: Fri, 06 May 2022 08:21:59 GMT
vary: Accept-Encoding

A immutable cached response for version.json means my app will always believe there's an upgrade pending, as the browser has cached the initial version response.

Logs

No response

System Info

See StackBlitz container - the npx envinfo command didn't run to completion.

	"devDependencies": {
		"@sveltejs/adapter-node": "^1.0.0-next.73",
		"@sveltejs/kit": "next",
		"@types/cookie": "^0.4.1",
		"prettier": "^2.5.1",
		"prettier-plugin-svelte": "^2.5.0",
		"svelte": "^3.46.0",
		"svelte-check": "^2.2.6",
		"typescript": "~4.6.2"
	},

Severity

blocking an upgrade

Additional Information

No response

[geoffrich]

Looks like #3222 assumed that everything in _app/ would be a hashed asset, but version.json is not.

[georgecrawford]

Thanks @geoffrich, that’s the problem for sure. I don’t know what the team’s definition of ‘_app’ is, so I’ll wait for someone to advise rather than open a speculative PR.

[Rich-Harris]

Are you experiencing buggy behaviour, or is it just that you don't expect the immutable header? Everything in _app is indeed marked as immutable, but it should work anyway because version.json is fetched with no-cache:

kit/packages/kit/src/runtime/client/utils.js

Lines 87 to 94 in 82cd1d7

	const file = import.meta.env.VITE_SVELTEKIT_APP_VERSION_FILE;
	const res = await fetch(`${assets}/${file}`, {
	headers: {
	pragma: 'no-cache',
	'cache-control': 'no-cache'
	}
	});

[bjon]

@Rich-Harris Can confirm it doesn't work behind a CDN. File never updates (tested with Google Cloud CDN).

[georgecrawford]

Are you experiencing buggy behaviour, or is it just that you don't expect the immutable header? Everything in _app is indeed marked as immutable, but it should work anyway because version.json is fetched with no-cache:

kit/packages/kit/src/runtime/client/utils.js

Lines 87 to 94 in 82cd1d7

	const file = import.meta.env.VITE_SVELTEKIT_APP_VERSION_FILE;
	const res = await fetch(`${assets}/${file}`, {
	headers: {
	pragma: 'no-cache',
	'cache-control': 'no-cache'
	}
	});

Thanks for this. I think I might be wrong - I wasn't aware the request could cache-bust an immutable resource like this. TBH, I can't find this trick explicitly documented anywhere online, and the version is immutable statement seems all wrong to me - almost by definition, the version will change over time.

I did however see some buggy behaviour, but it could be with userland code. I'll try and get a reduced test case.

[Rich-Harris]

Ah, interesting — I thought if a CDN received a no-cache request it would go back to the origin server. That's... surprising. I guess we'll need to do something like move everything inside _app that isn't version.json into something like _app/build, and only apply immutable cache headers to that directory.