`$env/static/private` is deprecated, use `$app/env/private`

Error message

`$env/static/private` is deprecated, use `$app/env/private` instead

What it means

The `$env/static/private` module is deprecated in favor of `$app/env/private`. It statically re-exports all private environment variables and emits this DEV warning when imported. Variables remain statically inlined at build time; only the import location changed.

Source

Thrown at packages/kit/src/runtime/env/static/private.js:5

import { DEV } from 'esm-env';
export * from '../../app/env/private/index.js';

if (DEV) {
	console.warn('`$env/static/private` is deprecated, use `$app/env/private` instead');
}

View on GitHub (pinned to 03f1687fe6)

Solutions

Change imports to `import { env } from '$app/env/private'` and access `env.SECRET_X`, or use `$app/env/private` equivalents for named imports
Update all server-only usages since static named imports from the old path will keep warning
Run a codemod/grep for `$env/static/private` across the repo

Example fix

// before
import { DATABASE_URL } from '$env/static/private';
// after
import { env } from '$app/env/private';
const DATABASE_URL = env.DATABASE_URL;

Defensive patterns

Strategy: validation

Validate before calling

import { env } from '$app/env/private'; // correct specifier
// CI grep: ! grep -r "\$env/static/private" src/

Prevention

Import private env via $app/env/private instead of static named imports
Keep secrets in server-only files and never import them client-side
Run repo-wide grep for $env/static/private in CI

When it happens

Trigger: Importing `import { SECRET_X } from '$env/static/private'` (or named imports generally) in server-only code during development.

Common situations: Server-only modules (hooks, endpoints, auth utilities) importing specific secret values via the old static module after upgrading SvelteKit to the version with `$app/env` modules.

Related errors

AI-assisted analysis of sveltejs/kit@03f1687fe6 (2026-09-02). Data as JSON: /api/errors/8727b76686c92f3a. Report an issue: GitHub.