fix(deps): update astro monorepo #777
Open
+593
−798
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.9.5→0.9.69.2.2→9.5.17.0.13→7.2.45.7.14→5.16.6Release Notes
withastro/astro (@astrojs/check)
v0.9.6Patch Changes
#14740
abfed97Thanks @ArmandPhilippot! - Fixes link targets in documentation following repository relocation.Updated dependencies [
abfed97]:withastro/astro (@astrojs/node)
v9.5.1Compare Source
Patch Changes
9e9c528,0f75f6b]:v9.5.0Compare Source
Minor Changes
#14441
62ec8eaThanks @upsuper! - Updates redirect handling to be consistent acrossstaticandserveroutput, aligning with the behavior of other adapters.Previously, the Node.js adapter used default HTML files with meta refresh tags when in
staticoutput. This often resulted in an extra flash of the page on redirect, while also not applying the proper status code for redirections. It's also likely less friendly to search engines.This update ensures that configured redirects are always handled as HTTP redirects regardless of output mode, and the default HTML files for the redirects are no longer generated in
staticoutput. It makes the Node.js adapter more consistent with the other official adapters.No change to your project is required to take advantage of this new adapter functionality. It is not expected to cause any breaking changes. However, if you relied on the previous redirecting behavior, you may need to handle your redirects differently now. Otherwise you should notice smoother redirects, with more accurate HTTP status codes, and may potentially see some SEO gains.
v9.4.6Compare Source
Patch Changes
66a26d7Thanks @matthewp! - Fixes compatibility issue with older versions of Astro by makinggetAllowedDomains()call optional and updating peer dependency to requireastro@^5.14.3v9.4.5Compare Source
Patch Changes
b8ca69b]:v9.4.4Compare Source
Patch Changes
1e2499e]:v9.4.3Compare Source
Patch Changes
77b18fbThanks @delucis! - Increases the minimum supported version of Astro to 5.7.0v9.4.2Compare Source
Patch Changes
4d16de7]:v9.4.1Compare Source
Patch Changes
5fc3c59Thanks @ematipico! - Fixes a routing bug in standalone mode withtrailingSlashset to"always".v9.4.0Compare Source
Minor Changes
#14188
e3422aaThanks @ascorbic! - Adds support for specifying a host to load prerendered error pagesBy default, if a user defines a custom error page that is prerendered, Astro will load it from the same host as the one that the request is made to. This change allows users to specify a different host for loading prerendered error pages. This can be useful in scenarios such as where the server is running behind a reverse proxy or when prerendered pages are hosted on a different domain.
To use this feature, set the
experimentalErrorPageHostadapter option in your Astro configuration to the desired host URL. For example, if your server is running on localhost and served via a proxy, you can ensure the prerendered error pages are fetched via the localhost URL:For more information on enabling and using this experimental feature, see the
@astrojs/nodeadapter docs.v9.3.3Compare Source
Patch Changes
0567fb7]:v9.3.2Compare Source
Patch Changes
f4e8889]:v9.3.1Compare Source
Patch Changes
e4d74baThanks @ColoredCarrot! - fix(node): emit set-cookie header from middlewares for not-found routes (#14136)v9.3.0Compare Source
Minor Changes
#14012
a125a14Thanks @florian-lefebvre! - Adds a new experimental configuration optionexperimentalDisableStreamingto allow you to opt out of Astro's default HTML streaming for pages rendered on demand.HTML streaming helps with performance and generally provides a better visitor experience. In most cases, disabling streaming is not recommended.
However, when you need to disable HTML streaming (e.g. your host only supports non-streamed HTML caching at the CDN level), you can now opt out of the default behavior:
import { defineConfig } from 'astro/config'; import node from '@​astrojs/node'; export default defineConfig({ adapter: node({ mode: 'standalone', + experimentalDisableStreaming: true, }), });#13972
db8f8beThanks @ematipico! - Adds support for the experimental static headers Astro feature.When the feature is enabled via the option
experimentalStaticHeaders, and experimental Content Security Policy is enabled, the adapter will generateResponseheaders for static pages, which allows support for CSP directives that are not supported inside a<meta>tag (e.g.frame-ancestors).withastro/astro (@astrojs/svelte)
v7.2.4Compare Source
Patch Changes
16f3994Thanks @antonyfaris! - Fixes an issue where Svelte components used in Astro files would incorrectly report type errors when usingclient:*directives.v7.2.3Compare Source
Patch Changes
4264a36Thanks @antonyfaris! - Fixes an issue where Svelte 5 components used in Astro files would not have proper type checking and IntelliSense.v7.2.2Compare Source
Patch Changes
#14715
3d55c5dThanks @ascorbic! - Adds support for client hydration ingetContainerRenderer()The
getContainerRenderer()function is exported by Astro framework integrations to simplify the process of rendering framework components when using the experimental Container API inside a Vite or Vitest environment. This update adds the client hydration entrypoint to the returned object, enabling client-side interactivity for components rendered using this function. Previously this required users to manually callcontainer.addClientRenderer()with the appropriate client renderer entrypoint.See the
container-with-vitestdemo for a usage example, and the Container API documentation for more information on using framework components with the experimental Container API.v7.2.1Compare Source
Patch Changes
e3175d9Thanks @GameRoMan! - Updatesviteversion to fix CVEv7.2.0Compare Source
Minor Changes
#14430
78011baThanks @ascorbic! - Adds support for async server renderingSvelte 5.36 added experimental support for async rendering. This allows you to use
awaitin your components in several new places. This worked out of the box with client-rendered components, but server-rendered components needed some extra help. This update adds support for async server rendering in Svelte components used in Astro.To use async rendering, you must enable it in your Svelte config:
Then you can use
awaitin your components:See the Svelte docs for more information on using
awaitin Svelte components, including inside$derivedblocks and directly in markup.Patch Changes
9cc8f21Thanks @ascorbic! - Fixes a bug that prevented Svelte 5.39.1+ components rendering when multiple frameworks were presentv7.1.1Compare Source
Patch Changes
c24a8f4Thanks @jsparkdev! - Updatesviteversion to fix CVEv7.1.0Compare Source
Minor Changes
#13809
3c3b492Thanks @ascorbic! - Increases minimum Node.js version to 18.20.8Node.js 18 has now reached end-of-life and should not be used. For now, Astro will continue to support Node.js 18.20.8, which is the final LTS release of Node.js 18, as well as Node.js 20 and Node.js 22 or later. We will drop support for Node.js 18 in a future release, so we recommend upgrading to Node.js 22 as soon as possible. See Astro's Node.js support policy for more details.
withastro/astro (astro)
v5.16.6Compare Source
Patch Changes
#14982
6849e38Thanks @Princesseuh! - Fixes images outside the project directory not working when using astro:assets in development mode#14987
9dd9fcaThanks @Princesseuh! - Fixes SVGs not working in dev mode when using the passthrough image service#15014
a178422Thanks @delucis! - Adds support for extending the type of the props accepted by Astro’s<Image>component,<Picture>component, andgetImage()API.v5.16.5Compare Source
Patch Changes
#14985
c016f10Thanks @florian-lefebvre! - Fixes a case where JSDoc annotations wouldn't show for fonts related APIs in the Astro config#14973
ed7cc2fThanks @amankumarpandeyin! - Fixes performance regression and OOM errors when building medium-sized blogs with many content entries. Replaced O(n²) object spread pattern with direct mutation ingenerateLookupMap.#14958
70eb542Thanks @ascorbic! - Gives a helpful error message if a user setsoutput: "hybrid"in their Astro config.The option was removed in Astro 5, but lots of content online still references it, and LLMs often suggest it. It's not always clear that the replacement is
output: "static", rather thanoutput: "server". This change adds a helpful error message to guide humans and robots.#14901
ef53716Thanks @Darknab! - Updates theglob()loader to log a warning when duplicated IDs are detectedUpdated dependencies [
d8305f8]:v5.16.4Compare Source
Patch Changes
#14940
2cf79c2Thanks @ematipico! - Fixes a bug where Astro didn't properly combine CSP resources from thecspconfiguration with those added using the runtime API (Astro.csp.insertDirective()) to form grammatically correct CSP headersNow Astro correctly deduplicate CSP resources. For example, if you have a global resource in the configuration file, and then you add a
a new one using the runtime APIs.
v5.16.3Compare Source
Patch Changes
#14889
4bceeb0Thanks @florian-lefebvre! - Fixes actions types when using specific TypeScript configurations#14929
e0f277dThanks @matthewp! - Fixes authentication bypass via double URL encoding in middlewarePrevents attackers from bypassing path-based authentication checks using multi-level URL encoding (e.g.,
/%2561dmininstead of/%61dmin). Pathnames are now validated after decoding to ensure no additional encoding remains.v5.16.2Compare Source
Patch Changes
#14876
b43dc7fThanks @florian-lefebvre! - Fixes a vite warning log during builds when using npm#14884
10273e0Thanks @florian-lefebvre! - Fixes a case where setting the status of a page to404in ssr would show an empty page (or404.astropage if provided) instead of using the current pagev5.16.1Compare Source
Patch Changes
#14769
b43ee71Thanks @adriandlam! - Fixes an unhandled rejection issue when using Astro with Vercel Workflow DevKit#14761
345eb22Thanks @ooga! - Updatesbuttonattributes types to allowcommandandcommandfor#14866
65e214bThanks @GameRoMan! - FixesAstro.globto be correctly marked as deprecated#14894
1ad9a5bThanks @delucis! - Fixes support for Astro component rendering in Vitest test suites using a “client” environment such ashappy-domorjsdom#14782
abed929Thanks @florian-lefebvre! - Improves syncingv5.16.0Compare Source
Minor Changes
#13880
1a2ed01Thanks @azat-io! - Adds experimental SVGO optimization support for SVG assetsAstro now supports automatic SVG optimization using SVGO during build time. This experimental feature helps reduce SVG file sizes while maintaining visual quality, improving your site's performance.
To enable SVG optimization with default settings, add the following to your
astro.config.mjs:To customize optimization, pass a SVGO configuration object:
For more information on enabling and using this feature in your project, see the experimental SVG optimization docs.
#14810
2e845feThanks @ascorbic! - Adds a hint for code agents to use the--yesflag to skip prompts when runningastro add#14698
f42ff9bThanks @mauriciabad! - Adds theActionInputSchemautility type to automatically infer the TypeScript type of an action's input based on its Zod schemaFor example, this type can be used to retrieve the input type of a form action:
#14574
4356485Thanks @jacobdalamb! - Adds new CLI shortcuts available when runningastro preview:o+enter: open the site in your browserq+enter: quit the previewh+enter: print all available shortcutsPatch Changes
#14813
e1dd377Thanks @ematipico! - Removespicocolorsas dependency in favor of the forkpiccolore.#14609
d774306Thanks @florian-lefebvre! - Improvesastro info#14796
c29a785Thanks @florian-lefebvre! - BREAKING CHANGE to the experimental Fonts API onlyUpdates the default
subsetsto["latin"]Subsets have been a common source of confusion: they caused a lot of files to be downloaded by default. You now have to manually pick extra subsets.
Review your Astro config and update subsets if you need, for example if you need greek characters:
import { defineConfig, fontProviders } from "astro/config" export default defineConfig({ experimental: { fonts: [{ name: "Roboto", cssVariable: "--font-roboto", provider: fontProviders.google(), + subsets: ["latin", "greek"] }] } })v5.15.9Compare Source
Patch Changes
#14786
758a891Thanks @mef! - Add handling of invalid encrypted props and slots in server islands.#14783
504958fThanks @florian-lefebvre! - Improves the experimental Fonts API build log to show the number of downloaded files. This can help spotting excessive downloading because of misconfiguration#14791
9e9c528Thanks @Princesseuh! - Changes the remote protocol checks for images to require explicit authorization in order to use data URIs.In order to allow data URIs for remote images, you will need to update your
astro.config.mjsfile to include the following configuration:#14787
0f75f6bThanks @matthewp! - Fixes wildcard hostname pattern matching to correctly reject hostnames without dotsPreviously, hostnames like
localhostor other single-part names would incorrectly match patterns like*.example.com. The wildcard matching logic has been corrected to ensure that only valid subdomains matching the pattern are accepted.#14776
3537876Thanks @ktym4a! - Fixes the behavior ofpassthroughImageServiceso it does not generate webp.Updated dependencies [
9e9c528,0f75f6b]:v5.15.8Compare Source
Patch Changes
#14772
00c579aThanks @matthewp! - Improves the security of Server Islands slots by encrypting them before transmission to the browser, matching the security model used for props. This improves the integrity of slot content and prevents injection attacks, even when component templates don't explicitly support slots.Slots continue to work as expected for normal usage—this change has no breaking changes for legitimate requests.
#14771
6f80081Thanks @matthewp! - Fix middleware pathname matching by normalizing URL-encoded pathsMiddleware now receives normalized pathname values, ensuring that encoded paths like
/%61dminare properly decoded to/adminbefore middleware checks. This prevents potential security issues where middleware checks might be bypassed through URL encoding.v5.15.7Compare Source
Patch Changes
#14765
03fb47cThanks @florian-lefebvre! - Fixes a case whereprocess.envwouldn't be properly populated during the build#14690
ae7197dThanks @fredriknorlin! - Fixes a bug where Astro's i18n fallback system withfallbackType: 'rewrite'would not generate fallback files for pages whose filename started with a locale key.v5.15.6Compare Source
Patch Changes
#14751
18c55e1Thanks @delucis! - Fixes hydration of client components when running the dev server and using a barrel file that re-exports both Astro and UI framework components.#14750
35122c2Thanks @florian-lefebvre! - Updates the experimental Fonts API to log a warning if families with a conflictingcssVariableare provided#14737
74c8852Thanks @Arecsu! - Fixes an error when usingtransition:persistwith components that use declarative Shadow DOM. Astro now avoids re-attaching a shadow root if one already exists, preventing"Unable to re-attach to existing ShadowDOM"navigation errors.#14750
35122c2Thanks @florian-lefebvre! - Updates the experimental Fonts API to allow for more granular configuration of remote font familiesA font family is defined by a combination of properties such as weights and styles (e.g.
weights: [500, 600]andstyles: ["normal", "bold"]), but you may want to download only certain combinations of these.For greater control over which font files are downloaded, you can specify the same font (ie. with the same
cssVariable,name, andproviderproperties) multiple times with different combinations. Astro will merge the results and download only the required files. For example, it is possible to download normal500and600while downloading only italic500:v5.15.5Compare Source
Patch Changes
#14712
91780cfThanks @florian-lefebvre! - Fixes a case where build'sprocess.envwould be inlined in the server output#14713
666d5a7Thanks @florian-lefebvre! - Improves fallbacks generation when using the experimental Fonts API#14743
dafbb1bThanks @matthewp! - ImprovesX-Forwardedheader validation to prevent cache poisoning and header injection attacks. Now properly validatesX-Forwarded-Proto,X-Forwarded-Host, andX-Forwarded-Portheaders against configuredallowedDomainspatterns, rejecting malformed or suspicious values. This is especially important when running behind a reverse proxy or load balancer.v5.15.4Compare Source
Patch Changes
#14703
970ac0fThanks @ArmandPhilippot! - Adds missing documentation for some public utilities exported fromastro:i18n.#14715
3d55c5dThanks @ascorbic! - Adds support for client hydration ingetContainerRenderer()The
getContainerRenderer()function is exported by Astro framework integrations to simplify the process of rendering framework components when using the experimental Container API inside a Vite or Vitest environment. This update adds the client hydration entrypoint to the returned object, enabling client-side interactivity for components rendered using this function. Previously this required users to manually callcontainer.addClientRenderer()with the appropriate client renderer entrypoint.See the
container-with-vitestdemo for a usage example, and the Container API documentation for more information on using framework components with the experimental Container API.#14711
a4d284dThanks @deining! - Fixes typos in documenting our error messages and public APIs.#14701
9be54c7Thanks @florian-lefebvre! - Fixes a case where the experimental Fonts API would filter available font files too aggressively, which could prevent the download of woff files when using the google providerv5.15.3Compare Source
Patch Changes
#14627
b368de0Thanks @matthewp! - Fixes skew protection support for images and font URLsAdapter-level query parameters (
assetQueryParams) are now applied to all image and font asset URLs, including:/_imageendpoint#14631
3ad33f9Thanks @KurtGokhan! - Adds theastro/jsx-dev-runtimeexport as an alias forastro/jsx-runtimev5.15.2Compare Source
Patch Changes
#14623
c5fe295Thanks @delucis! - Fixes a leak of server runtime code when importing SVGs in client-side code. Previously, when importing an SVG file in client code, Astro could end up adding code for rendering SVGs on the server to the client bundle.#14621
e3175d9Thanks @GameRoMan! - Updatesviteversion to fix CVEv5.15.1Compare Source
Patch Changes
18552c7Thanks @ematipico! - Fixes a regression introduced in Astro v5.14.7 that caused?urlimports to not work correctly. This release reverts #14142.v5.15.0Compare Source
Minor Changes
#14543
9b3241dThanks @matthewp! - Adds two new adapter configuration optionsassetQueryParamsandinternalFetchHeadersto the Adapter API.Official and community-built adapters can now use
client.assetQueryParamsto specify query parameters that should be appended to asset URLs (CSS, JavaScript, images, fonts, etc.). The query parameters are automatically appended to all generated asset URLs during the build process.Adapters can also use
client.internalFetchHeadersto specify headers that should be included in Astro's internal fetch calls (Actions, View Transitions, Server Islands, Prefetch).This enables features like Netlify's skew protection, which requires the deploy ID to be sent with both internal requests and asset URLs to ensure client and server versions match during deployments.
#14489
add4277Thanks @dev-shetty! - Adds a new Copy to Clipboard button to the error overlay stack trace.When an error occurs in dev mode, you can now copy the stack trace with a single click to more easily share it in a bug report, a support thread, or with your favorite LLM.
#14564
5e7cebbThanks @florian-lefebvre! - Updatesastro add cloudflareto scaffold more configuration filesRunning
astro add cloudflarewill now emitwrangler.jsoncandpublic/.assetsignore, allowing your Astro project to work out of the box as a worker.Patch Changes
#14591
3e887ecThanks @matthewp! - Adds TypeScript support for thecomponentsprop on MDXContentcomponent when usingawait render(). Developers now get proper IntelliSense and type checking when passing custom components to override default MDX element rendering.#14598
7b45c65Thanks @delucis! - Reduces terminal text styling dependency size by switching fromkleurtopicocolors#13826
8079482Thanks @florian-lefebvre! - Adds the option to specify in thepreloaddirective which weights, styles, or subsets to preload for a given font family when using the experimental Fonts API:Variable weight font files will be preloaded if any weight within its range is requested. For example, a font file for font weight
100 900will be included when400is specified in apreloadobject.v5.14.8Compare Source
Patch Changes
577d051Thanks @matthewp! - Fixes image path resolution in content layer collections to support bare filenames. Theimage()helper now normalizes bare filenames like"cover.jpg"to relative paths"./cover.jpg"for consistent resolution behavior between markdown frontmatter and JSON content collections.v5.14.7Compare Source
Patch Changes
#14582
7958c6bThanks @florian-lefebvre! - Fixes a regression that caused Actions to throw errors while loading#14567
94500bbThanks @matthewp! - Fixes the actions endpoint to return 404 for non-existent actions instead of throwing an unhandled error#14566
946fe68Thanks @matthewp! - Fixes handling malformed cookies gracefully by returning the unparsed value instead of throwingWhen a cookie with an invalid value is present (e.g., containing invalid URI sequences),
Astro.cookies.get()now returns the raw cookie value instead of throwing a URIError. This aligns with the behavior of the underlyingcookiepackage and prevents crashes when manually-set or corrupted cookies are encountered.#14142
73c5de9Thanks @P4tt4te! - Updates handling of CSS for hydrated client components to prevent duplicates#14576
2af62c6Thanks @aprici7y! - Fixes a regression that causedAstro.siteto always beundefinedingetStaticPaths()v5.14.6Compare Source
Patch Changes
#14562
722bba0Thanks @erbierc! - Fixes a bug where the behavior of the "muted" HTML attribute was inconsistent with that of other attributes.#14538 [
51ebe6a](https://redirect.github.com/withastro/aConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.