Open
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
85ea1da to
405eb1b
Compare
405eb1b to
2f3266c
Compare
2f3266c to
39479d4
Compare
39479d4 to
8ef514f
Compare
8ef514f to
686e0f6
Compare
686e0f6 to
3ea6fe5
Compare
3ea6fe5 to
7cc9a6e
Compare
7cc9a6e to
ea52eb7
Compare
ea52eb7 to
4b5d974
Compare
4b5d974 to
fb89a0a
Compare
fb89a0a to
91fe3a9
Compare
91fe3a9 to
90af55f
Compare
90af55f to
42c306e
Compare
42c306e to
671b1e3
Compare
671b1e3 to
86ed8ad
Compare
86ed8ad to
c0ffc1d
Compare
c0ffc1d to
0f83d00
Compare
0f83d00 to
d121591
Compare
d121591 to
6a1dd66
Compare
6a1dd66 to
cbd247f
Compare
cbd247f to
4f09c27
Compare
4f09c27 to
b0413b0
Compare
b0413b0 to
3d9bb91
Compare
3d9bb91 to
117cfbe
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^9.5.4→^10.0.0^9.0.4→^10.0.0^5.18.0→^6.0.0Release Notes
withastro/astro (@astrojs/node)
v10.0.6Compare Source
Patch Changes
99464ed,f3485c3]:v10.0.5Compare Source
Patch Changes
940afd5Thanks @matthewp! - Fixes static asset error responses incorrectly including immutable cache headers. Conditional request failures (e.g.If-Matchmismatch) now return the correct status code without far-future cache directives.v10.0.4Compare Source
Patch Changes
#16002
846f27fThanks @buley! - Fixes file descriptor leaks from read streams that were not destroyed on client disconnect or read errors#15941
f41584aThanks @ematipico! - Fixes an infinite loop inresolveClientDir()when the server entry point is bundled with esbuild or similar tools. The function now throws a descriptive error instead of hanging indefinitely when the expected server directory segment is not found in the file path.v10.0.3Compare Source
Patch Changes
#15735
9685e2dThanks @fa-sharp! - Fixes an EventEmitter memory leak when serving static pages from Node.js middleware.When using the middleware handler, requests that were being passed on to Express / Fastify (e.g. static files / pre-rendered pages / etc.) weren't cleaning up socket listeners before calling
next(), causing a memory leak warning. This fix makes sure to run the cleanup before callingnext().v10.0.2Compare Source
Patch Changes
6f8f0bcThanks @ematipico! - Updates the AstropeerDependencies#astroto be6.0.0.v10.0.1Compare Source
Patch Changes
bb2b8f5Thanks @ematipico! - Fixes an issue where the adapter would cause a series of warnings during the build.v10.0.0Compare Source
Major Changes
#15654
a32aee6Thanks @florian-lefebvre! - Removes theexperimentalErrorPageHostoptionThis option allowed fetching a prerendered error page from a different host than the server is currently running on.
However, there can be security implications with prefetching from other hosts, and often more customization was required to do this safely. This has now been removed as a built-in option so that you can implement your own secure solution as needed and appropriate for your project via middleware.
What should I do?
If you were previously using this feature, you must remove the option from your adapter configuration as it no longer exists:
// astro.config.mjs import { defineConfig } from 'astro/config' import node from '@​astrojs/node' export default defineConfig({ adapter: node({ mode: 'standalone', - experimentalErrorPageHost: 'http://localhost:4321' }) })You can replicate the previous behavior by checking the response status in a middleware and fetching the prerendered page yourself:
Minor Changes
#15258
d339a18Thanks @ematipico! - Stabilizes the adapter featureexperimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:export default defineConfig({ adapter: netlify({ - experimentalStaticHeaders: true + staticHeaders: true }) })#15759
39ff2a5Thanks @matthewp! - Adds a newbodySizeLimitoption to the@astrojs/nodeadapterYou can now configure a maximum allowed request body size for your Node.js standalone server. The default limit is 1 GB. Set the value in bytes, or pass
0to disable the limit entirely:#15006
f361730Thanks @florian-lefebvre! - Adds new session driver object shapeFor greater flexibility and improved consistency with other Astro code, session drivers are now specified as an object:
Specifying the session driver as a string has been deprecated, but will continue to work until this feature is removed completely in a future major version. The object shape is the current recommended and documented way to configure a session driver.
#14946
95c40f7Thanks @ematipico! - Removes theexperimental.cspflag and replaces it with a new configuration optionsecurity.csp- (v6 upgrade guidance)Patch Changes
#15473
d653b86Thanks @matthewp! - Improves error page loading to read from disk first before falling back to configured host#15562
e14a51dThanks @florian-lefebvre! - Updates to new Adapter API introduced in v6#15585
98ea30cThanks @matthewp! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.#15777
02e24d9Thanks @matthewp! - Fixes CSRF origin check mismatch by passing the actual server listening port tocreateRequest, ensuring the constructed URL origin includes the correct port (e.g.,http://localhost:4321instead ofhttp://localhost). Also restrictsX-Forwarded-Prototo only be trusted whenallowedDomainsis configured.#15714
9a2c949Thanks @ematipico! - Fixes an issue where static headers weren't correctly applied when the website usesbase.#15763
1567e8cThanks @matthewp! - Normalizes static file paths before evaluating dotfile access rules for improved consistency#15164
54dc11dThanks @HiDeoo! - Fixes an issue where the Node.js adapter could fail to serve a 404 page matching a pre-rendered dynamic route pattern.#15745
20b05c0Thanks @matthewp! - Hardens static file handler path resolution to ensure resolved paths stay within the client directory#15495
5b99e90Thanks @leekeh! - Refactors to usemiddlewareModeadapter feature (set toclassic)#15657
cb625b6Thanks @qzio! - Adds a newsecurity.actionBodySizeLimitoption to configure the maximum size of Astro Actions request bodies.This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.
If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.
Updated dependencies [
4ebc1e3,4e7f3e8,a164c77,cf6ea6b,a18d727,240c317,745e632]:withastro/astro (@astrojs/vercel)
v10.0.5Compare Source
Patch Changes
99464ed,f3485c3]:v10.0.4Compare Source
Patch Changes
d0fe1ecThanks @bittoby! - Fixes edge middlewarenext()dropping the HTTP method and body when forwarding requests to the serverless function, which caused non-GET API routes (POST, PUT, PATCH, DELETE) to return 404v10.0.3Compare Source
Patch Changes
aa26636Thanks @empoulter-uclan! - Fix vercel ISR path rewritev10.0.2Compare Source
Patch Changes
335a204Thanks @matthewp! - Fix Vercel serverless path override handling so override values are only applied when the trusted middleware secret is present.v10.0.1Compare Source
Patch Changes
6f8f0bcThanks @ematipico! - Updates the AstropeerDependencies#astroto be6.0.0.v10.0.0Compare Source
Major Changes
736216bThanks @florian-lefebvre! - Removes the deprecated@astrojs/vercel/serverlessand@astrojs/vercel/staticexports. Use the@astrojs/vercelexport insteadMinor Changes
#15258
d339a18Thanks @ematipico! - Stabilizes the adapter featureexperimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:export default defineConfig({ adapter: netlify({ - experimentalStaticHeaders: true + staticHeaders: true }) })#15413
736216bThanks @florian-lefebvre! - Updates the implementation to use the new Adapter API#15495
5b99e90Thanks @leekeh! - Adds newmiddlewareModeadapter feature and deprecatesedgeMiddlewareoptionThe
edgeMiddlewareoption is now deprecated and will be removed in a future release, so users should transition to using the newmiddlewareModefeature as soon as possible.export default defineConfig({ adapter: vercel({ - edgeMiddleware: true + middlewareMode: 'edge' }) })#14946
95c40f7Thanks @ematipico! - Removes theexperimental.cspflag and replaces it with a new configuration optionsecurity.csp- (v6 upgrade guidance)Patch Changes
#15781
2de969dThanks @ematipico! - Adds a newclientAddressoption to thecreateContext()functionProviding this value gives adapter and middleware authors explicit control over the client IP address. When not provided, accessing
clientAddressthrows an error consistent with other contexts where it is not set by the adapter.Additionally, both of the official Netlify and Vercel adapters have been updated to provide this information in their edge middleware.
#15778
4ebc1e3Thanks @ematipico! - Fixes an issue where the computedclientAddresswas incorrect in cases of a Request header with multiple values. TheclientAddressis now also validated to contain only characters valid in IP addresses, rejecting injection payloads.#15460
ee7e53fThanks @florian-lefebvre! - Updates to use the new Adapter API#15450
50c9129Thanks @florian-lefebvre! - Fixes a case wherebuild.serverEntrywould not be respected when using the new Adapter API#15461
9f21b24Thanks @florian-lefebvre! - Updates to new Adapter API introduced in v6#15125
6feb0d7Thanks @florian-lefebvre! - Updates Node versions data to account for v24 as the defaultUpdated dependencies [
4ebc1e3,4e7f3e8,a164c77,cf6ea6b,a18d727,240c317,745e632]:withastro/astro (astro)
v6.1.9Compare Source
Patch Changes
#16448
99464edThanks @matthewp! - Updates vite, picomatch, and unstorage to latest patch versions#16422
a3951d7Thanks @matthewp! - Hardensastro-islandexport resolution and hydration error handling for malformed component metadata#16420
e21de1dThanks @matthewp! - Hardens Astro's error overlay and server logging paths to avoid unsafe HTML insertion and format-string interpolation#16419
f3485c3Thanks @matthewp! - Hardens nested object and package metadata lookups to ignore prototype keys in content handling and project scaffolding#16022
a002540Thanks @mathieumaf! - Fixes an issue where i18n domains would return 404 whentrailingSlashis set tonever.Updated dependencies [
99464ed,f3485c3]:v6.1.8Compare Source
Patch Changes
#16367
a6866a7Thanks @ematipico! - Fixes an issue where build output files could contain special characters (!,~,{,}) in their names, causing deploy failures on platforms like Netlify.#16381
217c5b3Thanks @ematipico! - Slightly improved the performance of the dev server by caching the internal crawling of the dependencies of a project.#16348
7d26cd7Thanks @ocavue! - Fixes a bug where emitted assets during a client build would contain always fresh, new hashes in their name. Now the build should be more stable.#16317
d012bfeThanks @das-peter! - Fixes a bug whereallowedDomainsweren't correctly propagated when using the development server.#16379
5a84551Thanks @martrapp! - Improves Vue scoped style handling in DEV mode during client router navigation.#16317
d012bfeThanks @das-peter! - Adds tests to verify settings are properly propagated when using the development server.#16282
5b0fdaaThanks @jmurty! - Fixes build errors on platforms with skew protection enabled (e.g. Vercel, Netlify) for inter-chunk Javascript using dynamic importsUpdated dependencies [
e0b240e]:v6.1.7Compare Source
Patch Changes
#16027
c62516bThanks @fkatsuhiro! - Fixes a bug where remote image dimensions were not validated during static builds on Netlify.#16311
94048f2Thanks @Arecsu! - Fixes--portflag being ignored after a Vite-triggered server restart (e.g. when a.envfile changes)#16316
0fcd04cThanks @ematipico! - Fixes the/_imageendpoint accepting an arbitraryf=svgquery parameter and serving non-SVG content asimage/svg+xml. The endpoint now validates that the source is actually SVG before honoringf=svg, matching the same guard already enforced on the<Image>component path.v6.1.6Compare Source
Patch Changes
#16202
b5c2fbaThanks @matthewp! - Fixes Actions failing withActionsWithoutServerOutputErrorwhen usingoutput: 'static'with an adapter#16303
b06eabfThanks @matthewp! - Improves handling of special characters in inline<script>content#14924
bb4586aThanks @aralroca! - Fixes SCSS and CSS module file changes triggering a full page reload instead of hot-updating styles in place during developmentv6.1.5Compare Source
Patch Changes
#16171
5bcd03cThanks @Desel72! - Fixes a build error that occurred when a pre-rendered page used the<Picture>component and another page calledrender()on content collection entries.#16239
7c65c04Thanks @dataCenter430! - Fixes sync content inside<Fragment>not streaming to the browser until all async sibling expressions have resolved.#16242
686c312Thanks @martrapp! - Revives UnoCSS in dev mode when used with the client router.This change partly reverts #16089, which in hindsight turned out to be too general. Instead of automatically persisting all style sheets, we now do this only for styles from Vue components.
#16192
79d86b8Thanks @alexanderniebuhr! - Uses today’s date for Cloudflarecompatibility_dateinastro add cloudflareWhen creating new projects,
astro add cloudflarenow setscompatibility_dateto the current date. Previously, this date was resolved from locally installed packages, which could be unreliable in some package manager environments. Using today’s date is simpler and more reliable across environments, and is supported byworkerd.#16259
34df955Thanks @gameroman! - Removeddlvdependencyv6.1.4Compare Source
Patch Changes
#16197
21f9fe2Thanks @SchahinRohani! - Remove unused re-exports from assets/utils barrel file to fix Vite build warning#16059
6d5469eThanks @matthewp! - FixesExpected 'miniflare' to be definederrors and 404 responses in dev mode when using the Cloudflare adapter and the config file changes. Instead of creating a brand new Vite server on config changes, Astro now performs a Vite in-place restart, allowing the Cloudflare adapter to reuse its existing miniflare instance across restarts.#16154
7610ba4Thanks @Desel72! - Fixes pages with dots in their filenames (e.g.hello.world.astro) returning 404 when accessed with a trailing slash in the dev server. ThetrailingSlashForPathfunction now only forcestrailingSlash: 'never'for endpoints with file extensions, allowing pages to correctly respect the user'strailingSlashconfig.#16193
23425e2Thanks @matthewp! - FixestrailingSlash: "always"producing redirect HTML instead of the actual response for extensionless endpoints during static buildsv6.1.3Compare Source
Patch Changes
#16161
b51f297Thanks @matthewp! - Fixes a dev rendering issue with the Cloudflare adapter where head metadata could be missing and dev CSS/scripts could be injected in the wrong place#16110
de669f0Thanks @tmimmanuel! - Fixes skew protection query parameters not being appended to inter-chunk JavaScript imports in client bundles, which could cause version mismatches during rolling deployments on Vercel#16162
a0a49e9Thanks @rururux! - Fixes an issue where HMR would not trigger when modifying files while using @astrojs/cloudflare with prerenderEnvironment: 'node' enabled.#16142
7454854Thanks @rururux! - Fixes HTML content being incorrectly escaped as plain text when rendering a MDX component using theAstroContainerAPIs.#16116
12602a9Thanks @riderx! - Fixes a bug where page-level CSS could leak between unrelated pages when traversing style parents across top-level route boundaries#16178
a7e7567Thanks @matthewp! - Fixes SSR builds failing with "No matching renderer found" when a project only has injected routes and nosrc/pages/directoryv6.1.2Compare Source
Patch Changes
#16104
47a394dThanks @matthewp! - Fixesastro previewignoringvite.preview.allowedHostsset inastro.config.mjs#16047
711f837Thanks @matthewp! - Fixes catch-all routes incorrectly intercepting requests for static assets when using the@astrojs/nodeadapter in middleware mode.#15981
a60cbb6Thanks @moktamd! - Fix Zod v4 validation error formatting to show human-readable messages instead of raw JSONv6.1.1Compare Source
Patch Changes
#16105
23d60deThanks @matthewp! - Fix dev toolbar audit crash when encountering theimageARIA role#16089
999c875Thanks @martrapp! - Fixes an issue with the client router where Vue's:deep()notation was ignored in dev mode.v6.1.0Compare Source
Minor Changes
#15804
a5e7232Thanks @merlinnot! - Allows setting codec-specific defaults for Astro's built-in Sharp image service viaimage.service.config.You can now configure encoder-level options such as
jpeg.mozjpeg,webp.effort,webp.alphaQuality,avif.effort,avif.chromaSubsampling, andpng.compressionLevelwhen usingastro/assets/services/sharpfor compile-time image generation.These settings apply as defaults for the built-in Sharp pipeline, while per-image
qualitystill takes precedence when set on<Image />,<Picture />, orgetImage().#15455
babf57fThanks @AhmadYasser1! - AddsfallbackRoutesto theIntegrationResolvedRoutetype, exposing i18n fallback routes to integrations via theastro:routes:resolvedhook for projects usingfallbackType: 'rewrite'.This allows integrations such as the sitemap integration to properly include generated fallback routes in their output.
#15340
10a1a5aThanks @trueberryless! - Adds support for advanced configuration of SmartyPants in Markdown.You can now pass an options object to
markdown.smartypantsin your Astro configuration to fine-tune how punctuation, dashes, and quotes are transformed.This is helpful for projects that require specific typographic standards, such as "oldschool" dash handling or localized quotation marks.
See the
retext-smartypantsoptions for more information.Patch Changes
#16025
a09f319Thanks @koji-1009! - Instructs the client router to skip view transition animations when the browser is already providing its own visual transition, such as a swipe gesture.#16055
ccecb8fThanks @Gautam-Bharadwaj! - Fixes an issue whereclient:onlycomponents could have duplicateclient:component-pathattributes added in MDX in rare cases#16081
44fc340Thanks @crazylogic03! - Fixes theemitFile() is not supported in serve modewarning that appears duringastro devwhen using integrations that inject before-hydration scripts (e.g.@astrojs/react)#16068
31d733bThanks @Karthikeya1500! - Fixes the dev toolbar a11y audit incorrectly classifyingmenuitemradioas a non-interactive ARIA role.#16080
e80ac73Thanks @ematipico! - Fixesexperimental.queuedRenderingincorrectly escaping the HTML output of.htmlpage files, causing the page content to render as plain text instead of HTML in the browser.#16048
13b9d56Thanks @matthewp! - Fixes a dev server crash (serverIslandNameMap.get is not a function) that occurred when navigating to a page withserver:deferafter first visiting a page without one, when using@astrojs/cloudflare#16093
336e086Thanks @Snugug! - Fixes Zod meta not correctly being rendered on top-level schema when converted into JSON Schema#16043
d402485Thanks @ematipico! - FixescheckOriginCSRF protection inastro devbehind a TLS-terminating reverse proxy. The dev server now readsX-Forwarded-Proto(gated onsecurity.allowedDomains, matching production behaviour) so the constructed request origin matches thehttps://origin the browser sends. Also ensuressecurity.allowedDomainsandsecurity.checkOriginare respected in dev.#16064
ba58e0dThanks @ematipico! - Updates the dependencysvgoto the latest, to fix a security issue.#16007
2dcd8d5Thanks @florian-lefebvre! - Fixes a case where fonts files would unecessarily be copied several times during the build#16017
b089b90Thanks @felmonon! - Fix theastro syncerror message whengetImage()is called while loading content collections.#16014
fa73fbbThanks @matthewp! - Fixes a build error where usingastro:config/clientinside a<script>tag would cause Rollup to fail with "failed to resolve importvirtual:astro:routesfromvirtual:astro:manifest"#16054
f74465aThanks @seroperson! - Fixes an issue with the development server, where changes to the middleware weren't picked, and it required a full restart of the server.#16033
198d31bThanks @adampage! - Fixes a bug where the the roleimagewas incorrectly reported by audit tool bar.#15935
278828cThanks @oliverlynch! - Fixes cached assets failing to revalidate due to redirect check mishandling Not Modified responses.#16075
2c1ae85Thanks @florian-lefebvre! - Fixes a case where invalid URLs would be generated in development when using font families with an obliquestyleand angles#16062
87fd6a4Thanks @matthewp! - Warns on dev server startup when Vite 8 is detected at the top level of the user's project, and automatically adds a"overrides": { "vite": "^7" }entry topackage.jsonwhen runningastro add cloudflare. This prevents arequire_dist is not a functioncrash caused by a Vite version split between Astro (requires Vite 7) and packages like@tailwindcss/vitethat hoist Vite 8.Updated dependencies [
10a1a5a]:v6.0.8Compare Source
Patch Changes
#15978
6d182feThanks @seroperson! - Fixes a bug where Astro Actions didn't properly support nested object properties, causing problems when users used zod functions such assuperRefineordiscriminatedUnion.#16011
e752170Thanks @matthewp! - Fixes a dev server hang on the first request when using the Cloudflare adapter#15997
1fddff7Thanks @ematipico! - FixesAstro.rewrite()failing when the target path contains duplicate slashes (e.g.//about). The duplicate slashes are now collapsed before URL parsing, preventing them from being interpreted as a protocol-relative URL.v6.0.7Compare Source
Patch Changes
#15950
acce5e8Thanks @matthewp! - Fixes a build regression in projects with multiple frontend integrations whereserver:deferserver islands could fail at runtime when all pages are prerendered.#15988
c93b4a0Thanks @ossaidqadri! - Fix styles from dynamically imported components not being injected on first dev server load.#15968
3e7a9d5Thanks @chasemccoy! - FixesrenderMarkdownin custom content loaders not resolving images in markdown content. Images referenced in markdown processed byrenderMarkdownare now correctly optimized, matching the behavior of the built-inglob()loader.#15990
1e6017fThanks @ematipico! - Fixes an issue whereAstro.currentLocalewould always be the default locale instead of the actual one when using a dynamic route like[locale].astroor[locale]/index.astro. It now resolves to the correct locale from the URL.#15990
1e6017fThanks @ematipico! - Fixes an issue where visiting an invalid locale URL (e.g./asdf/) would show the content of a dynamic[locale]page with a 404 status code, instead of showing your custom 404 page. Now, the correct 404 page is rendered when the locale in the URL doesn't match any configured locale.#15960
1d84020Thanks @matthewp! - Fixes Cloudflare dev server islands withprerenderEnvironment: 'node'by sharingConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.