fix(deps): update astro monorepo (major)#10
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
85ea1da to
405eb1b
Compare
405eb1b to
2f3266c
Compare
2f3266c to
39479d4
Compare
39479d4 to
8ef514f
Compare
8ef514f to
686e0f6
Compare
686e0f6 to
3ea6fe5
Compare
3ea6fe5 to
7cc9a6e
Compare
7cc9a6e to
ea52eb7
Compare
ea52eb7 to
4b5d974
Compare
4b5d974 to
fb89a0a
Compare
fb89a0a to
91fe3a9
Compare
91fe3a9 to
90af55f
Compare
90af55f to
42c306e
Compare
c0ffc1d to
0f83d00
Compare
0f83d00 to
d121591
Compare
d121591 to
6a1dd66
Compare
6a1dd66 to
cbd247f
Compare
cbd247f to
4f09c27
Compare
4f09c27 to
b0413b0
Compare
b0413b0 to
3d9bb91
Compare
3d9bb91 to
117cfbe
Compare
117cfbe to
f18beb0
Compare
f18beb0 to
85ca381
Compare
85ca381 to
81d19da
Compare
81d19da to
8aa5ed8
Compare
8aa5ed8 to
309931f
Compare
309931f to
6657be4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^9.5.4→^10.0.0^9.0.4→^10.0.0^5.18.0→^6.0.0Release Notes
withastro/astro (@astrojs/node)
v10.0.6Compare Source
Patch Changes
99464ed,f3485c3]:v10.0.5Compare Source
Patch Changes
940afd5Thanks @matthewp! - Fixes static asset error responses incorrectly including immutable cache headers. Conditional request failures (e.g.If-Matchmismatch) now return the correct status code without far-future cache directives.v10.0.4Compare Source
Patch Changes
#16002
846f27fThanks @buley! - Fixes file descriptor leaks from read streams that were not destroyed on client disconnect or read errors#15941
f41584aThanks @ematipico! - Fixes an infinite loop inresolveClientDir()when the server entry point is bundled with esbuild or similar tools. The function now throws a descriptive error instead of hanging indefinitely when the expected server directory segment is not found in the file path.v10.0.3Compare Source
Patch Changes
#15735
9685e2dThanks @fa-sharp! - Fixes an EventEmitter memory leak when serving static pages from Node.js middleware.When using the middleware handler, requests that were being passed on to Express / Fastify (e.g. static files / pre-rendered pages / etc.) weren't cleaning up socket listeners before calling
next(), causing a memory leak warning. This fix makes sure to run the cleanup before callingnext().v10.0.2Compare Source
Patch Changes
6f8f0bcThanks @ematipico! - Updates the AstropeerDependencies#astroto be6.0.0.v10.0.1Compare Source
Patch Changes
bb2b8f5Thanks @ematipico! - Fixes an issue where the adapter would cause a series of warnings during the build.v10.0.0Compare Source
Major Changes
#15654
a32aee6Thanks @florian-lefebvre! - Removes theexperimentalErrorPageHostoptionThis option allowed fetching a prerendered error page from a different host than the server is currently running on.
However, there can be security implications with prefetching from other hosts, and often more customization was required to do this safely. This has now been removed as a built-in option so that you can implement your own secure solution as needed and appropriate for your project via middleware.
What should I do?
If you were previously using this feature, you must remove the option from your adapter configuration as it no longer exists:
// astro.config.mjs import { defineConfig } from 'astro/config' import node from '@​astrojs/node' export default defineConfig({ adapter: node({ mode: 'standalone', - experimentalErrorPageHost: 'http://localhost:4321' }) })You can replicate the previous behavior by checking the response status in a middleware and fetching the prerendered page yourself:
Minor Changes
#15258
d339a18Thanks @ematipico! - Stabilizes the adapter featureexperimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:export default defineConfig({ adapter: netlify({ - experimentalStaticHeaders: true + staticHeaders: true }) })#15759
39ff2a5Thanks @matthewp! - Adds a newbodySizeLimitoption to the@astrojs/nodeadapterYou can now configure a maximum allowed request body size for your Node.js standalone server. The default limit is 1 GB. Set the value in bytes, or pass
0to disable the limit entirely:#15006
f361730Thanks @florian-lefebvre! - Adds new session driver object shapeFor greater flexibility and improved consistency with other Astro code, session drivers are now specified as an object:
Specifying the session driver as a string has been deprecated, but will continue to work until this feature is removed completely in a future major version. The object shape is the current recommended and documented way to configure a session driver.
#14946
95c40f7Thanks @ematipico! - Removes theexperimental.cspflag and replaces it with a new configuration optionsecurity.csp- (v6 upgrade guidance)Patch Changes
#15473
d653b86Thanks @matthewp! - Improves error page loading to read from disk first before falling back to configured host#15562
e14a51dThanks @florian-lefebvre! - Updates to new Adapter API introduced in v6#15585
98ea30cThanks @matthewp! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.#15777
02e24d9Thanks @matthewp! - Fixes CSRF origin check mismatch by passing the actual server listening port tocreateRequest, ensuring the constructed URL origin includes the correct port (e.g.,http://localhost:4321instead ofhttp://localhost). Also restrictsX-Forwarded-Prototo only be trusted whenallowedDomainsis configured.#15714
9a2c949Thanks @ematipico! - Fixes an issue where static headers weren't correctly applied when the website usesbase.#15763
1567e8cThanks @matthewp! - Normalizes static file paths before evaluating dotfile access rules for improved consistency#15164
54dc11dThanks @HiDeoo! - Fixes an issue where the Node.js adapter could fail to serve a 404 page matching a pre-rendered dynamic route pattern.#15745
20b05c0Thanks @matthewp! - Hardens static file handler path resolution to ensure resolved paths stay within the client directory#15495
5b99e90Thanks @leekeh! - Refactors to usemiddlewareModeadapter feature (set toclassic)#15657
cb625b6Thanks @qzio! - Adds a newsecurity.actionBodySizeLimitoption to configure the maximum size of Astro Actions request bodies.This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.
If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.
Updated dependencies [
4ebc1e3,4e7f3e8,a164c77,cf6ea6b,a18d727,240c317,745e632]:withastro/astro (@astrojs/vercel)
v10.0.6Compare Source
Patch Changes
0bae1a5Thanks @cyphercodes! - Fix forwarded serverless requests with streamed bodies by preserving the requiredduplex: 'half'option when rewriting middleware paths.v10.0.5Compare Source
Patch Changes
99464ed,f3485c3]:v10.0.4Compare Source
Patch Changes
d0fe1ecThanks @bittoby! - Fixes edge middlewarenext()dropping the HTTP method and body when forwarding requests to the serverless function, which caused non-GET API routes (POST, PUT, PATCH, DELETE) to return 404v10.0.3Compare Source
Patch Changes
aa26636Thanks @empoulter-uclan! - Fix vercel ISR path rewritev10.0.2Compare Source
Patch Changes
335a204Thanks @matthewp! - Fix Vercel serverless path override handling so override values are only applied when the trusted middleware secret is present.v10.0.1Compare Source
Patch Changes
6f8f0bcThanks @ematipico! - Updates the AstropeerDependencies#astroto be6.0.0.v10.0.0Compare Source
Major Changes
736216bThanks @florian-lefebvre! - Removes the deprecated@astrojs/vercel/serverlessand@astrojs/vercel/staticexports. Use the@astrojs/vercelexport insteadMinor Changes
#15258
d339a18Thanks @ematipico! - Stabilizes the adapter featureexperimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:export default defineConfig({ adapter: netlify({ - experimentalStaticHeaders: true + staticHeaders: true }) })#15413
736216bThanks @florian-lefebvre! - Updates the implementation to use the new Adapter API#15495
5b99e90Thanks @leekeh! - Adds newmiddlewareModeadapter feature and deprecatesedgeMiddlewareoptionThe
edgeMiddlewareoption is now deprecated and will be removed in a future release, so users should transition to using the newmiddlewareModefeature as soon as possible.export default defineConfig({ adapter: vercel({ - edgeMiddleware: true + middlewareMode: 'edge' }) })#14946
95c40f7Thanks @ematipico! - Removes theexperimental.cspflag and replaces it with a new configuration optionsecurity.csp- (v6 upgrade guidance)Patch Changes
#15781
2de969dThanks @ematipico! - Adds a newclientAddressoption to thecreateContext()functionProviding this value gives adapter and middleware authors explicit control over the client IP address. When not provided, accessing
clientAddressthrows an error consistent with other contexts where it is not set by the adapter.Additionally, both of the official Netlify and Vercel adapters have been updated to provide this information in their edge middleware.
#15778
4ebc1e3Thanks @ematipico! - Fixes an issue where the computedclientAddresswas incorrect in cases of a Request header with multiple values. TheclientAddressis now also validated to contain only characters valid in IP addresses, rejecting injection payloads.#15460
ee7e53fThanks @florian-lefebvre! - Updates to use the new Adapter API#15450
50c9129Thanks @florian-lefebvre! - Fixes a case wherebuild.serverEntrywould not be respected when using the new Adapter API#15461
9f21b24Thanks @florian-lefebvre! - Updates to new Adapter API introduced in v6#15125
6feb0d7Thanks @florian-lefebvre! - Updates Node versions data to account for v24 as the defaultUpdated dependencies [
4ebc1e3,4e7f3e8,a164c77,cf6ea6b,a18d727,240c317,745e632]:withastro/astro (astro)
v6.2.2Compare Source
Patch Changes
#16292
00f48eeThanks @p-linnane! - Fixes head metadata propagation in dev for adapters that load modules in theprerenderVite environment, such as@astrojs/cloudflare. Theastro:head-metadataplugin previously only tracked thessrenvironment, somaybeRenderHead()could fire inside an unrelated component's<template>element, trapping subsequent hoisted<style>blocks.#16451
778865fThanks @maximslo! - Fixes build crash when processing animated AVIF images. Sharp now gracefully passes through unsupported image formats instead of crashing during the build.#16548
7214d3eThanks @senutpal! - Fixes scoped styles applying to the wrong element whenvite.css.transformeris set to'lightningcss'and a selector uses a nested&inside:where(...), such as Tailwind v4'sspace-x-*,space-y-*, anddivide-*utilities.#16566
9ac96b4Thanks @web-dev0521! - Fixesdata-astro-prefetch="tap"not triggering when clicking nested elements (e.g.<span>,<img>,<svg>) inside an anchor tag.#15994
1e70d18Thanks @ossaidqadri! - Fix<style>compilation failure when importing Astro components via tsconfig path aliases#16144
1cd6650Thanks @fkatsuhiro! - Fixed a regression where.htmlwas unexpectedly stripped from dynamic route parameters on non-page routes (.tsendpoints and redirects). This caused endpoints like/some/[...id].tsreturningid: 'file.html'ongetStaticPathsto not serve that file because the generated route (/some/file.html) would get matched asid: filethat is not part of the list returned bygetStaticPaths.#16415
559c0fdThanks @0xbejaxer! - Fix CSS traversal boundaries so pages withexport const partial = truestill contribute styles when imported as components by other pages.#16516
17f1867Thanks @fkatsuhiro! - Fixes an issue where the index route would return a 404 error when using a custombasepath combined withtrailingSlash: 'never'. This ensures that the home page and internal rewrites are correctly matched under these configurations.#16515
280ec88Thanks @jp-knj! - Fixes an issue wherei18n.fallbackpages withfallbackType: 'rewrite'were emitted with empty bodies duringastro build.#16565
7959798Thanks @enjoyandlove! - Fixes session persistence whensession.delete()is the first mutation in a request (no priorget,set,has, orkeys). The session was marked dirty in memory, but persistence skipped the save because#datastayedundefined, so the backing store could still return the deleted key on the next request.#16527
86fd80dThanks @enjoyandlove! - Prevents script deduplication state from being consumed while rendering inert<template>contexts.#16540
e59c637Thanks @ascorbic! - Skips session storage reads when no session cookie is present. Previously, callingsession.get()on a request without a session cookie would initialize the storage driver and make a read that was guaranteed to miss. On network-backed drivers this added latency and resource usage to every anonymous request.#16517
6ab0b3cThanks @adamchal! - Removes inline CSS for prerendered routes from the SSR manifest. The static HTML on disk already inlines those styles, and the SSR worker never renders prerendered routes, so the data was dead weight. Builds with many prerendered routes andbuild.inlineStylesheets: "always"(or"auto"with small stylesheets) will see a smaller SSR entry chunk, which reduces cold-start parse time on platforms like Cloudflare Workers.#16509
d3d3557Thanks @cyphercodes! - Fix conditional named slot callbacks receiving arguments fromAstro.slots.render().#16236
c6b068eThanks @fkatsuhiro! - Fixes thepositionprop on<Image />and<Picture />components to correctly applyobject-positionstyles#16018
d14f47cThanks @felmonon! - FixdefineLiveCollection()soLiveLoaderdata types declared as interfaces are accepted.v6.2.1Compare Source
Patch Changes
#16531
76db01dThanks @rodrigosdev! - Fixes config validation for omittedintegrationsfields with newer Zod versions.#16535
7df0fe4Thanks @rururux! - Fixed an issue where a warning was displayed when theserverproperty was missing during config validation, even though it is not required.#16534
5cf6c51Thanks @matthewp! - Fixes compatibility with Zod 4.4.0 for theserverconfig property and error formattingv6.2.0Compare Source
Minor Changes
#16187
fe58071Thanks @gllmt! - Adds awaitUntiloption to theRenderOptionsso that adapters can forward runtime background-task hooks to Astro.When provided by an adapter, runtime cache providers receive
context.waitUntilinCacheProvider.onRequest(), which allows background cache work such as stale-while-revalidatewithout blocking the response. The Cloudflare adapter now forwards
ExecutionContext.waitUntilto this API.#16290
a49637aThanks @ViVaLaDaniel! - Ensures thatserver.allowedHosts(andvite.preview.allowedHosts) configuration is respected when usingastro previewwith the@astrojs/cloudflareadapter. This improves security by preventing DNS rebinding attacks when previewing Cloudflare builds locally.#15725
4108ec1Thanks @meyer! - Adds support for a new'jsx'value for thecompressHTMLoption. When set, whitespace is stripped using JSX whitespace rules instead of the default HTML compression strategy.In JSX, whitespaces never matter, as such, no amount of indentation, or newlines will not affect the rendered output. For instance, the following code:
will be rendered as
foobar, whereas with HTML whitespace rules, a space would be present between the words due to the newline and indentation between the tags.#16477
28fb3e1Thanks @ematipico! - Adds experimental support for configurable log handlers.This experimental feature provides better control over Astro's logging infrastructure by allowing users to replace the default console output with custom logging implementations (e.g., structured JSON). This is particularly useful for users using on-demand rendering and wishing to connect their log aggregation services, such as Kibana, Logstash, CloudWatch, Grafana, or Loki.
By default, Astro provides three built-in log handlers (
json,node, andconsole), but you can also create your own.JSON logging
JSON logging can be enabled via the CLI for the
build,dev, andsynccommands using theexperimentalJsonflag:Custom logger
You can also create your own custom logger by implementing the correct interface:
For more information on enabling and using this feature in your project, see the Experimental Logger docs.
For a complete overview and to give feedback on this experimental API, see the Custom logger RFC.
#16333
0f7c3c8Thanks @florian-lefebvre! - Adds an experimental flagsvgOptimizerthat enables automatic optimization of your SVG components using the provided optimizer. This supersedes thesvgoexperimental flag, which is now removed.When enabled, your imported SVG files used as components will be optimized for smaller file sizes and better performance while maintaining visual quality. This can significantly reduce the size of your SVG assets by removing unnecessary metadata, comments, and redundant code.
Astro ships with a SVGO based optimizer, but any can be used.
To enable this feature, add the experimental flag in your Astro config and remove
svgoif it was enabled:For more information on enabling and using this feature in your project, see the experimental SVG optimization docs.
#16302
f6f8e80Thanks @florian-lefebvre! - Adds a newexperimental_getFontFileURL()method to resolve font file URLs when using the Fonts APIThe
fontDataobject exported fromastro:assetswas introduced to provide low-level access to font family data for advanced usage. One of the goals of this API was to be able to resolve buffers using URLs. However, it turned out to be impractical, especially during prerendering.Astro now exports a new
experimental_getFontFileURL()helper function fromastro:assetsto resolve font file URLs fromfontData. For example, when using satori to generate Open Graph images:// src/pages/og.png.ts import type { APIRoute } from "astro"; -import { fontData } from "astro:assets"; +import { fontData, experimental_getFontFileURL } from "astro:assets"; -import { outDir } from "astro:config/server"; -import { readFile } from "node:fs/promises"; import satori from "satori"; import { html } from "satori-html"; import sharp from "sharp"; export const GET: APIRoute = async (context) => { const fontPath = fontData["--font-roboto"][0]?.src[0]?.url; if (fontPath === undefined) { throw new Error("Cannot find the font path."); } - const data = import.meta.env.DEV - ? await fetch(new URL(fontPath, context.url.origin)).then(async (res) => res.arrayBuffer()) - : await readFile(new URL(`.${fontPath}`, outDir)); + const url = experimental_getFontFileURL(fontPath, context.url); + const data = await fetch(url).then((res) => res.arrayBuffer()); const svg = await satori( html`<div style="color: black;">hello, world</div>`, { width: 600, height: 400, fonts: [ { name: "Roboto", data, weight: 400, style: "normal", }, ], }, ); const pngBuffer = await sharp(Buffer.from(svg)) .resize(600, 400) .png() .toBuffer(); return new Response(new Uint8Array(pngBuffer), { headers: { "Content-Type": "image/png", }, }); };See the Fonts API documentation for more information.
Patch Changes
8812382Thanks @seroperson! - Prevents script deduplication inside<template>elementsv6.1.10Compare Source
Patch Changes
#16479
1058428Thanks @matthewp! - Fixes a spurious[WARN] [content] Content config not loadedwarning duringastro devfor projects that don't use content collections#16457
3d82220Thanks @matthewp! - Hardens server island encryption to prevent encrypted data from one island component being replayed against a different one#16481
152700eThanks @matthewp! - Fixes a spurious 404 request for a dev toolbar sourcemap duringastro devcaused by the browser mis-resolving a relativesourceMappingURLfrom the/@​id/URL prefix#16480
1bcb43bThanks @matthewp! - Fixes an unnecessary full page reload on first navigation during devv6.1.9Compare Source
Patch Changes
#16448
99464edThanks @matthewp! - Updates vite, picomatch, and unstorage to latest patch versions#16422
a3951d7Thanks @matthewp! - Hardensastro-islandexport resolution and hydration error handling for malformed component metadata#16420
e21de1dThanks @matthewp! - Hardens Astro's error overlay and server logging paths to avoid unsafe HTML insertion and format-string interpolation#16419
f3485c3Thanks @matthewp! - Hardens nested object and package metadata lookups to ignore prototype keys in content handling and project scaffolding#16022
a002540Thanks @mathieumaf! - Fixes an issue where i18n domains would return 404 whentrailingSlashis set tonever.Updated dependencies [
99464ed,f3485c3]:v6.1.8Compare Source
Patch Changes
#16367
a6866a7Thanks @ematipico! - Fixes an issue where build output files could contain special characters (!,~,{,}) in their names, causing deploy failures on platforms like Netlify.#16381
217c5b3Thanks @ematipico! - Slightly improved the performance of the dev server by caching the internal crawling of the dependencies of a project.#16348
7d26cd7Thanks @ocavue! - Fixes a bug where emitted assets during a client build would contain always fresh, new hashes in their name. Now the build should be more stable.#16317
d012bfeThanks @das-peter! - Fixes a bug whereallowedDomainsweren't correctly propagated when using the development server.#16379
5a84551Thanks @martrapp! - Improves Vue scoped style handling in DEV mode during client router navigation.#16317
d012bfeThanks @das-peter! - Adds tests to verify settings are properly propagated when using the development server.#16282
5b0fdaaThanks @jmurty! - Fixes build errors on platforms with skew protection enabled (e.g. Vercel, Netlify) for inter-chunk Javascript using dynamic importsUpdated dependencies [
e0b240e]:v6.1.7Compare Source
Patch Changes
#16027
c62516bThanks @fkatsuhiro! - Fixes a bug where remote image dimensions were not validated during static builds on Netlify.#16311
94048f2Thanks @Arecsu! - Fixes--portflag being ignored after a Vite-triggered server restart (e.g. when a.envfile changes)#16316
0fcd04cThanks @ematipico! - Fixes the/_imageendpoint accepting an arbitraryf=svgquery parameter and serving non-SVG content asimage/svg+xml. The endpoint now validates that the source is actually SVG before honoringf=svg, matching the same guard already enforced on the<Image>component path.v6.1.6Compare Source
Patch Changes
#16202
b5c2fbaThanks @matthewp! - Fixes Actions failing withActionsWithoutServerOutputErrorwhen usingoutput: 'static'with an adapter#16303
b06eabfThanks @matthewp! - Improves handling of special characters in inline<script>content#14924
bb4586aThanks @aralroca! - Fixes SCSS and CSS module file changes triggering a full page reload instead of hot-updating styles in place during developmentv6.1.5Compare Source
Patch Changes
#16171
5bcd03cThanks @Desel72! - Fixes a build error that occurred when a pre-rendered page used the<Picture>component and another page calledrender()on content collection entries.#16239
7c65c04Thanks @dataCenter430! - Fixes sync content inside<Fragment>not streaming to the browser until all async sibling expressions have resolved.#16242
686c312Thanks @martrapp! - Revives UnoCSS in dev mode when used with the client router.This change partly reverts #16089, which in hindsight turned out to be too general. Instead of automatically persisting all style sheets, we now do this only for styles from Vue components.
#16192
79d86b8Thanks @alexanderniebuhr! - Uses today’s date for Cloudflarecompatibility_dateinastro add cloudflareWhen creating new projects,
astro add cloudflarenow setscompatibility_dateto the current date. Previously, this date was resolved from locally installed packages, which could be unreliable in some package manager environments. Using today’s date is simpler and more reliable across environments, and is supported byworkerd.#16259
34df955Thanks @gameroman! - Removeddlvdependencyv6.1.4Compare Source
Patch Changes
#16197
21f9fe2Thanks @SchahinRohani! - Remove unused re-exports from assets/utils barrel file to fix Vite build warning#16059
6d5469eThanks @matthewp! - FixesExpected 'miniflare' to be definederrors and 404 responses in dev mode when using the Cloudflare adapter and the config file changes. Instead of creating a brand new Vite server on config changes, Astro now performs a Vite in-place restart, allowing the Cloudflare adapter to reuse its existing miniflare instance across restarts.[#16154
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.