Changes

• astro:content builds render with a factory call since #17818 (7.3.0): export const render = createRenderEntry({ logger }). The bundler keeps unannotated calls, so renderEntry stays in every server bundle that imports astro:content. Its dynamic import('astro:content-module-imports') stays with it. That's the map that lazily imports every renderable entry.
• As a result, when on-demand routes only read collection data (getCollection(), getEntry()) and never call render(), every entry rendered by prerendered pages is still compiled into the server output. In 7.2, renderEntry was a plain exported function and was tree-shaken.
• This marks the factory call /* @__PURE__ */, so an unused render is dropped again. Bundles that do use render() keep it, so runtime behavior is unchanged.

Real-world impact: on a Vercel site with ~200 MDX posts in 11 locales and a few on-demand routes (/blog listing, /compare/*), the _render function went from 50 MB (7.2.10) to 389 MB (7.3.0 through 7.4.2). Vercel rejects that: "exceeds the maximum uncompressed size limit of 250mb". With this change it's back to 49 MB, and all of the site's on-demand routes still render.

Bisected on that site: 7.2.10 builds a 49 MB function, while 7.3.1, 7.3.4, 7.3.8, 7.4.0 and 7.4.2 build 389–390 MB. Walking the server environment's module graph points to this chain:

on-demand page → astro:content → content/runtime.js (renderEntry)
  → import('astro:content-module-imports') → import(<every entry>.mdx?astroPropagatedAssets)

Testing

• Added content-render-tree-shaking.test.ts with a fixture that has two MDX entries, a prerendered page that renders them with render(), and an on-demand page that only calls getCollection(). The test asserts that no server chunk contains an entry's compiled body, and that both pages render. The fixture uses retainBody: false, so the marker can only reach the server output through a compiled entry module and not through the data store.
  • Without the change, it fails: dist/server/chunks/first_*.mjs contains the entry.
  • With the change, it passes.
• test/content*.test.ts, test/ssr-prerender*.test.ts, test/server-islands.test.ts, test/csp-server-islands.test.ts and test/live-*.test.ts all pass (80/80).

Docs

No docs needed: this is a bundle-size fix with no API or behavior change.

Made with AI.

Changes

• Fixes #18418 by preserving component-rendered <link> tags (such as stylesheets and preconnect hints) in @astrojs/react island markup.
• React 19 auto-injects resource preloads (e.g., for <img> tags), which are intended to be stripped from island output. However, the regex previously stripped all <link rel="..."> tags including stylesheet and preconnect, causing missing styles prior to hydration and React hydration mismatches (#418 / #423).
• Updated stripping logic to target only auto-injected preloads (rel="preload|modulepreload") on React 19+.
• Skips stripping completely on React 18, which does not inject resource hints.
• Added changeset .changeset/preserve-react-island-links.md.

Testing

• Updated packages/integrations/react/test/react-19-preloads.test.ts to assert that component-rendered <link rel="stylesheet"> and <link rel="preconnect"> are preserved in the rendered island markup while preloads remain stripped.
• Verified all @astrojs/react test suites pass cleanly.
• Biome formatting and lint checks pass.

Docs

No documentation changes needed; this fixes unintended stripping of developer-rendered tags to align with expected component behavior.

Changes

Fixes #18530.

matchAllRoutes in packages/astro/src/core/routing/match.ts only tested route.pattern, while matchRoute in the same file and Router.matchAll also check fallbackRoutes. This meant i18n fallback routes were not matched by the dev server path that uses matchAllRoutes. It now checks fallback routes the same way, so behaviour is consistent across the three matchers.

Testing

• No new test added: dev-server route matching is covered by the existing routing tests, which run in CI.
• Verified with a focused before/after reproduction: before the fix, matchAllRoutes('/blog') missed a route whose fallback pattern is /blog; after the fix it matches, same as matchRoute.

Changes

Fixes #18527.

generateDynamicPattern in @astrojs/underscore-redirects only read the first part of each route segment, so compound dynamic routes were truncated when generating _redirects entries: post-[id] produced /post- instead of /post-:id. It now joins every part of a segment, so post-[id] produces /post-:id and [year]-[month]-[slug] produces /:year-:month-:slug.

Testing

• Added two tests to packages/underscore-redirects/test/astro.test.ts covering post-[id] and [year]-[month]-[slug].
• The full underscore-redirects test file passes (9/9) against the fixed code; before the fix the two new tests failed with the truncated patterns.

Changes

• Fixes an unhandled TypeError: Cannot convert undefined or null to object when calling route.generate() or getRouteGenerator()(/* no args */) on static routes without arguments (fixes #18528).
• Defaults params to {} in getRouteGenerator and safely coalesces params ?? {} when passing to sanitizeParams.
• Added patch changeset .changeset/quiet-routes-generate.md.

Testing

• Added unit tests in packages/astro/test/units/routing/generator.test.ts verifying generator() and generator(undefined) return the expected static path without throwing.
• Verified dynamic routes called without params continue throwing Missing parameter: <name>.
• Verified formatting and linting via Biome.

Docs

Bug fix only; no documentation changes needed as the TypeScript signature already documents (data?: any) => string.

Changes

• Client bundles built with the Cloudflare adapter no longer contain raw process.env.* references. Previously, the adapter applied 'process.env': 'process.env' to the top-level Vite config, which leaked into client chunks and caused ReferenceError: process is not defined in the browser for any code that reads process.env at import time (e.g. @vuetify/v0).
• The define is now applied only to the ssr and prerender Vite environments, mirroring how the globalThis.process banner was already scoped in #18213. Client bundles receive Vite's default browser replacement ({}) again.

Testing

• Added a test in packages/integrations/cloudflare/test/static.test.ts that builds a fixture containing a client-only component that references process.env.* and asserts the output chunk does not contain a bare process.env reference.

Docs

• No docs update needed; this is a bug fix restoring behavior that was unintentionally broken — no public API or configuration surface changed.

Closes #18507

Changes

• astro info no longer triggers the DEP0190 Node.js deprecation warning on Node 24+. The warning was caused by passing an args array to tinyexec with shell: true, which Node 24 flags as a security risk. Removing shell: true is safe because tinyexec already handles Windows .cmd shims without it, matching how astro add already invokes package managers.
• Drops the now-unused shell option from CommandExecutorOptions and TinyexecCommandExecutor.

Testing

• Adds packages/astro/test/units/cli/info.test.ts covering that the npm, pnpm, and yarn package-manager executors do not pass shell: true to the underlying command executor.

Docs

• No docs update needed; this is an internal implementation fix with no user-facing API change.

Closes #18485

Changes

• Astro's bundled .astro components (ClientRouter.astro, Code.astro, Debug.astro, Image.astro, Picture.astro) now compile cleanly under every option in astro/tsconfigs/strictest. With @astrojs/ts-content-mapper, tsc type-checks .astro source files in node_modules using the project's own compiler options — meaning skipLibCheck does not apply — so projects extending strictest previously saw 9 unavoidable errors they could not fix.
• The two strictest options responsible were exactOptionalPropertyTypes (7 errors across Code.astro, Image.astro, Picture.astro) and noUncheckedIndexedAccess (2 errors in ClientRouter.astro, Debug.astro). Each component was updated to satisfy those constraints.

Testing

• No dedicated test files were added; the correctness is verified by tsc itself passing on the fixed components under strictest. The existing component type-check coverage in CI did not previously include packages/astro/components/*.astro under the strictest preset, so no existing assertions changed.

Docs

• No docs update needed; this is a bug fix in internal component implementations with no API surface change.

Closes #18471

Changes

• Cached 404/500 responses with a null body are no longer stored in the memory provider. Previously, serializeResponse() converted the null body to an empty ArrayBuffer, so cache hits returned an empty response body instead of the rendered error page (which the router could only produce when response.body === null).
• Adds an isErrorPageReroute() guard in core/cache/memory-provider.ts that skips caching (and deletes any stale SWR entry) when the response has a reroutable status (404 or 500) and a null body. One trade-off: endpoints that return an empty 404/500 with skipErrorReroute will also bypass the cache, though the response they send is still correct.

Testing

• New unit tests in packages/astro/test/units/cache/memory-provider.test.ts covering both the initial-request path and the SWR revalidation path for empty 404 and 500 responses, asserting they are not stored and that stale entries are evicted.

Docs

• No docs update needed; this is a bug fix restoring the already-documented behavior of the memory cache provider.

Closes #18456

Changes

• JSON content collection entries saved with a UTF-8 byte order mark (Visual Studio, PowerShell 5.1 Set-Content -Encoding UTF8, "UTF-8 with BOM" in editors) failed to load: glob() threw DataCollectionEntryParseError ("Unexpected token ... is not valid JSON", the token being the invisible BOM) and file() logged "Error reading data" and dropped the whole collection.
• Strip a leading BOM before JSON.parse in the .json data entry type, and when the file() loader reads its file (so custom parsers, e.g. for a CSV exported from Excel, also get clean text).
• YAML/TOML entries and frontmatter (#12664) already accept a BOM, and so does Node's own require() of JSON.

Testing

Added unit tests for both loaders that write a BOM-prefixed JSON file to a temp dir; they fail without the change and pass with it. Also reproduced with a small Astro project: astro build fails before and renders both collections after.

Docs

No docs needed, bug fix.

I used Claude Code to write this change.

Changes

• String tag names (.astro dynamic tags, JSX, MDX) now go through one shared helper that renders only the leading valid element name, so characters like / or = can't change the generated markup.
• Strings that don't start with a valid element name (e.g. '!--', '') now throw instead of producing invalid HTML.

Testing

• New unit tests for the helper and the JSX renderer.
• Extended the dynamic tag fixture test with a / case.

Docs

• No docs needed.

This PR contains the following updates:

Package	Change	Age	Confidence
undici (source)	7.30.0 → 8.12.2

undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

CVE-2026-109869 / GHSA-xjj6-f33q-929c

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

CVE-2026-109841 / GHSA-f72v-6w45-q472

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

CVE-2026-109924 / GHSA-4qv8-2p9j-2685

undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

CVE-2026-109855 / GHSA-qq8j-7v2v-3rwp

undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

CVE-2026-109932 / GHSA-9fm3-97px-rjf6

undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 / GHSA-qrxm-fqhp-jwvm

undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

CVE-2026-109383 / GHSA-2m5v-pch6-74hx

undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

CVE-2026-109829 / GHSA-4w7w-5xrc-9h26

undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

CVE-2026-87029 / GHSA-55wc-3pg8-jfw6

Release Notes

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Changes

• Passes the issue author login to the needs-repro step through env: and reads it as $USER_LOGIN in the script.

Testing

• None, CI-only change.

Docs

• Not needed.

Fixes #18516.

When a second navigation starts before the previous view transition is ready, abortAndRecreateMostRecentTransition() calls skipTransition() on the pending transition. skipTransition() does not throw — it rejects viewTransition.ready with an AbortError. The try/catch around the call never covers that rejection, so it surfaces as an unhandled promise rejection in the browser console and fires any global unhandledrejection listener (error trackers, test runners).

The fix adds .catch(() => {}) on viewTransition.ready immediately before skipTransition(). This registers a handler for the rejection before it is created, silencing it. The stale comment ("might throw AbortError DOMException") is replaced with one that describes the actual behaviour.

The second navigation still completes normally — the only observable change is that the AbortError is no longer unhandled.

Changes

with fontProviders.npm({ remote: false }), unifont resolves installed font files to file:// URLs. the fonts pipeline only reads absolute paths from disk, so those URLs went to fetch() and dev and build failed with CannotFetchFontFile.

the npm provider now converts them to paths with fileURLToPath, same as the local provider, so they're read, hashed and watched as local files. this is the Astro side of #16218, the unifont side was fixed in August.

Testing

new case in providers.test.ts that installs a fake @fontsource package in a fixture, resolves it with remote: false and checks the font file comes back as an absolute path. fetch throws in that test, so it also covers that nothing goes to the network.

Docs

no docs change, this makes remote: false behave the way it's already documented.

This PR contains the following updates:

Package	Change	Age	Confidence
@netlify/blobs (source)	^11.1.4 → ^11.1.6
@netlify/functions (source)	^6.0.2 → ^6.0.3
devalue	^6.0.2 → ^6.0.3

Release Notes

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:

Package	Change	Age	Confidence
devalue	^6.0.2 → ^6.0.3
linkedom	^0.18.13 → ^0.18.14
preact (source)	^11.0.1 → ^11.0.2

Release Notes

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Changes

Fixes #18479.

Problem

When a component inside <body> calls Astro.csp.insertScriptHash(), its hash can be missing from the CSP <meta> tag because the tag is rendered before the component runs.

Layouts with <slot name="head" /> previously avoided this issue because asynchronous slot rendering buffered the body before the head was flushed. #17857 allowed synchronous slots to stay synchronous

Fix

For non-streaming renders, this PR delays generating the CSP <meta> tag until the whole page has rendered:

1. The head writes a placeholder comment where the CSP <meta> tag belongs.
2. After rendering completes, renderPage replaces the placeholder with the final tag, including hashes registered by body components.

This builds moves the replacement logic to renderPage so the fix covers both .astro and MDX pages.

Scope

This fix covers non-streaming renders. In streaming SSR, hashes registered after the head has been sent cannot be added to its CSP <meta> tag. A warning for those calls could be added in a follow-up.

Docs

No documentation changes are needed. The docs already describe using Astro.csp inside components.

Changes

• In astro dev, view-transition-name styles generated by transition:name are now correctly emitted when the component is only reachable through another component that has no styles, scripts, or CSS imports of its own. Previously, Menu.astro (which renders <Dot />) would stay propagation: 'none' because Dot.astro's metadata wasn't available yet at resolveId time, causing the transition scope style to arrive too late and be dropped from <head>.
• The transform hook in packages/astro/src/vite-plugin-head/index.ts now walks a module's importers (and their ancestors) and marks them in-tree when the transformed module carries self/in-tree propagation. This mirrors the full-graph analysis that astro build already performs, making dev behaviour consistent.

Testing

• New unit test added in packages/astro/test/units/vite-plugin-head/head-metadata.test.ts covering the case where a transition:name component is reached only through a non-propagating parent — verifying that the parent is correctly promoted to in-tree propagation after the child is transformed.

Docs

• No docs update needed; this is a dev-server-only bug fix with no API or behaviour changes visible to users beyond the bug being resolved.

Closes #18509

Changes

Adds .tif as an accepted image extension, next to .tiff. Tools like Lightroom and darktable export TIFFs as .tif, so those files currently have to be renamed before Astro treats them as images.

VALID_SUPPORTED_FORMATS is unchanged. It's checked against the detected format, which is still 'tiff', so image services see no difference.

ImageInputFormat is derived from VALID_INPUT_FORMATS, so it now also includes 'tif'. However, ImageMetadata.format is still 'tiff' at runtime, similar to 'jpeg' being detected as 'jpg'. Keeping 'tif' out of the type would need a separate extension list, which seemed like overkill for adding an alias.

Testing

• Integration (test/core-image.test.ts, supports .tif): a new fixture page imports a 2×3 .tif and renders it with <Image>. In dev, the test checks that format is 'tiff', that width/height are read from the file, and that the optimized src loads.
• Unit (test/units/assets/utils.test.ts): imageSrcToImportId (used for content collection images) returns an import ID for ./photo.tif, where it previously returned undefined.

Docs

Docs left unchanged. The astro:assets reference documents the possible values of ImageMetadata.format, and TIFF images report 'tiff' at runtime regardless of extension.

Changes

• <ClientRouter /> now passes behavior: 'instant' to all scroll-restore scrollTo calls in moveToLocation() and on page reload. Previously, omitting behavior caused these calls to inherit CSS scroll-behavior: smooth, producing a visible animated scroll to the saved position on back/forward navigation. The browser restores scroll instantly in the same scenario, so this brings <ClientRouter /> in line with native behavior.
• Anchor (#hash) navigation is unaffected because it does not go through these scrollTo calls.

Testing

• Added an e2e test in packages/astro/e2e/view-transitions.test.ts covering back/forward scroll restoration with scroll-behavior: smooth applied to html. The test asserts that scrollY reaches the saved position in at most one animation frame (i.e., no intermediate animated values).

Docs

• No docs update needed; this is a bug fix that aligns <ClientRouter /> with existing browser behavior, not a new option or API.

Closes #18505

Changes

• <Picture> no longer emits a duplicate 1x candidate in <source> srcset when densities includes 1. Previously, the component always prepended a plain (descriptorless, implicitly 1x) image.src to the srcset, and then getSrcSet would also produce an explicit 1x entry for the same URL, resulting in invalid markup (X, X 1x, Y 2x).
• The plain base candidate is now added only when the srcset does not already contain a 1x entry. This preserves existing behavior for densities={[2]} (the base candidate is still included as the implicit 1x fallback) while eliminating the duplicate when densities={[1, 2]}.

Testing

• Added a fixture case in packages/astro/test/core-image.test.ts asserting that densities={[1, 2]} produces exactly 1x, 2x in the <source> srcset with no extra descriptorless candidate. The test fails without the fix and passes with it.

Docs

• No docs update needed; this is a bug fix for invalid HTML output with no API changes.

Closes #18501

astro build was resetting the last-modified date on two classes of output files.

Root cause 1, public/ directory. Vite copies the public directory internally and does not forward mtime or atime. Every copied file ends up with the build timestamp rather than the source timestamp.

Root cause 2, Font files. The font plugin wrote fonts from an in-memory Buffer via writeFileSync, which always creates a fresh file with the current timestamp. The disk cache already held the font with the correct source mtime, but it was never consulted at write time.

What changed.

• packages/astro/src/core/fs/index.ts: Added copyTimestamps(srcDir, destDir). It walks srcDir recursively and for each file calls fs.promises.utimes(destFile, atime, mtime) to copy the timestamp from the source tree. Files missing in destDir (e.g. files filtered by Vite) are silently skipped via ENOENT handling.

• packages/astro/src/core/build/static-build.ts: After the client bundle build, calls copyTimestamps(settings.config.publicDir, outDir) to restore source timestamps on all public/ files.

• packages/astro/src/assets/fonts/vite-plugin-fonts.ts: Changed font copying to call fontFetcher.fetch() (which populates the disk cache), then copyCachedFile(cacheFile, destFile) instead of writeFileSync(destFile, data). copyCachedFile already calls utimes after copying, so the cache mtime is preserved end-to-end. Dropped the unused writeFileSync import.

Verified. Logic confirmed by code review. The copyTimestamps helper mirrors the existing copyCachedFile pattern already used in the image pipeline. The font-path change has the same observable behavior since fontFetcher.fetch() always caches before returning.

Fixes #18483

🤖 Generated with Claude Code

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@astrojs/starlight@0.42.8

Patch Changes

• #4295 af9557e Thanks @delucis! - Fixes a formatting issue in some error messages impacting projects with Zod ≥4.5 installed

• #4299 a103f38 Thanks @clean99! - Fixes empty sidebars when autogenerating entries from the docs root directory using directory: ''

Changes

• baseService.getSrcSet() now removes duplicate density values before building srcset candidates. Previously, equivalent inputs like [1, '1x', 2] or [1, 1, 2] produced duplicate descriptors (e.g. 1x, 1x, 2x), violating the HTML spec's prohibition on duplicate density descriptors.
• The fix wraps the parsed density values in Array.from(new Set(...)) before sorting, matching the deduplication already applied to the widths branch of the same function. Only the emitted markup changes — no extra image files are generated.

Testing

• New unit test cases added to packages/astro/test/units/assets/getImage.test.ts covering mixed numeric/string duplicates ([1, '1x', 2]), repeated numbers ([1, 1, 2]), and repeated strings (['1x', '1.0x', 2]), asserting that each density produces exactly one srcset candidate.

Docs

• No docs update needed; this is a bug fix for undocumented internal deduplication behavior.

Closes #18496

Description

This PR cherry picks a change from #4218 (comment) which is also needed in #4175 so we can land it independently of those two PRs.

Changes

• Failed fetch() calls in the generated server island client script no longer surface as Uncaught (in promise) TypeError. Previously, when a fetch rejected (network drop, aborted navigation, blocked cross-origin redirect), the top-level await in the island module would throw unhandled, polluting error trackers even though the fallback content remained visible. Both the GET and POST island fetch calls now append .catch(() => {}), and replaceServerIsland returns early on a missing response or a failed r.text() read, keeping the fallback silently.
• The return statement suggested in the issue cannot be used at module top-level; the .catch(() => {}) approach achieves the same effect without a syntax error.

Testing

• Extended packages/astro/test/units/server-islands/server-islands-render.test.ts to cover the case where fetch rejects, asserting that no error is thrown and the fallback content is preserved.

Docs

• No docs update needed; this is an internal error-handling fix with no new public API or configuration surface.

Closes #18495

Changes

• Astro 7.4.2 raised the Node.js minimum to >=22.23.4 for a security patch release, which broke StackBlitz WebContainers (stuck on Node 22.22.3 with no user control). Every astro command now exits with "Node.js is not supported" on StackBlitz, which is the official reproduction path via astro.new.
• Restores the WebContainer exception introduced in #15264: when process.versions.webcontainer is set, the CLI uses >=22.22.0 instead of >=22.23.4. Normal Node.js installations keep the stricter security minimum unchanged.

Testing

• No automated tests were added. The version check lives in top-level code in bin/astro.mjs with no importable surface, and CI's Node versions (22.23.4 and 24) can't reproduce the failure path. The fix was verified by simulating process.versions.webcontainer against the version satisfier.

Docs

• No docs update needed; this is a CLI compatibility guard with no user-facing API change.

Closes #18492

Changes

• Unused Astro components imported through a barrel file no longer contribute their scoped CSS to the bundle. In Rolldown (Astro 7), $$createComponent calls were not treated as pure, so Rolldown marked the component's default export as rendered even when nothing on the page actually used it — causing Vite's cssScopeTo tree-shaking to keep the associated CSS. Setting treeshake.manualPureFunctions: ['$$createComponent'] in the Rolldown options lets Rolldown drop those unused exports and Vite then drops their scoped styles.
• User-supplied treeshake options are merged in so custom configurations are preserved; treeshake: false is left untouched.

Testing

• A new unit test in packages/astro/test/units/build/vite-build-config.test.ts checks that $$createComponent appears in manualPureFunctions in the generated Rolldown options.
• The existing barrel-styles integration fixture (packages/astro/test/fixtures/0-css/.../barrel-styles) gains a new assertion in packages/astro/test/0-css.test.ts covering components whose frontmatter references Astro.self, which is the pattern that triggered the regression.

Docs

• No docs update needed; this is an internal build-config fix with no user-facing API changes.

Closes #18491

Changes

Add diagnostic reporters to astro check for terminal output, scripts, and CI artifacts. Following Biome's reporter flags, --reporter selects how diagnostics and the run summary are written. Reports go to stdout unless an adjacent --reporter-file selects a file.

# JSON on stdout
npx astro check --reporter=json

# SARIF file only
npx astro check --reporter=sarif --reporter-file=reports/astro.sarif

# Live terminal diagnostics and a SARIF file
npx astro check --reporter=default --reporter=sarif --reporter-file=reports/astro.sarif

Supported formats are default, json, sarif, junit, and checkstyle. Repeat reporter/file groups for multiple outputs; a file flag without an adjacent reporter selects default plain text. Existing commands without reporter flags keep their default output.

• Route Astro startup, telemetry notification, and sync logs to stderr when there is no default stdout reporter. Suppress default diagnostics, summaries, and watch control sequences in structured output. Node and JSON logger handlers accept an explicit output stream.
• Preserve diagnostic codes, source locations, severity filtering, and exit status. JSON uses a documented versioned structure; SARIF uses UTF-16 columns and encoded file URIs. Each JUnit report contains one test whose failure follows the full results and --minimumFailingSeverity.
• Resolve file paths from the working directory, create missing parent directories, and overwrite after completed checks. Cancelled or superseded checks preserve the previous report; report files are excluded from watching. Structured watch stdout emits consecutive completed report documents.
• Expose a reporters array in the JavaScript API, plus reporter/reporterFile for a single output. Include a minor changeset for @astrojs/check and a patch changeset for Astro's CLI integration.

Docs

I've updated package README and linked reporting guide cover formats, stdout/file routing, repeated flags, JSON structure, severity mappings, CLI/API usage, paths, watch mode, and failures. CLI help is generated from the options.

The website CLI reference needs the corresponding options documented before release.

Fixes #18487

When CSP meta tags are on, createResult hashed children for every head style and script. External stylesheets and module scripts are stored as { props: { href|src }, children: '' }, so every page got 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' (the SHA-256 of the empty string) in script-src and style-src.

A hash in those directives makes 'unsafe-inline' ignored, so a project that relied on it for inline styles or scripts would lose that without asking.

Only entries with actual inline content (and no href/src) are hashed now.

Test plan

• Unit test: external stylesheet + hoisted script with empty children do not emit the empty-string hash

Description

• Closes #4289
• With lastUpdated enabled, production builds read file names from git log --name-status. Git quotes and octal-escapes file names that contain non-ASCII characters by default (core.quotePath), for example "caf\303\251.md" for café.md. These names never matched the page file paths, so pages such as zh-cn/指南.md rendered without a last updated date. The development server was not affected.
• This PR runs the command with -c core.quotePath=false so git prints these file names verbatim.
• The existing getAllNewestCommitDate tests now include a file with non-ASCII characters in its name. Both tests fail without the fix and pass with it.
• No visual changes.

Summary

• Apply host validation to Astro development request handling.
• Fall back to the local host when allowedDomains is absent, empty, or the incoming host fails validation.
• Add unit and integration tests for development host handling.

Validation

The Phase 6 report records the following results:

• Unit tests: 13/13 passed.
• Integration tests: 6/6 passed.
• Biome check: passed.
• Type checks: passed.
• Staged diff whitespace check: passed.

These results are based on the recorded local validation report.

Scope and limitations

This change is proposed as defense in depth / hardening. The current evidence does not establish a confirmed exploitable vulnerability, CVE, zero-day, or bounty eligibility.

The change is submitted for maintainer review. Compatibility implications for custom development hosts should be considered, particularly when allowedDomains is not configured.

No merge or release is requested as part of this submission.

Changes

• Fixes duplicate React.useId() values when experimentalDisableStreaming is enabled. renderToString was called without the per-component identifierPrefix, so every component started from the same id, and islands hydrated with a prefix the server HTML did not have.
• Passes the existing renderOptions to renderToString, as the streaming paths already do. #6976 added the prefix for #6849 before the option from #13036 existed.

Testing

• Adds react-disable-streaming.test.ts with a fixture that renders a useId component twice statically and twice with client:idle. It checks that the ids are unique and that each island id contains the island's prefix.

Docs

• No docs update needed, because the option and its documented behavior do not change.

Fixes #18498

Changes

Telemetry did a blocking git call on startup, causing pretty much every astro command to be 15-200ms slower than it should. This is specifically noticeable for astro dev.

Testing

Manually

Docs

N/A

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

astro@7.4.3

Patch Changes

• #18488 e4e25fa Thanks @umeraamir69! - CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string into script-src and style-src.

• #18500 e5a3a1b Thanks @astro-factory! - Fixes <Image> and <Picture> emitting duplicate srcset candidates when densities contains equivalent values such as 1 and '1x'

• #18517 c3185b7 Thanks @okxint! - Fix unhandled AbortError rejection when ClientRouter skips a pending view transition

• #18497 c712113 Thanks @astro-factory! - Fixes an uncaught TypeError in the browser when a server:defer island request fails due to a network error. The fallback content is kept, as it is for non-200 responses.

• #18525 d0240b9 Thanks @astro-factory! - Fixes a DEP0190 deprecation warning printed by astro info on Node.js 24 and later

• #18511 d060ff9 Thanks @astro-factory! - Fixes transition:name styles missing in dev when the element is inside a component that is only rendered through another component with no styles or scripts

• #18494 5fe699c Thanks @astro-factory! - Fixes the astro CLI refusing to run on StackBlitz by allowing Node.js >=22.22.0 inside WebContainers, whose Node.js version users cannot change

• #18506 bf43a60 Thanks @astro-factory! - Fixes <ClientRouter /> animating scroll restoration on back/forward navigation when scroll-behavior: smooth is set. Saved scroll positions are now restored instantly, matching the browser's native behavior.

• #18476 8ea79a2 Thanks @astro-factory! - Fixes a DataCloneError crash when building pages that render SVG imports with <Image /> or getImage() while experimental.parallelPrerender is enabled.

• #18504 6dbd737 Thanks @astro-factory! - Fixes <Picture> emitting a duplicate 1x candidate in <source> srcset when densities includes 1

• #18524 7524889 Thanks @astro-factory! - Fixes type errors reported in Astro's built-in <Image />, <Picture />, <Code />, <Debug /> and <ClientRouter /> components when type-checking a project that extends astro/tsconfigs/strictest with tsc and @astrojs/ts-content-mapper

• #18493 3773941 Thanks @astro-factory! - Fixes scoped styles of unused Astro components being included in the build when those components are re-exported from a barrel file

• #18512 1151b9e Thanks @jp-knj! - Fixes CSP hashes added with Astro.csp from components rendered inside <body> being left out of the CSP <meta> element in static builds, including MDX pages

• Updated dependencies [6cf3423, edfbf4a]:

  • @astrojs/telemetry@3.4.2
  • @astrojs/markdown-satteri@0.4.6

@astrojs/prism@4.1.2

Patch Changes

• edfbf4a Thanks @matthewp! - Fixes Prism code blocks for languages Prism doesn't support, such as vue or svelte. Their code is now displayed as plain text instead of being rendered as HTML. Also correctly escapes the code block language in the generated class and data-language attributes.

@astrojs/cloudflare@14.4.3

Patch Changes

• #18526 d0504c2 Thanks @astro-factory! - Fixes process is not defined errors in client-side scripts and islands that reference process.env. The adapter's process.env define now applies only to the server output, so browser builds get Vite's default replacement.
• Updated dependencies []:
  • @astrojs/underscore-redirects@1.0.4

@astrojs/markdoc@2.1.2

Patch Changes

• edfbf4a Thanks @matthewp! - Fixes Prism code blocks for languages Prism doesn't support, such as vue or svelte. Their code is now displayed as plain text instead of being rendered as HTML. Also correctly escapes the code block language in the generated class and data-language attributes.
• Updated dependencies [edfbf4a]:
  • @astrojs/prism@4.1.2

@astrojs/mdx@8.1.2

Patch Changes

• Updated dependencies [edfbf4a]:
  • @astrojs/markdown-satteri@0.4.6

@astrojs/react@7.1.2

Patch Changes

• #18482 9c88994 Thanks @wrostomMM! - Fixes duplicate React.useId() values across components when experimentalDisableStreaming is enabled

@astrojs/solid-js@7.1.2

Patch Changes

• 290b196 Thanks @matthewp! - Escapes slot names when rendering the slot wrapper elements for Solid components

@astrojs/svelte@9.1.2

Patch Changes

• 5e47636 Thanks @matthewp! - Escapes slot names when rendering the slot wrapper elements for Svelte components

@astrojs/vercel@11.0.17

Patch Changes

• #18085 785473b Thanks @nikolas-sapa! - Fix redirects never matching on Vercel when trailingSlash: 'always' is set. Redirect sources now include the trailing slash so they match the normalized request path. Sources whose last segment contains a dot are left unslashed, and dynamic or spread sources emit both the slashed and unslashed form, because Vercel only normalizes paths without a dot.

@astrojs/markdown-remark@7.3.5

Patch Changes

• edfbf4a Thanks @matthewp! - Fixes Prism code blocks for languages Prism doesn't support, such as vue or svelte. Their code is now displayed as plain text instead of being rendered as HTML. Also correctly escapes the code block language in the generated class and data-language attributes.
• Updated dependencies [edfbf4a]:
  • @astrojs/prism@4.1.2

@astrojs/markdown-satteri@0.4.6

Patch Changes

• edfbf4a Thanks @matthewp! - Fixes Prism code blocks for languages Prism doesn't support, such as vue or svelte. Their code is now displayed as plain text instead of being rendered as HTML. Also correctly escapes the code block language in the generated class and data-language attributes.
• Updated dependencies [edfbf4a]:
  • @astrojs/prism@4.1.2

@astrojs/telemetry@3.4.2

Patch Changes

• #18481 6cf3423 Thanks @Princesseuh! - Avoids blocking Astro commands while looking up the anonymous project ID, by running git asynchronously. Events recorded at the same time now share a single lookup.

Changes

• SVG imports are Astro component functions with image metadata attached. When experimental.parallelPrerender is on, the prerender worker sends collected static-image transforms to the main thread via postMessage, which uses structured cloning — functions cannot be cloned, causing a DataCloneError. resolveStaticImage() now detects when transform.src is a function (i.e. an SVG component) and replaces it with a plain-object copy of the metadata before recording the transform, making the value serializable without changing the data the image service receives.

Testing

• Added a unit test in packages/astro/test/units/assets/static-images.test.ts covering the case where an SVG component function is passed as src, asserting that the recorded transform stores a plain object rather than the original function.

Docs

• No docs update needed; this is a bug fix for an experimental feature with no API surface change.

Closes #18426

Changes

Bumps the minimum version of Node.js to 22.23.4

Reference https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Testing

Green CI

Docs

withastro/docs#14761

Changes

Tries to make our life easier when it comes to PRs:

• Adds a workflow that closes open pull requests when another pull request fixes every issue they close.
• Runs after a merge and on a weekly sweep, so duplicates opened before this workflow are cleaned up too.
• Skips drafts, pull requests from maintainers, and pull requests that also fix issues the merged change does not.
• Comments with the merged fix and a path to reopen.

Testing

• Ran the merge handler against #18419, which closed the duplicate #18358.
• Ran the sweep against the live repository, which found #18064, #18324, #18338, #18358, and #18369.
• Exercised pagination, deleted authors, reopened issues, partial supersets, permission failures, and state races with a stub harness.
• zizmor --min-severity high --min-confidence high reports no findings.
• Biome and Prettier checks pass.

Docs

No documentation changes. This is repository automation.

AI was used to write this change.

Changes

• Running astro sync, astro check, or astro build while astro dev is active no longer wipes out the running dev server's node_modules/.vite/deps_ssr, preventing 500 errors on the next HMR reload.
• cfPrismPlugin now checks the adapter's isTypeGenPhase flag before appending include: ['prismjs/components/prism-*.js'] to the SSR environment's optimizeDeps. During type generation, the Prism glob is omitted so Vite honours the noDiscovery: true, include: [] opt-out and never re-runs the optimizer against the shared cache directory.

Testing

• Added packages/integrations/cloudflare/test/typegen-phase.test.ts, which verifies that cfPrismPlugin does not inject the Prism include entries when isTypeGenPhase is true, and does inject them during normal dev/build phases.

Docs

• No docs update needed; this is a bug fix with no API surface change.

Closes #18464

Changes

• @astrojs/upgrade [version] now pins packages to the requested exact version instead of silently falling back to latest. resolveTargetVersion() previously only checked the argument against npm dist-tags; an exact semver like 7.3.8 never matched, so the CLI always resolved to latest with no warning.
• The fix consults the versions map already present in the npm metadata. If the argument is a published version of a package, that version is used with no ^. Packages that never published that version (e.g. @astrojs/* integrations with their own version schemes) still fall back to ^latest, preserving existing behaviour.

Testing

• New test cases added to packages/upgrade/test/verify.test.ts covering: exact version resolves correctly, unknown version falls back to latest, and dist-tag arguments continue to work.

Docs

• No docs update needed; the [version] parameter was already advertised in the CLI help text — the fix makes the implementation match the documented behaviour.

Closes #18420

Changes

• Fixes astro dev rendering prerendered pages through productionEnvironment (instead of the dev render environment) when a custom src/fetch.ts is used with @astrojs/cloudflare and prerenderEnvironment: "node". This caused pages with hoisted <script> tags or hydrated islands to be truncated with Unable to resolve [...] errors.
• The Cloudflare adapter no longer adds Astro core packages (astro, astro/fetch, astro/app, etc.) to optimizeDeps.include for the Node prerender environment. Previously those entries caused Vite to bundle a separate copy of those modules in node_modules/.vite/deps_prerender, giving new FetchState(request) its own empty copy of the environments WeakMap and making it fall back to productionEnvironment. The workerd prerender environment retains its include list unchanged.

Testing

• Adds a test in packages/integrations/cloudflare/test/typegen-phase.test.ts covering the case where prerenderEnvironment: "node" is combined with a custom src/fetch.ts, asserting that the dev server renders the full page without Unable to resolve errors.

Docs

• No docs update needed; this is a dev-server rendering correctness fix with no change to public API or configuration options.

Closes #18457

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated.

⚠️⚠️⚠️⚠️⚠️⚠️

next is currently in pre mode so this branch has prereleases rather than normal releases. If you want to exit prereleases, run changeset pre exit on next.

⚠️⚠️⚠️⚠️⚠️⚠️

Releases

@astrojs/cloudflare@15.0.0-beta.3

Patch Changes

• #18462 f170236 Thanks @ematipico! - Updates the @cloudflare/vite-plugin to the latest. The dependency isn't pinned anymore.

Changes

• sharpImageService({ ...options }) options are now preserved when the Cloudflare adapter's imageService: 'compile' mode replaces the build service. Previously, hasUserImageService() returned false for Sharp (no runtime key), causing the adapter to substitute a bare { entrypoint: 'astro/assets/services/sharp' } build service with no config, silently dropping user-supplied options like avif.effort.
• The fix copies the user's Sharp config into the generated build service: build: { ...COMPILE_BUILD_IMAGE_SERVICE, config: getRuntimeImageService(config.service).config }. This restores the behavior present in adapter 14.3.3.

Testing

• Adds a unit test in packages/integrations/cloudflare/test/image-config.test.ts covering the case where sharpImageService() is configured with options and imageService: 'compile' is set, asserting that the resolved build service retains the user's config.

Docs

• No docs update needed; this is a bug fix restoring previously documented behaviour, with no API changes.

Closes #18437

Changes

Dirty hack to skip the sleep, all this code will go to waste anyway when we have TS7 support.

Fix #18310

Testing

Added tests

Docs

N/A

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

astro@7.4.2

Patch Changes

• #18430 dda9ec3 Thanks @Abhirup-99! - Speeds up content sync with experimental.collectionStorage: "chunked" by computing each character's UTF-8 width from its code point instead of encoding every character through TextEncoder. On a store of ~44k entries this cuts the chunking step from about 60 seconds to well under a second, with byte-identical output.

• #18438 5e0eaa4 Thanks @astro-factory! - Fixes astro dev with @astrojs/cloudflare failing with Calling `require` for "node-fetch" when a server dependency such as cross-fetch requires node-fetch

• #18376 a4e201d Thanks @okxint! - Fixes astro dev treating a stale lock file containing a Linux thread ID as a running Astro server. A successful process lookup with no matching PID now marks the lock as stale, preventing astro dev stop and astro dev --force from killing the unrelated process that owns the thread.

• #18467 d1fb7d3 Thanks @astro-factory! - Fixes the defineConfig() types for i18n.defaultLocale, i18n.fallback, and i18n.domains so they accept a custom locale's path instead of its codes, matching how Astro validates and uses these values

• #18475 cf27e70 Thanks @ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

  This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

• #18451 7a0ba6f Thanks @DenisCDev! - Fixes astro sync, astro check and astro build replacing the optimized dependencies of a dev server running in the same project, which broke framework islands in that dev server until it was restarted with --force

• #18336 e943003 Thanks @astro-factory! - Fixes inline styles in dev so that framework-transformed CSS is used, such as scoped styles and v-bind() in Vue single-file components

• #18399 829fc00 Thanks @astro-factory! - Fixes a dev server error (Could not find server component name) for a server:defer island that imports astro:actions or astro:config/server, when its page was not the first island page loaded after starting the server

• #18330 4db9e0d Thanks @Samuteg! - Fixes the astro:env/server virtual module being generated with invalid JS in dev when any environment variable contains $ replacement patterns ($`, $&, $', $1, …). The inlined env JSON was passed as a string to String.replace, so e.g. the KITTY_PUBLIC_KEY value set by default in Kitty terminals corrupted the module and broke dev with Failed to parse source for import analysis

• Updated dependencies [cf27e70]:

  • @astrojs/telemetry@3.4.1
  • @astrojs/markdown-satteri@0.4.5

@astrojs/prism@4.1.1

Patch Changes

• #18475 cf27e70 Thanks @ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

  This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

create-astro@5.3.1

Patch Changes

• #18475 cf27e70 Thanks @ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

  This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

@astrojs/cloudflare@14.4.2

Patch Changes

• #18422 07700d4 Thanks @cyface! - Fixes the /_image endpoint returning a 500 error when href points to a missing file or a file that isn't an image. It now responds with a 404 or 400 instead.

• #18465 f31f143 Thanks @astro-factory! - Fixes a custom src/fetch.ts rendering truncated pages without islands or hoisted scripts in astro dev when prerenderEnvironment: 'node' is set

• #18461 8b77891 Thanks @astro-factory! - Fixes options passed to sharpImageService() being ignored when generating images at build time with imageService: 'compile'

• #18468 119263a Thanks @astro-factory! - Fixes astro sync, astro check, and astro build overwriting the dependency cache of a running astro dev server, which caused it to fail with "The file does not exist ... in the optimize deps directory" errors

• Updated dependencies []:

  • @astrojs/underscore-redirects@1.0.4

@astrojs/markdoc@2.1.1

Patch Changes

• #18475 cf27e70 Thanks @ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

  This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

• Updated dependencies [cf27e70]:

  • @astrojs/prism@4.1.1

@astrojs/mdx@8.1.1

Patch Changes

• #18475 cf27e70 Thanks @ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

  This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

• Updated dependencies []:

  • @astrojs/markdown-satteri@0.4.5

@astrojs/partytown@2.1.9

Patch Changes

• #18439 3e80f04 Thanks @hanford! - Updates Partytown to 1.0.1, which preserves queued events when falling back to the main thread with dataLayer.push forwarded using preserveBehavior.

@astrojs/preact@6.1.1

Patch Changes

• #18475 cf27e70 Thanks @ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

  This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

@astrojs/react@7.1.1

Patch Changes

• #18475 cf27e70 Thanks @ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

  This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

@astrojs/solid-js@7.1.1

Patch Changes

• #18475 cf27e70 Thanks @ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

  This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

@astrojs/svelte@9.1.1

Patch Changes

• #18475 cf27e70 Thanks @ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

  This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

@astrojs/vue@7.1.2

Patch Changes

• #18475 cf27e70 Thanks @ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

  This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

@astrojs/check@0.9.12

Patch Changes

• #18455 7af66fc Thanks @astro-factory! - Fixes the astro-check binary ignoring its first two command-line arguments, so flags such as --help, --root, --watch, and --tsconfig are respected again. If your scripts padded the arguments to work around this (for example, astro-check -- -- --tsconfig ./tsconfig.app.json), remove the padding.
• Updated dependencies [044148d]:
  • @astrojs/language-server@2.17.3

@astrojs/language-server@2.17.3

Patch Changes

• #18460 044148d Thanks @Princesseuh! - Speeds up astro check by skipping a 10 ms editor-cancellation wait that ran before checking each file

@astrojs/markdown-remark@7.3.4

Patch Changes

• Updated dependencies [cf27e70]:
  • @astrojs/prism@4.1.1

@astrojs/markdown-satteri@0.4.5

Patch Changes

• Updated dependencies [cf27e70]:
  • @astrojs/prism@4.1.1

@astrojs/telemetry@3.4.1

Patch Changes

• #18475 cf27e70 Thanks @ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

  This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

@astrojs/upgrade@0.8.1

Patch Changes

• #18475 cf27e70 Thanks @ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

  This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

• #18466 d7f5c54 Thanks @astro-factory! - Fixes @astrojs/upgrade [version] ignoring an exact version number (for example npx @astrojs/upgrade 7.3.8) and upgrading to the latest release instead

Changes

• bin/astro-check.js was passing process.argv.slice(2) to parseArgsAsCheckConfig(), which already calls yargs' hideBin() internally — stripping two more entries. This caused the first two user-supplied arguments to be silently ignored (e.g. astro-check --help ran diagnostics instead of printing help, and astro-check --root src ignored --root). The binary now passes the full process.argv, matching how parseArgsAsCheckConfig() is documented and how the astro check CLI caller works.
• The packages/astro build script used astro-check -- -- --tsconfig ... as a padding workaround to compensate for the double-strip. That padding is removed now that the binary handles argv correctly; users with the same workaround in their own scripts should drop it too (noted in the changeset).

Testing

• Added packages/language-tools/astro-check/test/bin.test.ts, which spawns the built binary with --help and asserts it exits successfully and prints help output. This test fails without the fix and passes with it.

Docs

• No docs update needed; this is a bug fix restoring already-documented behavior for --root, --watch, --tsconfig, and --help.

Closes #18454

Description

• Closes #
• Manual sidebar links such as { label: 'Tabs', link: '/guides/components/#tabs' } are run through formatPath(), which adds the trailing slash or .html extension to the end of the whole string. With trailingSlash: 'always' this produces /guides/components/#tabs/, and with build.format: 'file' it produces /guides/components/#tabs.html, so the link no longer targets the section.
• formatPath() now splits off any ?query or #hash suffix, formats only the pathname as before, and appends the suffix back. Links without a query or hash are unchanged.
• Added cases to __tests__/basics/format-path.test.ts covering hashes and query strings for directory with always and never, and for file. They fail on main and pass with this change. The full packages/starlight unit suite passes.
• Includes a patch changeset.

Fixes #4286

Description

• Closes #

Was pretty simple so went straight to PR. Let me know if you'd prefer an issue.

• What does this PR change? Give us a brief description.

The PR adds fetchpriority=high to hero images, along with the loading=eager and decode=async that already exist.

Fetchpriority improves loading time of key resources on the page as discussed here: https://web.dev/articles/fetch-priority and hero images are most likely to be the LCP image so are exactly the types of resources that benefit from this.

Full disclosure I work on the Chrome team and maintain the above doc, but this is available in all modern browsers (caniuse, MDN). Happy to answer any questions on this feature (or anything else in web performance space).

Neither the existing loading not decode are configurable, nor are the documented (presumably cause they are not configureable?) so I followed that implementation here. Happy to make it configurable instead and/or document this (and the others) if you prefer.

• Did you change something visual? A before/after screenshot can be helpful.

No. This merely provides a slight performance boost to Hero images.

Changes

• astro sync (also run by astro check and astro build) creates a temporary Vite server with optimizeDeps: { noDiscovery: true }. Astro itself (dev toolbar deps) and integrations such as @astrojs/react and @astrojs/preact add optimizeDeps.include entries, so Vite still runs the dependency optimizer on that server. It wrote to the project's default Vite cache, node_modules/.vite, which is the cache a running astro dev reads from. The dev server's optimized dependencies were replaced with ones built by the temporary server, for example React's production jsx-dev-runtime where jsxDEV is undefined, and islands broke with _jsxDEV is not a function or Invalid hook call until the dev server was restarted with --force.
• The temporary server now uses its own Vite cacheDir, <cacheDir>/vite-sync/ under Astro's cacheDir. It optimizes the same dependencies as before and plugins see the same config; only where the output is written changes.

Fixes #18449

Testing

• Added a test to test/astro-sync.test.ts. It writes a placeholder node_modules/.vite/deps/_metadata.json (standing in for a running dev server's cache) into a fixture that no other test starts a dev server on, runs sync, and asserts the file is unchanged. Without the change in sync/index.ts it fails, because sync replaces the placeholder with its own optimizer metadata. With the change, pnpm -C packages/astro exec astro-scripts test "test/astro-sync.test.ts" passes 10/10.
• Checked the same change against the reproduction from #18449 (astro 7.4.0 + @astrojs/react): with astro dev running, node_modules/.vite/deps is no longer modified by astro sync, astro check or astro build, and sync's output goes to node_modules/.astro/vite-sync/deps.

Docs

No docs change. There is no API or config change; the only visible effect is a vite-sync directory inside Astro's cacheDir.

Changes

• The --preserveWatchOutput description in @astrojs/check previously said "If set to false, output won't be cleared between checks in watch mode" — the opposite of the flag's actual behavior. The runtime code clears the terminal when the flag is false (default) and preserves output when true, so only the help string was wrong. Changed "false" to "true" in the description.
• No behavior change; only the text shown by astro check --help is affected.

Testing

• No test changes. The existing test/parseArgs.test.ts already covers flag parsing behavior, and the change is limited to a static help string with no logic impact.

Docs

• No docs update needed; the change corrects inline CLI help text rather than user-facing documentation.

Closes #18443

Changes

• astro check --watch no longer exits immediately when the project is located in a directory whose name contains node_modules or .git. Previously, chokidar's ignored callback matched against the absolute path, so any project root containing those substrings was immediately excluded from watching, leaving nothing to keep the process alive.
• Adds a isInIgnoredDirectory(rootPath, filePath) helper that only checks path segments relative to the watched root, so only real <root>/node_modules and <root>/.git sub-directories are ignored — not the root itself or unrelated paths like .github.

Testing

• Adds packages/language-tools/astro-check/test/watch.test.ts, covering that watch mode stays alive when the project path contains node_modules and that actual node_modules/.git sub-directories inside the project are still excluded.

Docs

• No docs update needed; this is a bug fix for an internal path-filtering predicate with no user-facing API change.

Closes #18442

This PR contains the following updates:

Package	Change	Age	Confidence
@playwright/test (source)	1.64.0 → 1.64.1

Release Notes

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:

Package	Change	Age	Confidence
devalue	^6.0.2 → ^6.0.3
fastify (source)	^5.12.5 → ^5.12.7

Release Notes

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Changes

Raises the minimum Partytown version from ^1.0.0 to ^1.0.1, the latest stable release, following #18375.

Partytown 1.0.1 fixes a fallback that could discard queued analytics events: when dataLayer.push is forwarded with preserveBehavior, falling back to the main thread keeps the existing dataLayer and its events. It also avoids the deprecated fenced-frame API warning. See the release notes and fallback fix.

Updating the minimum ensures existing lockfiles cannot retain 1.0.0. Includes the lockfile update and a patch changeset so the integration can publish these fixes.

Testing

• pnpm install --frozen-lockfile --ignore-scripts
• pnpm build — all 33 tasks passed, including the integration typecheck.
• pnpm -C packages/astro exec astro-scripts test 'test/ssr-partytown.test.ts' --strip-types — both tests passed, covering SSR script injection and worker assets in the manifest.
• pnpm -C packages/integrations/partytown exec publint
• pnpm format and pnpm lint:ai — passed; the existing language-server test fixture still emits its noConsole warning.
• pnpm exec changeset status confirms a patch release for @astrojs/partytown.

No new tests added for this dependency-only update. The fallback regression is covered upstream in QwikDev/partytown#790; the existing Astro tests check integration compatibility.

Docs

No configuration or API changes. The patch changeset describes the fix for the release notes.

Changes

• astro dev with the Cloudflare adapter no longer crashes with Calling \require` for "node-fetch"when a CJS dependency (e.g.cross-fetch) requires node-fetchat load time. Vite now bundlesnode-fetchinto the optimized dep instead of leaving it as a bare externalrequire` call that workerd cannot resolve.
• Removes 'node-fetch' from the hard-coded optimizeDeps.exclude list applied to server environments when dependency discovery is enabled (noDiscovery === false). The exclude was a leftover from the Environment API refactor (#14306) — it previously lived in the top-level client optimizeDeps config and was never intended for workerd ssr environments.

Testing

• Adds a unit test in packages/astro/test/units/vite-plugin-environment/server-entries.test.ts covering that node-fetch is no longer excluded from optimizeDeps for server environments with discovery enabled.

Docs

• No docs update needed; this is a bug fix restoring behavior that previously worked on Astro 6 / Vite 7.

Closes #18436

Changes

• @astrojs/upgrade now reads the package manager's release age policy (npm min-release-age, pnpm minimum-release-age).
• It installs the newest version old enough instead of always pinning the newest. Before, the install failed when the policy blocked the newest version.
• If nothing newer than the installed version is allowed yet, the package is reported as up to date.
• Dist-tags (e.g. beta) are respected. It never moves past the tag's version, and prereleases are only considered when the target is one.
• Fetches the full package metadata once per package, and only when a policy is set.
• Changeset included.

Known limitations / not in this PR

• Yarn and Bun are not detected yet. They behave as before: the newest version is pinned, and the install fails with the generic "run manually" message if their policy blocks it.
• pnpm's existing minimumReleaseAge error message in install.ts is unchanged. It remains as a fallback for cases where detection misses the policy. It matches on a plain MINIMUM_RELEASE_AGE substring without checking the package manager name. That is pre-existing and left alone here; a ctx.packageManager.name === 'pnpm' guard would be a small follow-up.
• Transitive dependencies are not checked. The package manager resolves their ranges against the policy itself, and dependencies of an old-enough version should also be old enough. Peer dependency mismatches between packages pinned to different versions are not handled and have not been tested.

Testing

Added unit tests in packages/upgrade/test/verify.test.ts:

• resolveTargetVersion: newest version is kept when old enough, an older allowed version is picked when it isn't, dist-tags are not passed, the installed version is kept when nothing newer is allowed, and publish times are ignored with no policy.
• getMinReleaseAge: npm days, pnpm minutes, unset or null values, a failing config command, and unsupported package managers.

Also checked manually with --dry-run against astro 7.3.0 in an npm and a pnpm project (screenshots above): no policy targets 7.4.0, a 30-day policy targets 7.3.3, and a 60-day policy reports up to date.

Docs

No docs needed. This only changes which version the upgrade tool picks when a release age policy is set, and the changeset covers it.

Changes

Pass env.imageConfig to revalidateRemoteImage(). Without it, redirect destinations are checked against an empty allowlist during cache revalidation, causing warnings and the reuse of stale cached images even when the destinations are allowed.

Reproduction: https://github.com/mumumu6/astro-remote-image-redirect-repro

Testing

• Added two regression tests covering image.domains and image.remotePatterns. Both fail without the fix. All 12 tests in test/units/assets/remote.test.ts pass with the fix.
• Built Astro, checked types, and ran Biome and ESLint on the changed files.
• Ran the reproduction against the patched Astro. The second build receives a 304 response and logs revalidated cache entry without the stale-cache warning.

Docs

No documentation changes are needed, as this fix corrects existing behavior without introducing new configuration options.

Description

This PR adds a check to the GitHub Action benchmark job to make sure it only runs in the withastro org and not in forks. The reason is that I noticed that the benchmark fails in forks because of missing permissions, here is an example run: https://github.com/trueberryless/withastro-starlight/actions/runs/39007600241/job/117323145054

Changes

• loadSharp() threw MissingSharp for any failed import('sharp'), dropping the original error. It's now passed as the cause, which Astro's error output already prints under "Caused by:".
• Sharp's own error is often the only useful clue, e.g. Unsupported CPU: Prebuilt binaries for Linux x64 require v2 microarchitecture when Sharp is installed but its binary can't run. Several Zulip self-hosters (Zulip's help center uses Starlight) spent months on an unexplained "Could not find Sharp" with exactly this cause.

Testing

• No test added. Nothing in the unit tests can make import('sharp') fail, and adding module mocking seemed like too much for a one-line change. I checked it manually by loading the built service under qemu-x86_64 -cpu Penryn (a CPU without x86-64-v2): the error now includes Sharp's "Unsupported CPU" message.

Docs

• No docs update needed. The MissingSharp error and its reference page are unchanged; the error just carries a cause now.

AI-assisted: written with Claude Code; I reviewed and tested the change.

Changes

Sparse array props prevent framework components from hydrating. For example, Array(2) serializes as {"items":[1,[null,null]]} when passed as { items: Array(2) }. The island decoder expects a tagged tuple for every entry and throws a TypeError on the bare null values.

Array.prototype.map skips missing entries. Visiting every entry with Array.from lets the existing serializer encode each hole as undefined, producing {"items":[1,[[0],[0]]]}. This uses the existing wire format and leaves the client script unchanged. It does not preserve the distinction between a hole and an explicit undefined property.

Testing

Both added regressions fail before the fix; all 27 serializer tests pass after rebuilding. The package build, typecheck, and changed-file lint and formatting checks pass.

The packed serializer and production island script were also exercised in a real browser. Leading, all-hole, and nested sparse arrays reach the hydration callback as undefined entries; the same cases throw before the fix. An explicit-undefined control passes both. The full dev-server and e2e suites were not run.

Docs

No documentation change is needed. Arrays are already supported as hydrated props, and this fixes their serialization without adding an API. An astro patch changeset describes the fix.

Changes

Fixes #18429.

• getChunkEnd() in data-store-writer.ts called TextEncoder.encode() once per character of the serialized store, only to learn that character's UTF-8 byte width. With experimental.collectionStorage: "chunked" this ran over the whole store on every sync and was ~63s of an 89s content sync on a 44k-entry (~180 MB serialized) store (node --cpu-prof on astro sync).
• The width is fully determined by the code point, so compute it arithmetically: < 0x80 → 1, < 0x800 → 2, < 0x10000 → 3, else 4. Lone surrogates fall in the 3-byte branch, which matches the U+FFFD (3 bytes) that TextEncoder substitutes for them, so the two agree on every input.
• Output is byte-identical: endIndex and bytes are unchanged for every input, so existing part files keep their xxhash names and nothing is invalidated.
• Drops the now-unused module-level ENCODER.

Real project (16.4k pages, warm cache): content sync 89s → 5.5s, full astro build 2:28 → 1:31. Standalone: 20 MB string, chunkString() 10.30s → 0.08s, identical parts.

Testing

• Added two unit tests to chunk-string.test.ts: code points on each UTF-8 width boundary (U+007F/U+0080/U+07FF/U+0800/U+FFFF/U+10000) with an exact expected split, and lone surrogates (high, low, reversed) budgeted as 3 bytes.
• Existing chunkString tests unchanged and pass.
• Differential fuzz of the original vs. the arithmetic getChunkEnd on ~25M cases (ASCII, 2/3-byte BMP, boundary values, astral pairs, lone/reversed surrogates, U+FFFD, NUL; maxBytes 1–1000; arbitrary start offsets including mid-pair), comparing both return values and the full chunkString() split: 0 mismatches. Script and timing repro: https://gist.github.com/Abhirup-99/2adc2e813117342d215f1b998a4a461a
• Verified on the real store that all 14 part files hash identically before and after.

Docs

No docs change: internal performance fix, no user-facing behaviour change.

🤖 Generated with Claude Code

Changes

• Svelte island CSS for conditionally-rendered child components (e.g. {#if visible}<Panel />{/if}) was silently dropped from production builds when using Vite 8 / Rolldown. Rolldown ignores direct assignments to the bundle object inside generateBundle, which caused the cssScopeTo recovery path in astro:rollup-plugin-build-css to be a no-op — the deleted CSS assets were never restored.
• The plugin now defers all CSS asset deletions to the end of generateBundle. Instead of deleting and re-assigning, it builds a set of assets to keep during the cssScopeTo pass and only drops the rest, eliminating the need to write back to bundle.

Testing

• Re-enabled the existing integration test packages/integrations/svelte/test/conditional-rendering.test.ts, which had been skipped with a TODO(rolldown) comment. This test covers Svelte island children that are conditionally rendered and verifies their scoped CSS is present in the production build output.

Docs

• No docs update needed; this is an internal build pipeline fix with no user-facing API changes.

Closes #18337

Changes

• renderChunk in vite-plugin-server-islands now returns early unless chunk.moduleIds includes \0virtual:astro:server-island-manifest. Previously the hook ran on every chunk containing the $$server-islands-map$$ marker. When a page imported astro/config, Rolldown bundled the server-islands plugin's own source into chunks/create-vite_*.mjs, the hook rewrote the plugin's serverIslandPlaceholderMap string literal, and the build failed with [PARSE_ERROR] Unterminated string.
• The guard is safe for all valid cases: the manifest chunk always carries its own virtual module ID, even when merged into a larger chunk or when output is minified.

Testing

• Updated packages/astro/test/units/server-islands/vite-plugin-server-islands.test.ts to cover the early-return path: a chunk that contains the marker but does not include the virtual manifest module ID is left unchanged.

Docs

• No docs update needed; this is an internal build-pipeline fix with no user-facing API change.

Closes #18364

Changes

• Cached image files copied into dist/ now keep the source file's mtime on all platforms. Previously, Node's copyFile reset the timestamp to the current time on Linux and Windows; only macOS happened to preserve it via clonefile(2) when COPYFILE_FICLONE was used.
• A new copyCachedFile helper in packages/astro/src/core/fs/index.ts wraps copyFile (with COPYFILE_FICLONE) and immediately applies the source atime/mtime via stat + utimes. All four cache-hit paths in the assets pipeline (generate.ts) and the experimental incremental-build restore path (incremental.ts) now use it.

Testing

• Added packages/astro/test/units/fs/copy-cached-file.test.ts, which verifies that the destination file's mtime matches the source file's mtime to the millisecond after copyCachedFile runs.

Docs

• No docs update needed; this is an internal build-time behaviour fix with no user-facing API change.

Closes #18402

Changes

• Style-only HMR in .astro components now correctly hot-updates CSS instead of falling back to a full page reload when a PostCSS plugin (e.g. @unocss/postcss with @apply) lists the processed file as a dependency of itself.
• The first loop in handleHotUpdate now skips the case where astroFile === ctx.file. Previously, when a component's own CSS dependency list included itself, the loop would delete the component's compile metadata, causing isStyleOnlyChanged to never run and Vite to receive an unfiltered module list that triggered a full reload. Other Astro files that legitimately depend on the changed file are still invalidated.

Testing

• Added a unit test in packages/astro/test/units/vite-plugin-astro/hmr.test.ts covering the case where a PostCSS plugin registers the component as a dependency of its own style, verifying that a style-only edit produces a CSS hot update rather than a full reload.

Docs

• No docs update needed; this is a dev-server HMR bug fix with no user-facing API change.

Closes #18406

Changes

Fixes #18421

• transform(): a local href whose ASSETS fetch isn't ok now returns 404, matching the remote-fetch branch. Before this, the 404 response body was passed to the Images binding as the source.
• transformStream(): when the Images binding rejects the source as not an image (IMAGES_TRANSFORM_ERROR 9412), the endpoint returns 400 instead of throwing. Any other binding error is rethrown unchanged.

Before → after, on a deployed Worker:

Testing

• Added two cases to test/image-binding-transform.test.ts: a mocked binding rejecting with 9412 → 400, and a different binding error → still rejects.
• The content.ok check in transform() has no unit test. That module imports astro:assets, which is why the existing tests target transformStream directly. I verified it on a deployed Worker instead (table above). Happy to add a fixture test if you'd prefer one.
• Deployed verification: the reproduction from the issue (https://github.com/cyface/astro-cloudflare-image-500-repro), built against 14.3.4 with this change applied as a patch, and uploaded as a Worker preview version.
• pnpm test in packages/integrations/cloudflare: 403/417 pass. The 1 failure (server-island / framework dev tests) also fails on main without this change.

Docs

None needed: there are no new options, and valid images behave the same. Only the error status for bad sources changes.

🤖 Generated with Claude Code

Changes

• Corrects the error message in validateFontsCssVariables() from "be a valid indent" to "be a valid ident", matching the CSS <ident> token the message's own MDN link documents. No validation behavior changes.

Testing

• Adds an assertion to the existing "Should error on invalid css variable" test in packages/astro/test/units/config/config-validate.test.ts that the error message contains 'be a valid ident:', covering the corrected wording.

Docs

• No docs update needed; this only corrects an error message string.

Closes #18356

Changes

• Fixes the @astrojs/node standalone startup log being skipped on Node 26.12 when HOST is an IP literal: the log handler waits for the listening event after it may already have fired, so the "Server listening" line never prints (server still serves requests).
• Adds an if (!server.listening) guard before waiting for the event, so the message is logged whenever the server is already up.

Testing

• Adds a unit test for logListeningOn covering the already-listening case; hardened so the server is closed in an after() hook (the previous version hung the test runner when the assertion failed).

Docs

• No docs update needed — startup log behavior only.

Changes

• Fixes conditionally-rendered island component styles being silently dropped from production builds under Vite 8 / Rolldown (astro:rollup-plugin-build-css ... assigns to bundle variable warning).
• The CSS dedup loop no longer deletes the combined chunk while the cssScopeTo recovery still needs it: asset ids are only marked during dedup and deleted at the end, so statically-rendered island styles are kept and inlined.

Testing

• Re-enables packages/integrations/svelte/test/conditional-rendering.test.ts (previously skipped with a TODO(rolldown)); it fails on main and passes with the fix.

Docs

• No docs update needed — build-internal fix.

Changes

• Fixes a build failure ("Unterminated string") when a page imports astro/config: the server-islands renderChunk rewrite could run on the bundled plugin source itself, leaving a quoted placeholder unterminated in a create-vite_* chunk.
• The rewrite now only runs when the chunk contains the server-island manifest module, which is the only source of the placeholder.

Testing

• Adds a unit test for the server-islands renderChunk covering chunks that do not contain the manifest module.

Docs

• No docs update needed — build-internal fix.

Changes

• Keeps the last-modified time of cached assets when they are copied into the build output, so workflows that compare mtimes (rsync, deploy diffing, spotting cache-sourced files) see stable timestamps across platforms.
• Adds copyCachedFile() which copies (with FICLONE where supported) and then restores the source mtime via utimes; used at all copy sites in the assets cache and incremental build restore.
• Related to #18386 (same intent, different implementation); this PR uses a shared helper and keeps the change scoped to cache copies.

Testing

• Adds test/units/fs/copy-cached-file.test.ts verifying copied contents and restored mtime.

Docs

• No docs update needed — internal build-output behavior only.

Changes

• Fixes @astrojs/vue SSR concatenating slot HTML character-by-character when the slot content is large (e.g. an island): Astro hands slots to renderers as a String wrapper object, which Vue's streaming renderer treats as a nested buffer.
• StaticHtml now converts slot content with String() before setting innerHTML, making Vue SSR render it as one string. Output markup is unchanged.

Testing

• Adds test/units/static-html.test.ts verifying slot HTML is rendered as a single string.

Docs

• No docs update needed — no user-facing behavior or markup change.

Changes

• Stops style-only HMR from falling back to a full page reload when a PostCSS plugin (e.g. @unocss/postcss with @apply) lists the component as its own dependency.
• handleHotUpdate now skips the component's own metadata when it appears in its own CSS dependencies, so Vite keeps serving the style modules instead of reloading the page.

Testing

• Adds 2 tests to test/units/vite-plugin-astro/hmr.test.ts covering style-only updates when the CSS dependency list contains the file itself.

Docs

• No docs update needed — dev-mode HMR behavior only.

Changes

• Deploys with Vercel's Bun runtime when the project is built with Bun: the adapter reads process.versions.bun and writes a bun1.x runtime into .vc-config.json instead of always using a Node runtime.
• No hard-coded version table, per the review direction on the earlier #18235 (which this PR supersedes). Vercel resolves bun1.x to its current Bun version (1.3.x today).
• A user-facing runtime config option is left as a follow-up.

Testing

• Adds test/units/runtime.test.ts for the new getRuntime() export: Bun build → bun1.x, Node build → unchanged nodejs*.x.

Docs

• No docs update needed for this patch; the runtime option follow-up would ship with its own docs.

Changes

• Fixes vercel redirects not matching under trailingSlash: 'always': @vercel/routing-utils emits the trailing-slash normalization redirect before redirect routes, so extensionless redirect sources are now generated with a trailing slash (static) or an optional trailing slash (dynamic/spread last segments) to match the normalized request path.
• Also fixes legacy .html URLs under dynamic/spread segments that a naive slash-append broke.
• Supersedes factory/fix-18073, whose fix skipped spread routes.

Testing

• Adds 7 unit tests in test/units/redirects.test.ts covering static, dynamic, and spread sources under trailingSlash: 'always'.
• Updates existing test/redirects.test.ts assertions for the new normalized source patterns.

Docs

• No docs update needed — internal fix to redirect route generation.

Changes

• Corrects a typo in the config validation error for font cssVariable values — the message says a value must be a valid "indent" but means a valid CSS ident.
• Wording-only change; validation behavior is unchanged.

Testing

• Adds an assertion to config-validate.test.ts verifying the corrected message.

Docs

• No docs update needed — only an error message wording fix.

Changes

Fixes #18377

• WebKit marks a history entry as created without user interaction when pushState runs without recent user activation, and apps built on WKWebView, including Chrome and Edge on iOS, hide those entries from the back button. In Chrome on iOS a tap only counts as activation while its event is being dispatched. The router calls pushState after it has fetched the new page, so every entry it adds is hidden and Back leaves the site.
• When a navigation starts with transient activation (navigator.userActivation.isActive), the router pushes the history entry right away as a copy of the current one, then fills it in with replaceState once the new page is swapped in.
• If the router hands the navigation to the browser for a full page load, it uses location.replace() so the entry doesn't stay behind as a duplicate. A navigation that interrupts a pending one reuses its entry, and Back or Forward drops it.
• #15163 was closed because it relied on UA sniffing. This follows the approach suggested in the issue, which doesn't need any browser detection.

In every browser, pressing Back while a page is still loading now returns to the current page instead of the previous one, because the entry already exists by then. The workaround posted in the issue behaves the same way. I can handle that case in a follow-up if you think it's worth it.

Testing

• Added e2e tests to view-transitions.test.ts:
  • the history entry is added while the click is handled (fails without this change)
  • a navigation that interrupts another one doesn't add an extra entry
  • a full page load doesn't leave an extra entry
• The view transitions e2e suite passes locally on Chrome and Firefox.
• Tested on an iPhone 12 Pro Max (iOS 26.6.2, Chrome 154.0.8037.55) with the view-transitions fixture: open /one in a new tab by typing the address, go to /two, then press Back. Without this change Back leaves the site, with it Back goes to /one.

Before:

After:

Docs

No docs changes needed. This is a bug fix and doesn't change any API.

Changes

• replaceDefine in vite-plugin-import-meta-env.ts now passes tsconfig: false to transformWithOxc, preventing Oxc from auto-discovering tsconfig files for each transformed file. Without this, Oxc could walk up to a parent-directory tsconfig.json whose extends (e.g. astro/tsconfigs/strict) can't be resolved in that directory, causing a fatal TSCONFIG_ERROR. This matches what Vite's own define plugin does for its equivalent lang: 'js' define-only transform.
• tsconfig is irrelevant for the plain define-replacement this transform performs, so disabling discovery is safe and more robust than forwarding config.tsconfig (which would still fall back to auto-discovery when vite.tsconfig is unset).

Testing

• Unit test added in packages/astro/test/units/env/vite-plugin-import-meta-env.test.ts covering the case where transformWithOxc is called with tsconfig: false, ensuring the option is forwarded correctly.

Docs

• No docs update needed; this is an internal build behavior fix with no user-facing API changes.

Closes #18404

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

astro@7.4.1

Patch Changes

• #18425 6fdc36e Thanks @astro-factory! - Preserves the last modified date of cached optimized images and incrementally restored build output when copying them into the build output on all platforms

• #18419 395d195 Thanks @astro-factory! - Fixes a typo in the error message shown when a font cssVariable is invalid

• #18401 484822f Thanks @danielmlr! - Fixes a bug where projects whose path contains an apostrophe (') failed to load sessions, middleware, a cache provider, or a src/fetch.ts handler

• #18407 a6e00be Thanks @astro-factory! - Fixes a TSCONFIG_ERROR during astro build when a parent directory contains a tsconfig.json that cannot be resolved, such as one extending astro/tsconfigs/strict without installed dependencies

• #18427 908f167 Thanks @astro-factory! - Fixes an Unterminated string build error when application code imports from astro/config (for example, fontProviders in a shared fonts module)

• #18428 40e7d54 Thanks @astro-factory! - Fixes missing styles in production builds for conditionally rendered framework components (e.g. Svelte components inside {#if} blocks) imported by a hydrated island

• #18424 617ff59 Thanks @astro-factory! - Fixes style-only HMR in .astro components falling back to a full page reload when a PostCSS plugin (such as @unocss/postcss) lists the component as a dependency of its own style

• #18274 70834bb Thanks @Princesseuh! - Fixes increasing memory usage when editing the Astro configuration while the dev server is running

@astrojs/cloudflare@14.4.1

Patch Changes

• #18351 9669d81 Thanks @astro-factory! - Fixes Cannot find package 'prismjs' errors when prismjs isn't hoisted, such as with pnpm's global virtual store or hoist=false
• Updated dependencies []:
  • @astrojs/underscore-redirects@1.0.4

@astrojs/node@11.1.9

Patch Changes

• #18382 c75e897 Thanks @Llois41! - Fixes the standalone server not logging Server listening on … when HOST is an IP address, which happens on Node.js 26.12 and later

@astrojs/vercel@11.0.16

Patch Changes

• #18411 48ec171 Thanks @matthewp! - Uses the Vercel Bun runtime for serverless functions when the project is built with Bun (e.g. bunx --bun astro build)

@astrojs/vue@7.1.1

Patch Changes

• #18398 9731465 Thanks @ump45nose! - Fixes Vue SSR concatenating Astro slot HTML character by character when the slot value is a String object (Astro's SlotString). StaticHtml now coerces the value with String(...) before passing it to innerHTML.

@astrojs/check@0.9.11

Patch Changes

• #18445 d736df7 Thanks @astro-factory! - Fixes the --preserveWatchOutput help text, which described the opposite of the flag's behavior. Setting it to true keeps output between checks in watch mode.

• #18444 c55134c Thanks @astro-factory! - Fixes astro check --watch exiting immediately when the project path contains node_modules or .git

This PR contains the following updates:

Package	Change	Age	Confidence
@vitest/snapshot (source)	4.1.11 → 5.0.5
vitest (source)	4.1.11 → 5.0.5
vitest (source)	^4.1.11 → ^5.0.5

Release Notes

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Changes

• Fixes a dev server 500 when the project path contains an apostrophe and a session driver is set, as @astrojs/node does by default. Astro writes the resolved driver path into the generated virtual:astro:session-driver module inside single quotes, so a path like ~/arc's site/ ends the string early and Vite can't parse the module.
• The cache provider, middleware and src/fetch.ts modules break the same way. In dev, src/fetch.ts is then ignored without an error.
• These import paths now go through JSON.stringify(), as the content layer already does. Paths without special characters resolve to the same files.

Reproduction with Astro 7.4.0 and @astrojs/node 11.1.8:

npm create astro@latest "arc's site" -- --template minimal --install --no-git --yes
cd "arc's site"
npx astro add node --yes
npx astro dev

Opening / returns a 500 and logs:

Failed to parse source for import analysis because the content contains invalid JS syntax. If you are using JSX, make sure to name the file with the .jsx or .tsx extension.
  Stack trace:
    at \0virtual:astro:session-driver:1:208

With pnpm and an on-demand page, astro build fails at the same module.

Testing

• New test/units/virtual-module-imports.test.ts loads each of the four modules with an apostrophe in the resolved path and checks that the generated imports point at it. Without the fix, each case fails with a parse error.

Docs

• None: bug fix, no API change.

Changes

• In dev, a server:defer island that imports astro:actions or astro:config/server would 500 with Could not find server component name if its page wasn't the first island page loaded after the server started. ensureModulesLoaded() in the CSS plugin was walking into virtual:astro:server-island-manifest and re-fetching it on the server side before the module runner could, causing the runner to keep a stale island map that was missing the newly discovered island.
• ensureModulesLoaded() now skips RESOLVED_SERVER_ISLAND_MANIFEST. The manifest contains no CSS, so CSS collection is unaffected. The non-cascading refresh introduced in #18166 is preserved.

Testing

• Added a dev-server integration test in packages/astro/test/server-islands.test.ts using a new test/fixtures/server-islands/late-discovery fixture. The test cold-starts the dev server, requests an island-free page first, then requests a second page whose island imports astro:actions, and asserts a 200 response (previously 500).

Docs

• No docs update needed; this is a dev-only bug fix with no user-facing API changes.

Closes #18387

Description

This PR updates the monorepo to pnpm 12.11.2 (latest tag).

• Use the devEngines field to manage both the pnpm and Node.js versions.
• Use Node.js 24.18.0 by default locally and in CI (ci.yml still tests using the minimum Node.js major version supported by Astro).
• Use pnpm/setup in workflows.
• Fix the devcontainer which was already broken before this PR and would have been even more after it. I tested locally that everything works as expected using the devcontainers CLI and Docker.
• Enable minimumReleaseAgeExcludePrune which automatically prunes entries in minimumReleaseAgeExclude when running a resolving commands (pnpm install, pnpm update, etc.). Note that a specific version is pruned only when that version is no longer in the lockfile (this means that an entry no longer requiring to be in minimumReleaseAgeExclude but still used would not be pruned automatically).

Changes

• @astrojs/vue's StaticHtml now coerces the slot value with String(...) before passing it to innerHTML.
• Astro hands slots as SlotString (a String object). Vue's SSR buffer treats non-primitives as nested buffers and builds the output one character at a time, which becomes costly for large slots (for example island markup).

Fixes #18392

Testing

• Added packages/integrations/vue/test/static-html.test.ts: renders with a String object and with a primitive; empty value returns null.
• Ran: pnpm exec astro-scripts test "test/static-html.test.ts" (Node 22.20.0) → 2/2 pass.
• Ablation bench (30× render of an 8k String object): coerced ~10ms vs uncoerced ~19ms locally; larger payloads widen the gap.
• Did not run the full @astrojs/vue fixture suite (needs a full astro package build on this machine).

Docs

No docs change — internal SSR performance fix; user-facing behavior is unchanged.

AI assistance disclosure

An AI coding agent (Grok Bot) drafted this change. I reviewed the diff, ran the tests above, and take responsibility for the PR.

This PR contains the following updates:

Package	Change	Age	Confidence
vitest (source)	^5.0.3 → ^5.0.4

Release Notes

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:

Package	Change	Age	Confidence
zod (source)	^4.6.5 → ^4.6.6

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/workers-types	^5.20261009.1 → ^5.20261012.1
@vitejs/plugin-vue (source)	^6.0.9 → ^6.0.10

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:

Package	Change	Age	Confidence
zod (source)	^4.6.5 → ^4.6.6

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:

Package	Change	Age	Confidence
vite (source)	^8.3.3 → ^8.3.4

Release Notes

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

• If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Changes

• isr.exclude entries are written to the Vercel config as exact routes with no trailing slash (/account becomes ^/account$), but the ISR routes accept one (^(/([^/]+?)/?)$).
• So a request for an excluded path with a trailing slash (/account/) skips its exclusion. If a dynamic route like [slug].astro also matches it, the request goes to the ISR function, and the response is cached and served to every visitor until it expires. For a page that depends on cookies, one visitor's page can be shown to others.
• This allows an optional trailing slash on exclusion routes, the same way the ISR routes do. The edge-middleware path uses the same list (isrExcludedRoutes), so it's fixed there too.

Seen on a live site: /projects was in isr.exclude. /projects returned x-vercel-cache: MISS, while /projects/ returned STALE and its links picked up x_astro_path from the ISR rewrite.

Testing

• isr.test.ts: updated the expected exclusion routes, and added a test that /two/, /excluded/foo/, /excluded/foo/bar/, /api/ and /api/foo/ all reach _render before any ISR route. The fixture's [a]/[b] route matches /excluded/foo/, which reproduces the bug.
• isr-edge-middleware.test.ts: updated the expected /live route, and added a check that the middleware sends /live/ to _render. /live overlaps the fixture's [slug] route.
• Without the source change, these four tests fail. With it, the full @astrojs/vercel suite passes.

Docs

No docs change. This makes isr.exclude behave the way the docs already describe it.

This PR contains the following updates:

Package	Change	Age	Confidence
@preact/signals (source)	2.11.2 → 2.11.3
@vitejs/plugin-vue (source)	^6.0.9 → ^6.0.10
es-module-lexer	^3.0.2 → ^3.0.3
hono (source)	^4.13.11 → ^4.13.13
http-cache-semantics	^4.2.0 → ^4.3.0
magic-string	^1.4.2 → ^1.4.3
oxc-transform-react (source)	^0.151.0 → ^0.153.0
p-queue	^9.3.3 → ^9.3.5
package-manager-detector	^1.8.0 → ^1.9.0
postcss (source)	^8.5.28 → ^8.5.29
postcss-preset-env (source)	^11.5.4 → ^11.6.1
sass	^1.105.0 → ^1.105.1
shiki (source)	^4.4.3 → ^4.5.0
smol-toml	^1.9.0 → ^1.9.1
solid-js (source)	^1.9.15 → ^1.9.17
svelte (source)	^5.57.1 → ^5.57.2
unifont	^1.0.2 → ^1.0.3
zod (source)	^4.6.5 → ^4.6.6

Release Notes