fix(deps): update astro monorepo (major)#10
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
85ea1da to
405eb1b
Compare
405eb1b to
2f3266c
Compare
2f3266c to
39479d4
Compare
39479d4 to
8ef514f
Compare
8ef514f to
686e0f6
Compare
686e0f6 to
3ea6fe5
Compare
3ea6fe5 to
7cc9a6e
Compare
7cc9a6e to
ea52eb7
Compare
ea52eb7 to
4b5d974
Compare
4b5d974 to
fb89a0a
Compare
fb89a0a to
91fe3a9
Compare
91fe3a9 to
90af55f
Compare
90af55f to
42c306e
Compare
6a1dd66 to
cbd247f
Compare
cbd247f to
4f09c27
Compare
4f09c27 to
b0413b0
Compare
b0413b0 to
3d9bb91
Compare
3d9bb91 to
117cfbe
Compare
117cfbe to
f18beb0
Compare
f18beb0 to
85ca381
Compare
85ca381 to
81d19da
Compare
81d19da to
8aa5ed8
Compare
8aa5ed8 to
309931f
Compare
309931f to
6657be4
Compare
6657be4 to
d222629
Compare
d222629 to
5eb8cc2
Compare
5eb8cc2 to
a02f759
Compare
a02f759 to
061561d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^9.5.4→^11.0.0^9.0.4→^11.0.0^5.18.0→^7.0.0Release Notes
withastro/astro (@astrojs/node)
v11.0.2Compare Source
Patch Changes
#17252
eb6f97eThanks @matthewp! - Fixes trailing-slash handling for request paths that begin with a backslashWith
trailingSlash: 'always', the standalone Node server could append a trailing slash to a request path that begins with a backslash (for example/\example.com/foo) and echo that path back in theLocationheader of a301response. Because browsers resolve a leading\the same way as/, the resultingLocationcould point off-site.Such paths are now recognized as internal paths, matching the existing handling for paths that begin with
//, so they are no longer rewritten with a trailing slash.Updated dependencies [
eb6f97e]:v11.0.1Compare Source
Patch Changes
02b73b0Thanks @ematipico! - Fixes an issue where thepeerDependenciesfield used incorrect dependencies.v11.0.0Compare Source
Patch Changes
#17054
d426b67Thanks @astrobot-houston! - Fixes an issue where Astro files with non-ASCII characters in their name weren't correctly served after the build.#17027
241250bThanks @ocavue! - Triggers beta prereleases for packages that are still on alphav10.1.4Compare Source
Patch Changes
4ecff32Thanks @maximslo! - Fixes theexperimental.loggerdestination not being used for the "Server listening on..." startup message. The logger is now resolved before the server starts listening, andadapterLoggerre-creates itself when the underlying logger changes so the startup message uses the correct destination.v10.1.3Compare Source
Patch Changes
#16922
7dce185Thanks @astrobot-houston! - Fixes prerendered pages returning 404 when usingbuild.format: 'file'orbuild.format: 'preserve'with the Node adapter in standalone mode.Previously, clean URLs like
/aboutwould fail to resolve toabout.htmlon disk, because the static file handler only supported the defaultdirectoryformat (about/index.html). Now the handler correctly resolves clean URLs to.htmlfiles when the build format produces them.v10.1.2Compare Source
Patch Changes
f732f3c]:v10.1.1Compare Source
Patch Changes
d365c97]:v10.1.0Compare Source
Minor Changes
4d72482Thanks @ematipico! - The adapter now depends on Astro 6.3.0.v10.0.6Compare Source
Patch Changes
99464ed,f3485c3]:v10.0.5Compare Source
Patch Changes
940afd5Thanks @matthewp! - Fixes static asset error responses incorrectly including immutable cache headers. Conditional request failures (e.g.If-Matchmismatch) now return the correct status code without far-future cache directives.v10.0.4Compare Source
Patch Changes
#16002
846f27fThanks @buley! - Fixes file descriptor leaks from read streams that were not destroyed on client disconnect or read errors#15941
f41584aThanks @ematipico! - Fixes an infinite loop inresolveClientDir()when the server entry point is bundled with esbuild or similar tools. The function now throws a descriptive error instead of hanging indefinitely when the expected server directory segment is not found in the file path.v10.0.3Compare Source
Patch Changes
#15735
9685e2dThanks @fa-sharp! - Fixes an EventEmitter memory leak when serving static pages from Node.js middleware.When using the middleware handler, requests that were being passed on to Express / Fastify (e.g. static files / pre-rendered pages / etc.) weren't cleaning up socket listeners before calling
next(), causing a memory leak warning. This fix makes sure to run the cleanup before callingnext().v10.0.2Compare Source
Patch Changes
6f8f0bcThanks @ematipico! - Updates the AstropeerDependencies#astroto be6.0.0.v10.0.1Compare Source
Patch Changes
bb2b8f5Thanks @ematipico! - Fixes an issue where the adapter would cause a series of warnings during the build.v10.0.0Compare Source
Major Changes
#15654
a32aee6Thanks @florian-lefebvre! - Removes theexperimentalErrorPageHostoptionThis option allowed fetching a prerendered error page from a different host than the server is currently running on.
However, there can be security implications with prefetching from other hosts, and often more customization was required to do this safely. This has now been removed as a built-in option so that you can implement your own secure solution as needed and appropriate for your project via middleware.
What should I do?
If you were previously using this feature, you must remove the option from your adapter configuration as it no longer exists:
// astro.config.mjs import { defineConfig } from 'astro/config' import node from '@​astrojs/node' export default defineConfig({ adapter: node({ mode: 'standalone', - experimentalErrorPageHost: 'http://localhost:4321' }) })You can replicate the previous behavior by checking the response status in a middleware and fetching the prerendered page yourself:
Minor Changes
#15258
d339a18Thanks @ematipico! - Stabilizes the adapter featureexperimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:export default defineConfig({ adapter: netlify({ - experimentalStaticHeaders: true + staticHeaders: true }) })#15759
39ff2a5Thanks @matthewp! - Adds a newbodySizeLimitoption to the@astrojs/nodeadapterYou can now configure a maximum allowed request body size for your Node.js standalone server. The default limit is 1 GB. Set the value in bytes, or pass
0to disable the limit entirely:#15006
f361730Thanks @florian-lefebvre! - Adds new session driver object shapeFor greater flexibility and improved consistency with other Astro code, session drivers are now specified as an object:
Specifying the session driver as a string has been deprecated, but will continue to work until this feature is removed completely in a future major version. The object shape is the current recommended and documented way to configure a session driver.
#14946
95c40f7Thanks @ematipico! - Removes theexperimental.cspflag and replaces it with a new configuration optionsecurity.csp- (v6 upgrade guidance)Patch Changes
#15473
d653b86Thanks @matthewp! - Improves error page loading to read from disk first before falling back to configured host#15562
e14a51dThanks @florian-lefebvre! - Updates to new Adapter API introduced in v6#15585
98ea30cThanks @matthewp! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.#15777
02e24d9Thanks @matthewp! - Fixes CSRF origin check mismatch by passing the actual server listening port tocreateRequest, ensuring the constructed URL origin includes the correct port (e.g.,http://localhost:4321instead ofhttp://localhost). Also restrictsX-Forwarded-Prototo only be trusted whenallowedDomainsis configured.#15714
9a2c949Thanks @ematipico! - Fixes an issue where static headers weren't correctly applied when the website usesbase.#15763
1567e8cThanks @matthewp! - Normalizes static file paths before evaluating dotfile access rules for improved consistency#15164
54dc11dThanks @HiDeoo! - Fixes an issue where the Node.js adapter could fail to serve a 404 page matching a pre-rendered dynamic route pattern.#15745
20b05c0Thanks @matthewp! - Hardens static file handler path resolution to ensure resolved paths stay within the client directory#15495
5b99e90Thanks @leekeh! - Refactors to usemiddlewareModeadapter feature (set toclassic)#15657
cb625b6Thanks @qzio! - Adds a newsecurity.actionBodySizeLimitoption to configure the maximum size of Astro Actions request bodies.This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.
If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.
Updated dependencies [
4ebc1e3,4e7f3e8,a164c77,cf6ea6b,a18d727,240c317,745e632]:withastro/astro (@astrojs/vercel)
v11.0.3Compare Source
Patch Changes
3a43cf0Thanks @matthewp! - Improves internal ISR route handlingv11.0.2Compare Source
Patch Changes
eb6f97e]:v11.0.1Compare Source
Patch Changes
02b73b0Thanks @ematipico! - Fixes an issue where thepeerDependenciesfield used incorrect dependencies.v11.0.0Compare Source
Major Changes
cafec4eThanks @delucis! - Upgrade to Vite v8Minor Changes
9a53f77Thanks @ascorbic! - Adds a CDN cache provider for Astro route caching on VercelSetup
Import
cacheVercel()from@astrojs/vercel/cacheand set it as your cache provider:Caching responses
Use
Astro.cache.set()in your pages and API routes to cache responses on Vercel's edge network. The provider setsVercel-CDN-Cache-ControlandVercel-Cache-Tagheaders on responses.You can also set cache rules for groups of routes in your config:
Invalidation
Purge cached responses by tag or path from any API route or server endpoint:
Both tag-based and path-based invalidation are supported. Tag invalidation is a soft invalidation, marking cached responses as stale so they can be revalidated in the background via stale-while-revalidate.
Patch Changes
241250bThanks @ocavue! - Triggers beta prereleases for packages that are still on alphav10.0.8Compare Source
Patch Changes
f732f3c]:v10.0.7Compare Source
Patch Changes
d365c97]:v10.0.6Compare Source
Patch Changes
0bae1a5Thanks @cyphercodes! - Fix forwarded serverless requests with streamed bodies by preserving the requiredduplex: 'half'option when rewriting middleware paths.v10.0.5Compare Source
Patch Changes
99464ed,f3485c3]:v10.0.4Compare Source
Patch Changes
d0fe1ecThanks @bittoby! - Fixes edge middlewarenext()dropping the HTTP method and body when forwarding requests to the serverless function, which caused non-GET API routes (POST, PUT, PATCH, DELETE) to return 404v10.0.3Compare Source
Patch Changes
aa26636Thanks @empoulter-uclan! - Fix vercel ISR path rewritev10.0.2Compare Source
Patch Changes
335a204Thanks @matthewp! - Fix Vercel serverless path override handling so override values are only applied when the trusted middleware secret is present.v10.0.1Compare Source
Patch Changes
6f8f0bcThanks @ematipico! - Updates the AstropeerDependencies#astroto be6.0.0.v10.0.0Compare Source
Major Changes
736216bThanks @florian-lefebvre! - Removes the deprecated@astrojs/vercel/serverlessand@astrojs/vercel/staticexports. Use the@astrojs/vercelexport insteadMinor Changes
#15258
d339a18Thanks @ematipico! - Stabilizes the adapter featureexperimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:export default defineConfig({ adapter: netlify({ - experimentalStaticHeaders: true + staticHeaders: true }) })#15413
736216bThanks @florian-lefebvre! - Updates the implementation to use the new Adapter API#15495
5b99e90Thanks @leekeh! - Adds newmiddlewareModeadapter feature and deprecatesedgeMiddlewareoptionThe
edgeMiddlewareoption is now deprecated and will be removed in a future release, so users should transition to using the newmiddlewareModefeature as soon as possible.export default defineConfig({ adapter: vercel({ - edgeMiddleware: true + middlewareMode: 'edge' }) })#14946
95c40f7Thanks @ematipico! - Removes theexperimental.cspflag and replaces it with a new configuration optionsecurity.csp- (v6 upgrade guidance)Patch Changes
#15781
2de969dThanks @ematipico! - Adds a newclientAddressoption to thecreateContext()functionProviding this value gives adapter and middleware authors explicit control over the client IP address. When not provided, accessing
clientAddressthrows an error consistent with other contexts where it is not set by the adapter.Additionally, both of the official Netlify and Vercel adapters have been updated to provide this information in their edge middleware.
#15778
4ebc1e3Thanks @ematipico! - Fixes an issue where the computedclientAddresswas incorrect in cases of a Request header with multiple values. TheclientAddressis now also validated to contain only characters valid in IP addresses, rejecting injection payloads.#15460
ee7e53fThanks @florian-lefebvre! - Updates to use the new Adapter API#15450
50c9129Thanks @florian-lefebvre! - Fixes a case wherebuild.serverEntrywould not be respected when using the new Adapter API#15461
9f21b24Thanks @florian-lefebvre! - Updates to new Adapter API introduced in v6#15125
6feb0d7Thanks @florian-lefebvre! - Updates Node versions data to account for v24 as the defaultUpdated dependencies [
4ebc1e3,4e7f3e8,a164c77,cf6ea6b,a18d727,240c317,745e632]:withastro/astro (astro)
v7.1.0Minor Changes
#17302
5f4dc03Thanks @astrobot-houston! - Adds a newdeferRenderoption to theglob()content loaderWhen set to
true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that.mdxfiles already use.This reduces memory usage during
astro buildfor large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins likerehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.By default
deferRenderisfalse, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.#17296
30698a2Thanks @ematipico! - Adds a new experimentalcollectionStorageoption for controlling how the content layer persists its data storeBy default, Astro serializes the entire content layer data store to a single file (
.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.Set
experimental.collectionStorage: 'chunked'to instead split the data store across many smaller, content-addressed files inside a.astro/data-store/directory, described by a manifest:Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is
'single-file', which preserves the current behavior.#17214
44c4989Thanks @ematipico! - Adds support for the more specific CSP directivesscript-src-elem,script-src-attr,style-src-elem, andstyle-src-attrthrough a newkindoption.Previously,
CSPwas only scoped to genericscript-src/style-srcdirectives. Now each source or hash can be scoped to a narrower directive — for example, to allow inlinestyleattributes (such as those fromdefine:varsor Shiki) without loosening the policy for your<style>and<link>elements.Scoping sources and hashes in your config
Each entry in
resourcesandhashescan be an object with akindproperty. Depending on whether you usescriptDirectiveorstyleDirective,"element"targetsscript-src-elemorstyle-src-elem,"attribute"targetsscript-src-attrorstyle-src-attr, and"default"(the same as a bare string or hash) targetsscript-srcorstyle-src.Scoping at runtime
The same
kindoption is available on the runtime CSP API, where the existing methods now also accept an object:#17258
84814d4Thanks @astrobot-houston! - Adds a newformat()option to thepaginateutility. Theformat()option is a function that accepts the current URL of the page, and returns a new URL.For example, when your host only supports URLs using the
.htmlextension, you can useformat()to add it to the generated URLs:#17331
7db6420Thanks @matthewp! - Adds a--ignore-lockflag toastro devfor starting a dev server without checking or writing the lock file, so it can run alongside an already-running dev server for the same project.The new instance is not tracked by
astro dev stop,astro dev status, orastro dev logs.--ignore-lockcannot be combined with--background(or an auto-detected AI agent environment, which runs dev servers in the background automatically) or--force, since those rely on the lock file.#17389
16de021Thanks @florian-lefebvre! - Allows passing URL entrypoints when configuring the loggerMatching other APIs like session drivers or font providers, the logger entrypoint can now be a URL:
Patch Changes
#17332
4407483Thanks @astrobot-houston! - Fixes the JSON logger crashing withprocess is not definedin non-Node runtimes like Cloudflare's workerd. The JSON logger now usesconsole.log/console.errorinstead ofprocess.stdout/process.stderr, matching the pattern already used by the console logger.#17391
186a1e7Thanks @florian-lefebvre! - Fixes a case where an integration could not update the logger withupdateConfig()#17394
d9f99e1Thanks @matthewp! - Fixes element-specific CSP directives to preserve the existing behavior of configured script and style resources#17374
b2d1b3eThanks @astrobot-houston! - Fixes dev server returning 404 for?urlimported assets when accessed via browser navigation#17390
ed71eafThanks @florian-lefebvre! - Removes an unused and undocumented generic from theAstroLoggerDestinationtype#17393
092da56Thanks @matthewp! - Hardens generated transition styles, development metadata, and server island URLs when embedding dynamic valuesv7.0.9Compare Source
Patch Changes
#17286
a249317Thanks @astrobot-houston! - Fixes the first browser visit afterastro devstarts triggering an immediate full page reload#17369
a94d4a5Thanks @adamchal! - Fixes an issue where a client island could permanently fail to hydrate if the first attempt to load its component failed. Islands now reliably recover from transient import failures, which previously did not work for React components duringastro dev.v7.0.8Compare Source
Patch Changes
#17363
3f4efc5Thanks @astrobot-houston! - Fixesastro preview --opennot opening a browser when using an adapter with a custom preview entrypoint, such as@astrojs/cloudflare#17313
e2e319dThanks @ronits2407! - Exposes theAstroRuntimeLoggerinterface to allow users to properly type the logger functions at runtime.#17328
025cc74Thanks @matthewp! - Fixesastro dev --forcenot replacing an already-running dev server#17353
2bba277Thanks @ematipico! - Updates the Astro compiler to the latest version, which fixes many regressions. Refer to the changelog for more details.#17344
79a41e0Thanks @adamchal! - Improves rendering performance for pages with many component instances, such as repeated MDX<Content />components.Updated dependencies [
64b0d66]:v7.0.7Compare Source
Patch Changes
#17318
23a4120Thanks @astrobot-houston! - Fixes CSS module scoped-name hash mismatch inastro devwhen usingvite.css.transformer: 'lightningcss'with content collections. Previously, a component importing a CSS module and rendered via content collectionrender()would get different class name hashes in the element and the injected<style>tag, causing styles not to apply.#17323
4298883Thanks @ematipico! - Fixes a dev server memory leak which caused Node.js to emit warnings in the console.#17323
4298883Thanks @ematipico! - Fixes a dev server crash when a.htmlor/index.htmlsuffixed request (such as thosenetlify devprobes as pretty-URL fallbacks) matched a dynamic endpoint route, causing aTypeError: Missing parametererror#17325
cebc404Thanks @astrobot-houston! - Fixes a bug where CSS@importrules could end up mid-stylesheet after inline CSS chunks were merged during build, causing browsers to silently ignore them#17323
4298883Thanks @ematipico! - Fixes a build regression that could leave unresolved preload markers in inlined scripts with external dynamic importsUpdated dependencies [
4298883,4298883]:v7.0.6Compare Source
Patch Changes
#17261
79aa99cThanks @astrobot-houston! - Fixes a false deprecation warning formarkdown.gfmandmarkdown.smartypantswhen using the Container API#17247
f94280dThanks @chatman-media! - Fixes route generation throwing "Missing parameter" (or silently dropping the segment) when a dynamic param's value is0. The generator used truthy checks instead of checking forundefined, sopaginate(posts, { params: { categoryId: 0 } })would crash even though0is a perfectly valid param value.#17278
6f11739Thanks @astrobot-houston! - Fixes missing CSS for virtual style modules (e.g., responsive image layout styles) in dev mode when JavaScript is disabled#17250
0b30b35Thanks @matthewp! - Fixes thesecurity.checkOrigincheck so it is applied consistently to Astro Actions and on-demand endpoints, regardless of how the request pipeline is composed. Previously, the origin check could be skipped in the composableastro/honopipeline depending on the order of themiddleware()primitive (or when it was omitted).#17274
8c3579bThanks @astrobot-houston! - Fixes missingrender()type overload for live collection entries. Previously, callingrender()on aLiveDataEntryproduced a TypeScript error when using onlylive.config.tswithout acontent.config.ts.#17257
4208297Thanks @astrobot-houston! - Fixesastro checkfailing to find@astrojs/checkandtypescriptwhen astro is installed in a directory outside the project tree (e.g. pnpm virtual store)#17272
b428648Thanks @matthewp! - Fixes island component paths so that extensionless imports (e.g.import { Counter } from '../components/Counter') resolve to the real file on disk, matching Vite's extension order and directoryindexresolution. This makes theinclude/excludeoptions of JSX renderer integrations (React, Preact, Solid) match components imported without a file extension, and removes the spurious React 19 "Invalid hook call" warning logged on every request in dev whenincludewas set alongside another JSX renderer#17279
2aeaa44Thanks @astrobot-houston! - Fixes a bug where<Picture inferSize>with a remote image could fail withFailedToFetchRemoteImageDimensionswhen the image server rate-limits requests (e.g. HTTP 429). Remote dimensions are now resolved onceConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.