[dependabot]

Bumps astro from 7.2.0 to 7.4.11.

Release notes

Sourced from astro's releases.

astro@7.4.11

Patch Changes

• #18641 08e2cee Thanks @​astro-factory! - Validates the protocol, host and port from X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port together against each security.allowedDomains entry, instead of one at a time:

  • A forwarded protocol is only applied when an entry allows it for the host in use.
  • A forwarded port is only applied when the entry for that host lists it.
  • A forwarded host without a forwarded protocol is validated with the protocol of the server.
  • An entry with port: '443' (or '80' for http) now matches a host that doesn't include a port.

• #18651 93a9057 Thanks @​umeraamir69! - Returns 400 Bad Request for malformed percent-encoded paths in the dev server and static preview instead of bubbling into a 500

• #18672 e901468 Thanks @​astro-factory! - Fixes astro check reporting @astrojs/check as missing when the package is installed but throws while loading. The original error is now shown instead of an install prompt.

• #18641 08e2cee Thanks @​astro-factory! - Fixes security.allowedDomains accepting non-HTTP(S) X-Forwarded-Proto values (such as ftp or ws) when the list mixes patterns with and without a protocol

• #18686 62bb716 Thanks @​astro-factory! - Fixes astro build deleting the license file generated by Vite's build.license option. Astro now removes only its own Vite manifest from the .vite/ output folder.

• #18629 e9916e1 Thanks @​decrek! - Fixes spreading an object onto an element with scoped styles changing that object. When the same object was spread on every render, for example a constant imported from another module, its class grew with every request.

• #18641 08e2cee Thanks @​astro-factory! - Tightens how security.allowedDomains validates the Host and X-Forwarded-Host headers. Only a plain hostname with an optional port is accepted, and the validated host is applied to Astro.url exactly as it was matched.

• Updated dependencies [d13beeb, e9916e1]:

  • @​astrojs/markdown-satteri@​0.4.9
  • @​astrojs/runtime@​0.1.1
  • @​astrojs/vite-plugin-astro@​0.1.2

astro@7.4.10

Patch Changes

• #18621 8a61493 Thanks @​marcalexiei! - Fixes the dev toolbar's audit freezing an image's CSS animations in Safari, by reading the image's size from the request that loaded it instead of fetching it again

• #18691 f787792 Thanks @​ematipico! - Improves startup time of astro commands by loading SVGO only when svgoOptimizer() optimizes an SVG, instead of whenever astro/config is imported

• #18678 ea63d76 Thanks @​astro-factory! - Fixes duplicate CSS loading for hydrated islands that share modules or are imported through a path alias. The client build no longer emits and preloads stylesheets that are already linked on the page by the server build.

• Updated dependencies [57137ed]:

  • @​astrojs/internal-helpers@​0.13.2
  • @​astrojs/markdown-satteri@​0.4.8
  • @​astrojs/vite-plugin-astro@​0.1.1

astro@7.4.9

Patch Changes

• #18681 bf1828b Thanks @​astro-factory! - Fixes static builds skipping or failing on pages whose getStaticPaths() params contain characters like % or \, and warns when a prerendered page is skipped because it returned an empty error response

• #18630 c904827 Thanks @​astro-factory! - Fixes bundled scripts and hydrated islands being blocked when security.csp.scriptDirective.strictDynamic is enabled. Astro now adds the hash of every bundled script to script-src and renders an import map with their integrity in the <head>.

• #18611 f98e8a8 Thanks @​matthewp! - Fixes bundling of a <script src> that uses a root-relative path to a project file outside src/, such as /lib/analytics.ts. The error asking for is:inline is now shown only when the path points to a file in public/.

• #18688 1999c84 Thanks @​astro-factory! - Fixes errors thrown after a page has started streaming bypassing the configured logger. They are now reported once through it, as one error record, in both production and astro dev

• Updated dependencies [c904827, 5083c65, 1999c84, 5083c65, f98e8a8, f98e8a8]:

... (truncated)

Changelog

Sourced from astro's changelog.

7.4.11

Patch Changes

• #18641 08e2cee Thanks @​astro-factory! - Validates the protocol, host and port from X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port together against each security.allowedDomains entry, instead of one at a time:

  • A forwarded protocol is only applied when an entry allows it for the host in use.
  • A forwarded port is only applied when the entry for that host lists it.
  • A forwarded host without a forwarded protocol is validated with the protocol of the server.
  • An entry with port: '443' (or '80' for http) now matches a host that doesn't include a port.

• #18651 93a9057 Thanks @​umeraamir69! - Returns 400 Bad Request for malformed percent-encoded paths in the dev server and static preview instead of bubbling into a 500

• #18672 e901468 Thanks @​astro-factory! - Fixes astro check reporting @astrojs/check as missing when the package is installed but throws while loading. The original error is now shown instead of an install prompt.

• #18641 08e2cee Thanks @​astro-factory! - Fixes security.allowedDomains accepting non-HTTP(S) X-Forwarded-Proto values (such as ftp or ws) when the list mixes patterns with and without a protocol

• #18686 62bb716 Thanks @​astro-factory! - Fixes astro build deleting the license file generated by Vite's build.license option. Astro now removes only its own Vite manifest from the .vite/ output folder.

• #18629 e9916e1 Thanks @​decrek! - Fixes spreading an object onto an element with scoped styles changing that object. When the same object was spread on every render, for example a constant imported from another module, its class grew with every request.

• #18641 08e2cee Thanks @​astro-factory! - Tightens how security.allowedDomains validates the Host and X-Forwarded-Host headers. Only a plain hostname with an optional port is accepted, and the validated host is applied to Astro.url exactly as it was matched.

• Updated dependencies [d13beeb, e9916e1]:

  • @​astrojs/markdown-satteri@​0.4.9
  • @​astrojs/runtime@​0.1.1
  • @​astrojs/vite-plugin-astro@​0.1.2

7.4.10

Patch Changes

• #18621 8a61493 Thanks @​marcalexiei! - Fixes the dev toolbar's audit freezing an image's CSS animations in Safari, by reading the image's size from the request that loaded it instead of fetching it again

• #18691 f787792 Thanks @​ematipico! - Improves startup time of astro commands by loading SVGO only when svgoOptimizer() optimizes an SVG, instead of whenever astro/config is imported

• #18678 ea63d76 Thanks @​astro-factory! - Fixes duplicate CSS loading for hydrated islands that share modules or are imported through a path alias. The client build no longer emits and preloads stylesheets that are already linked on the page by the server build.

• Updated dependencies [57137ed]:

  • @​astrojs/internal-helpers@​0.13.2
  • @​astrojs/markdown-satteri@​0.4.8
  • @​astrojs/vite-plugin-astro@​0.1.1

7.4.9

Patch Changes

• #18681 bf1828b Thanks @​astro-factory! - Fixes static builds skipping or failing on pages whose getStaticPaths() params contain characters like % or \, and warns when a prerendered page is skipped because it returned an empty error response

• #18630 c904827 Thanks @​astro-factory! - Fixes bundled scripts and hydrated islands being blocked when security.csp.scriptDirective.strictDynamic is enabled. Astro now adds the hash of every bundled script to script-src and renders an import map with their integrity in the <head>.

• #18611 f98e8a8 Thanks @​matthewp! - Fixes bundling of a <script src> that uses a root-relative path to a project file outside src/, such as /lib/analytics.ts. The error asking for is:inline is now shown only when the path points to a file in public/.

... (truncated)

Commits

• d68e4f6 [ci] release (#18699)
• 2e83637 [ci] format
• 93a9057 fix(astro): return 400 for malformed paths in dev and static preview (#18651)
• 08e2cee Mixed allowedDomains patterns no longer accept non-http(s) X-Forwarded-Proto ...
• e9916e1 fix: don't mutate objects spread onto elements with scoped styles (#18629)
• e901468 Show real import errors instead of a false missing-package prompt in `astro c...
• 62bb716 Keep files outside manifest.json when cleaning up .vite/ after build (#18686)
• ed3ef40 [ci] release (#18693)
• f787792 fix(astro): lazily import svgo in svgoOptimizer (#18691)
• 8a61493 fix(dev-toolbar): read an image's size without fetching it again (#18621)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.