AstroEco is Contributing…

Display your GitHub pull requests using astro-loader-github-prs

fix(create-astro): validate integration names to prevent shell injection

Description

The --add flag was passing user input directly to shell commands, allowing shell metacharacters to be interpreted as shell syntax. For example:

npm create --yes astro poc -- --add "react; open -a Calculator.app;" --install --yes

Would result in open -a Calculator.app being executed.

Changes

Added VALID_INTEGRATION_NAME regex pattern that matches valid npm package names (lowercase letters, numbers, hyphens, underscores, dots, and scoped packages)
Added isValidIntegrationName() validation function
Invalid integration names are now filtered out with a clear error message
Added 3 tests for validation behavior:
- Rejects integration names with shell metacharacters
- Accepts valid integration names
- Filters out only invalid names (keeps valid ones)

Testing

All 73 tests pass, including the 3 new tests:

rejects integration names with shell metacharacters ✔
accepts valid integration names ✔
filters out only invalid integration names ✔

[ci] release (beta)

withastro/astro

#15426 Feb 6

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

⚠️⚠️⚠️⚠️⚠️⚠️

main is currently in pre mode so this branch has prereleases rather than normal releases. If you want to exit prereleases, run changeset pre exit on main.

⚠️⚠️⚠️⚠️⚠️⚠️

Releases

@astrojs/cloudflare@13.0.0-beta.6

Major Changes

#15345 840fbf9 Thanks @matthewp! - Removes the cloudflareModules adapter option

The cloudflareModules option has been removed because it is no longer necessary. Cloudflare natively supports importing .sql, .wasm, and other module types.

What should I do?

Remove the cloudflareModules option from your Cloudflare adapter configuration if you were using it:
```
import cloudflare from '@astrojs/cloudflare';

export default defineConfig({
  adapter: cloudflare({
-   cloudflareModules: true
  })
});
```

Minor Changes

#15077 a164c77 Thanks @matthewp! - Adds support for prerendering pages using the workerd runtime.

The Cloudflare adapter now uses the new setPrerenderer() API to prerender pages via HTTP requests to a local preview server running workerd, instead of using Node.js. This ensures prerendered pages are built using the same runtime that serves them in production.

Patch Changes

Updated dependencies [a164c77]:
- @astrojs/internal-helpers@0.8.0-beta.1
- @astrojs/underscore-redirects@1.0.0

astro@6.0.0-beta.10

Minor Changes

#15231 3928b87 Thanks @rururux! - Adds a new optional getRemoteSize() method to the Image Service API.

Previously, inferRemoteSize() had a fixed implementation that fetched the entire image to determine its dimensions.
With this new helper function that extends inferRemoteSize(), you can now override or extend how remote image metadata is retrieved.

This enables use cases such as:
- Caching: Storing image dimensions in a database or local cache to avoid redundant network requests.
- Provider APIs: Using a specific image provider's API (like Cloudinary or Vercel) to get dimensions without downloading the file.
For example, you can add a simple cache layer to your existing image service:
```
const cache = new Map();

const myService = {
  ...baseService,
  async getRemoteSize(url, imageConfig) {
    if (cache.has(url)) return cache.get(url);

    const result = await baseService.getRemoteSize(url, imageConfig);
    cache.set(url, result);
    return result;
  },
};
```
See the Image Services API reference documentation for more information.

#15077 a164c77 Thanks @matthewp! - Updates the Integration API to add setPrerenderer() to the astro:build:start hook, allowing adapters to provide custom prerendering logic.

The new API accepts either an AstroPrerenderer object directly, or a factory function that receives the default prerenderer:

'astro:build:start': ({ setPrerenderer }) => {
  setPrerenderer((defaultPrerenderer) => ({
    name: 'my-prerenderer',
    async setup() {
      // Optional: called once before prerendering starts
    },
    async getStaticPaths() {
      // Returns array of { pathname: string, route: RouteData }
      return defaultPrerenderer.getStaticPaths();
    },
    async render(request, { routeData }) {
      // request: Request
      // routeData: RouteData
      // Returns: Response
    },
    async teardown() {
      // Optional: called after all pages are prerendered
    }
  }));
}

Also adds the astro:static-paths virtual module, which exports a StaticPaths class for adapters to collect all prerenderable paths from within their target runtime. This is useful when implementing a custom prerenderer that runs in a non-Node environment:

// In your adapter's request handler (running in target runtime)
import { App } from 'astro/app';
import { StaticPaths } from 'astro:static-paths';

export function createApp(manifest) {
  const app = new App(manifest);

  return {
    async fetch(request) {
      const { pathname } = new URL(request.url);

      // Expose endpoint for prerenderer to get static paths
      if (pathname === '/__astro_static_paths') {
        const staticPaths = new StaticPaths(app);
        const paths = await staticPaths.getAll();
        return new Response(JSON.stringify({ paths }));
      }

      // Normal request handling
      return app.render(request);
    },
  };
}

See the adapter reference for more details on implementing a custom prerenderer.

#15345 840fbf9 Thanks @matthewp! - Adds a new emitClientAsset function to astro/assets/utils for integration authors. This function allows emitting assets that will be moved to the client directory during SSR builds, useful for assets referenced in server-rendered content that need to be available on the client.
```
import { emitClientAsset } from 'astro/assets/utils';

// Inside a Vite plugin's transform or load hook
const handle = emitClientAsset(this, {
  type: 'asset',
  name: 'my-image.png',
  source: imageBuffer,
});
```

Patch Changes

#15423 c5ea720 Thanks @matthewp! - Improves error message when a dynamic redirect destination does not match any existing route.

Previously, configuring a redirect like /categories/[category] → /categories/[category]/1 in static output mode would fail with a misleading "getStaticPaths required" error. Now, Astro detects this early and provides a clear error explaining that the destination does not match any existing route.
#15345 840fbf9 Thanks @matthewp! - Fixes an issue where .sql files (and other non-asset module types) were incorrectly moved to the client assets folder during SSR builds, causing "no such module" errors at runtime.

The ssrMoveAssets function now reads the Vite manifest to determine which files are actual client assets (CSS and static assets like images) and only moves those, leaving server-side module files in place.
#15422 68770ef Thanks @matthewp! - Upgrade to @astrojs/compiler@3.0.0-beta
Updated dependencies [a164c77]:
- @astrojs/internal-helpers@0.8.0-beta.1
- @astrojs/markdown-remark@7.0.0-beta.6

@astrojs/markdoc@1.0.0-beta.9

Minor Changes

#15345 840fbf9 Thanks @matthewp! - Uses Astro's new emitClientAsset API for image emission in content collections

Patch Changes

Updated dependencies [a164c77]:
- @astrojs/internal-helpers@0.8.0-beta.1
- @astrojs/markdown-remark@7.0.0-beta.6

@astrojs/internal-helpers@0.8.0-beta.1

Minor Changes

#15077 a164c77 Thanks @matthewp! - Adds normalizePathname() utility function for normalizing URL pathnames to match the canonical form used by route generation.

@astrojs/mdx@5.0.0-beta.6

Patch Changes

Updated dependencies []:
- @astrojs/markdown-remark@7.0.0-beta.6

@astrojs/netlify@7.0.0-beta.8

Patch Changes

Updated dependencies [a164c77]:
- @astrojs/internal-helpers@0.8.0-beta.1
- @astrojs/underscore-redirects@1.0.0

@astrojs/node@10.0.0-beta.3

Patch Changes

Updated dependencies [a164c77]:
- @astrojs/internal-helpers@0.8.0-beta.1

@astrojs/vercel@10.0.0-beta.3

Patch Changes

Updated dependencies [a164c77]:
- @astrojs/internal-helpers@0.8.0-beta.1

@astrojs/markdown-remark@7.0.0-beta.6

Patch Changes

Updated dependencies [a164c77]:
- @astrojs/internal-helpers@0.8.0-beta.1

fix(routing): improve error for invalid dynamic redirect destinations

withastro/astro

#15423 Feb 5

Changes

Adds early validation in createRedirectRoutes() to detect when a dynamic redirect destination doesn't match any existing route
Throws a new InvalidRedirectDestination error with a clear message instead of the misleading "getStaticPaths required" error
Only applies to static output mode (server mode handles dynamic redirects at runtime)

Closes #12036. Supersedes #14161 which was closed due to inactivity.

Testing

Added test case in packages/astro/test/redirects.test.js that reproduces the issue and verifies the new error message.

Docs

N/A, bug fix

Use the beta version of the compiler

withastro/astro

#15422 Feb 5

Changes

Upgrades to the beta version of the compiler

Testing

N/A

Docs

N/A

fix: remove left-over log in CSP

withastro/astro

#15421 Feb 5

Changes

Left over logging was left in the last beta, this should fix it

Testing

I mean

Docs

N/A

fix(create-astro): make --add stricter

withastro/astro

#15419 Feb 5

Changes

Closes #15420

I refactored the solution to make more generic and apply it to --add and astro add. We have a generic regex that checks wether the name follows the npmjs naming convention. If not, we throw an error.

I preferred to have this regex inside the internal helpers, so both create-astro and astro can use the same source of truth.

Note

Solution designed by me. Code and tests generated via AI. I checked all the code

Testing

Added various tests.

Added new tests. Tested manually

Docs

N/A

[ci] release (beta)

withastro/astro

#15416 Feb 5

⚠️⚠️⚠️⚠️⚠️⚠️

main is currently in pre mode so this branch has prereleases rather than normal releases. If you want to exit prereleases, run changeset pre exit on main.

⚠️⚠️⚠️⚠️⚠️⚠️

Releases

@astrojs/cloudflare@13.0.0-beta.5

Major Changes

#15400 41eb284 Thanks @florian-lefebvre! - Removes the workerEntryPoint option, which wasn't used anymore. Set the main field of your wrangler config instead

See how to migrate

Patch Changes

Updated dependencies []:
- @astrojs/underscore-redirects@1.0.0

astro@6.0.0-beta.9

Patch Changes

#15415 cc3c46c Thanks @ematipico! - Fixes an issue where CSP headers were incorrectly injected in the development server.
#15412 c546563 Thanks @florian-lefebvre! - Improves the AstroAdapter type and how legacy adapters are handled
#15421 bf62b6f Thanks @Princesseuh! - Removes unintended logging

fix: CSP headers in dev

withastro/astro

#15415 Feb 5

Changes

Found this issue while I was working on images + CSP. Decided to open a different PR.

Testing

Manually tested, and confirmed that I don't see headers in dev. Existing tests should pass.

Docs

N/A

fix(astro): ensure `req.url` has a starting `/` when modifying it in the internal base middleware

withastro/astro

#15414 Feb 5

Changes

This PR fixes the following error found in ecosystem-ci:

[ERROR] [vite] Internal server error: The specifiers must be a non-empty string. Received ""
https://github.com/vitejs/vite-ecosystem-ci/actions/runs/21699933912/job/62578172408#step:7:1774

This error was happening because astro's internal base middleware was assigning a string without the starting / to req.url.

Testing

Tested on ecosystem-ci: https://github.com/vitejs/vite-ecosystem-ci/actions/runs/21707585317/job/62602560591

Docs

No user facing change

feat: convert netlify and vercel adapters to new API

withastro/astro

#15413 Feb 5

Changes

Updates the netlify and vercel adapters to the new adapter API
The vercel adapter is updated to use web request/response now that Vercel supports it
I'll tackle node in a distinct PR as it should require bigger changes

Testing

Updated

Docs

Changesets, no docs needed

feat: better adapter type

withastro/astro

#15412 Feb 5

Changes

Depends on #15400
Improves the AstroAdapter type to better reflect reality, by using a discriminated union
Cleans up a few internals around legacy adapters

Testing

Should pass

Docs

Changeset, withastro/docs#13229

ci: update bench libs

withastro/astro

#15409 Feb 4

Changes

Let's see if this fixes the failures.

Testing

Green benchmarks

Docs

feat(csp): support responsive images

withastro/astro

#15407 Feb 4

Changes

Adds support for responsive images with CSP.

The solution was to refactor how the styles for responsive images are computed. Until now, they are computed at runtime and injected in the style attribute. This can't be supported via CSP for many reasons.

This PR moves the generation of the styles inside a virtual module, which generates the styles in a static way based on the configuration provided by the user.

The solution uses data attributes, no class names.

Note

The code was generated via Claude Code

Testing

Existing tests should pass. One test was updated due to how --fit and --pos are injected.
One test was moved to E2E because styles emitted via virtual modules are injected by vite after rendering, client side.

Docs

I still need to identify if this is a breaking change or not, and if it needs some docs update.

fix(deps): lock file maintenance language tools

withastro/astro

#15406 Feb 4

This PR contains the following updates:

Package	Type	Update	Change
		lockFileMaintenance	All locks refreshed
@volar/language-core (source)	devDependencies	patch	`~2.4.27` → `~2.4.28`
@volar/kit (source)	dependencies	patch	`~2.4.27` → `~2.4.28`
@volar/language-core (source)	dependencies	patch	`~2.4.27` → `~2.4.28`
@volar/language-server (source)	devDependencies	patch	`~2.4.27` → `~2.4.28`
@volar/language-server (source)	dependencies	patch	`~2.4.27` → `~2.4.28`
@volar/language-service (source)	dependencies	patch	`~2.4.27` → `~2.4.28`
@volar/test-utils (source)	devDependencies	patch	`~2.4.27` → `~2.4.28`
@volar/typescript (source)	dependencies	patch	`~2.4.27` → `~2.4.28`
@volar/typescript (source)	devDependencies	patch	`~2.4.27` → `~2.4.28`
@volar/vscode (source)	devDependencies	patch	`~2.4.27` → `~2.4.28`
prettier (source)	dependencies	patch	`^3.8.0` → `^3.8.1`
svelte (source)	dependencies	patch	`^5.0.0` → `^5.49.1`

🔧 This Pull Request updates lock files to use the latest dependency versions.

Configuration

📅 Schedule: Branch creation - "before 4am on monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

fix(deps): lock file maintenance astro dependencies

withastro/astro

#15405 Feb 4

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending
		lockFileMaintenance	All locks refreshed
@preact/signals (source)	dependencies	minor	`2.5.1` → `2.6.2`	`2.7.0`
preact (source)	dependencies	patch	`^10.28.2` → `^10.28.3`
unist-util-visit	dependencies	patch	`^5.0.0` → `^5.1.0`
cheerio (source)	devDependencies	minor	`1.1.2` → `1.2.0`
shiki (source)	devDependencies	patch	`^3.21.0` → `^3.22.0`
vite (source)	devDependencies	patch	`^7.1.7` → `^7.3.1`
svelte (source)	dependencies	patch	`^5.46.1` → `^5.49.1`
vue (source)	dependencies	patch	`^3.5.26` → `^3.5.27`
solid-js (source)	dependencies	patch	`^1.9.10` → `^1.9.11`
autoprefixer	dependencies	patch	`^10.4.23` → `^10.4.24`
react (source)	dependencies	patch	`^19.2.3` → `^19.2.4`
react-dom (source)	dependencies	patch	`^19.2.3` → `^19.2.4`
zod (source)	dependencies	patch	`^4.1.12` → `^4.3.6`
rollup (source)	devDependencies	patch	`^4.55.1` → `^4.57.1`
sass	devDependencies	patch	`^1.97.2` → `^1.97.3`
@astrojs/compiler (source)	dependencies	minor	`0.0.0-render-script-20251003120459` → `0.33.0`
@playwright/test (source)	devDependencies	minor	`1.57.0` → `1.58.1`
@types/http-cache-semantics (source)	devDependencies	patch	`^4.0.4` → `^4.2.0`
ci-info	dependencies	patch	`^4.3.1` → `^4.4.0`
fontace	dependencies	patch	`~0.4.0` → `~0.4.1`
shiki (source)	dependencies	patch	`^3.21.0` → `^3.22.0`
solid-js (source)	devDependencies	patch	`^1.9.10` → `^1.9.11`
undici (source)	devDependencies	patch	`^7.19.1` → `^7.19.2`	`7.20.0`
vite (source)	dependencies	patch	`^7.1.7` → `^7.3.1`
zod (source)	dependencies	patch	`^4.0.0` → `^4.3.6`
sass	dependencies	patch	`^1.97.2` → `^1.97.3`
@astrojs/mdx (source)	dependencies	patch	`^4.3.5` → `^4.3.13`
@types/react (source)	dependencies	patch	`^18.3.24` → `^18.3.27`
@vitejs/plugin-vue (source)	dependencies	patch	`^6.0.2` → `^6.0.3`	`6.0.4`
preact (source)	dependencies	patch	`^10.25.4` → `^10.28.3`
vue (source)	dependencies	patch	`^3.5.25` → `^3.5.27`
react (source)	dependencies	patch	`19.2.3` → `19.2.4`
react-dom (source)	dependencies	patch	`19.2.3` → `19.2.4`

🔧 This Pull Request updates lock files to use the latest dependency versions.

Release Notes

preactjs/signals (@preact/signals)

Package	Type	Update	Change	Pending
		lockFileMaintenance	All locks refreshed
@vercel/functions (source)	dependencies	patch	`^3.3.6` → `^3.4.0`	`3.4.1`
cheerio (source)	devDependencies	minor	`1.1.2` → `1.2.0`
fastify (source)	devDependencies	patch	`^5.7.0` → `^5.7.2`	`5.7.4` (+1)
@astrojs/mdx (source)	dependencies	patch	`^4.3.5` → `^4.3.13`
@netlify/vite-plugin (source)	dependencies	patch	`^2.7.19` → `^2.8.0`
@types/react (source)	dependencies	patch	`^18.3.24` → `^18.3.27`
vite (source)	dependencies	patch	`^7.1.7` → `^7.3.1`
@vitejs/plugin-vue (source)	dependencies	patch	`^6.0.2` → `^6.0.3`	`6.0.4`
svelte (source)	dependencies	patch	`^5.46.1` → `^5.49.1`
vue (source)	dependencies	patch	`^3.5.26` → `^3.5.27`
solid-js (source)	dependencies	patch	`^1.9.10` → `^1.9.11`
svelte (source)	dependencies	patch	`^5.46.3` → `^5.49.1`
vue (source)	dependencies	patch	`^3.5.25` → `^3.5.27`
@cloudflare/workers-types	devDependencies	patch	`^4.20260124.0` → `^4.20260131.0`	`4.20260203.0`
rollup (source)	devDependencies	patch	`^4.55.1` → `^4.57.1`

Package	Change	Type	Update	Pending
@astrojs/rss (source)	`^4.0.15-beta.3` → `^4.0.15`	dependencies	patch
@astrojs/sitemap (source)	`^3.6.1-beta.3` → `^3.7.0`	dependencies	minor
@playwright/test (source)	`1.58.0` → `1.58.1`	devDependencies	patch
@preact/signals (source)	`^2.6.1` → `^2.6.2`	dependencies	patch	`2.7.0`
alpinejs (source)	`^3.15.5` → `^3.15.6`	dependencies	patch	`3.15.8` (+1)
node (source)	`22.20.0` → `22.22.0`		minor
node	`22-bullseye` → `22.21.1-bullseye`	final	minor	`22.22.0`
open-props	`^1.7.17` → `^1.7.23`	dependencies	patch
pnpm (source)	`10.28.0` → `10.28.2`	packageManager	patch
preact (source)	`^10.28.2` → `^10.28.3`	dependencies	patch
shiki (source)	`^3.21.0` → `^3.22.0`	dependencies	minor
turbo (source)	`^2.8.0` → `^2.8.1`	devDependencies	patch	`2.8.3` (+1)

Algorithm / Encoding	`"hex"`	`"base64"`	`"base64url"`
`"md5"`	32	24 (22 + "==")	22
`"sha1"`	40	28 (27 + "=")	27
`"sha256"`	64	44 (43 + "=")	43
`"sha384"`	96	64 (no padding)	64
`"sha512"`	128	88 (86 + "==")	86

Package	Change	Age	Confidence
@types/react (source)	`^18.3.27` → `^19.2.10`
@types/react-dom (source)	`^18.3.7` → `^19.2.3`
react (source)	`^18.3.1` → `^19.2.4`
react-dom (source)	`^18.3.1` → `^19.2.4`

Description

Changes

Testing

Releases

@astrojs/cloudflare@13.0.0-beta.6

Major Changes

What should I do?

Minor Changes

Patch Changes

astro@6.0.0-beta.10

Minor Changes

Patch Changes

@astrojs/markdoc@1.0.0-beta.9

Minor Changes

Patch Changes

@astrojs/internal-helpers@0.8.0-beta.1

Minor Changes

@astrojs/mdx@5.0.0-beta.6

Patch Changes

@astrojs/netlify@7.0.0-beta.8

Patch Changes

@astrojs/node@10.0.0-beta.3

Patch Changes

@astrojs/vercel@10.0.0-beta.3

Patch Changes

@astrojs/markdown-remark@7.0.0-beta.6

Patch Changes

Changes

Testing

Docs

Changes

Testing

Docs

Changes

Testing

Docs

Changes

Testing

Docs

Releases

@astrojs/cloudflare@13.0.0-beta.5

Major Changes

Patch Changes

astro@6.0.0-beta.9

Patch Changes

Changes

Testing

Docs

Changes

Testing

Docs

Changes

Testing

Docs

Changes

Testing

Docs

Changes

Testing

Docs

Changes

Testing

Docs

Configuration

Release Notes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

What's Changed

New Contributors

v19.2.4: 19.2.4 (January 26th, 2026)

React Server Components

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

`v19.2.4`: 19.2.4 (January 26th, 2026)