Skip to content

chore: another merge, plus lost fixes#16464

Open
ematipico wants to merge 156 commits intonextfrom
fix/merge-again-and-fixes
Open

chore: another merge, plus lost fixes#16464
ematipico wants to merge 156 commits intonextfrom
fix/merge-again-and-fixes

Conversation

@ematipico
Copy link
Copy Markdown
Member

@ematipico ematipico commented Apr 23, 2026

Changes

Some fixes were lost from the last merge. Plus, we needed a fix main that fixed some failures coming from the cloudflare adapter.

Testing

Green CI for test. Smoke tests don't have next branch.

Astro check fails but I don't know why.

Docs

matthewp and others added 30 commits March 30, 2026 16:34
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…pdate (#16124)

* fix(content): clear stale asset imports on content collection entry update

* fix lint errors
…#16110)

* fix(core): append assetQueryParams to inter-chunk JS imports (#15964)

* Add changeset for inter-chunk skew protection fix
* fix(vercel): edge middleware next() drops HTTP method and body

* fix: conditional and format-sensitive
* Update dev head metadata for non-runnable pipeline

* Refine non-runnable component metadata loading

* Load component metadata in non-runnable dev

* Remove unused export for virtual component metadata constant

* Add docs for virtual component metadata module
…to 'node' (#16162)

Co-authored-by: Matthew Phillips <matthewphillips@cloudflare.com>
…nts (#16142)

* fix(container): don't escape slot HTML in renderToString during build

* performance issue

* oops

* apply Erika's suggestion

* use `isHTMLString` within `markHTMLString`

* simplify test fixtures

* format

* remove the no longer used `Symbol.toStringTag` from `HTMLString`

* rename to `htmlStringSymbol`

* update changeset

* Apply suggestion from @ematipico

---------

Co-authored-by: Emanuele Stoppa <my.burning@gmail.com>
…16034)

Co-authored-by: astrobot-houston <fred+astrobot@astro.build>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…16154)

* Fix periods in URLs with trailing slashes causing 404s in dev server (#16140)

Pages with dots in their filenames (e.g. `hello.world.astro`) were incorrectly
treated as file-extension paths, forcing `trailingSlash: 'never'` regardless of
user config. Only endpoints with file extensions should force this behavior.

* ci: retry flaky e2e tests

* ci: retry flaky e2e tests

---------

Co-authored-by: Matthew Phillips <matthewphillips@cloudflare.com>
)

* docs(language-tools): mention js/ts settings namespace in vscode

* Apply suggestion from @Copilot

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Matthew Phillips <matthew@matthewphillips.info>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…6183)

A spurious import of createLoggerFromFlags from cli/flags.ts was added
to the client-side PostComment.tsx component via a sync commit, breaking
hydration and causing Comment and Logout tests to fail.
…rts (#16059)

* fix: preserve viteServer.restart wrapper chain for Cloudflare adapter

* add changeset

* fix: use Vite in-place restart for config changes to preserve Cloudflare miniflare instance

* use vite.resolveConfig to get a proper ResolvedConfig instead of patching inlineConfig

* fix watcher listener accumulation, null-check hot.send, move restartInFlight to finally, add tests

* fix port drift on restart by passing current httpServer port to createVite

* remove non-actionable CSP dev warning

* merge main, fix restart tests to use static fixture dir
* fix(astro): remove unused re-exports causing Vite build warning (#16188)

* chore: add changeset

---------

Co-authored-by: astrobot-houston <fred+astrobot@astro.build>
…seAge (#16211)

* Exclude astro-og-canvas@0.11.0 from minimumReleaseAge

* Exclude @types/node@24.12.2 from minimumReleaseAge
ocavue and others added 18 commits April 21, 2026 17:24
* refactor(astro): migrate all remaining tests to typescript

* Fix renderHead
* fix(deps): upgrade vite, picomatch, unstorage to address security advisories

- vite: ^7.3.1 → ^7.3.2 (GHSA-4w7w-66w2-5vf9, GHSA-v2wj-q39q-566r, GHSA-p9ff-h696-f583)
- picomatch: ^4.0.3 → ^4.0.4 (GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj)
- unstorage: ^1.17.4 → ^1.17.5 (pulls h3 ^1.15.10 → defu ^6.1.6, fixing GHSA-737v-mqg7-c878)
- pnpm overrides for transitive picomatch 2.x and vite 7.x in monorepo

* chore: add changeset
* fix(astro): harden nested object path lookups

* refactor: deduplicate FORBIDDEN_PATH_KEYS into @astrojs/internal-helpers/object

* Update .changeset/harden-object-path-lookups.md

Co-authored-by: Emanuele Stoppa <estoppa@cloudflare.com>

---------

Co-authored-by: Emanuele Stoppa <estoppa@cloudflare.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore(ci): harden command execution paths

* chore(ci): split out upgrade command hardening

* fix(ci): restore shell spawn on Windows for turbo-run-affected

The shell is required on Windows because turbo filter arguments contain
special characters (globs, brackets, etc.) that cause EINVAL errors
when passed directly to CreateProcess without a shell.
* chore: annotate trusted semgrep patterns

* chore: remove changeset from semgrep annotation PR
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…jection (#16458)

* fix(cloudflare): default compatibility_date to avoid workerd future date rejection

The @cloudflare/vite-plugin defaults compatibility_date to today's date
via getTodaysCompatDate(), but workerd rejects dates past its binary's
max supported date (~7 days from build). Set a hard-coded default in the
Astro config customizer so users without a wrangler config are not affected.

* remove unused export to fix knip lint
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actions github-actions Bot added pkg: integration Related to any renderer integration (scope) pkg: astro Related to the core `astro` package (scope) labels Apr 23, 2026
@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Apr 23, 2026

⚠️ No Changeset found

Latest commit: 4eb2f01

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 23, 2026

📊 Dependency Size Changes

Warning

This PR adds 11 MB of new dependencies, which exceeds the threshold of 100 kB.

📦 Package 📏 Size
@napi-rs/wasm-runtime@1.1.1 5.2 MB
@emnapi/core@1.8.1 1.8 MB
undici@7.24.0 1.6 MB
lru-cache@11.2.6 841.2 kB
h3@1.15.5 528.2 kB
@emnapi/runtime@1.8.1 424.1 kB
@emnapi/wasi-threads@1.1.0 227.5 kB
postcss@8.5.10 204.2 kB
@rolldown/binding-linux-x64-gnu@1.0.0-rc.15 → @rolldown/binding-linux-x64-gnu@1.0.0-rc.16 86 kB
cookie-es@1.2.2 47.5 kB
vite@8.0.8 → vite@8.0.9 9.1 kB
@rolldown/pluginutils@1.0.0-rc.15 → @rolldown/pluginutils@1.0.0-rc.4 -359 B
rolldown@1.0.0-rc.15 → rolldown@1.0.0-rc.16 -13 B
@oxc-project/types@0.124.0 → @oxc-project/types@0.126.0 0 B

Total size change: 11 MB

⚠️ Package Trust Level Decreased

Caution

Decreased trust levels may indicate a higher risk of supply chain attacks. Please review these changes carefully.

📦 Package 🔒 Before 🔓 After
@emnapi/wasi-threads trusted-with-provenance none

@ematipico ematipico marked this pull request as ready for review April 24, 2026 14:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pkg: astro Related to the core `astro` package (scope) pkg: integration Related to any renderer integration (scope)

Projects

None yet

Development

Successfully merging this pull request may close these issues.