[pull] main from withastro:main

.agents/skills/triage/comment.md

@@ -4,7 +4,7 @@ Generate a GitHub issue comment from triage findings.
 
 **CRITICAL: You MUST always read `report.md` and produce a GitHub comment as your final output, regardless of what input files are available. Even if `report.md` is missing or empty, you must still produce a comment. In that case, produce a minimal comment stating that automated triage could not be completed.**
 
-**SCOPE: Your job is comment generation only. Finish your work once you've completed this workflow. Do NOT go further than this. It is no longer time to attempt reproduction, diagnosis, or fixing of the issue.**
+**SCOPE: Your job is comment generation only. Finish your work once you've completed this workflow. Do NOT go further than this. It is no longer time to attempt reproduction, diagnosis, or fixing of the issue. Do not spawn tasks/sub-agents.**
 
 ## Prerequisites
 

.agents/skills/triage/diagnose.md

@@ -4,7 +4,7 @@ Find the root cause of a reproduced bug in the Astro source code.
 
 **CRITICAL: You MUST always read `report.md` and append to `report.md` before finishing, regardless of outcome. Even if you cannot identify the root cause, hit errors, or the investigation is inconclusive — always update `report.md` with your findings. The orchestrator and downstream skills depend on this file to determine what happened.**
 
-**SCOPE: Your job is diagnosis only. Finish your work once you've completed this workflow. Do NOT go further than this (no larger verification of the issue, no fixing of the issue, etc.).**
+**SCOPE: Your job is diagnosis only. Finish your work once you've completed this workflow. Do NOT go further than this (no larger verification of the issue, no fixing of the issue, etc.). Do not spawn tasks/sub-agents.**
 
 ## Prerequisites
 

.agents/skills/triage/fix.md

@@ -4,6 +4,8 @@ Develop and verify a fix for a diagnosed Astro bug.
 
 **CRITICAL: You MUST always read `report.md` and append to `report.md` before finishing, regardless of outcome. Even if the fix attempt fails, you encounter errors, or you cannot resolve the bug — always update `report.md` with your findings. The orchestrator and downstream skills depend on this file to determine what happened.**
 
+**SCOPE: Do not spawn tasks/sub-agents.**
+
 ## Prerequisites
 
 These variables are referenced throughout this skill. They may be passed as args by an orchestrator, or inferred from the conversation when run standalone.

.agents/skills/triage/reproduce.md

@@ -4,7 +4,7 @@ Reproduce a GitHub issue to determine if a bug is valid and reproducible.
 
 **CRITICAL: You MUST always read `report.md` and write `report.md` to the triage directory before finishing, regardless of outcome. Even if you encounter errors, cannot reproduce the bug, hit unexpected problems, or need to skip — always write `report.md`. The orchestrator and downstream skills depend on this file to determine what happened. If you finish without writing it, the entire pipeline fails silently.**
 
-**SCOPE: Your job is reproduction only. Finish your work once you've completed this workflow. Do NOT go further than this (no larger diagnosis of the issue, no fixing of the issue, etc.).**
+**SCOPE: Your job is reproduction only. Finish your work once you've completed this workflow. Do NOT go further than this (no larger diagnosis of the issue, no fixing of the issue, etc.). Do not spawn tasks/sub-agents.**
 
 ## Prerequisites
 

.agents/skills/triage/verify.md

@@ -4,7 +4,7 @@ Verify whether a GitHub issue describes an actual bug or a misunderstanding of i
 
 **CRITICAL: You MUST always read `report.md` and append to `report.md` before finishing, regardless of outcome. Even if you cannot reach a conclusion — always update `report.md` with your findings. The orchestrator and downstream skills depend on this file to determine what happened.**
 
-**SCOPE: Your job is verification only. Finish your work once you've completed this workflow. Do NOT go further than this (no fixing of the issue, etc.).**
+**SCOPE: Your job is verification only. Finish your work once you've completed this workflow. Do NOT go further than this (no fixing of the issue, etc.). Do not spawn tasks/sub-agents.**
 
 ## Prerequisites
 

.changeset/thirty-experts-tickle.md

@@ -0,0 +1,41 @@
+---
+'@astrojs/node': major
+---
+
+Removes the `experimentalErrorPageHost` option
+
+This option allowed fetching a prerendered error page from a different host than the server is currently running on.
+
+However, there can be security implications with prefetching from other hosts, and often more customization was required to do this safely. This has now been removed as a built-in option so that you can implement your own secure solution as needed and appropriate for your project via middleware.
+
+#### What should I do?
+
+If you were previously using this feature, you must remove the option from your adapter configuration as it no longer exists:
+
+```diff
+// astro.config.mjs
+import { defineConfig } from 'astro/config'
+import node from '@astrojs/node'
+
+export default defineConfig({
+  adapter: node({
+    mode: 'standalone',
+-    experimentalErrorPageHost: 'http://localhost:4321'
+  })
+})
+```
+
+You can replicate the previous behavior by checking the response status in a middleware and fetching the prerendered page yourself:
+
+```ts
+// src/middleware.ts
+import { defineMiddleware } from 'astro:middleware'
+
+export const onRequest = defineMiddleware(async (ctx, next) => {
+	const response = await next()
+	if (response.status === 404 || response.status === 500) {
+		return fetch(`http://localhost:4321/${response.status}.html`);
+	}
+	return response
+})
+```

.flue/sandbox/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24.13.1-bookworm-slim
+FROM node:24.14.0-bookworm-slim
 
 # Avoid interactive prompts during package installation
 ENV DEBIAN_FRONTEND=noninteractive

.gitignore

@@ -2,6 +2,7 @@ node_modules/
 /triage/
 /.compiler/
 dist/
+temp/
 *.tsbuildinfo
 .DS_Store
 .vercel

.nvmrc

@@ -1 +1 @@
-24.13.1
+24.14.0

examples/basics/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/blog/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/container-with-vitest/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/framework-alpine/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/framework-multiple/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/framework-multiple/package.json

@@ -25,7 +25,7 @@
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "solid-js": "^1.9.11",
-    "svelte": "^5.53.0",
-    "vue": "^3.5.28"
+    "svelte": "^5.53.5",
+    "vue": "^3.5.29"
   }
 }

examples/framework-preact/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/framework-react/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/framework-solid/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/framework-svelte/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/framework-svelte/package.json

@@ -15,6 +15,6 @@
   "dependencies": {
     "@astrojs/svelte": "^8.0.0-beta.3",
     "astro": "^6.0.0-beta.17",
-    "svelte": "^5.53.0"
+    "svelte": "^5.53.5"
   }
 }

examples/framework-vue/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/framework-vue/package.json

@@ -15,6 +15,6 @@
   "dependencies": {
     "@astrojs/vue": "^6.0.0-beta.1",
     "astro": "^6.0.0-beta.17",
-    "vue": "^3.5.28"
+    "vue": "^3.5.29"
   }
 }

examples/hackernews/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/minimal/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/portfolio/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/ssr/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/ssr/package.json

@@ -17,6 +17,6 @@
     "@astrojs/node": "^10.0.0-beta.6",
     "@astrojs/svelte": "^8.0.0-beta.3",
     "astro": "^6.0.0-beta.17",
-    "svelte": "^5.53.0"
+    "svelte": "^5.53.5"
   }
 }

examples/toolbar-app/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/with-markdoc/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/with-mdx/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/with-nanostores/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/with-nanostores/package.json

@@ -16,7 +16,7 @@
     "@astrojs/preact": "^5.0.0-beta.4",
     "@nanostores/preact": "^1.0.0",
     "astro": "^6.0.0-beta.17",
-    "nanostores": "^1.1.0",
+    "nanostores": "^1.1.1",
     "preact": "^10.28.4"
   }
 }

examples/with-tailwindcss/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

examples/with-tailwindcss/package.json

@@ -14,10 +14,10 @@
   },
   "dependencies": {
     "@astrojs/mdx": "^5.0.0-beta.9",
-    "@tailwindcss/vite": "^4.2.0",
+    "@tailwindcss/vite": "^4.2.1",
     "@types/canvas-confetti": "^1.9.0",
     "astro": "^6.0.0-beta.17",
     "canvas-confetti": "^1.9.4",
-    "tailwindcss": "^4.2.0"
+    "tailwindcss": "^4.2.1"
   }
 }

examples/with-vitest/.codesandbox/Dockerfile

@@ -1 +1 @@
-FROM node:24.13.1-bullseye
+FROM node:24.14.0-bullseye

package.json

@@ -55,7 +55,7 @@
   "engines": {
     "node": ">=22.12.0"
   },
-  "packageManager": "pnpm@10.30.1",
+  "packageManager": "pnpm@10.30.3",
   "dependencies": {
     "astro-benchmark": "workspace:*"
   },
@@ -64,22 +64,22 @@
     "@biomejs/biome": "2.4.2",
     "@changesets/changelog-github": "^0.5.2",
     "@changesets/cli": "^2.29.8",
-    "@flue/cli": "^0.0.44",
-    "@flue/client": "^0.0.27",
+    "@flue/cli": "^0.0.47",
+    "@flue/client": "^0.0.29",
     "@types/node": "^18.19.115",
     "bgproc": "^0.2.0",
     "esbuild": "0.25.5",
-    "eslint": "^9.39.2",
+    "eslint": "^9.39.3",
     "eslint-plugin-regexp": "^3.0.0",
     "knip": "5.82.1",
     "only-allow": "^1.2.2",
     "prettier": "^3.8.1",
     "prettier-plugin-astro": "^0.14.1",
     "publint": "^0.3.17",
     "tinyglobby": "^0.2.15",
-    "turbo": "^2.8.10",
+    "turbo": "^2.8.11",
     "typescript": "~5.9.3",
-    "typescript-eslint": "^8.56.0",
+    "typescript-eslint": "^8.56.1",
     "valibot": "^1.2.0"
   }
 }

packages/astro-rss/package.json

@@ -32,7 +32,7 @@
     "xml2js": "0.6.2"
   },
   "dependencies": {
-    "fast-xml-parser": "^5.3.7",
+    "fast-xml-parser": "^5.4.1",
     "piccolore": "^0.1.3",
     "zod": "^4.3.6"
   }

packages/integrations/node/src/index.ts

@@ -29,22 +29,10 @@ export function getAdapter({ staticHeaders }: Pick<Options, 'staticHeaders'>): A
 	};
 }
 
-const protocols = ['http:', 'https:'];
-
 export default function createIntegration(userOptions: UserOptions): AstroIntegration {
 	if (!userOptions?.mode) {
 		throw new AstroError(`Setting the 'mode' option is required.`);
 	}
-	const { experimentalErrorPageHost } = userOptions;
-	if (
-		experimentalErrorPageHost &&
-		(!URL.canParse(experimentalErrorPageHost) ||
-			!protocols.includes(new URL(experimentalErrorPageHost).protocol))
-	) {
-		throw new AstroError(
-			`Invalid experimentalErrorPageHost: ${experimentalErrorPageHost}. It should be a valid URL.`,
-		);
-	}
 
 	let _config: AstroConfig | undefined = undefined;
 	let _routeToHeaders: RouteToHeaders | undefined = undefined;
@@ -90,7 +78,6 @@ export default function createIntegration(userOptions: UserOptions): AstroIntegr
 								host: _config.server.host,
 								port: _config.server.port,
 								staticHeaders: userOptions.staticHeaders ?? false,
-								experimentalErrorPageHost,
 							}),
 						],
 					},

packages/integrations/node/src/serve-app.ts

@@ -62,22 +62,15 @@ export function createAppHandler(app: BaseApp, options: Options): RequestHandler
 	// Read prerendered error pages directly from disk instead of fetching over HTTP.
 	// This avoids SSRF risks and is more efficient.
 	const prerenderedErrorPageFetch = async (url: string): Promise<Response> => {
-		if (url.includes('/404')) {
+		const { pathname } = new URL(url);
+		if (pathname.endsWith('/404.html') || pathname.endsWith('/404/index.html')) {
 			const response = await readErrorPageFromDisk(client, 404);
 			if (response) return response;
 		}
-		if (url.includes('/500')) {
+		if (pathname.endsWith('/500.html') || pathname.endsWith('/500/index.html')) {
 			const response = await readErrorPageFromDisk(client, 500);
 			if (response) return response;
 		}
-		// Fallback: if experimentalErrorPageHost is configured, fetch from there
-		if (options.experimentalErrorPageHost) {
-			const originUrl = new URL(options.experimentalErrorPageHost);
-			const errorPageUrl = new URL(url);
-			errorPageUrl.protocol = originUrl.protocol;
-			errorPageUrl.host = originUrl.host;
-			return fetch(errorPageUrl);
-		}
 		// No file found and no fallback configured - return empty response
 		return new Response(null, { status: 404 });
 	};

packages/integrations/node/src/types.ts

@@ -20,15 +20,6 @@ export interface UserOptions {
 	 * - The CSP header of the static pages is added when CSP support is enabled.
 	 */
 	staticHeaders?: boolean;
-
-	/**
-	 * The host that should be used if the server needs to fetch the prerendered error page.
-	 * If not provided, this will default to the host of the server. This should be set if the server
-	 * should fetch prerendered error pages from a different host than the public URL of the server.
-	 * This is useful for example if the server is behind a reverse proxy or a load balancer, or if
-	 * static files are hosted on a different domain. Do not include a path in the URL: it will be ignored.
-	 */
-	experimentalErrorPageHost?: string | URL;
 }
 
 export interface Options extends UserOptions {