diff --git a/.changeset/harden-dev-server-sec-fetch.md b/.changeset/harden-dev-server-sec-fetch.md new file mode 100644 index 000000000000..9360ae6cf0a0 --- /dev/null +++ b/.changeset/harden-dev-server-sec-fetch.md @@ -0,0 +1,5 @@ +--- +'astro': patch +--- + +Hardens the dev server by validating Sec-Fetch metadata headers to restrict cross-origin subresource requests diff --git a/.changeset/pre.json b/.changeset/pre.json index 0f8a73227f0e..a87f5bc6248b 100644 --- a/.changeset/pre.json +++ b/.changeset/pre.json @@ -95,6 +95,7 @@ "dull-mangos-travel", "eager-owls-stare", "early-badgers-pull", + "early-times-drop", "emit-client-asset-api", "encoding-static-builds", "every-carpets-grin", @@ -105,10 +106,13 @@ "fast-bushes-fall", "fast-wolves-render", "fifty-dingos-study", + "fix-action-prototype-traversal", + "fix-cloudflare-static-output", "fix-content-hmr", "fix-create-astro-registry-hang", "fix-font-head-swap", "fix-forwarded-proto-allowed-domains", + "fix-i18n-fallback-redirect", "fix-large-static-build-promise-all", "fix-large-static-routes-stack-overflow", "fix-markdoc-table-attributes", @@ -118,8 +122,11 @@ "fix-preact-cloudflare-hooks", "fix-rewrite-non-ascii-paths", "fix-serve-files-outside-srcdir", + "fix-server-island-dev-build-output", + "fix-session-regenerate-dirty", "fix-ssr-prerendered-image-deletion", "fix-store-race-condition", + "fix-svg-content-collection-component", "fix-svg-content-collection-deadlock", "fix-vite-runner-closed", "flat-lions-care", @@ -145,6 +152,9 @@ "green-zebras-lick", "grumpy-tables-serve", "happy-falcons-show", + "harden-attribute-escaping", + "harden-merge-responses-cookies", + "harden-xff-allowed-domains", "heavy-beers-unite", "heavy-cats-own", "heavy-parts-throw", @@ -152,6 +162,7 @@ "hojze-jglnm-ggfbv", "honest-deer-add", "hot-eyes-sink", + "humble-humans-sink", "hungry-jars-pump", "icy-pigs-smile", "internal-helpers-normalize-pathname", @@ -160,6 +171,7 @@ "khaki-bushes-stop", "khaki-toys-think", "kind-emus-relate", + "kind-hairs-report", "kind-pears-behave", "large-ears-ask", "large-keys-see", @@ -170,10 +182,12 @@ "legacy-collections-backwards-compat-docs", "light-parrots-find", "little-goats-poke", + "long-bushes-rest", "long-chefs-tie", "long-trams-see", "lovely-mice-sniff", "lowercase-style-tags", + "major-lights-kiss", "many-banks-hammer", "many-cars-hope", "markdoc-emit-client-asset", @@ -191,7 +205,9 @@ "open-monkeys-boil", "optional-wrangler-config", "orange-boats-refuse", + "polite-balloons-rhyme", "polite-terms-shop", + "preserve-directory-structure", "pretty-forks-smash", "proud-pans-change", "public-files-priority", @@ -203,6 +219,8 @@ "quiet-owls-jump", "ready-eagles-wink", "ready-tigers-try", + "red-quail-bite", + "redirect-catch-all-hardening", "remove-cloudflare-modules", "render-markdown-file-url", "render-markdown-frontmatter", @@ -213,6 +231,7 @@ "sad-lines-hear", "sad-teams-end", "server-island-slot-scripts", + "shiki-v4", "short-pears-hammer", "shy-cats-grin", "silly-eels-remain", @@ -221,13 +240,16 @@ "slick-plums-remain", "slimy-fans-sing", "slimy-queens-punch", + "slow-coins-write", "slow-laws-marry", "small-ghosts-sort", "smart-mammals-stop", + "smart-pillows-chew", "smooth-kids-tease", "social-jeans-mix", "social-kings-swim", "social-maps-shine", + "soft-vans-ask", "solid-fans-jam", "solid-sloths-call", "some-olives-march", @@ -252,6 +274,7 @@ "tender-bats-tan", "tender-moose-help", "thin-hands-find", + "thirty-experts-tickle", "three-sheep-burn", "tiny-books-scream", "tired-eels-cough", @@ -264,6 +287,7 @@ "vite-environments-breaking", "vite-plugin-react-v5", "vite-plugin-vue-v6", + "warm-comics-pump", "warm-donuts-learn", "warm-dots-glow", "wet-lines-wear", diff --git a/.changeset/purple-steaks-begin.md b/.changeset/purple-steaks-begin.md new file mode 100644 index 000000000000..e4f2236b3ca5 --- /dev/null +++ b/.changeset/purple-steaks-begin.md @@ -0,0 +1,5 @@ +--- +'astro': patch +--- + +Fixes a bug where some requests to the dev server didn't start with the leading `/`. diff --git a/examples/basics/package.json b/examples/basics/package.json index 089324517991..6577738f03b1 100644 --- a/examples/basics/package.json +++ b/examples/basics/package.json @@ -13,6 +13,6 @@ "astro": "astro" }, "dependencies": { - "astro": "^6.0.0-beta.17" + "astro": "^6.0.0-beta.18" } } diff --git a/examples/blog/package.json b/examples/blog/package.json index 8816b7b3cd53..f2fe6aafebea 100644 --- a/examples/blog/package.json +++ b/examples/blog/package.json @@ -13,10 +13,10 @@ "astro": "astro" }, "dependencies": { - "@astrojs/mdx": "^5.0.0-beta.9", + "@astrojs/mdx": "^5.0.0-beta.10", "@astrojs/rss": "^4.0.15-beta.4", "@astrojs/sitemap": "^3.6.1-beta.3", - "astro": "^6.0.0-beta.17", + "astro": "^6.0.0-beta.18", "sharp": "^0.34.3" } } diff --git a/examples/component/package.json b/examples/component/package.json index 6a544eb47985..66a9ff5f2551 100644 --- a/examples/component/package.json +++ b/examples/component/package.json @@ -18,7 +18,7 @@ ], "scripts": {}, "devDependencies": { - "astro": "^6.0.0-beta.17" + "astro": "^6.0.0-beta.18" }, "peerDependencies": { "astro": "^5.0.0 || ^6.0.0" diff --git a/examples/container-with-vitest/package.json b/examples/container-with-vitest/package.json index 878afcaf09a6..1c8b0fcdf6c0 100644 --- a/examples/container-with-vitest/package.json +++ b/examples/container-with-vitest/package.json @@ -15,7 +15,7 @@ }, "dependencies": { "@astrojs/react": "^5.0.0-beta.3", - "astro": "^6.0.0-beta.17", + "astro": "^6.0.0-beta.18", "react": "^18.3.1", "react-dom": "^18.3.1", "vitest": "^3.2.4" diff --git a/examples/framework-alpine/package.json b/examples/framework-alpine/package.json index a4e6c6f85d1b..d786b6c21c82 100644 --- a/examples/framework-alpine/package.json +++ b/examples/framework-alpine/package.json @@ -16,6 +16,6 @@ "@astrojs/alpinejs": "^0.5.0-beta.1", "@types/alpinejs": "^3.13.11", "alpinejs": "^3.15.8", - "astro": "^6.0.0-beta.17" + "astro": "^6.0.0-beta.18" } } diff --git a/examples/framework-multiple/package.json b/examples/framework-multiple/package.json index 666f4d1998f0..aa14e791aa22 100644 --- a/examples/framework-multiple/package.json +++ b/examples/framework-multiple/package.json @@ -20,7 +20,7 @@ "@astrojs/vue": "^6.0.0-beta.1", "@types/react": "^18.3.28", "@types/react-dom": "^18.3.7", - "astro": "^6.0.0-beta.17", + "astro": "^6.0.0-beta.18", "preact": "^10.28.4", "react": "^18.3.1", "react-dom": "^18.3.1", diff --git a/examples/framework-preact/package.json b/examples/framework-preact/package.json index cac6b7e114b7..f89d75a41969 100644 --- a/examples/framework-preact/package.json +++ b/examples/framework-preact/package.json @@ -15,7 +15,7 @@ "dependencies": { "@astrojs/preact": "^5.0.0-beta.4", "@preact/signals": "^2.8.1", - "astro": "^6.0.0-beta.17", + "astro": "^6.0.0-beta.18", "preact": "^10.28.4" } } diff --git a/examples/framework-react/package.json b/examples/framework-react/package.json index 6a3c48f9ef04..be59dfc0b627 100644 --- a/examples/framework-react/package.json +++ b/examples/framework-react/package.json @@ -16,7 +16,7 @@ "@astrojs/react": "^5.0.0-beta.3", "@types/react": "^18.3.28", "@types/react-dom": "^18.3.7", - "astro": "^6.0.0-beta.17", + "astro": "^6.0.0-beta.18", "react": "^18.3.1", "react-dom": "^18.3.1" } diff --git a/examples/framework-solid/package.json b/examples/framework-solid/package.json index 446682d44915..0adc50679cf7 100644 --- a/examples/framework-solid/package.json +++ b/examples/framework-solid/package.json @@ -14,7 +14,7 @@ }, "dependencies": { "@astrojs/solid-js": "^6.0.0-beta.2", - "astro": "^6.0.0-beta.17", + "astro": "^6.0.0-beta.18", "solid-js": "^1.9.11" } } diff --git a/examples/framework-svelte/package.json b/examples/framework-svelte/package.json index a57a592464a2..34e44e9b1345 100644 --- a/examples/framework-svelte/package.json +++ b/examples/framework-svelte/package.json @@ -14,7 +14,7 @@ }, "dependencies": { "@astrojs/svelte": "^8.0.0-beta.3", - "astro": "^6.0.0-beta.17", + "astro": "^6.0.0-beta.18", "svelte": "^5.53.5" } } diff --git a/examples/framework-vue/package.json b/examples/framework-vue/package.json index 587abc886c7e..4c0de677fc52 100644 --- a/examples/framework-vue/package.json +++ b/examples/framework-vue/package.json @@ -14,7 +14,7 @@ }, "dependencies": { "@astrojs/vue": "^6.0.0-beta.1", - "astro": "^6.0.0-beta.17", + "astro": "^6.0.0-beta.18", "vue": "^3.5.29" } } diff --git a/examples/hackernews/package.json b/examples/hackernews/package.json index b5019572b4d6..4bfb774d04ea 100644 --- a/examples/hackernews/package.json +++ b/examples/hackernews/package.json @@ -13,7 +13,7 @@ "astro": "astro" }, "dependencies": { - "@astrojs/node": "^10.0.0-beta.6", - "astro": "^6.0.0-beta.17" + "@astrojs/node": "^10.0.0-beta.7", + "astro": "^6.0.0-beta.18" } } diff --git a/examples/integration/package.json b/examples/integration/package.json index 74da1874298d..7327cf3a637b 100644 --- a/examples/integration/package.json +++ b/examples/integration/package.json @@ -18,7 +18,7 @@ ], "scripts": {}, "devDependencies": { - "astro": "^6.0.0-beta.17" + "astro": "^6.0.0-beta.18" }, "peerDependencies": { "astro": "^4.0.0" diff --git a/examples/minimal/package.json b/examples/minimal/package.json index 18f4714fab05..1c5d7d525809 100644 --- a/examples/minimal/package.json +++ b/examples/minimal/package.json @@ -13,6 +13,6 @@ "astro": "astro" }, "dependencies": { - "astro": "^6.0.0-beta.17" + "astro": "^6.0.0-beta.18" } } diff --git a/examples/portfolio/package.json b/examples/portfolio/package.json index 3189a474dec1..828e904a8c1a 100644 --- a/examples/portfolio/package.json +++ b/examples/portfolio/package.json @@ -13,6 +13,6 @@ "astro": "astro" }, "dependencies": { - "astro": "^6.0.0-beta.17" + "astro": "^6.0.0-beta.18" } } diff --git a/examples/ssr/package.json b/examples/ssr/package.json index de1905e3c1e9..8e6a32b827ae 100644 --- a/examples/ssr/package.json +++ b/examples/ssr/package.json @@ -14,9 +14,9 @@ "server": "node dist/server/entry.mjs" }, "dependencies": { - "@astrojs/node": "^10.0.0-beta.6", + "@astrojs/node": "^10.0.0-beta.7", "@astrojs/svelte": "^8.0.0-beta.3", - "astro": "^6.0.0-beta.17", + "astro": "^6.0.0-beta.18", "svelte": "^5.53.5" } } diff --git a/examples/starlog/package.json b/examples/starlog/package.json index f11da4f42517..de305ae40dfd 100644 --- a/examples/starlog/package.json +++ b/examples/starlog/package.json @@ -9,7 +9,7 @@ "astro": "astro" }, "dependencies": { - "astro": "^6.0.0-beta.17", + "astro": "^6.0.0-beta.18", "sass": "^1.97.3", "sharp": "^0.34.3" }, diff --git a/examples/toolbar-app/package.json b/examples/toolbar-app/package.json index 5273c8819a10..1856e6cdad9d 100644 --- a/examples/toolbar-app/package.json +++ b/examples/toolbar-app/package.json @@ -16,7 +16,7 @@ }, "devDependencies": { "@types/node": "^18.17.8", - "astro": "^6.0.0-beta.17" + "astro": "^6.0.0-beta.18" }, "engines": { "node": ">=22.12.0" diff --git a/examples/with-markdoc/package.json b/examples/with-markdoc/package.json index 0bbfdb06ff47..e4c3b09effce 100644 --- a/examples/with-markdoc/package.json +++ b/examples/with-markdoc/package.json @@ -13,7 +13,7 @@ "astro": "astro" }, "dependencies": { - "@astrojs/markdoc": "^1.0.0-beta.12", - "astro": "^6.0.0-beta.17" + "@astrojs/markdoc": "^1.0.0-beta.13", + "astro": "^6.0.0-beta.18" } } diff --git a/examples/with-mdx/package.json b/examples/with-mdx/package.json index 14bfefccf386..73f889680e39 100644 --- a/examples/with-mdx/package.json +++ b/examples/with-mdx/package.json @@ -13,9 +13,9 @@ "astro": "astro" }, "dependencies": { - "@astrojs/mdx": "^5.0.0-beta.9", + "@astrojs/mdx": "^5.0.0-beta.10", "@astrojs/preact": "^5.0.0-beta.4", - "astro": "^6.0.0-beta.17", + "astro": "^6.0.0-beta.18", "preact": "^10.28.4" } } diff --git a/examples/with-nanostores/package.json b/examples/with-nanostores/package.json index d31e628cf9a0..4a5536d3931f 100644 --- a/examples/with-nanostores/package.json +++ b/examples/with-nanostores/package.json @@ -15,7 +15,7 @@ "dependencies": { "@astrojs/preact": "^5.0.0-beta.4", "@nanostores/preact": "^1.0.0", - "astro": "^6.0.0-beta.17", + "astro": "^6.0.0-beta.18", "nanostores": "^1.1.1", "preact": "^10.28.4" } diff --git a/examples/with-tailwindcss/package.json b/examples/with-tailwindcss/package.json index 71b29a8c3638..f09645e978c7 100644 --- a/examples/with-tailwindcss/package.json +++ b/examples/with-tailwindcss/package.json @@ -13,10 +13,10 @@ "astro": "astro" }, "dependencies": { - "@astrojs/mdx": "^5.0.0-beta.9", + "@astrojs/mdx": "^5.0.0-beta.10", "@tailwindcss/vite": "^4.2.1", "@types/canvas-confetti": "^1.9.0", - "astro": "^6.0.0-beta.17", + "astro": "^6.0.0-beta.18", "canvas-confetti": "^1.9.4", "tailwindcss": "^4.2.1" } diff --git a/examples/with-vitest/package.json b/examples/with-vitest/package.json index 338345a2f410..ff8f1e55cc02 100644 --- a/examples/with-vitest/package.json +++ b/examples/with-vitest/package.json @@ -14,7 +14,7 @@ "test": "vitest" }, "dependencies": { - "astro": "^6.0.0-beta.17", + "astro": "^6.0.0-beta.18", "vitest": "^3.2.4" } } diff --git a/packages/astro/CHANGELOG.md b/packages/astro/CHANGELOG.md index 70a77fe62c7c..49786be75e72 100644 --- a/packages/astro/CHANGELOG.md +++ b/packages/astro/CHANGELOG.md @@ -1,5 +1,215 @@ # astro +## 6.0.0-beta.18 + +### Major Changes + +- [#15668](https://github.com/withastro/astro/pull/15668) [`1118ac4`](https://github.com/withastro/astro/commit/1118ac4f299341e15061e8a4e6e8423071c4d41c) Thanks [@florian-lefebvre](https://github.com/florian-lefebvre)! - Changes TypeScript configuration - ([v6 upgrade guidance](https://v6.docs.astro.build/en/guides/upgrade-to/v6/#changed-typescript-configuration)) + +- [#15726](https://github.com/withastro/astro/pull/15726) [`6f19ecc`](https://github.com/withastro/astro/commit/6f19ecc35adfb2ddaabbba2269630f95c13f5a57) Thanks [@ocavue](https://github.com/ocavue)! - Updates dependency `shiki` to v4 + + Check [Shiki's upgrade guide](https://shiki.style/blog/v4). + +### Minor Changes + +- [#15694](https://github.com/withastro/astro/pull/15694) [`66449c9`](https://github.com/withastro/astro/commit/66449c930e73e9a58ce547b9c32635a98a310966) Thanks [@matthewp](https://github.com/matthewp)! - Adds `preserveBuildClientDir` option to adapter features + + Adapters can now opt in to preserving the client/server directory structure for static builds by setting `preserveBuildClientDir: true` in their adapter features. When enabled, static builds will output files to `build.client` instead of directly to `outDir`. + + This is useful for adapters that require a consistent directory structure regardless of the build output type, such as deploying to platforms with specific file organization requirements. + + ```js + // my-adapter/index.js + export default function myAdapter() { + return { + name: 'my-adapter', + hooks: { + 'astro:config:done': ({ setAdapter }) => { + setAdapter({ + name: 'my-adapter', + adapterFeatures: { + buildOutput: 'static', + preserveBuildClientDir: true, + }, + }); + }, + }, + }; + } + ``` + +- [#15579](https://github.com/withastro/astro/pull/15579) [`08437d5`](https://github.com/withastro/astro/commit/08437d531e31b79a42333a9f7aabaa9fe646ce4f) Thanks [@ascorbic](https://github.com/ascorbic)! - Adds two new experimental flags for a Route Caching API and further configuration-level Route Rules for controlling SSR response caching. + + Route caching gives you a platform-agnostic way to cache server-rendered responses, based on web standard cache headers. You set caching directives in your routes using `Astro.cache` (in `.astro` pages) or `context.cache` (in API routes and middleware), and Astro translates them into the appropriate headers or runtime behavior depending on your adapter. You can also define cache rules for routes declaratively in your config using `experimental.routeRules`, without modifying route code. + + This feature requires on-demand rendering. Prerendered pages are already static and do not use route caching. + + #### Getting started + + Enable the feature by configuring `experimental.cache` with a cache provider in your Astro config: + + ```js + // astro.config.mjs + import { defineConfig } from 'astro/config'; + import node from '@astrojs/node'; + import { memoryCache } from 'astro/config'; + + export default defineConfig({ + adapter: node({ mode: 'standalone' }), + experimental: { + cache: { + provider: memoryCache(), + }, + }, + }); + ``` + + #### Using `Astro.cache` and `context.cache` + + In `.astro` pages, use `Astro.cache.set()` to control caching: + + ```astro + --- + // src/pages/index.astro + Astro.cache.set({ + maxAge: 120, // Cache for 2 minutes + swr: 60, // Serve stale for 1 minute while revalidating + tags: ['home'], // Tag for targeted invalidation + }); + --- + + Cached page + ``` + + In API routes and middleware, use `context.cache`: + + ```ts + // src/pages/api/data.ts + export function GET(context) { + context.cache.set({ + maxAge: 300, + tags: ['api', 'data'], + }); + return Response.json({ ok: true }); + } + ``` + + #### Cache options + + `cache.set()` accepts the following options: + - **`maxAge`** (number): Time in seconds the response is considered fresh. + - **`swr`** (number): Stale-while-revalidate window in seconds. During this window, stale content is served while a fresh response is generated in the background. + - **`tags`** (string[]): Cache tags for targeted invalidation. Tags accumulate across multiple `set()` calls within a request. + - **`lastModified`** (Date): When multiple `set()` calls provide `lastModified`, the most recent date wins. + - **`etag`** (string): Entity tag for conditional requests. + + Call `cache.set(false)` to explicitly opt out of caching for a request. + + Multiple calls to `cache.set()` within a single request are merged: scalar values use last-write-wins, `lastModified` uses most-recent-wins, and tags accumulate. + + #### Invalidation + + Purge cached entries by tag or path using `cache.invalidate()`: + + ```ts + // Invalidate all entries tagged 'data' + await context.cache.invalidate({ tags: ['data'] }); + + // Invalidate a specific path + await context.cache.invalidate({ path: '/api/data' }); + ``` + + #### Config-level route rules + + Use `experimental.routeRules` to set default cache options for routes without modifying route code. Supports Nitro-style shortcuts for ergonomic configuration: + + ```js + import { memoryCache } from 'astro/config'; + + export default defineConfig({ + experimental: { + cache: { + provider: memoryCache(), + }, + routeRules: { + // Shortcut form (Nitro-style) + '/api/*': { swr: 600 }, + + // Full form with nested cache + '/products/*': { cache: { maxAge: 3600, tags: ['products'] } }, + }, + }, + }); + ``` + + Route patterns support static paths, dynamic parameters (`[slug]`), and rest parameters (`[...path]`). Per-route `cache.set()` calls merge with (and can override) the config-level defaults. + + You can also read the current cache state via `cache.options`: + + ```ts + const { maxAge, swr, tags } = context.cache.options; + ``` + + #### Cache providers + + Cache behavior is determined by the configured **cache provider**. There are two types: + - **CDN providers** set response headers (e.g. `CDN-Cache-Control`, `Cache-Tag`) and let the CDN handle caching. Astro strips these headers before sending the response to the client. + - **Runtime providers** implement `onRequest()` to intercept and cache responses in-process, adding an `X-Astro-Cache` header (HIT/MISS/STALE) for observability. + + #### Built-in memory cache provider + + Astro includes a built-in, in-memory LRU runtime cache provider. Import `memoryCache` from `astro/config` to configure it. + + Features: + - In-memory LRU cache with configurable max entries (default: 1000) + - Stale-while-revalidate support + - Tag-based and path-based invalidation + - `X-Astro-Cache` response header: `HIT`, `MISS`, or `STALE` + - Query parameter sorting for better hit rates (`?b=2&a=1` and `?a=1&b=2` hit the same entry) + - Common tracking parameters (`utm_*`, `fbclid`, `gclid`, etc.) excluded from cache keys by default + - `Vary` header support — responses that set `Vary` automatically get separate cache entries per variant + - Configurable query parameter filtering via `query.exclude` (glob patterns) and `query.include` (allowlist) + + For more information on enabling and using this feature in your project, see the [Experimental Route Caching docs](https://docs.astro.build/en/reference/experimental-flags/route-caching/). + For a complete overview and to give feedback on this experimental API, see the [Route Caching RFC](https://github.com/withastro/roadmap/pull/1245). + +### Patch Changes + +- [#15721](https://github.com/withastro/astro/pull/15721) [`e6e146c`](https://github.com/withastro/astro/commit/e6e146cb0ac535e21c26f6b1c3d2f65be9dbdb4c) Thanks [@matthewp](https://github.com/matthewp)! - Fixes action route handling to return 404 for requests to prototype method names like `constructor` or `toString` used as action paths + +- [#15704](https://github.com/withastro/astro/pull/15704) [`862d77b`](https://github.com/withastro/astro/commit/862d77bd6c3e05e20fd58293f9577ae685a9b8c9) Thanks [@umutkeltek](https://github.com/umutkeltek)! - Fixes i18n fallback middleware intercepting non-404 responses + + The fallback middleware was triggering for all responses with status >= 300, including legitimate 3xx redirects, 403 forbidden, and 5xx server errors. This broke auth flows and form submissions on localized server routes. The fallback now correctly only triggers for 404 (page not found) responses. + +- [#15703](https://github.com/withastro/astro/pull/15703) [`829182b`](https://github.com/withastro/astro/commit/829182bbdfc307a005aea00ac8c00923f76efb08) Thanks [@matthewp](https://github.com/matthewp)! - Fixes server islands returning a 500 error in dev mode for adapters that do not set `adapterFeatures.buildOutput` (e.g. `@astrojs/netlify`) + +- [#15749](https://github.com/withastro/astro/pull/15749) [`573d188`](https://github.com/withastro/astro/commit/573d188de9a7e6635f24004291c3e71e0ddc7a7a) Thanks [@ascorbic](https://github.com/ascorbic)! - Fixes a bug that caused `session.regenerate()` to silently lose session data + + Previously, regenerated session data was not saved under the new session ID unless `set()` was also called. + +- [#15685](https://github.com/withastro/astro/pull/15685) [`1a323e5`](https://github.com/withastro/astro/commit/1a323e5c64c7c23212ed80546f593d930115d55c) Thanks [@jcayzac](https://github.com/jcayzac)! - Fix regression where SVG images in content collection `image()` fields could not be rendered as inline components. This behavior is now restored while preserving the TLA deadlock fix. + +- [#15740](https://github.com/withastro/astro/pull/15740) [`c5016fc`](https://github.com/withastro/astro/commit/c5016fc86c4928a26b49dbe144b5569d5d89ac04) Thanks [@matthewp](https://github.com/matthewp)! - Removes an escape hatch that skipped attribute escaping for URL values containing `&`, ensuring all dynamic attribute values are consistently escaped + +- [#15744](https://github.com/withastro/astro/pull/15744) [`fabb710`](https://github.com/withastro/astro/commit/fabb710c2514c5a1298e002dd961a1d79686f021) Thanks [@matthewp](https://github.com/matthewp)! - Fixes cookie handling during error page rendering to ensure cookies set by middleware are consistently included in the response + +- [#15742](https://github.com/withastro/astro/pull/15742) [`9d9699c`](https://github.com/withastro/astro/commit/9d9699c04aba7524bd3c8e1b8303691db19fa5bd) Thanks [@matthewp](https://github.com/matthewp)! - Hardens `clientAddress` resolution to respect `security.allowedDomains` for `X-Forwarded-For`, consistent with the existing handling of `X-Forwarded-Host`, `X-Forwarded-Proto`, and `X-Forwarded-Port`. The `X-Forwarded-For` header is now only used to determine `Astro.clientAddress` when the request's host has been validated against an `allowedDomains` entry. Without a matching domain, `clientAddress` falls back to the socket's remote address. + +- [#15696](https://github.com/withastro/astro/pull/15696) [`a9fd221`](https://github.com/withastro/astro/commit/a9fd221bda99db4660c241c494b6d3225eb4e51d) Thanks [@Princesseuh](https://github.com/Princesseuh)! - Fixes images not working in MDX when using the Cloudflare adapter in certain cases + +- [#15693](https://github.com/withastro/astro/pull/15693) [`4db2089`](https://github.com/withastro/astro/commit/4db2089a8e01cdb298c49f61817daf240ae07fa5) Thanks [@ArmandPhilippot](https://github.com/ArmandPhilippot)! - Fixes the links to Astro Docs to match the v6 structure. + +- [#15717](https://github.com/withastro/astro/pull/15717) [`4000aaa`](https://github.com/withastro/astro/commit/4000aaa2d361cbfc9bbf280a9b0e78e6db167945) Thanks [@matthewp](https://github.com/matthewp)! - Ensures that URLs with multiple leading slashes (e.g. `//admin`) are normalized to a single slash before reaching middleware, so that pathname checks like `context.url.pathname.startsWith('/admin')` work consistently regardless of the request URL format + +- [#15752](https://github.com/withastro/astro/pull/15752) [`918d394`](https://github.com/withastro/astro/commit/918d3949f3b92b1ae46dadd77cfb1404869c50bd) Thanks [@ascorbic](https://github.com/ascorbic)! - Fixes an issue where a session ID from a cookie with no matching server-side data was accepted as-is. The session now generates a new ID when the cookie value has no corresponding storage entry. + +- [#15743](https://github.com/withastro/astro/pull/15743) [`3b4252a`](https://github.com/withastro/astro/commit/3b4252a82a937fccbfd433d90a93ad524a7a6f7b) Thanks [@matthewp](https://github.com/matthewp)! - Hardens config-based redirects with catch-all parameters to prevent producing protocol-relative URLs (e.g. `//example.com`) in the `Location` header + +- [#15718](https://github.com/withastro/astro/pull/15718) [`14f37b8`](https://github.com/withastro/astro/commit/14f37b80aa2bd086cf31feccd5016c73a09822ae) Thanks [@florian-lefebvre](https://github.com/florian-lefebvre)! - Fixes a case where internal headers may leak when rendering error pages + +- Updated dependencies [[`6f19ecc`](https://github.com/withastro/astro/commit/6f19ecc35adfb2ddaabbba2269630f95c13f5a57), [`f94d3c5`](https://github.com/withastro/astro/commit/f94d3c5313e5a7576cf2cb316a85d68d335a188f)]: + - @astrojs/markdown-remark@7.0.0-beta.9 + ## 6.0.0-beta.17 ### Minor Changes diff --git a/packages/astro/package.json b/packages/astro/package.json index 29f211728d85..fd482524d5f1 100644 --- a/packages/astro/package.json +++ b/packages/astro/package.json @@ -1,6 +1,6 @@ { "name": "astro", - "version": "6.0.0-beta.17", + "version": "6.0.0-beta.18", "description": "Astro is a modern site builder with web best practices, performance, and DX front-of-mind.", "type": "module", "author": "withastro", diff --git a/packages/astro/src/vite-plugin-astro-server/base.ts b/packages/astro/src/vite-plugin-astro-server/base.ts index 23e04690fc2b..aea2a29f9865 100644 --- a/packages/astro/src/vite-plugin-astro-server/base.ts +++ b/packages/astro/src/vite-plugin-astro-server/base.ts @@ -1,6 +1,6 @@ import * as fs from 'node:fs'; import path from 'node:path'; -import { appendForwardSlash } from '@astrojs/internal-helpers/path'; +import { appendForwardSlash, prependForwardSlash } from '@astrojs/internal-helpers/path'; import colors from 'piccolore'; import type * as vite from 'vite'; import type { Logger } from '../core/logger/core.js'; @@ -32,6 +32,7 @@ export function baseMiddleware( if (pathname.startsWith(devRoot)) { req.url = url.replace(devRoot, devRootReplacement); + if (!req.url.startsWith('/')) req.url = prependForwardSlash(req.url); return next(); } diff --git a/packages/astro/src/vite-plugin-astro-server/plugin.ts b/packages/astro/src/vite-plugin-astro-server/plugin.ts index f2e5a8793461..50a0f04fc41b 100644 --- a/packages/astro/src/vite-plugin-astro-server/plugin.ts +++ b/packages/astro/src/vite-plugin-astro-server/plugin.ts @@ -31,6 +31,7 @@ import { createController } from './controller.js'; import { recordServerError } from './error.js'; import { setRouteError } from './server-state.js'; import { routeGuardMiddleware } from './route-guard.js'; +import { secFetchMiddleware } from './sec-fetch.js'; import { trailingSlashMiddleware } from './trailing-slash.js'; import { sessionConfigToManifest } from '../core/session/utils.js'; @@ -108,6 +109,11 @@ export default function createVitePluginAstroServer({ route: '', handle: routeGuardMiddleware(settings), }); + // Validate Sec-Fetch metadata headers to restrict cross-origin subresource requests + viteServer.middlewares.stack.unshift({ + route: '', + handle: secFetchMiddleware(logger, settings.config.security?.allowedDomains), + }); // Note that this function has a name so other middleware can find it. viteServer.middlewares.use(async function astroDevHandler(request, response) { diff --git a/packages/astro/src/vite-plugin-astro-server/sec-fetch.ts b/packages/astro/src/vite-plugin-astro-server/sec-fetch.ts new file mode 100644 index 000000000000..aa1630fd4640 --- /dev/null +++ b/packages/astro/src/vite-plugin-astro-server/sec-fetch.ts @@ -0,0 +1,82 @@ +import type { RemotePattern } from '@astrojs/internal-helpers/remote'; +import type * as vite from 'vite'; +import { BaseApp } from '../core/app/base.js'; +import type { Logger } from '../core/logger/core.js'; + +/** + * Middleware that validates Sec-Fetch metadata headers on incoming requests + * to block cross-origin subresource requests (e.g. `