2fa19c4 - Improved error handling in the rendering phase
Added defensive validation in App.render() and #renderError() to provide a descriptive error message when a route module doesn’t have a valid page function.
#15199d8e64ef Thanks @ArmandPhilippot! - Fixes the links to Astro Docs so that they match the current docs structure.
#15169b803d8b Thanks @rururux! - fix: fix image 500 error when moving dist directory in standalone Node
#146229b35c62 Thanks @aprici7y! - Fixes CSS url() references to public assets returning 404 in dev mode when base path is configured
#151256feb0d7 Thanks @florian-lefebvre! - Improves JSDoc annotations for AstroGlobal, AstroSharedContext and APIContext types
#151769265546 Thanks @matthewp! - Fixes hydration for framework components inside MDX when using Astro.slots.render()
Previously, when multiple framework components with client:* directives were passed as named slots to an Astro component in MDX, only the first slot would hydrate correctly. Subsequent slots would render their HTML but fail to include the necessary hydration scripts.
#1512106261e0 Thanks @ematipico! - Fixes a bug where the Astro, with the Cloudlfare integration, couldn’t correctly serve certain routes in the development server.
#151256feb0d7 Thanks @florian-lefebvre! - Fixes images not working in development when using setups with port forwarding
#151372f70bf1 Thanks @matthewp! - Adds legacy.collectionsBackwardsCompat flag that restores v5 backwards compatibility behavior for legacy content collections - (v6 upgrade guidance)
When enabled, this flag allows:
Collections defined without loaders (automatically get glob loader)
Collections with type: 'content' or type: 'data'
Config files located at src/content/config.ts (legacy location)
Legacy entry API: entry.slug and entry.render() methods
Path-based entry IDs instead of slug-based IDs
astro.config.mjs
exportdefaultdefineConfig({
legacy: {
collectionsBackwardsCompat: true,
},
});
This is a temporary migration helper for v6 upgrades. Migrate collections to the Content Layer API, then disable this flag.
Changes the font format downloaded by default when using the experimental Fonts API. Additionally, adds a new formats configuration option to specify which font formats to download.
Previously, Astro was opinionated about which font sources would be kept for usage, mainly keeping woff2 and woff files.
You can now specify what font formats should be downloaded (if available). Only woff2 files are downloaded by default.
What should I do?
If you were previously relying on Astro downloading the woff format, you will now need to specify this explicitly with the new formats configuration option. Additionally, you may also specify any additional file formats to download if available:
astro.config.mjs
import { defineConfig, fontProviders } from 'astro/config'
export default defineConfig({
experimental: {
fonts: [{
name: 'Roboto',
cssVariable: '--font-roboto',
provider: fontProviders.google(),
formats: ['woff2', 'woff', 'otf']
}]
}
})
#151798c8aee6 Thanks @HiDeoo! - Fixes an issue when importing using an import alias a file with a name matching a directory name.
#151769265546 Thanks @matthewp! - Fixes scripts in components not rendering when a sibling <Fragment slot="..."> exists but is unused
#15150a77c4f4 Thanks @matthewp! - Fixes hydration for framework components inside MDX when using Astro.slots.render()
Previously, when multiple framework components with client:* directives were passed as named slots to an Astro component in MDX, only the first slot would hydrate correctly. Subsequent slots would render their HTML but fail to include the necessary hydration scripts.
Changes how font providers are implemented with updates to the FontProvider type
This is an implementation detail that changes how font providers are created. This process allows Astro to take more control rather than relying directly on unifont types. All of Astro’s built-in font providers have been updated to reflect this new type, and can be configured as before. However, using third-party unifont providers that rely on unifont types will require an update to your project code.
Previously, an Astro FontProvider was made of a config and a runtime part. It relied directly on unifont types, which allowed a simple configuration for third-party unifont providers, but also coupled Astro’s implementation to unifont, which was limiting.
Astro’s font provider implementation is now only made of a config part with dedicated hooks. This allows for the separation of config and runtime, but requires you to create a font provider object in order to use custom font providers (e.g. third-party unifont providers, or private font registeries).
What should I do?
If you were using a 3rd-party unifont font provider, you will now need to write an Astro FontProvider using it under the hood. For example:
astro.config.ts
import { defineConfig } from "astro/config";
import { acmeProvider, type AcmeOptions } from '@acme/unifont-provider'
import type { FontProvider } from "astro";
import type { InitializedProvider } from 'unifont';
function acme(config?: AcmeOptions): FontProvider {
const provider = acmeProvider(config);
let initializedProvider: InitializedProvider | undefined;
#1512481db3c0 Thanks @leonace924! - Fixes an issue where requests with query parameters to the base path would return a 404 if trailingSlash was not 'ignore' in development
#1515239ee41f Thanks @rururux! - Fixes a case where context.cookies.set() would be overriden when setting cookies via response headers in development
Changes the font format downloaded by default when using the experimental Fonts API. Additionally, adds a new formats configuration option to specify which font formats to download.
Previously, Astro was opinionated about which font sources would be kept for usage, mainly keeping woff2 and woff files.
You can now specify what font formats should be downloaded (if available). Only woff2 files are downloaded by default.
What should I do?
If you were previously relying on Astro downloading the woff format, you will now need to specify this explicitly with the new formats configuration option. Additionally, you may also specify any additional file formats to download if available:
astro.config.mjs
import { defineConfig, fontProviders } from 'astro/config'
For greater flexibility and improved consistency with other Astro code, session drivers are now specified as an object:
import { defineConfig } from 'astro/config'
import { defineConfig, sessionDrivers } from 'astro/config'
export default defineConfig({
session: {
driver: 'redis',
options: {
url: process.env.REDIS_URL
},
driver: sessionDrivers.redis({
url: process.env.REDIS_URL
}),
}
})
Specifying the session driver as a string has been deprecated, but will continue to work until this feature is removed completely in a future major version. The object shape is the current recommended and documented way to configure a session driver.
#150475580372 Thanks @matthewp! - Fixes wrangler config template in astro add cloudflare to use correct entrypoint and compatibility date
#15053674b63f Thanks @matthewp! - Excludes astro:* and virtual:astro:* from client optimizeDeps in core. Needed for prefetch users since virtual modules are now in the dependency graph.
#149826849e38 Thanks @Princesseuh! - Fixes images outside the project directory not working when using astro:assets in development mode
#149879dd9fca Thanks @Princesseuh! - Fixes SVGs not working in dev mode when using the passthrough image service
#15014a178422 Thanks @delucis! - Adds support for extending the type of the props accepted by Astro’s <Image> component, <Picture> component, and getImage() API.
#14759d7889f7 Thanks @florian-lefebvre! - Removes the option to define dynamic schemas in content loaders as functions and adds a new equivalent createSchema() property (Loader API) - (v6 upgrade guidance)
#14306141c4a2 Thanks @ematipico! - Adds new optional properties to setAdapter() for adapter entrypoint handling in the Adapter API
Changes:
New optional properties:
devEntrypoint?: string | URL - specifies custom dev server entrypoint
entryType?: 'self' | 'legacy-dynamic' - determines if the adapter provides its own entrypoint ('self') or if Astro constructs one ('legacy-dynamic', default)
Migration: Adapter authors can optionally add these properties to support custom dev entrypoints. If not specified, adapters will use the legacy behavior.
#14826170f64e Thanks @florian-lefebvre! - Adds an option prerenderConflictBehavior to configure the behavior of conflicting prerendered routes
By default, Astro warns you during the build about any conflicts between multiple dynamic routes that can result in the same output path. For example /blog/[slug] and /blog/[...all] both could try to prerender the /blog/post-1 path. In such cases, Astro renders only the highest priority route for the conflicting path. This allows your site to build successfully, although you may discover that some pages are rendered by unexpected routes.
With the new prerenderConflictBehavior configuration option, you can now configure this further:
prerenderConflictBehavior: 'error' fails the build
prerenderConflictBehavior: 'warn' (default) logs a warning and the highest-priority route wins
prerenderConflictBehavior: 'ignore' silently picks the highest-priority route when conflicts occur
#14985c016f10 Thanks @florian-lefebvre! - Fixes a case where JSDoc annotations wouldn’t show for fonts related APIs in the Astro config
#14973ed7cc2f Thanks @amankumarpandeyin! - Fixes performance regression and OOM errors when building medium-sized blogs with many content entries. Replaced O(n²) object spread pattern with direct mutation in generateLookupMap.
#1495870eb542 Thanks @ascorbic! - Gives a helpful error message if a user sets output: "hybrid" in their Astro config.
The option was removed in Astro 5, but lots of content online still references it, and LLMs often suggest it. It’s not always clear that the replacement is output: "static", rather than output: "server". This change adds a helpful error message to guide humans and robots.
#14901ef53716 Thanks @Darknab! - Updates the glob() loader to log a warning when duplicated IDs are detected
#149402cf79c2 Thanks @ematipico! - Fixes a bug where Astro didn’t properly combine CSP resources from the csp configuration with those added using the runtime API (Astro.csp.insertDirective()) to form grammatically correct CSP headers
Now Astro correctly deduplicate CSP resources. For example, if you have a global resource in the configuration file, and then you add a
a new one using the runtime APIs.
#14929e0f277d Thanks @matthewp! - Fixes authentication bypass via double URL encoding in middleware
Prevents attackers from bypassing path-based authentication checks using multi-level URL encoding (e.g., /%2561dmin instead of /%61dmin). Pathnames are now validated after decoding to ensure no additional encoding remains.
#1488410273e0 Thanks @florian-lefebvre! - Fixes a case where setting the status of a page to 404 in ssr would show an empty page (or 404.astro page if provided) instead of using the current page
#148941ad9a5b Thanks @delucis! - Fixes support for Astro component rendering in Vitest test suites using a “client” environment such as happy-dom or jsdom
#138801a2ed01 Thanks @azat-io! - Adds experimental SVGO optimization support for SVG assets
Astro now supports automatic SVG optimization using SVGO during build time. This experimental feature helps reduce SVG file sizes while maintaining visual quality, improving your site’s performance.
To enable SVG optimization with default settings, add the following to your astro.config.mjs:
#148102e845fe Thanks @ascorbic! - Adds a hint for code agents to use the --yes flag to skip prompts when running astro add
#14698f42ff9b Thanks @mauriciabad! - Adds the ActionInputSchema utility type to automatically infer the TypeScript type of an action’s input based on its Zod schema
For example, this type can be used to retrieve the input type of a form action:
import { type ActionInputSchema, defineAction } from'astro:actions';
import { z } from'astro/zod';
constaction=defineAction({
accept: 'form',
input: z.object({ name: z.string() }),
handler: ({ name }) => ({ message: `Welcome, ${name}!` }),
#14786758a891 Thanks @mef! - Add handling of invalid encrypted props and slots in server islands.
#14783504958f Thanks @florian-lefebvre! - Improves the experimental Fonts API build log to show the number of downloaded files. This can help spotting excessive downloading because of misconfiguration
#147919e9c528 Thanks @Princesseuh! - Changes the remote protocol checks for images to require explicit authorization in order to use data URIs.
In order to allow data URIs for remote images, you will need to update your astro.config.mjs file to include the following configuration:
astro.config.mjs
import { defineConfig } from'astro/config';
exportdefaultdefineConfig({
images: {
remotePatterns: [
{
protocol: 'data',
},
],
},
});
#147870f75f6b Thanks @matthewp! - Fixes wildcard hostname pattern matching to correctly reject hostnames without dots
Previously, hostnames like localhost or other single-part names would incorrectly match patterns like *.example.com. The wildcard matching logic has been corrected to ensure that only valid subdomains matching the pattern are accepted.
#147763537876 Thanks @ktym4a! - Fixes the behavior of passthroughImageService so it does not generate webp.
#1477200c579a Thanks @matthewp! - Improves the security of Server Islands slots by encrypting them before transmission to the browser, matching the security model used for props. This improves the integrity of slot content and prevents injection attacks, even when component templates don’t explicitly support slots.
Slots continue to work as expected for normal usage—this change has no breaking changes for legitimate requests.
Middleware now receives normalized pathname values, ensuring that encoded paths like /%61dmin are properly decoded to /admin before middleware checks. This prevents potential security issues where middleware checks might be bypassed through URL encoding.
