Bump astro from 7.0.3 to 7.0.5 in /site by dependabot[bot] · Pull Request #43 · jssblck/mite

dependabot · 2026-07-02T11:05:48Z

Bumps astro from 7.0.3 to 7.0.5.

Release notes

astro@7.0.5

Patch Changes
#17242 9c05ba4 Thanks @matthewp! - Fixes an error that could occur after the dev server restarts when using an adapter such as @astrojs/cloudflare, where a request would fail with a 500 referencing a missing pre-bundled dependency:
The file does not exist at "node_modules/.vite/deps_ssr/astro_compiler-runtime.js?v=6419660d" which is in the optimize deps directory. The dependency might be incompatible with the dep optimizer. Try adding it to `optimizeDeps.exclude`.
#17202 c6d254d Thanks @matthewp! - Refactors path alias resolution to use Vite's native tsconfigPaths option

This is an internal change with no expected impact on user projects. Astro now defers tsconfig and jsconfig paths alias resolution to Vite, keeping a small fallback for a few CSS cases Vite does not yet handle.

#17123 72e29bd Thanks @martrapp! - Fixes an issue where the ClientRouter wipes head elements after page transitions if the <head> contains a server:defer component.

#17232 257505e Thanks @matthewp! - Fixes a bug where <style> tags from components such as a content collection's Content could be silently dropped from the output when an await appeared before the component in an .astro file's markup.

#17193 a7352fd Thanks @jan-kubica! - Fixes the background dev server failing to start when astro is hoisted outside the project's node_modules (for example bun workspaces). The background process is now spawned from Astro's own resolved location instead of a path assumed under the project root.

#17255 581d171 Thanks @astrobot-houston! - Fixes prefetch not working for links inside server:defer components
astro@7.0.4

Patch Changes

#17212 7ba0bb1 Thanks @matthewp! - Ensures transition directive values are HTML-escaped when rendered on hydrated islands

#17224 dc5e52f Thanks @astrobot-houston! - Fixes trailing slash handling for dynamic file endpoints in dev mode. Dynamic file endpoints (e.g., src/pages/api/[name].json.ts) with trailingSlash: "always" incorrectly required a trailing slash in dev mode, returning 404 for /api/bar.json and 200 for /api/bar.json/.

#17067 23f9446 Thanks @fkatsuhiro! - Fixed a bug where the development toolbar did not output a warning even though the implicit ARIA role and the manually specified role were duplicated.

#17234 d5fbee8 Thanks @ocavue! - Adds support for sharp v0.35. pnpm users no longer need to approve sharp's build script (see allowBuilds) when on v0.35.

#17223 5970ef4 Thanks @astrobot-houston! - Fixes getCollection() returning empty in dev mode for large content collections (500k+ entries)

#17184 799e5cd Thanks @Princesseuh! - Upgrades the Rust compiler to the latest, which fixes some bugs. Refer to its changelog for more information.

#17208 da8b573 Thanks @matthewp! - Hardens forwarded header handling so the internal request helper validates X-Forwarded-Host against security.allowedDomains before trusting X-Forwarded-For for clientAddress. Previously it only checked that the header was present, which was inconsistent with the public createRequest helper. This aligns both code paths; behavior is unchanged for correctly configured proxies.

Changelog

Sourced from astro's changelog.

7.0.5

Patch Changes
#17242 9c05ba4 Thanks @matthewp! - Fixes an error that could occur after the dev server restarts when using an adapter such as @astrojs/cloudflare, where a request would fail with a 500 referencing a missing pre-bundled dependency:
The file does not exist at "node_modules/.vite/deps_ssr/astro_compiler-runtime.js?v=6419660d" which is in the optimize deps directory. The dependency might be incompatible with the dep optimizer. Try adding it to `optimizeDeps.exclude`.
#17202 c6d254d Thanks @matthewp! - Refactors path alias resolution to use Vite's native tsconfigPaths option

This is an internal change with no expected impact on user projects. Astro now defers tsconfig and jsconfig paths alias resolution to Vite, keeping a small fallback for a few CSS cases Vite does not yet handle.

#17123 72e29bd Thanks @martrapp! - Fixes an issue where the ClientRouter wipes head elements after page transitions if the <head> contains a server:defer component.

#17232 257505e Thanks @matthewp! - Fixes a bug where <style> tags from components such as a content collection's Content could be silently dropped from the output when an await appeared before the component in an .astro file's markup.

#17193 a7352fd Thanks @jan-kubica! - Fixes the background dev server failing to start when astro is hoisted outside the project's node_modules (for example bun workspaces). The background process is now spawned from Astro's own resolved location instead of a path assumed under the project root.

#17255 581d171 Thanks @astrobot-houston! - Fixes prefetch not working for links inside server:defer components
7.0.4

Patch Changes

#17212 7ba0bb1 Thanks @matthewp! - Ensures transition directive values are HTML-escaped when rendered on hydrated islands

#17224 dc5e52f Thanks @astrobot-houston! - Fixes trailing slash handling for dynamic file endpoints in dev mode. Dynamic file endpoints (e.g., src/pages/api/[name].json.ts) with trailingSlash: "always" incorrectly required a trailing slash in dev mode, returning 404 for /api/bar.json and 200 for /api/bar.json/.

#17067 23f9446 Thanks @fkatsuhiro! - Fixed a bug where the development toolbar did not output a warning even though the implicit ARIA role and the manually specified role were duplicated.

#17234 d5fbee8 Thanks @ocavue! - Adds support for sharp v0.35. pnpm users no longer need to approve sharp's build script (see allowBuilds) when on v0.35.

#17223 5970ef4 Thanks @astrobot-houston! - Fixes getCollection() returning empty in dev mode for large content collections (500k+ entries)

#17184 799e5cd Thanks @Princesseuh! - Upgrades the Rust compiler to the latest, which fixes some bugs. Refer to its changelog for more information.

#17208 da8b573 Thanks @matthewp! - Hardens forwarded header handling so the internal request helper validates X-Forwarded-Host against security.allowedDomains before trusting X-Forwarded-For for clientAddress. Previously it only checked that the header was present, which was inconsistent with the public createRequest helper. This aligns both code paths; behavior is unchanged for correctly configured proxies.

Commits

7d8ec1f [ci] release (#17237)
4fe943a [ci] format
581d171 fix(prefetch): observe dynamically added anchors from server islands (#13297)...
9c05ba4 Fix spurious dependency re-optimization on dev server restart (#17242)
0a054e7 chore(head): normalize html charset declarations (#17197)
d6ce7cd Fix inline \<style> blocks ignoring vite.build.target when cssMinify is ...
807c8fd [ci] format
72e29bd fix(client router): prevent head elements loss during page transitions with s...
a7352fd fix: background dev server fails to start in hoisted monorepos (#17193)
c6d254d Use Vite tsconfig path resolution by default (#17202)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 7.0.3 to 7.0.5. - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.0.5/packages/astro) --- updated-dependencies: - dependency-name: astro dependency-version: 7.0.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-07-02T11:06:50Z

Bastion review

Passed. All 3 gate(s) passed. 3 reviewer(s) ran, 34s, 228992 in / 2930 out / 83712 cached tokens.

Warning

Bastion's bundled agent skills are missing or out of date in this repository, so agents may be working from stale guidance on how to use Bastion. To fix, run bastion skills install to install them, then commit the result.

.claude/skills/using-bastion/SKILL.md (missing)
.agents/skills/using-bastion/SKILL.md (missing)

Reviewer	Mode	Verdict	Summary
`private-eval-ip-disclosure`	gate	pass	No private eval disclosure issues found.
`prose-hygiene`	gate	pass	Changed prose is clean.
`committed-artifacts`	gate	pass	No inappropriate added files or local/runtime artifacts found.

_{Posted by Bastion. Full transcripts are attached to the workflow run as an artifact. These checks were posted under the shared GitHub Actions app, so with other workflows on the commit they can cluster under one of those; set up a dedicated app to give them their own group.}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 2, 2026

jssblck merged commit b2153aa into main Jul 3, 2026
12 checks passed

jssblck deleted the dependabot/npm_and_yarn/site/astro-7.0.5 branch July 3, 2026 03:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump astro from 7.0.3 to 7.0.5 in /site#43

Bump astro from 7.0.3 to 7.0.5 in /site#43
jssblck merged 1 commit into
mainfrom
dependabot/npm_and_yarn/site/astro-7.0.5

dependabot Bot commented on behalf of github Jul 2, 2026

Uh oh!

github-actions Bot commented Jul 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jul 2, 2026

astro@7.0.5

Patch Changes

astro@7.0.4

Patch Changes

7.0.5

Patch Changes

7.0.4

Patch Changes

Uh oh!

github-actions Bot commented Jul 2, 2026

Bastion review

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant