Skip to content

fix(deps): update astro monorepo (major)#10

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/major-astro-monorepo
Open

fix(deps): update astro monorepo (major)#10
renovate[bot] wants to merge 1 commit intomainfrom
renovate/major-astro-monorepo

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Mar 10, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@astrojs/node (source) ^9.5.4 → ^10.0.0 age confidence
@astrojs/vercel (source) ^9.0.4 → ^10.0.0 age confidence
astro (source) ^5.18.0 → ^6.0.0 age confidence

Release Notes

withastro/astro (@​astrojs/node)

v10.0.0

Compare Source

Major Changes

  • #​15654 a32aee6 Thanks @​florian-lefebvre! - Removes the experimentalErrorPageHost option

    This option allowed fetching a prerendered error page from a different host than the server is currently running on.

    However, there can be security implications with prefetching from other hosts, and often more customization was required to do this safely. This has now been removed as a built-in option so that you can implement your own secure solution as needed and appropriate for your project via middleware.

What should I do?

If you were previously using this feature, you must remove the option from your adapter configuration as it no longer exists:

// astro.config.mjs
import { defineConfig } from 'astro/config'
import node from '@​astrojs/node'

export default defineConfig({
  adapter: node({
    mode: 'standalone',
-    experimentalErrorPageHost: 'http://localhost:4321'
  })
})

You can replicate the previous behavior by checking the response status in a middleware and fetching the prerendered page yourself:

// src/middleware.ts
import { defineMiddleware } from 'astro:middleware';

export const onRequest = defineMiddleware(async (ctx, next) => {
  const response = await next();
  if (response.status === 404 || response.status === 500) {
    return fetch(`http://localhost:4321/${response.status}.html`);
  }
  return response;
});
Minor Changes

  • #​15258 d339a18 Thanks @​ematipico! - Stabilizes the adapter feature experimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:

    export default defineConfig({
  adapter: netlify({
-    experimentalStaticHeaders: true
+    staticHeaders: true
  })
})

  • #​15759 39ff2a5 Thanks @​matthewp! - Adds a new bodySizeLimit option to the @astrojs/node adapter

    You can now configure a maximum allowed request body size for your Node.js standalone server. The default limit is 1 GB. Set the value in bytes, or pass 0 to disable the limit entirely:

    import node from '@​astrojs/node';
import { defineConfig } from 'astro/config';

export default defineConfig({
  adapter: node({
    mode: 'standalone',
    bodySizeLimit: 1024 * 1024 * 100, // 100 MB
  }),
});

  • #​15006 f361730 Thanks @​florian-lefebvre! - Adds new session driver object shape

    For greater flexibility and improved consistency with other Astro code, session drivers are now specified as an object:

    -import { defineConfig } from 'astro/config'
+import { defineConfig, sessionDrivers } from 'astro/config'

export default defineConfig({
  session: {
-    driver: 'redis',
-    options: {
-      url: process.env.REDIS_URL
-    },
+    driver: sessionDrivers.redis({
+      url: process.env.REDIS_URL
+    }),
  }
})

    Specifying the session driver as a string has been deprecated, but will continue to work until this feature is removed completely in a future major version. The object shape is the current recommended and documented way to configure a session driver.

  • #​14946 95c40f7 Thanks @​ematipico! - Removes the experimental.csp flag and replaces it with a new configuration option security.csp - (v6 upgrade guidance)

Patch Changes

  • #​15473 d653b86 Thanks @​matthewp! - Improves error page loading to read from disk first before falling back to configured host

  • #​15562 e14a51d Thanks @​florian-lefebvre! - Updates to new Adapter API introduced in v6

  • #​15585 98ea30c Thanks @​matthewp! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.

  • #​15777 02e24d9 Thanks @​matthewp! - Fixes CSRF origin check mismatch by passing the actual server listening port to createRequest, ensuring the constructed URL origin includes the correct port (e.g., http://localhost:4321 instead of http://localhost). Also restricts X-Forwarded-Proto to only be trusted when allowedDomains is configured.

  • #​15714 9a2c949 Thanks @​ematipico! - Fixes an issue where static headers weren't correctly applied when the website uses base.

  • #​15763 1567e8c Thanks @​matthewp! - Normalizes static file paths before evaluating dotfile access rules for improved consistency

  • #​15164 54dc11d Thanks @​HiDeoo! - Fixes an issue where the Node.js adapter could fail to serve a 404 page matching a pre-rendered dynamic route pattern.

  • #​15745 20b05c0 Thanks @​matthewp! - Hardens static file handler path resolution to ensure resolved paths stay within the client directory

  • #​15495 5b99e90 Thanks @​leekeh! - Refactors to use middlewareMode adapter feature (set to classic)

  • #​15657 cb625b6 Thanks @​qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.

    This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.

    If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.

    // astro.config.mjs
export default defineConfig({
  security: {
    actionBodySizeLimit: 10 * 1024 * 1024, // set to 10 MB
  },
});

  • Updated dependencies [4ebc1e3, 4e7f3e8, a164c77, cf6ea6b, a18d727, 240c317, 745e632]:

withastro/astro (@​astrojs/vercel)

v10.0.0

Compare Source

Major Changes
Minor Changes

  • #​15258 d339a18 Thanks @​ematipico! - Stabilizes the adapter feature experimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:

    export default defineConfig({
  adapter: netlify({
-    experimentalStaticHeaders: true
+    staticHeaders: true
  })
})

  • #​15413 736216b Thanks @​florian-lefebvre! - Updates the implementation to use the new Adapter API

  • #​15495 5b99e90 Thanks @​leekeh! - Adds new middlewareMode adapter feature and deprecates edgeMiddleware option

    The edgeMiddleware option is now deprecated and will be removed in a future release, so users should transition to using the new middlewareMode feature as soon as possible.

    export default defineConfig({
  adapter: vercel({
-    edgeMiddleware: true
+    middlewareMode: 'edge'
  })
})

  • #​14946 95c40f7 Thanks @​ematipico! - Removes the experimental.csp flag and replaces it with a new configuration option security.csp - (v6 upgrade guidance)

Patch Changes

  • #​15781 2de969d Thanks @​ematipico! - Adds a new clientAddress option to the createContext() function

    Providing this value gives adapter and middleware authors explicit control over the client IP address. When not provided, accessing clientAddress throws an error consistent with other contexts where it is not set by the adapter.

    Additionally, both of the official Netlify and Vercel adapters have been updated to provide this information in their edge middleware.

    import { createContext } from 'astro/middleware';

createContext({
  clientAddress: context.headers.get('x-real-ip'),
});

  • #​15778 4ebc1e3 Thanks @​ematipico! - Fixes an issue where the computed clientAddress was incorrect in cases of a Request header with multiple values. The clientAddress is now also validated to contain only characters valid in IP addresses, rejecting injection payloads.

  • #​15460 ee7e53f Thanks @​florian-lefebvre! - Updates to use the new Adapter API

  • #​15450 50c9129 Thanks @​florian-lefebvre! - Fixes a case where build.serverEntry would not be respected when using the new Adapter API

  • #​15461 9f21b24 Thanks @​florian-lefebvre! - Updates to new Adapter API introduced in v6

  • #​15125 6feb0d7 Thanks @​florian-lefebvre! - Updates Node versions data to account for v24 as the default

  • Updated dependencies [4ebc1e3, 4e7f3e8, a164c77, cf6ea6b, a18d727, 240c317, 745e632]:

withastro/astro (astro)

v6.0.2

Compare Source

Patch Changes

v6.0.1

Compare Source

Patch Changes

v6.0.0

Compare Source

Major Changes
What should I do?

If you were using experimental CSP runtime utilities, you must now access methods conditionally:

-Astro.csp.insertDirective("default-src 'self'");
+Astro.csp?.insertDirective("default-src 'self'");
Minor Changes

  • #​14306 141c4a2 Thanks @​ematipico! - Adds new optional properties to setAdapter() for adapter entrypoint handling in the Adapter API

    Changes:

    • New optional properties:
      • entryType?: 'self' | 'legacy-dynamic' - determines if the adapter provides its own entrypoint ('self') or if Astro constructs one ('legacy-dynamic', default)

    Migration: Adapter authors can optionally add these properties to support custom dev entrypoints. If not specified, adapters will use the legacy behavior.

  • #​15700 4e7f3e8 Thanks @​ocavue! - Updates the internal logic during SSR by providing additional metadata for UI framework integrations.

  • #​15231 3928b87 Thanks @​rururux! - Adds a new optional getRemoteSize() method to the Image Service API.

    Previously, inferRemoteSize() had a fixed implementation that fetched the entire image to determine its dimensions.
    With this new helper function that extends inferRemoteSize(), you can now override or extend how remote image metadata is retrieved.

    This enables use cases such as:

    • Caching: Storing image dimensions in a database or local cache to avoid redundant network requests.
    • Provider APIs: Using a specific image provider's API (like Cloudinary or Vercel) to get dimensions without downloading the file.

    For example, you can add a simple cache layer to your existing image service:

    const cache = new Map();

const myService = {
  ...baseService,
  async getRemoteSize(url, imageConfig) {
    if (cache.has(url)) return cache.get(url);

    const result = await baseService.getRemoteSize(url, imageConfig);
    cache.set(url, result);
    return result;
  },
};

    See the Image Services API reference documentation for more information.

  • #​15077 a164c77 Thanks @​matthewp! - Updates the Integration API to add setPrerenderer() to the astro:build:start hook, allowing adapters to provide custom prerendering logic.

    The new API accepts either an AstroPrerenderer object directly, or a factory function that receives the default prerenderer:

    'astro:build:start': ({ setPrerenderer }) => {
  setPrerenderer((defaultPrerenderer) => ({
    name: 'my-prerenderer',
    async setup() {
      // Optional: called once before prerendering starts
    },
    async getStaticPaths() {
      // Returns array of { pathname: string, route: RouteData }
      return defaultPrerenderer.getStaticPaths();
    },
    async render(request, { routeData }) {
      // request: Request
      // routeData: RouteData
      // Returns: Response
    },
    async teardown() {
      // Optional: called after all pages are prerendered
    }
  }));
}

    Also adds the astro:static-paths virtual module, which exports a StaticPaths class for adapters to collect all prerenderable paths from within their target runtime. This is useful when implementing a custom prerenderer that runs in a non-Node environment:

    // In your adapter's request handler (running in target runtime)
import { App } from 'astro/app';
import { StaticPaths } from 'astro:static-paths';

export function createApp(manifest) {
  const app = new App(manifest);

  return {
    async fetch(request) {
      const { pathname } = new URL(request.url);

      // Expose endpoint for prerenderer to get static paths
      if (pathname === '/__astro_static_paths') {
        const staticPaths = new StaticPaths(app);
        const paths = await staticPaths.getAll();
        return new Response(JSON.stringify({ paths }));
      }

      // Normal request handling
      return app.render(request);
    },
  };
}

    See the adapter reference for more details on implementing a custom prerenderer.

  • #​15345 840fbf9 Thanks @​matthewp! - Adds a new emitClientAsset function to astro/assets/utils for integration authors. This function allows emitting assets that will be moved to the client directory during SSR builds, useful for assets referenced in server-rendered content that need to be available on the client.

    import { emitClientAsset } from 'astro/assets/utils';

// Inside a Vite plugin's transform or load hook
const handle = emitClientAsset(this, {
  type: 'asset',
  name: 'my-image.png',
  source: imageBuffer,
});

  • #​15460 ee7e53f Thanks @​florian-lefebvre! - Updates the Adapter API to allow providing a serverEntrypoint when using entryType: 'self'

    Astro 6 introduced a new powerful yet simple Adapter API for defining custom server entrypoints. You can now call setAdapter() with the entryType: 'self' option and specify your custom serverEntrypoint:

    export function myAdapter() {
  return {
    name: 'my-adapter',
    hooks: {
      'astro:config:done': ({ setAdapter }) => {
        setAdapter({
          name: 'my-adapter',
          entryType: 'self',
          serverEntrypoint: 'my-adapter/server.js',
          supportedAstroFeatures: {
            // ...
          },
        });
      },
    },
  };
}

    If you need further customization at the Vite level, you can omit serverEntrypoint and instead specify your custom server entrypoint with vite.build.rollupOptions.input.

  • #​15781 2de969d Thanks @​ematipico! - Adds a new clientAddress option to the createContext() function

    Providing this value gives adapter and middleware authors explicit control over the client IP address. When not provided, accessing clientAddress throws an error consistent with other contexts where it is not set by the adapter.

    Additionally, both of the official Netlify and Vercel adapters have been updated to provide this information in their edge middleware.

    import { createContext } from 'astro/middleware';

createContext({
  clientAddress: context.headers.get('x-real-ip'),
});

  • #​15258 d339a18 Thanks @​ematipico! - Stabilizes the adapter feature experimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:

    export default defineConfig({
  adapter: netlify({
-    experimentalStaticHeaders: true
+    staticHeaders: true
  })
})

  • #​15535 dfe2e22 Thanks @​florian-lefebvre! - Exports new createRequest() and writeResponse() utilities from astro/app/node

    To replace the deprecated NodeApp.createRequest() and NodeApp.writeResponse() methods, the astro/app/node module now exposes new createRequest() and writeResponse() utilities. These can be used to convert a NodeJS IncomingMessage into a web-standard Request and stream a web-standard Response into a NodeJS ServerResponse:

    import { createApp } from 'astro/app/entrypoint';
import { createRequest, writeResponse } from 'astro/app/node';
import { createServer } from 'node:http';

const app = createApp();

const server = createServer(async (req, res) => {
  const request = createRequest(req);
  const response = await app.render(request);
  await writeResponse(response, res);
});

  • #​15755 f9ee868 Thanks @​matthewp! - Adds a new security.serverIslandBodySizeLimit configuration option

    Server island POST endpoints now enforce a body size limit, similar to the existing security.actionBodySizeLimit for Actions. The new option defaults to 1048576 (1 MB) and can be configured independently.

    Requests exceeding the limit are rejected with a 413 response. You can customize the limit in your Astro config:

    export default defineConfig({
  security: {
    serverIslandBodySizeLimit: 2097152, // 2 MB
  },
});

  • #​15529 a509941 Thanks @​florian-lefebvre! - Adds a new build-in font provider npm to access fonts installed as NPM packages

    You can now add web fonts specified in your package.json through Astro's type-safe Fonts API. The npm font provider allows you to add fonts either from locally installed packages in node_modules or from a CDN.

    Set fontProviders.npm() as your fonts provider along with the required name and cssVariable values, and add options as needed:

    import { defineConfig, fontProviders } from 'astro/config';

export default defineConfig({
  experimental: {
    fonts: [
      {
        name: 'Roboto',
        provider: fontProviders.npm(),
        cssVariable: '--font-roboto',
      },
    ],
  },
});

    See the NPM font provider reference documentation for more details.

  • #​15471 32b4302 Thanks @​ematipico! - Adds a new experimental flag queuedRendering to enable a queue-based rendering engine

    The new engine is based on a two-pass process, where the first pass
    traverses the tree of components, emits an ordered queue, and then the queue is rendered.

    The new engine does not use recursion, and comes with two customizable options.

    Early benchmarks showed significant speed improvements and memory efficiency in big projects.

Queue-rendered based

The new engine can be enabled in your Astro config with experimental.queuedRendering.enabled set to true, and can be further customized with additional sub-features.

// astro.config.mjs
export default defineConfig({
  experimental: {
    queuedRendering: {
      enabled: true,
    },
  },
});
Pooling

With the new engine enabled, you now have the option to have a pool of nodes that can be saved and reused across page rendering. Node pooling has no effect when rendering pages on demand (SSR) because these rendering requests don't share memory. However, it can be very useful for performance when building static pages.

// astro.config.mjs
export default defineConfig({
  experimental: {
    queuedRendering: {
      enabled: true,
      poolSize: 2000, // store up to 2k nodes to be reused across renderers
    },
  },
});
Content caching

The new engine additionally unlocks a new contentCache option. This allows you to cache values of nodes during the rendering phase. This is currently a boolean feature with no further customization (e.g. size of cache) that uses sensible defaults for most large content collections:

When disabled, the pool engine won't cache strings, but only types.

// astro.config.mjs
export default defineConfig({
  experimental: {
    queuedRendering: {
      enabled: true,
      contentCache: true, // enable re-use of node values
    },
  },
});

For more information on enabling and using this feature in your project, see the experimental queued rendering docs for more details.

  • #​14888 4cd3fe4 Thanks @​OliverSpeir! - Updates astro add cloudflare to better setup types, by adding ./worker-configuration.d.ts to tsconfig includes and a generate-types script to package.json

  • #​15646 0dd9d00 Thanks @​delucis! - Removes redundant fetchpriority attributes from the output of Astro’s <Image> component

    Previously, Astro would always include fetchpriority="auto" on images not using the priority attribute.
    However, this is the default value, so specifying it is redundant. This change omits the attribute by default.

  • #​15291 89b6cdd Thanks @​florian-lefebvre! - Removes the experimental.fonts flag and replaces it with a new configuration option fonts - (v6 upgrade guidance)

  • #​15495 5b99e90 Thanks @​leekeh! - Adds a new middlewareMode adapter feature to replace the previous edgeMiddleware option.

    This feature only impacts adapter authors. If your adapter supports edgeMiddleware, you should upgrade to the new middlewareMode

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel
Copy link

vercel bot commented Mar 10, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
patchwork Ready Ready Preview, Comment Mar 10, 2026 9:32pm

@renovate renovate bot force-pushed the renovate/major-astro-monorepo branch from 85ea1da to 405eb1b Compare March 10, 2026 18:08
@renovate renovate bot changed the title fix(deps): update astro monorepo (major) fix(deps): update dependency astro to v6 Mar 10, 2026
@renovate renovate bot force-pushed the renovate/major-astro-monorepo branch from 405eb1b to 2f3266c Compare March 10, 2026 21:32
@renovate renovate bot changed the title fix(deps): update dependency astro to v6 fix(deps): update astro monorepo (major) Mar 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants