fix(deps): update astro monorepo (major)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/node (source)	^9.5.4 → ^11.0.0
@astrojs/vercel (source)	^9.0.4 → ^11.0.0
astro (source)	^5.18.0 → ^7.0.0

---

Release Notes

withastro/astro (@​astrojs/node)

v11.1.4

Compare Source

Patch Changes

• Updated dependencies [05763a0]:
  • @​astrojs/internal-helpers@​0.10.4

v11.1.3

Compare Source

Patch Changes

• #​17636 51723b1 Thanks @​matthewp! - Updates the adapter to wait for the configured log destination through Astro's new app.getLogger() API. This release requires Astro 7.2.1 or later.

• Updated dependencies [8c193f6]:

  • @​astrojs/internal-helpers@​0.10.3

v11.1.2

Compare Source

Patch Changes

• #​17400 c1cf110 Thanks @​tianrking! - Return a 404 instead of a 500 for unknown parameters that match a prerendered dynamic endpoint.

v11.1.1

Compare Source

Patch Changes

• #​17658 8b211a5 Thanks @​astrobot-houston! - Fixes an EventEmitter memory leak when serving static pages over keep-alive connections with staticHeaders enabled and CSP (security.csp) active

v11.1.0

Compare Source

Minor Changes

• #​16871 90c98ae Thanks @​adamchal! - When session: false is set in astro.config, the adapter no longer auto-wires the filesystem session driver. Combined with the matching astro change, this lets the session runtime tree-shake out of the server bundle.

Patch Changes

• #​17564 004fb0a Thanks @​dmgawel! - Fixes middleware mode routing when a prerendered dynamic route sorts before an on-demand fallback

v11.0.3

Compare Source

Patch Changes

• Updated dependencies [c895b12]:
  • @​astrojs/internal-helpers@​0.10.2

v11.0.2

Compare Source

Patch Changes

• #​17252 eb6f97e Thanks @​matthewp! - Fixes trailing-slash handling for request paths that begin with a backslash

  With trailingSlash: 'always', the standalone Node server could append a trailing slash to a request path that begins with a backslash (for example /\example.com/foo) and echo that path back in the Location header of a 301 response. Because browsers resolve a leading \ the same way as /, the resulting Location could point off-site.

  Such paths are now recognized as internal paths, matching the existing handling for paths that begin with //, so they are no longer rewritten with a trailing slash.

• Updated dependencies [eb6f97e]:

  • @​astrojs/internal-helpers@​0.10.1

v11.0.1

Compare Source

Patch Changes

• #​17249 02b73b0 Thanks @​ematipico! - Fixes an issue where the peerDependencies field used incorrect dependencies.

v11.0.0

Compare Source

Patch Changes

• #​17054 d426b67 Thanks @​astrobot-houston! - Fixes an issue where Astro files with non-ASCII characters in their name weren't correctly served after the build.

• #​17027 241250b Thanks @​ocavue! - Triggers beta prereleases for packages that are still on alpha

v10.1.4

Compare Source

Patch Changes

• #​16985 4ecff32 Thanks @​maximslo! - Fixes the experimental.logger destination not being used for the "Server listening on..." startup message. The logger is now resolved before the server starts listening, and adapterLogger re-creates itself when the underlying logger changes so the startup message uses the correct destination.

v10.1.3

Compare Source

Patch Changes

• #​16922 7dce185 Thanks @​astrobot-houston! - Fixes prerendered pages returning 404 when using build.format: 'file' or build.format: 'preserve' with the Node adapter in standalone mode.

  Previously, clean URLs like /about would fail to resolve to about.html on disk, because the static file handler only supported the default directory format (about/index.html). Now the handler correctly resolves clean URLs to .html files when the build format produces them.

v10.1.2

Compare Source

Patch Changes

• Updated dependencies [f732f3c]:
  • @​astrojs/internal-helpers@​0.10.0

v10.1.1

Compare Source

Patch Changes

• Updated dependencies [d365c97]:
  • @​astrojs/internal-helpers@​0.9.1

v10.1.0

Compare Source

Minor Changes

• #​16639 4d72482 Thanks @​ematipico! - The adapter now depends on Astro 6.3.0.

v10.0.6

Compare Source

Patch Changes

• Updated dependencies [99464ed, f3485c3]:
  • @​astrojs/internal-helpers@​0.9.0

v10.0.5

Compare Source

Patch Changes

• #​16319 940afd5 Thanks @​matthewp! - Fixes static asset error responses incorrectly including immutable cache headers. Conditional request failures (e.g. If-Match mismatch) now return the correct status code without far-future cache directives.

v10.0.4

Compare Source

Patch Changes

• #​16002 846f27f Thanks @​buley! - Fixes file descriptor leaks from read streams that were not destroyed on client disconnect or read errors

• #​15941 f41584a Thanks @​ematipico! - Fixes an infinite loop in resolveClientDir() when the server entry point is bundled with esbuild or similar tools. The function now throws a descriptive error instead of hanging indefinitely when the expected server directory segment is not found in the file path.

v10.0.3

Compare Source

Patch Changes

• #​15735 9685e2d Thanks @​fa-sharp! - Fixes an EventEmitter memory leak when serving static pages from Node.js middleware.

  When using the middleware handler, requests that were being passed on to Express / Fastify (e.g. static files / pre-rendered pages / etc.) weren't cleaning up socket listeners before calling next(), causing a memory leak warning. This fix makes sure to run the cleanup before calling next().

v10.0.2

Compare Source

Patch Changes

• #​15934 6f8f0bc Thanks @​ematipico! - Updates the Astro peerDependencies#astro to be 6.0.0.

v10.0.1

Compare Source

Patch Changes

• #​15868 bb2b8f5 Thanks @​ematipico! - Fixes an issue where the adapter would cause a series of warnings during the build.

v10.0.0

Compare Source

Major Changes

• #​15654 a32aee6 Thanks @​florian-lefebvre! - Removes the experimentalErrorPageHost option

  This option allowed fetching a prerendered error page from a different host than the server is currently running on.

  However, there can be security implications with prefetching from other hosts, and often more customization was required to do this safely. This has now been removed as a built-in option so that you can implement your own secure solution as needed and appropriate for your project via middleware.

What should I do?

If you were previously using this feature, you must remove the option from your adapter configuration as it no longer exists:

// astro.config.mjs
import { defineConfig } from 'astro/config'
import node from '@astrojs/node'

export default defineConfig({
  adapter: node({
    mode: 'standalone',
-    experimentalErrorPageHost: 'http://localhost:4321'
  })
})

You can replicate the previous behavior by checking the response status in a middleware and fetching the prerendered page yourself:

// src/middleware.ts
import { defineMiddleware } from 'astro:middleware';

export const onRequest = defineMiddleware(async (ctx, next) => {
  const response = await next();
  if (response.status === 404 || response.status === 500) {
    return fetch(`http://localhost:4321/${response.status}.html`);
  }
  return response;
});

Minor Changes

• #​15258 d339a18 Thanks @​ematipico! - Stabilizes the adapter feature experimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:

  export default defineConfig({
    adapter: netlify({
  -    experimentalStaticHeaders: true
  +    staticHeaders: true
    })
  })

• #​15759 39ff2a5 Thanks @​matthewp! - Adds a new bodySizeLimit option to the @astrojs/node adapter

  You can now configure a maximum allowed request body size for your Node.js standalone server. The default limit is 1 GB. Set the value in bytes, or pass 0 to disable the limit entirely:

  import node from '@astrojs/node';
  import { defineConfig } from 'astro/config';
  
  export default defineConfig({
    adapter: node({
      mode: 'standalone',
      bodySizeLimit: 1024 * 1024 * 100, // 100 MB
    }),
  });

• #​15006 f361730 Thanks @​florian-lefebvre! - Adds new session driver object shape

  For greater flexibility and improved consistency with other Astro code, session drivers are now specified as an object:

  -import { defineConfig } from 'astro/config'
  +import { defineConfig, sessionDrivers } from 'astro/config'
  
  export default defineConfig({
    session: {
  -    driver: 'redis',
  -    options: {
  -      url: process.env.REDIS_URL
  -    },
  +    driver: sessionDrivers.redis({
  +      url: process.env.REDIS_URL
  +    }),
    }
  })

  Specifying the session driver as a string has been deprecated, but will continue to work until this feature is removed completely in a future major version. The object shape is the current recommended and documented way to configure a session driver.

• #​14946 95c40f7 Thanks @​ematipico! - Removes the experimental.csp flag and replaces it with a new configuration option security.csp - (v6 upgrade guidance)

Patch Changes

• #​15473 d653b86 Thanks @​matthewp! - Improves error page loading to read from disk first before falling back to configured host

• #​15562 e14a51d Thanks @​florian-lefebvre! - Updates to new Adapter API introduced in v6

• #​15585 98ea30c Thanks @​matthewp! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.

• #​15777 02e24d9 Thanks @​matthewp! - Fixes CSRF origin check mismatch by passing the actual server listening port to createRequest, ensuring the constructed URL origin includes the correct port (e.g., http://localhost:4321 instead of http://localhost). Also restricts X-Forwarded-Proto to only be trusted when allowedDomains is configured.

• #​15714 9a2c949 Thanks @​ematipico! - Fixes an issue where static headers weren't correctly applied when the website uses base.

• #​15763 1567e8c Thanks @​matthewp! - Normalizes static file paths before evaluating dotfile access rules for improved consistency

• #​15164 54dc11d Thanks @​HiDeoo! - Fixes an issue where the Node.js adapter could fail to serve a 404 page matching a pre-rendered dynamic route pattern.

• #​15745 20b05c0 Thanks @​matthewp! - Hardens static file handler path resolution to ensure resolved paths stay within the client directory

• #​15495 5b99e90 Thanks @​leekeh! - Refactors to use middlewareMode adapter feature (set to classic)

• #​15657 cb625b6 Thanks @​qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.

  This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.

  If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.

  // astro.config.mjs
  export default defineConfig({
    security: {
      actionBodySizeLimit: 10 * 1024 * 1024, // set to 10 MB
    },
  });

• Updated dependencies [4ebc1e3, 4e7f3e8, a164c77, cf6ea6b, a18d727, 240c317, 745e632]:

  • @​astrojs/internal-helpers@​0.8.0

withastro/astro (@​astrojs/vercel)

v11.0.8

Compare Source

Patch Changes

• #​17794 dd29ce8 Thanks @​astro-factory! - Fixes a bug where @vercel/nft file tracing silently dropped all dependency files when outDir was configured outside root, causing deployed functions to crash with ERR_MODULE_NOT_FOUND

v11.0.7

Compare Source

Patch Changes

• #​17687 0a22ff5 Thanks @​asmyshlyaev177! - Fixes middlewareMode: 'edge' not running your middleware when isr is also enabled

  Previously, enabling both options deployed the edge middleware but never reached it: requests went straight to the ISR function, which skips rendering entirely on a cache hit. Middleware now runs at the edge for ISR-backed routes before the cached response is served, and query strings are preserved when it forwards the request.

• Updated dependencies [05763a0]:

  • @​astrojs/internal-helpers@​0.10.4

v11.0.6

Compare Source

Patch Changes

• #​17680 ce9f1da Thanks @​astrobot-houston! - Fixes server islands returning 404 responses in Vercel deployments using output: "static"

• Updated dependencies [8c193f6]:

  • @​astrojs/internal-helpers@​0.10.3

v11.0.5

Compare Source

Patch Changes

• #​17569 d1bb7fa Thanks @​lazerg! - Prevents astro build from crashing with EEXIST when .vercel/output/server/ already exists by creating it with { recursive: true }, matching the sibling static/ directory call

v11.0.4

Compare Source

Patch Changes

• Updated dependencies [c895b12]:
  • @​astrojs/internal-helpers@​0.10.2

v11.0.3

Compare Source

Patch Changes

• #​17370 3a43cf0 Thanks @​matthewp! - Improves internal ISR route handling

v11.0.2

Compare Source

Patch Changes

• Updated dependencies [eb6f97e]:
  • @​astrojs/internal-helpers@​0.10.1

v11.0.1

Compare Source

Patch Changes

• #​17249 02b73b0 Thanks @​ematipico! - Fixes an issue where the peerDependencies field used incorrect dependencies.

v11.0.0

Compare Source

Major Changes

• #​15819 cafec4e Thanks @​delucis! - Upgrade to Vite v8

Minor Changes

• #​16335 9a53f77 Thanks @​ascorbic! - Adds a CDN cache provider for Astro route caching on Vercel

Setup

Import cacheVercel() from @astrojs/vercel/cache and set it as your cache provider:

import { defineConfig } from 'astro/config';
import vercel from '@astrojs/vercel';
import { cacheVercel } from '@astrojs/vercel/cache';

export default defineConfig({
  adapter: vercel(),
  cache: {
    provider: cacheVercel(),
  },
});

Caching responses

Use Astro.cache.set() in your pages and API routes to cache responses on Vercel's edge network. The provider sets Vercel-CDN-Cache-Control and Vercel-Cache-Tag headers on responses.

---
Astro.cache.set({ maxAge: 300, tags: ['products'] });
const data = await fetchProducts();
---

<ProductList items={data} />

You can also set cache rules for groups of routes in your config:

cache: { provider: cacheVercel() },
routeRules: {
  '/products/[...slug]': { maxAge: 3600, tags: ['products'] },
  '/api/[...path]': { maxAge: 60, swr: 600 },
},

Invalidation

Purge cached responses by tag or path from any API route or server endpoint:

// src/pages/api/purge.ts
export async function POST({ request, cache }) {
  await cache.invalidate({ tags: ['products'] });
  return new Response('Purged');
}

// Path-based invalidation
await cache.invalidate({ path: '/products/123' });

Both tag-based and path-based invalidation are supported. Tag invalidation is a soft invalidation, marking cached responses as stale so they can be revalidated in the background via stale-while-revalidate.

Patch Changes

• #​17027 241250b Thanks @​ocavue! - Triggers beta prereleases for packages that are still on alpha

v10.0.8

Compare Source

Patch Changes

• Updated dependencies [f732f3c]:
  • @​astrojs/internal-helpers@​0.10.0

v10.0.7

Compare Source

Patch Changes

• Updated dependencies [d365c97]:
  • @​astrojs/internal-helpers@​0.9.1

v10.0.6

Compare Source

Patch Changes

• #​16486 0bae1a5 Thanks @​cyphercodes! - Fix forwarded serverless requests with streamed bodies by preserving the required duplex: 'half' option when rewriting middleware paths.

v10.0.5

Compare Source

Patch Changes

• Updated dependencies [99464ed, f3485c3]:
  • @​astrojs/internal-helpers@​0.9.0

v10.0.4

Compare Source

Patch Changes

• #​16170 d0fe1ec Thanks @​bittoby! - Fixes edge middleware next() dropping the HTTP method and body when forwarding requests to the serverless function, which caused non-GET API routes (POST, PUT, PATCH, DELETE) to return 404

v10.0.3

Compare Source

Patch Changes

• #​16079 aa26636 Thanks @​empoulter-uclan! - Fix vercel ISR path rewrite

v10.0.2

Compare Source

Patch Changes

• #​15959 335a204 Thanks @​matthewp! - Fix Vercel serverless path override handling so override values are only applied when the trusted middleware secret is present.

v10.0.1

Compare Source

Patch Changes

• #​15934 6f8f0bc Thanks @​ematipico! - Updates the Astro peerDependencies#astro to be 6.0.0.

v10.0.0

Compare Source

Major Changes

• #​15413 736216b Thanks @​florian-lefebvre! - Removes the deprecated @astrojs/vercel/serverless and @astrojs/vercel/static exports. Use the @astrojs/vercel export instead

Minor Changes

• #​15258 d339a18 Thanks @​ematipico! - Stabilizes the adapter feature experimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:

  export default defineConfig({
    adapter: netlify({
  -    experimentalStaticHeaders: true
  +    staticHeaders: true
    })
  })

• #​15413 736216b Thanks @​florian-lefebvre! - Updates the implementation to use the new Adapter API

• #​15495 5b99e90 Thanks @​leekeh! - Adds new middlewareMode adapter feature and deprecates edgeMiddleware option

  The edgeMiddleware option is now deprecated and will be removed in a future release, so users should transition to using the new middlewareMode feature as soon as possible.

  export default defineConfig({
    adapter: vercel({
  -    edgeMiddleware: true
  +    middlewareMode: 'edge'
    })
  })

• #​14946 95c40f7 Thanks @​ematipico! - Removes the experimental.csp flag and replaces it with a new configuration option security.csp - (v6 upgrade guidance)

Patch Changes

• #​15781 2de969d Thanks @​ematipico! - Adds a new clientAddress option to the createContext() function

  Providing this value gives adapter and middleware authors explicit control over the client IP address. When not provided, accessing clientAddress throws an error consistent with other contexts where it is not set by the adapter.

  Additionally, both of the official Netlify and Vercel adapters have been updated to provide this information in their edge middleware.

  import { createContext } from 'astro/middleware';
  
  createContext({
    clientAddress: context.headers.get('x-real-ip'),
  });

• #​15778 4ebc1e3 Thanks @​ematipico! - Fixes an issue where the computed clientAddress was incorrect in cases of a Request header with multiple values. The clientAddress is now also validated to contain only characters valid in IP addresses, rejecting injection payloads.

• #​15460 ee7e53f Thanks @​florian-lefebvre! - Updates to use the new Adapter API

• #​15450 50c9129 Thanks @​florian-lefebvre! - Fixes a case where build.serverEntry would not be respected when using the new Adapter API

• #​15461 9f21b24 Thanks @​florian-lefebvre! - Updates to new Adapter API introduced in v6

• #​15125 6feb0d7 Thanks @​florian-lefebvre! - Updates Node versions data to account for v24 as the default

• Updated dependencies [4ebc1e3, 4e7f3e8, a164c77, cf6ea6b, a18d727, 240c317, 745e632]:

  • @​astrojs/internal-helpers@​0.8.0

withastro/astro (astro)

v7.2.6

Compare Source

Patch Changes

• #​17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

v7.2.5

Compare Source

Patch Changes

• #​17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

• #​17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

• #​17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

• #​17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

• #​17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

• #​17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

  As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

• #​17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

• #​17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

• #​17783 60b14ff Thanks @​matthewp! - Fixes a type error when passing an image from a content collection image() schema to a component or <Image />. The schema returned by image() was missing the apng format, so it no longer matched the type of an imported image.

• #​17664 d483125 Thanks @​astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases "unsafe-inline" resource. Now when "unsafe-inline", Astro won't emit hashes for the directive specified.

• #​17810 0fc5f65 Thanks @​florian-lefebvre! - Fixes a regression in the content collections that could cause images to not be resolved

• #​17781 aa33b44 Thanks @​matthewp! - Fixes memoryCache() storing responses that set cookies through Astro.cookies or Astro.session

• #​17787 6661fbe Thanks @​astro-factory! - Fixes server:defer crashing the dev server with "undefined is not a function" when a deferred component imports from astro:i18n

• #​17750 dd0e3ac Thanks @​dobrodob! - Fixes a regression where transition:persist stopped working for <audio> and <video> elements.

• #​17774 fe1d16d Thanks @​astro-factory! - Adds support for importing .apng files as image metadata for use with standard <img> elements. Astro's image components reject APNG files to avoid removing their animation

• #​17799 8797754 Thanks @​astro-factory! - Fixes i18n fallbackType: "rewrite" returning 500 instead of 404 when the fallback locale also has no matching static path for a prerendered dynamic route

• #​17741 99d3d3d Thanks @​ericswpark! - Bumps the Astro compiler to the latest version. Changelog.

• #​17782 3578d45 Thanks @​Princesseuh! - Improves the performance of the Astro CLI in local by enabling Node's module compilation cache.

• #​17705 2043e4f Thanks @​astrobot-houston! - Fixes incremental builds serving cached HTML that references stale CSS filenames after a stylesheet-only edit

• #​17754 3d50dfd Thanks @​astro-factory! - Fixes the dev server refusing to start in Docker containers after a restart due to PID reuse in the lock file check

• #​17769 bbda94d Thanks @​astro-factory! - Fixes a build failure when defining vite.environments.ssr in the Astro config. User-provided environment config for ssr, prerender, or client is now properly deep-merged with Astro's internal environment settings instead of silently breaking the server entry naming.

• #​17776 0874da8 Thanks @​astro-factory! - Fixes the glob() content loader failing to load files with colons in their names (e.g., Guide: Architecture.md)

• Updated dependencies [0762a83, 0c99615]:

  • @​astrojs/markdown-satteri@​0.3.8

v7.2.4

Compare Source

Patch Changes

• #​17747 a90ff66 Thanks @​Princesseuh! - Fixes builds hanging when an image file is malformed

• #​17701 05763a0 Thanks @​matthewp! - Fixes base path stripping to respect path-segment boundaries. With a configured base such as /docs, a request like /docs-archive/page is no longer treated as being under the base, so routing and context.url.pathname now agree on the same pathname.

• #​17742 70b449d Thanks @​Kjubikstronk! - Fixes astro build throwing TypeError: Missing parameter for dynamic routes when `buil

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
patchwork	Ready	Preview	Aug 25, 2026 12:46pm