astro 5.17.0 → 5.17.2

package/client.d.ts

@@ -55,7 +55,6 @@ declare module 'astro:assets' {
 		Picture: typeof import('./components/Picture.astro').default;
 		Font: typeof import('./components/Font.astro').default;
 		fontData: Record<import('astro:assets').CssVariable, Array<import('astro:assets').FontData>>;
-		getFontBuffer: (url: string) => Promise<Buffer>;
 	};
 
 	type ImgAttributes = import('./dist/type-utils.js').WithRequired<
@@ -78,7 +77,6 @@ declare module 'astro:assets' {
 		Font,
 		inferRemoteSize,
 		fontData,
-		getFontBuffer,
 	}: AstroAssets;
 }
 

package/dist/assets/fonts/constants.d.ts

@@ -4,8 +4,6 @@ export declare const VIRTUAL_MODULE_ID = "virtual:astro:assets/fonts/internal";
 export declare const RESOLVED_VIRTUAL_MODULE_ID: string;
 export declare const RUNTIME_VIRTUAL_MODULE_ID = "virtual:astro:assets/fonts/runtime";
 export declare const RESOLVED_RUNTIME_VIRTUAL_MODULE_ID: string;
-export declare const BUFFER_VIRTUAL_MODULE_ID_PREFIX = "virtual:astro:assets/fonts/file/";
-export declare const RESOLVED_BUFFER_VIRTUAL_MODULE_ID_PREFIX: string;
 export declare const ASSETS_DIR = "fonts";
 export declare const CACHE_DIR = "./fonts/";
 export declare const FONT_TYPES: readonly ["woff2", "woff", "otf", "ttf", "eot"];

package/dist/assets/fonts/constants.js

@@ -11,8 +11,6 @@ const VIRTUAL_MODULE_ID = "virtual:astro:assets/fonts/internal";
 const RESOLVED_VIRTUAL_MODULE_ID = "\0" + VIRTUAL_MODULE_ID;
 const RUNTIME_VIRTUAL_MODULE_ID = "virtual:astro:assets/fonts/runtime";
 const RESOLVED_RUNTIME_VIRTUAL_MODULE_ID = "\0" + RUNTIME_VIRTUAL_MODULE_ID;
-const BUFFER_VIRTUAL_MODULE_ID_PREFIX = "virtual:astro:assets/fonts/file/";
-const RESOLVED_BUFFER_VIRTUAL_MODULE_ID_PREFIX = "\0" + BUFFER_VIRTUAL_MODULE_ID_PREFIX;
 const ASSETS_DIR = "fonts";
 const CACHE_DIR = "./fonts/";
 const FONT_TYPES = ["woff2", "woff", "otf", "ttf", "eot"];
@@ -41,14 +39,12 @@ const GENERIC_FALLBACK_NAMES = [
 const FONTS_TYPES_FILE = "fonts.d.ts";
 export {
   ASSETS_DIR,
-  BUFFER_VIRTUAL_MODULE_ID_PREFIX,
   CACHE_DIR,
   DEFAULTS,
   FONTS_TYPES_FILE,
   FONT_FORMATS,
   FONT_TYPES,
   GENERIC_FALLBACK_NAMES,
-  RESOLVED_BUFFER_VIRTUAL_MODULE_ID_PREFIX,
   RESOLVED_RUNTIME_VIRTUAL_MODULE_ID,
   RESOLVED_VIRTUAL_MODULE_ID,
   RUNTIME_VIRTUAL_MODULE_ID,

package/dist/assets/fonts/runtime.d.ts

@@ -0,0 +1 @@
+export declare const fontData: import("./types.js").FontDataByCssVariable;

package/dist/assets/fonts/runtime.js

@@ -0,0 +1,5 @@
+import * as fontsMod from "virtual:astro:assets/fonts/internal";
+const fontData = fontsMod.fontDataByCssVariable ?? {};
+export {
+  fontData
+};

package/dist/assets/fonts/types.d.ts

@@ -230,7 +230,4 @@ export interface FontFamilyAssets {
 }
 export type FontFamilyAssetsByUniqueKey = Map<string, FontFamilyAssets>;
 export type Collaborator<T extends (input: any) => any, U extends keyof Parameters<T>[0]> = (params: Pick<Parameters<T>[0], U>) => ReturnType<T>;
-export type BufferImports = Record<string, () => Promise<{
-    default: Buffer | null;
-}>>;
 export {};

package/dist/assets/fonts/vite-plugin-fonts.js

@@ -11,10 +11,8 @@ import { appendForwardSlash, joinPaths, prependForwardSlash } from "../../core/p
 import { getClientOutputDirectory } from "../../prerender/utils.js";
 import {
   ASSETS_DIR,
-  BUFFER_VIRTUAL_MODULE_ID_PREFIX,
   CACHE_DIR,
   DEFAULTS,
-  RESOLVED_BUFFER_VIRTUAL_MODULE_ID_PREFIX,
   RESOLVED_RUNTIME_VIRTUAL_MODULE_ID,
   RESOLVED_VIRTUAL_MODULE_ID,
   RUNTIME_VIRTUAL_MODULE_ID,
@@ -53,12 +51,9 @@ function fontsPlugin({ settings, sync, logger }) {
         if (id === RUNTIME_VIRTUAL_MODULE_ID) {
           return RESOLVED_RUNTIME_VIRTUAL_MODULE_ID;
         }
-        if (id.startsWith(BUFFER_VIRTUAL_MODULE_ID_PREFIX)) {
-          return `\0` + id;
-        }
       },
       load(id) {
-        if (id === RESOLVED_VIRTUAL_MODULE_ID || id === RESOLVED_RUNTIME_VIRTUAL_MODULE_ID || id.startsWith(RESOLVED_BUFFER_VIRTUAL_MODULE_ID_PREFIX)) {
+        if (id === RESOLVED_VIRTUAL_MODULE_ID || id === RESOLVED_RUNTIME_VIRTUAL_MODULE_ID) {
           return {
             code: ""
           };
@@ -249,9 +244,6 @@ function fontsPlugin({ settings, sync, logger }) {
       if (id === RUNTIME_VIRTUAL_MODULE_ID) {
         return RESOLVED_RUNTIME_VIRTUAL_MODULE_ID;
       }
-      if (id.startsWith(BUFFER_VIRTUAL_MODULE_ID_PREFIX)) {
-        return `\0` + id;
-      }
     },
     async load(id) {
       if (id === RESOLVED_VIRTUAL_MODULE_ID) {
@@ -259,50 +251,14 @@ function fontsPlugin({ settings, sync, logger }) {
           code: `
 						export const componentDataByCssVariable = new Map(${JSON.stringify(Array.from(componentDataByCssVariable?.entries() ?? []))});
 						export const fontDataByCssVariable = ${JSON.stringify(fontDataByCssVariable ?? {})}
-						export const bufferImports = {${[...fontFileById?.keys() ?? []].map((key) => `"${key}": () => import("${BUFFER_VIRTUAL_MODULE_ID_PREFIX}${key}")`).join(",")}};
 					`
         };
       }
       if (id === RESOLVED_RUNTIME_VIRTUAL_MODULE_ID) {
-        if (this.environment.name === "client") {
-          return {
-            code: `export * from 'astro/assets/fonts/runtime/client.js';`
-          };
-        }
         return {
-          code: `export * from 'astro/assets/fonts/runtime/server.js';`
+          code: `export * from 'astro/assets/fonts/runtime.js';`
         };
       }
-      if (id.startsWith(RESOLVED_BUFFER_VIRTUAL_MODULE_ID_PREFIX)) {
-        if (!fontFetcher) {
-          logger.debug(
-            "assets",
-            "Fonts dependencies should be initialized by now, skipping dev middleware."
-          );
-          return { code: `export default null;` };
-        }
-        const fontId = id.slice(RESOLVED_BUFFER_VIRTUAL_MODULE_ID_PREFIX.length);
-        const fontData = fontFileById?.get(fontId);
-        if (!fontData) {
-          return { code: `export default null;` };
-        }
-        try {
-          const buffer = await fontFetcher.fetch({ id: fontId, ...fontData });
-          const bytes = Array.from(buffer);
-          return {
-            code: `export default Uint8Array.from(${JSON.stringify(bytes)});`
-          };
-        } catch (err) {
-          logger.error("assets", "Cannot download font file");
-          if (isAstroError(err)) {
-            logger.error(
-              "SKIP_FORMAT",
-              formatErrorMessage(collectErrorMetadata(err), logger.level() === "debug")
-            );
-          }
-          return { code: `export default null;` };
-        }
-      }
     },
     async buildEnd() {
       if (sync || settings.config.experimental.fonts.length === 0 || !isBuild) {

package/dist/cli/infra/build-time-astro-version-provider.js

@@ -1,6 +1,6 @@
 class BuildTimeAstroVersionProvider {
   // Injected during the build through esbuild define
-  version = "5.17.0";
+  version = "5.17.2";
 }
 export {
   BuildTimeAstroVersionProvider

package/dist/content/content-layer.js

@@ -164,7 +164,7 @@ ${contentConfig.error.message}`);
       logger.info("Content config changed");
       shouldClear = true;
     }
-    if (previousAstroVersion && previousAstroVersion !== "5.17.0") {
+    if (previousAstroVersion && previousAstroVersion !== "5.17.2") {
       logger.info("Astro version changed");
       shouldClear = true;
     }
@@ -172,8 +172,8 @@ ${contentConfig.error.message}`);
       logger.info("Clearing content store");
       this.#store.clearAll();
     }
-    if ("5.17.0") {
-      await this.#store.metaStore().set("astro-version", "5.17.0");
+    if ("5.17.2") {
+      await this.#store.metaStore().set("astro-version", "5.17.2");
     }
     if (currentConfigDigest) {
       await this.#store.metaStore().set("content-config-digest", currentConfigDigest);

package/dist/core/app/node.js

@@ -4,6 +4,7 @@ import { clientAddressSymbol, nodeRequestAbortControllerCleanupSymbol } from "..
 import { deserializeManifest } from "./common.js";
 import { createOutgoingHttpHeaders } from "./createOutgoingHttpHeaders.js";
 import { App } from "./index.js";
+import { validateForwardedHeaders, validateHost } from "./validate-headers.js";
 import { apply } from "../polyfill.js";
 class NodeApp extends App {
   headersMap = void 0;
@@ -50,26 +51,28 @@ class NodeApp extends App {
       return multiValueHeader?.toString()?.split(",").map((e) => e.trim())?.[0];
     };
     const providedProtocol = isEncrypted ? "https" : "http";
-    const providedHostname = req.headers.host ?? req.headers[":authority"];
-    const validated = App.validateForwardedHeaders(
+    const untrustedHostname = req.headers.host ?? req.headers[":authority"];
+    const validated = validateForwardedHeaders(
       getFirstForwardedValue(req.headers["x-forwarded-proto"]),
       getFirstForwardedValue(req.headers["x-forwarded-host"]),
       getFirstForwardedValue(req.headers["x-forwarded-port"]),
       allowedDomains
     );
     const protocol = validated.protocol ?? providedProtocol;
-    const sanitizedProvidedHostname = App.sanitizeHost(
-      typeof providedHostname === "string" ? providedHostname : void 0
+    const validatedHostname = validateHost(
+      typeof untrustedHostname === "string" ? untrustedHostname : void 0,
+      protocol,
+      allowedDomains
     );
-    const hostname = validated.host ?? sanitizedProvidedHostname;
+    const hostname = validated.host ?? validatedHostname ?? "localhost";
     const port = validated.port;
     let url;
     try {
       const hostnamePort = getHostnamePort(hostname, port);
       url = new URL(`${protocol}://${hostnamePort}${req.url}`);
     } catch {
-      const hostnamePort = getHostnamePort(providedHostname, port);
-      url = new URL(`${providedProtocol}://${hostnamePort}`);
+      const hostnamePort = getHostnamePort(hostname, port);
+      url = new URL(`${protocol}://${hostnamePort}`);
     }
     const options = {
       method: req.method || "GET",

package/dist/core/app/validate-headers.d.ts

@@ -0,0 +1,17 @@
+import { type RemotePattern } from '@astrojs/internal-helpers/remote';
+/**
+ * Validate a host against allowedDomains.
+ * Returns the host only if it matches an allowed pattern, otherwise undefined.
+ * This prevents SSRF attacks by ensuring the Host header is trusted.
+ */
+export declare function validateHost(host: string | undefined, protocol: string, allowedDomains?: Partial<RemotePattern>[]): string | undefined;
+/**
+ * Validate forwarded headers (proto, host, port) against allowedDomains.
+ * Returns validated values or undefined for rejected headers.
+ * Uses strict defaults: http/https only for proto, rejects port if not in allowedDomains.
+ */
+export declare function validateForwardedHeaders(forwardedProtocol?: string, forwardedHost?: string, forwardedPort?: string, allowedDomains?: Partial<RemotePattern>[]): {
+    protocol?: string;
+    host?: string;
+    port?: string;
+};

package/dist/core/app/validate-headers.js

@@ -0,0 +1,80 @@
+import { matchPattern } from "@astrojs/internal-helpers/remote";
+function sanitizeHost(hostname) {
+  if (!hostname) return void 0;
+  if (/[/\\]/.test(hostname)) return void 0;
+  return hostname;
+}
+function parseHost(host) {
+  const parts = host.split(":");
+  return {
+    hostname: parts[0],
+    port: parts[1]
+  };
+}
+function matchesAllowedDomains(hostname, protocol, port, allowedDomains) {
+  const hostWithPort = port ? `${hostname}:${port}` : hostname;
+  const urlString = `${protocol}://${hostWithPort}`;
+  if (!URL.canParse(urlString)) {
+    return false;
+  }
+  const testUrl = new URL(urlString);
+  return allowedDomains.some((pattern) => matchPattern(testUrl, pattern));
+}
+function validateHost(host, protocol, allowedDomains) {
+  if (!host || host.length === 0) return void 0;
+  if (!allowedDomains || allowedDomains.length === 0) return void 0;
+  const sanitized = sanitizeHost(host);
+  if (!sanitized) return void 0;
+  const { hostname, port } = parseHost(sanitized);
+  if (matchesAllowedDomains(hostname, protocol, port, allowedDomains)) {
+    return sanitized;
+  }
+  return void 0;
+}
+function validateForwardedHeaders(forwardedProtocol, forwardedHost, forwardedPort, allowedDomains) {
+  const result = {};
+  if (forwardedProtocol) {
+    if (allowedDomains && allowedDomains.length > 0) {
+      const hasProtocolPatterns = allowedDomains.some((pattern) => pattern.protocol !== void 0);
+      if (hasProtocolPatterns) {
+        try {
+          const testUrl = new URL(`${forwardedProtocol}://example.com`);
+          const isAllowed = allowedDomains.some((pattern) => matchPattern(testUrl, pattern));
+          if (isAllowed) {
+            result.protocol = forwardedProtocol;
+          }
+        } catch {
+        }
+      } else if (/^https?$/.test(forwardedProtocol)) {
+        result.protocol = forwardedProtocol;
+      }
+    } else if (/^https?$/.test(forwardedProtocol)) {
+      result.protocol = forwardedProtocol;
+    }
+  }
+  if (forwardedPort && allowedDomains && allowedDomains.length > 0) {
+    const hasPortPatterns = allowedDomains.some((pattern) => pattern.port !== void 0);
+    if (hasPortPatterns) {
+      const isAllowed = allowedDomains.some((pattern) => pattern.port === forwardedPort);
+      if (isAllowed) {
+        result.port = forwardedPort;
+      }
+    }
+  }
+  if (forwardedHost && forwardedHost.length > 0 && allowedDomains && allowedDomains.length > 0) {
+    const protoForValidation = result.protocol || "https";
+    const sanitized = sanitizeHost(forwardedHost);
+    if (sanitized) {
+      const { hostname, port: portFromHost } = parseHost(sanitized);
+      const portForValidation = result.port || portFromHost;
+      if (matchesAllowedDomains(hostname, protoForValidation, portForValidation, allowedDomains)) {
+        result.host = sanitized;
+      }
+    }
+  }
+  return result;
+}
+export {
+  validateForwardedHeaders,
+  validateHost
+};

package/dist/core/constants.js

@@ -1,4 +1,4 @@
-const ASTRO_VERSION = "5.17.0";
+const ASTRO_VERSION = "5.17.2";
 const REROUTE_DIRECTIVE_HEADER = "X-Astro-Reroute";
 const REWRITE_DIRECTIVE_HEADER_KEY = "X-Astro-Rewrite";
 const REWRITE_DIRECTIVE_HEADER_VALUE = "yes";

package/dist/core/dev/dev.js

@@ -22,7 +22,7 @@ async function dev(inlineConfig) {
   await telemetry.record([]);
   const restart = await createContainerWithAutomaticRestart({ inlineConfig, fs });
   const logger = restart.container.logger;
-  const currentVersion = "5.17.0";
+  const currentVersion = "5.17.2";
   const isPrerelease = currentVersion.includes("-");
   if (!isPrerelease) {
     try {

package/dist/core/errors/errors-data.d.ts

@@ -1247,19 +1247,6 @@ export declare const FontFamilyNotFound: {
     message: (family: string) => string;
     hint: string;
 };
-/**
- * @docs
- * @description
- * Font buffer not found
- * @message
- * No buffer was found for the URL passed to the `getFontBuffer()` function.
- */
-export declare const FontBufferNotFound: {
-    name: string;
-    title: string;
-    message: (url: string) => string;
-    hint: string;
-};
 /**
  * @docs
  * @description

package/dist/core/errors/errors-data.js

@@ -470,12 +470,6 @@ const FontFamilyNotFound = {
   message: (family) => `No data was found for the \`"${family}"\` family passed to the \`<Font>\` component.`,
   hint: "This is often caused by a typo. Check that the `<Font />` component is using a `cssVariable` specified in your config."
 };
-const FontBufferNotFound = {
-  name: "FontBufferNotFound",
-  title: "Font buffer not found",
-  message: (url) => `No buffer was found for the \`"${url}"\` URL passed to the \`getFontBuffer()\` function.`,
-  hint: "Make sure you pass a valid URL, obtained via the `fontData` object."
-};
 const CspNotEnabled = {
   name: "CspNotEnabled",
   title: "CSP feature isn't enabled",
@@ -784,7 +778,6 @@ export {
   FailedToLoadModuleSSR,
   FileGlobNotSupported,
   FileParserNotFound,
-  FontBufferNotFound,
   FontFamilyNotFound,
   ForbiddenRewrite,
   GenerateContentTypesError,

package/dist/core/messages.js

@@ -38,7 +38,7 @@ function serverStart({
   host,
   base
 }) {
-  const version = "5.17.0";
+  const version = "5.17.2";
   const localPrefix = `${dim("\u2503")} Local    `;
   const networkPrefix = `${dim("\u2503")} Network  `;
   const emptyPrefix = " ".repeat(11);
@@ -275,7 +275,7 @@ function printHelp({
     message.push(
       linebreak(),
       `  ${bgGreen(black(` ${commandName} `))} ${green(
-        `v${"5.17.0"}`
+        `v${"5.17.2"}`
       )} ${headline}`
     );
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astro",
-  "version": "5.17.0",
+  "version": "5.17.2",
   "description": "Astro is a modern site builder with web best practices, performance, and DX front-of-mind.",
   "type": "module",
   "author": "withastro",
@@ -63,8 +63,7 @@
     "./assets/endpoint/*": "./dist/assets/endpoint/*.js",
     "./assets/services/sharp": "./dist/assets/services/sharp.js",
     "./assets/services/noop": "./dist/assets/services/noop.js",
-    "./assets/fonts/runtime/server.js": "./dist/assets/fonts/runtime/server.js",
-    "./assets/fonts/runtime/client.js": "./dist/assets/fonts/runtime/client.js",
+    "./assets/fonts/runtime.js": "./dist/assets/fonts/runtime.js",
     "./loaders": "./dist/content/loaders/index.js",
     "./content/config": "./dist/content/config.js",
     "./content/runtime": "./dist/content/runtime.js",
@@ -114,7 +113,7 @@
     "dlv": "^1.1.3",
     "dset": "^3.1.4",
     "es-module-lexer": "^1.7.0",
-    "esbuild": "^0.25.0",
+    "esbuild": "^0.27.0",
     "estree-walker": "^3.0.3",
     "flattie": "^1.1.1",
     "fontace": "~0.4.0",
@@ -154,9 +153,9 @@
     "zod": "^3.25.76",
     "zod-to-json-schema": "^3.25.1",
     "zod-to-ts": "^1.2.0",
+    "@astrojs/internal-helpers": "0.7.5",
     "@astrojs/markdown-remark": "6.3.10",
-    "@astrojs/telemetry": "3.3.0",
-    "@astrojs/internal-helpers": "0.7.5"
+    "@astrojs/telemetry": "3.3.0"
   },
   "optionalDependencies": {
     "sharp": "^0.34.0"
@@ -194,8 +193,8 @@
     "undici": "^6.23.0",
     "unified": "^11.0.5",
     "vitest": "^3.2.4",
-    "astro-scripts": "0.0.14",
-    "@astrojs/check": "0.9.6"
+    "@astrojs/check": "0.9.6",
+    "astro-scripts": "0.0.14"
   },
   "engines": {
     "node": "18.20.8 || ^20.3.0 || >=22.0.0",

package/dist/assets/fonts/core/create-get-font-buffer.d.ts

@@ -1,4 +0,0 @@
-import type { BufferImports } from './../types.js';
-export declare function createGetFontBuffer({ bufferImports }: {
-    bufferImports?: BufferImports;
-}): (url: string) => Promise<Buffer<ArrayBufferLike>>;

package/dist/assets/fonts/core/create-get-font-buffer.js

@@ -1,35 +0,0 @@
-import { AstroError, AstroErrorData } from "../../../core/errors/index.js";
-function createGetFontBuffer({ bufferImports }) {
-  return async function getFontBuffer(url) {
-    if (!bufferImports) {
-      throw new AstroError(AstroErrorData.ExperimentalFontsNotEnabled);
-    }
-    const hash = url.split("/").pop() ?? "";
-    const fn = bufferImports[hash];
-    if (!fn) {
-      throw new AstroError({
-        ...AstroErrorData.FontBufferNotFound,
-        message: AstroErrorData.FontBufferNotFound.message(url)
-      });
-    }
-    let mod;
-    try {
-      mod = await fn();
-    } catch {
-      throw new AstroError({
-        ...AstroErrorData.FontBufferNotFound,
-        message: AstroErrorData.FontBufferNotFound.message(url)
-      });
-    }
-    if (!mod?.default) {
-      throw new AstroError({
-        ...AstroErrorData.FontBufferNotFound,
-        message: AstroErrorData.FontBufferNotFound.message(url)
-      });
-    }
-    return mod.default;
-  };
-}
-export {
-  createGetFontBuffer
-};

package/dist/assets/fonts/runtime/client.d.ts

@@ -1,2 +0,0 @@
-export declare const fontData: import("../types.js").FontDataByCssVariable;
-export declare function getFontBuffer(): Promise<void>;

package/dist/assets/fonts/runtime/client.js

@@ -1,9 +0,0 @@
-import * as fontsMod from "virtual:astro:assets/fonts/internal";
-const fontData = fontsMod.fontDataByCssVariable ?? {};
-async function getFontBuffer() {
-  throw new Error("[astro:assets] `getFontBuffer()` is not available on the client.");
-}
-export {
-  fontData,
-  getFontBuffer
-};

package/dist/assets/fonts/runtime/server.d.ts

@@ -1,2 +0,0 @@
-export declare const fontData: import("../types.js").FontDataByCssVariable;
-export declare const getFontBuffer: (url: string) => Promise<Buffer<ArrayBufferLike>>;

package/dist/assets/fonts/runtime/server.js

@@ -1,8 +0,0 @@
-import * as fontsMod from "virtual:astro:assets/fonts/internal";
-import { createGetFontBuffer } from "../core/create-get-font-buffer.js";
-const fontData = fontsMod.fontDataByCssVariable ?? {};
-const getFontBuffer = createGetFontBuffer(fontsMod);
-export {
-  fontData,
-  getFontBuffer
-};