astro 7.0.5 → 7.0.6

package/components/Picture.astro

@@ -1,7 +1,13 @@
 ---
-import { getImage, imageConfig, type LocalImageProps, type RemoteImageProps } from 'astro:assets';
+import {
+	getImage,
+	imageConfig,
+	inferRemoteSize,
+	type LocalImageProps,
+	type RemoteImageProps,
+} from 'astro:assets';
 import * as mime from 'mrmime';
-import { isESMImportedImage, resolveSrc } from '../dist/assets/utils/imageKind.js';
+import { isESMImportedImage, isRemoteImage, resolveSrc } from '../dist/assets/utils/imageKind.js';
 import { AstroError, AstroErrorData } from '../dist/core/errors/index.js';
 import type {
 	GetImageResult,
@@ -62,6 +68,17 @@ for (const key in props) {
 }
 
 const originalSrc = await resolveSrc(props.src);
+
+// When inferSize is set for a remote image, resolve dimensions once and thread them through
+// to all getImage() calls. This avoids multiple redundant HTTP requests to the same URL,
+// which can trigger rate-limiting (HTTP 429) on servers like Wikimedia.
+if (props.inferSize && isRemoteImage(originalSrc)) {
+	const remoteSize = await inferRemoteSize(originalSrc);
+	delete props.inferSize;
+	props.width ??= remoteSize.width;
+	props.height ??= remoteSize.height;
+}
+
 const optimizedImages: GetImageResult[] = await Promise.all(
 	formats.map(
 		async (format) =>

package/dist/actions/handler.js

@@ -1,3 +1,7 @@
+import {
+  createCrossOriginForbiddenResponse,
+  isForbiddenCrossOriginRequest
+} from "../core/app/origin-check.js";
 import { PipelineFeatures } from "../core/base-pipeline.js";
 import { getActionContext, serializeActionResult } from "./runtime/server.js";
 class ActionHandler {
@@ -18,6 +22,9 @@ class ActionHandler {
     if (!action) {
       return void 0;
     }
+    if (state.pipeline.manifest.checkOrigin && isForbiddenCrossOriginRequest(apiContext.request, apiContext.url, apiContext.isPrerendered)) {
+      return Promise.resolve(createCrossOriginForbiddenResponse(apiContext.request));
+    }
     return this.#executeAction(action, setActionResult);
   }
   async #executeAction(action, setActionResult) {

package/dist/cli/infra/build-time-astro-version-provider.js

@@ -1,6 +1,6 @@
 class BuildTimeAstroVersionProvider {
   // Injected during the build through esbuild define
-  version = "7.0.5";
+  version = "7.0.6";
 }
 export {
   BuildTimeAstroVersionProvider

package/dist/cli/install-package.js

@@ -1,4 +1,5 @@
 import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
 import * as clack from "@clack/prompts";
 import ci from "ci-info";
 import { detect, resolveCommand } from "package-manager-detector";
@@ -8,8 +9,8 @@ const require2 = createRequire(import.meta.url);
 const { bold, cyan, dim, magenta } = colors;
 async function getPackage(packageName, logger, options, otherDeps = []) {
   try {
-    require2.resolve(packageName, { paths: [options.cwd ?? process.cwd()] });
-    const packageImport = await import(packageName);
+    const resolved = require2.resolve(packageName, { paths: [options.cwd ?? process.cwd()] });
+    const packageImport = await import(pathToFileURL(resolved).href);
     return packageImport;
   } catch {
     if (options.optional) return void 0;
@@ -25,7 +26,8 @@ async function getPackage(packageName, logger, options, otherDeps = []) {
     }
     const result = await installPackage([packageName, ...otherDeps], options, logger);
     if (result) {
-      const packageImport = await import(packageName);
+      const resolved = require2.resolve(packageName, { paths: [options.cwd ?? process.cwd()] });
+      const packageImport = await import(pathToFileURL(resolved).href);
       return packageImport;
     } else {
       return void 0;

package/dist/container/index.js

@@ -14,6 +14,8 @@ import { validateSegment } from "../core/routing/segment.js";
 import { SlotString } from "../runtime/server/render/slot.js";
 import { ContainerPipeline } from "./pipeline.js";
 import { createConsoleLogger } from "../core/logger/impls/console.js";
+const { gfm: _, smartypants: __, ...containerMarkdownDefaults } = ASTRO_CONFIG_DEFAULTS.markdown;
+const CONTAINER_CONFIG_DEFAULTS = { ...ASTRO_CONFIG_DEFAULTS, markdown: containerMarkdownDefaults };
 function createManifest(manifest, renderers, middleware) {
   function middlewareInstance() {
     return {
@@ -113,7 +115,7 @@ class experimental_AstroContainer {
    */
   static async create(containerOptions = {}) {
     const { streaming = false, manifest, renderers = [], resolve } = containerOptions;
-    const astroConfig = await validateConfig(ASTRO_CONFIG_DEFAULTS, process.cwd(), "container");
+    const astroConfig = await validateConfig(CONTAINER_CONFIG_DEFAULTS, process.cwd(), "container");
     return new experimental_AstroContainer({
       streaming,
       manifest,
@@ -206,7 +208,7 @@ class experimental_AstroContainer {
   // NOTE: we keep this private via TS instead via `#` so it's still available on the surface, so we can play with it.
   // @ts-expect-error @ematipico: I plan to use it for a possible integration that could help people
   static async createFromManifest(manifest) {
-    const astroConfig = await validateConfig(ASTRO_CONFIG_DEFAULTS, process.cwd(), "container");
+    const astroConfig = await validateConfig(CONTAINER_CONFIG_DEFAULTS, process.cwd(), "container");
     const container = new experimental_AstroContainer({
       manifest,
       astroConfig

package/dist/content/content-layer.js

@@ -197,7 +197,7 @@ ${contentConfig.error.message}`
       logger.info("Content config changed");
       shouldClear = true;
     }
-    if (previousAstroVersion && previousAstroVersion !== "7.0.5") {
+    if (previousAstroVersion && previousAstroVersion !== "7.0.6") {
       logger.info("Astro version changed");
       shouldClear = true;
     }
@@ -205,8 +205,8 @@ ${contentConfig.error.message}`
       logger.info("Clearing content store");
       this.#store.clearAll();
     }
-    if ("7.0.5") {
-      this.#store.metaStore().set("astro-version", "7.0.5");
+    if ("7.0.6") {
+      this.#store.metaStore().set("astro-version", "7.0.6");
     }
     if (currentConfigDigest) {
       this.#store.metaStore().set("content-config-digest", currentConfigDigest);

package/dist/core/app/origin-check.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Home of the `security.checkOrigin` logic. Exposes the shared predicate and
+ * response used to reject cross-site submissions, plus the middleware factory
+ * that installs the check in the request pipeline. Consumers (the pipeline
+ * middleware and the Astro Actions dispatch) import from here so the check
+ * stays consistent regardless of where it runs.
+ */
+import type { MiddlewareHandler } from '../../types/public/common.js';
+/**
+ * Determines whether a request should be rejected because it is a cross-site
+ * submission for a route rendered on demand.
+ *
+ * This encapsulates the shared logic used by both the origin-check middleware
+ * and the Astro Actions dispatch, so the check is applied consistently
+ * regardless of where the request is handled.
+ *
+ * @private
+ */
+export declare function isForbiddenCrossOriginRequest(request: Request, url: URL, isPrerendered: boolean): boolean;
+/**
+ * Builds the 403 response returned when a cross-site submission is rejected.
+ *
+ * @private
+ */
+export declare function createCrossOriginForbiddenResponse(request: Request): Response;
+/**
+ * Returns a middleware function in charge to check the `origin` header.
+ *
+ * @private
+ */
+export declare function createOriginCheckMiddleware(): MiddlewareHandler;
+export declare function hasFormLikeHeader(contentType: string | null): boolean;

package/dist/core/app/origin-check.js

@@ -0,0 +1,52 @@
+import { defineMiddleware } from "../middleware/defineMiddleware.js";
+const FORM_CONTENT_TYPES = [
+  "application/x-www-form-urlencoded",
+  "multipart/form-data",
+  "text/plain"
+];
+const SAFE_METHODS = ["GET", "HEAD", "OPTIONS"];
+function isForbiddenCrossOriginRequest(request, url, isPrerendered) {
+  if (isPrerendered) {
+    return false;
+  }
+  if (SAFE_METHODS.includes(request.method)) {
+    return false;
+  }
+  const isSameOrigin = request.headers.get("origin") === url.origin;
+  const hasContentType = request.headers.has("content-type");
+  if (hasContentType) {
+    const formLikeHeader = hasFormLikeHeader(request.headers.get("content-type"));
+    return formLikeHeader && !isSameOrigin;
+  }
+  return !isSameOrigin;
+}
+function createCrossOriginForbiddenResponse(request) {
+  return new Response(`Cross-site ${request.method} form submissions are forbidden`, {
+    status: 403
+  });
+}
+function createOriginCheckMiddleware() {
+  return defineMiddleware((context, next) => {
+    const { request, url, isPrerendered } = context;
+    if (isForbiddenCrossOriginRequest(request, url, isPrerendered)) {
+      return createCrossOriginForbiddenResponse(request);
+    }
+    return next();
+  });
+}
+function hasFormLikeHeader(contentType) {
+  if (contentType) {
+    for (const FORM_CONTENT_TYPE of FORM_CONTENT_TYPES) {
+      if (contentType.toLowerCase().includes(FORM_CONTENT_TYPE)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+export {
+  createCrossOriginForbiddenResponse,
+  createOriginCheckMiddleware,
+  hasFormLikeHeader,
+  isForbiddenCrossOriginRequest
+};

package/dist/core/base-pipeline.js

@@ -1,5 +1,5 @@
 import { NOOP_ACTIONS_MOD } from "../actions/noop-actions.js";
-import { createOriginCheckMiddleware } from "./app/middlewares.js";
+import { createOriginCheckMiddleware } from "./app/origin-check.js";
 import { ActionNotFoundError } from "./errors/errors-data.js";
 import { AstroError } from "./errors/index.js";
 import { NOOP_MIDDLEWARE_FN } from "./middleware/noop-middleware.js";

package/dist/core/constants.js

@@ -1,4 +1,4 @@
-const ASTRO_VERSION = "7.0.5";
+const ASTRO_VERSION = "7.0.6";
 const ASTRO_GENERATOR = `Astro v${ASTRO_VERSION}`;
 const ASTRO_ERROR_HEADER = "X-Astro-Error";
 const DEFAULT_404_COMPONENT = "astro-default-404.astro";

package/dist/core/dev/dev.js

@@ -26,7 +26,7 @@ async function dev(inlineConfig) {
   await telemetry.record([]);
   const restart = await createContainerWithAutomaticRestart({ inlineConfig, fs });
   const logger = restart.container.logger;
-  const currentVersion = "7.0.5";
+  const currentVersion = "7.0.6";
   const isPrerelease = currentVersion.includes("-");
   if (!isPrerelease) {
     try {

package/dist/core/messages/runtime.js

@@ -269,7 +269,7 @@ function printHelp({
     message.push(
       linebreak(),
       `  ${bgGreen(black(` ${commandName} `))} ${green(
-        `v${"7.0.5"}`
+        `v${"7.0.6"}`
       )} ${headline}`
     );
   }

package/dist/core/pages/handler.js

@@ -1,6 +1,10 @@
 import { renderEndpoint } from "../../runtime/server/endpoint.js";
 import { renderPage } from "../../runtime/server/index.js";
 import { ASTRO_ERROR_HEADER } from "../constants.js";
+import {
+  createCrossOriginForbiddenResponse,
+  isForbiddenCrossOriginRequest
+} from "../app/origin-check.js";
 import { getCookiesFromResponse } from "../cookies/response.js";
 const EMPTY_SLOTS = Object.freeze({});
 class PagesHandler {
@@ -78,8 +82,12 @@ class PagesHandler {
     if (!state.routeData) {
       return new Response(null, { status: 404, headers: { [ASTRO_ERROR_HEADER]: "true" } });
     }
+    const ctx = state.getAPIContext();
+    if (this.#pipeline.manifest.checkOrigin && isForbiddenCrossOriginRequest(ctx.request, ctx.url, ctx.isPrerendered)) {
+      return createCrossOriginForbiddenResponse(ctx.request);
+    }
     try {
-      return await this.handle(state, state.getAPIContext());
+      return await this.handle(state, ctx);
     } catch (err) {
       app.logger.error(null, err.stack || err.message || String(err));
       return app.renderError(state.request, {

package/dist/core/routing/generator.js

@@ -11,10 +11,10 @@ function sanitizeParams(params) {
 }
 function getParameter(part, params) {
   if (part.spread) {
-    return params[part.content.slice(3)] || "";
+    return params[part.content.slice(3)] ?? "";
   }
   if (part.dynamic) {
-    if (!params[part.content]) {
+    if (params[part.content] === void 0) {
       throw new TypeError(`Missing parameter: ${part.content}`);
     }
     return params[part.content];

package/dist/core/util.d.ts

@@ -24,6 +24,14 @@ export declare function resolvePages(config: AstroConfig): URL;
 export declare function isPage(file: URL, settings: AstroSettings): boolean;
 export declare function isEndpoint(file: URL, settings: AstroSettings): boolean;
 export declare function resolveJsToTs(filePath: string): string;
+/**
+ * Resolve a path that doesn't name a file on disk (e.g. produced by an
+ * extensionless import like `import { Counter } from './Counter'`) to the file
+ * Vite would load, by probing Vite's default extension order and directory
+ * `index` files. Returns the path unchanged when it already exists as a file
+ * or when no candidate is found.
+ */
+export declare function resolveExtensionlessPath(filePath: string): string;
 /**
  * Set a default NODE_ENV so Vite doesn't set an incorrect default when loading the Astro config
  */

package/dist/core/util.js

@@ -94,6 +94,28 @@ function resolveJsToTs(filePath) {
   }
   return filePath;
 }
+const VITE_DEFAULT_RESOLVE_EXTENSIONS = [".mjs", ".js", ".mts", ".ts", ".jsx", ".tsx", ".json"];
+function resolveExtensionlessPath(filePath) {
+  const stat = fs.statSync(filePath, { throwIfNoEntry: false });
+  if (stat?.isFile()) {
+    return filePath;
+  }
+  for (const ext of VITE_DEFAULT_RESOLVE_EXTENSIONS) {
+    const tryPath = filePath + ext;
+    if (fs.existsSync(tryPath)) {
+      return tryPath;
+    }
+  }
+  if (stat?.isDirectory()) {
+    for (const ext of VITE_DEFAULT_RESOLVE_EXTENSIONS) {
+      const tryPath = `${filePath}/index${ext}`;
+      if (fs.existsSync(tryPath)) {
+        return tryPath;
+      }
+    }
+  }
+  return filePath;
+}
 function ensureProcessNodeEnv(defaultNodeEnv) {
   if (!process.env.NODE_ENV) {
     process.env.NODE_ENV = defaultNodeEnv;
@@ -106,6 +128,7 @@ export {
   isMarkdownFile,
   isPage,
   parseNpmName,
+  resolveExtensionlessPath,
   resolveJsToTs,
   resolvePages,
   unwrapId,

package/dist/core/viteUtils.d.ts

@@ -9,6 +9,9 @@ export declare function normalizePath(id: string): string;
  * Examples:
  * - `./components/Button.jsx` from `/app/src/pages/index.astro`
  *   -> `/app/src/pages/components/Button.tsx` (when `.tsx` exists)
+ * - `../components/Counter` from `/app/src/pages/index.astro`
+ *   -> `/app/src/components/Counter.tsx` (extensionless imports probe Vite's
+ *   default extension order, then directory `index` files)
  * - `#components/react/Counter.tsx`
  *   -> `/app/src/components/react/Counter.tsx` via package `imports`
  */

package/dist/core/viteUtils.js

@@ -2,7 +2,13 @@ import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { prependForwardSlash, slash } from "../core/path.js";
-import { resolveJsToTs, unwrapId, VALID_ID_PREFIX, viteID } from "./util.js";
+import {
+  resolveExtensionlessPath,
+  resolveJsToTs,
+  unwrapId,
+  VALID_ID_PREFIX,
+  viteID
+} from "./util.js";
 const isWindows = typeof process !== "undefined" && process.platform === "win32";
 function normalizePath(id) {
   return path.posix.normalize(isWindows ? slash(id) : id);
@@ -10,7 +16,7 @@ function normalizePath(id) {
 function resolvePath(specifier, importer) {
   if (specifier.startsWith(".")) {
     const absoluteSpecifier = path.resolve(path.dirname(importer), specifier);
-    return resolveJsToTs(normalizePath(absoluteSpecifier));
+    return resolveExtensionlessPath(resolveJsToTs(normalizePath(absoluteSpecifier)));
   } else if (specifier.startsWith("#")) {
     try {
       const resolved = createRequire(pathToFileURL(importer)).resolve(specifier);

package/dist/runtime/server/render/common.js

@@ -103,7 +103,13 @@ function stringifyChunk(result, chunk) {
         out += stringifyChunk(result, instr);
       }
     }
-    out += chunk.toString();
+    if (c.chunks.length) {
+      for (const part of c.chunks) {
+        out += typeof part === "string" ? part : stringifyChunk(result, part);
+      }
+    } else {
+      out += chunk.toString();
+    }
     return out;
   }
   return chunk.toString();

package/dist/runtime/server/render/dom.js

@@ -1,6 +1,6 @@
 import { markHTMLString } from "../escape.js";
 import { renderSlotToString } from "./slot.js";
-import { toAttributeString } from "./util.js";
+import { INVALID_ATTR_NAME_CHAR, toAttributeString } from "./util.js";
 function componentIsHTMLElement(Component) {
   return typeof HTMLElement !== "undefined" && HTMLElement.isPrototypeOf(Component);
 }
@@ -8,6 +8,9 @@ async function renderHTMLElement(result, constructor, props, slots) {
   const name = getHTMLElementName(constructor);
   let attrHTML = "";
   for (const attr in props) {
+    if (INVALID_ATTR_NAME_CHAR.test(attr)) {
+      continue;
+    }
     attrHTML += ` ${attr}="${toAttributeString(await props[attr])}"`;
   }
   return markHTMLString(

package/dist/runtime/server/render/instruction.d.ts

@@ -35,3 +35,4 @@ export type TemplateExitInstruction = {
 export type RenderInstruction = RenderDirectiveInstruction | RenderHeadInstruction | MaybeRenderHeadInstruction | RendererHydrationScriptInstruction | ServerIslandRuntimeInstruction | RenderScriptInstruction | TemplateEnterInstruction | TemplateExitInstruction;
 export declare function createRenderInstruction<T extends RenderInstruction>(instruction: T): T;
 export declare function isRenderInstruction(chunk: any): chunk is RenderInstruction;
+export declare function isScriptInstruction(chunk: any): chunk is RenderScriptInstruction;

package/dist/runtime/server/render/instruction.js

@@ -7,7 +7,11 @@ function createRenderInstruction(instruction) {
 function isRenderInstruction(chunk) {
   return chunk && typeof chunk === "object" && chunk[RenderInstructionSymbol];
 }
+function isScriptInstruction(chunk) {
+  return chunk && typeof chunk === "object" && "type" in chunk && chunk.type === "script";
+}
 export {
   createRenderInstruction,
-  isRenderInstruction
+  isRenderInstruction,
+  isScriptInstruction
 };

package/dist/runtime/server/render/server-islands.js

@@ -115,14 +115,14 @@ class ServerIslandComponent {
     for (const name in this.slots) {
       if (name !== "fallback") {
         const content = await renderSlotToString(this.result, this.slots[name]);
-        let slotHtml = content.toString();
         const slotContent = content;
-        if (Array.isArray(slotContent.instructions)) {
-          for (const instruction of slotContent.instructions) {
-            if (instruction.type === "script") {
-              slotHtml += instruction.content;
-            }
+        let slotHtml = "";
+        if (slotContent.chunks?.length) {
+          for (const part of slotContent.chunks) {
+            slotHtml += typeof part === "string" ? part : part.content;
           }
+        } else {
+          slotHtml = content.toString();
         }
         renderedSlots[name] = slotHtml;
       }

package/dist/runtime/server/render/slot.d.ts

@@ -2,15 +2,28 @@ import type { SSRResult } from '../../../types/public/internal.js';
 import { HTMLString } from '../escape.js';
 import { renderTemplate } from './astro/render-template.js';
 import { type RenderInstance } from './common.js';
-import type { RenderInstruction } from './instruction.js';
+import { type RenderInstruction, type RenderScriptInstruction } from './instruction.js';
 type RenderTemplateResult = ReturnType<typeof renderTemplate>;
 export type ComponentSlots = Record<string, ComponentSlotValue>;
 export type ComponentSlotValue = (result: SSRResult) => RenderTemplateResult | Promise<RenderTemplateResult>;
 declare const slotString: unique symbol;
+/**
+ * A part of a slot's content stream: either already-stringified HTML or a
+ * position-sensitive script instruction that is resolved (and deduplicated)
+ * lazily when the slot is finally stringified.
+ */
+export type SlotStringChunk = string | RenderScriptInstruction;
 export declare class SlotString extends HTMLString {
     instructions: null | RenderInstruction[];
+    /**
+     * The slot's content as an ordered stream. Unlike `instructions` (which holds
+     * position-independent instructions like head/hydration content), scripts are
+     * kept inline here so they render at their original position instead of being
+     * hoisted to the start of the slot output.
+     */
+    chunks: SlotStringChunk[];
     [slotString]: boolean;
-    constructor(content: string, instructions: null | RenderInstruction[]);
+    constructor(content: string, instructions: null | RenderInstruction[], chunks?: SlotStringChunk[]);
 }
 export declare function isSlotString(str: string): str is any;
 /**

package/dist/runtime/server/render/slot.js

@@ -2,13 +2,24 @@ import { HTMLString, markHTMLString, unescapeHTML } from "../escape.js";
 import { renderChild } from "./any.js";
 import { renderTemplate } from "./astro/render-template.js";
 import { chunkToString } from "./common.js";
+import {
+  isScriptInstruction
+} from "./instruction.js";
 const slotString = /* @__PURE__ */ Symbol.for("astro:slot-string");
 class SlotString extends HTMLString {
   instructions;
+  /**
+   * The slot's content as an ordered stream. Unlike `instructions` (which holds
+   * position-independent instructions like head/hydration content), scripts are
+   * kept inline here so they render at their original position instead of being
+   * hoisted to the start of the slot output.
+   */
+  chunks;
   [slotString];
-  constructor(content, instructions) {
+  constructor(content, instructions, chunks = []) {
     super(content);
     this.instructions = instructions;
+    this.chunks = chunks;
     this[slotString] = true;
   }
 }
@@ -35,25 +46,35 @@ function renderSlot(result, slotted, fallback) {
 async function renderSlotToString(result, slotted, fallback) {
   let content = "";
   let instructions = null;
+  const chunks = [];
   const temporaryDestination = {
     write(chunk) {
       if (chunk instanceof SlotString) {
         content += chunk;
+        if (chunk.chunks.length) {
+          chunks.push(...chunk.chunks);
+        }
         instructions = mergeSlotInstructions(instructions, chunk);
       } else if (chunk instanceof Response) return;
       else if (typeof chunk === "object" && "type" in chunk && typeof chunk.type === "string") {
-        if (instructions === null) {
-          instructions = [];
+        if (isScriptInstruction(chunk)) {
+          chunks.push(chunk);
+        } else {
+          if (instructions === null) {
+            instructions = [];
+          }
+          instructions.push(chunk);
         }
-        instructions.push(chunk);
       } else {
-        content += chunkToString(result, chunk);
+        const str = chunkToString(result, chunk);
+        content += str;
+        chunks.push(str);
       }
     }
   };
   const renderInstance = renderSlot(result, slotted, fallback);
   await renderInstance.render(temporaryDestination);
-  return markHTMLString(new SlotString(content, instructions));
+  return markHTMLString(new SlotString(content, instructions, chunks));
 }
 async function renderSlots(result, slots = {}) {
   let slotInstructions = null;
@@ -68,6 +89,16 @@ async function renderSlots(result, slots = {}) {
             }
             slotInstructions.push(...output.instructions);
           }
+          if (output.chunks) {
+            for (const part of output.chunks) {
+              if (typeof part !== "string") {
+                if (slotInstructions === null) {
+                  slotInstructions = [];
+                }
+                slotInstructions.push(part);
+              }
+            }
+          }
           children[key] = output;
         })
       )

package/dist/runtime/server/render/util.d.ts

@@ -1,6 +1,7 @@
 import type { SSRElement } from '../../../types/public/internal.js';
 import type { RenderDestination, RenderFunction } from './common.js';
 export declare const voidElementNames: RegExp;
+export declare const INVALID_ATTR_NAME_CHAR: RegExp;
 export declare const toAttributeString: (value: any, shouldEscape?: boolean) => any;
 export declare const toStyleString: (obj: Record<string, any>) => string;
 export declare function defineScriptVars(vars: Record<any, any>): any;

package/dist/runtime/server/render/util.js

@@ -168,6 +168,7 @@ function promiseWithResolvers() {
   };
 }
 export {
+  INVALID_ATTR_NAME_CHAR,
   addAttribute,
   createBufferedRenderer,
   defineScriptVars,

package/dist/vite-plugin-astro-server/plugin.js

@@ -25,6 +25,9 @@ function createVitePluginAstroServer({
       return environment.name === ASTRO_VITE_ENVIRONMENT_NAMES.ssr;
     },
     async configureServer(viteServer) {
+      if (process.env.VITEST) {
+        return;
+      }
       const ssrEnvironment = viteServer.environments[ASTRO_VITE_ENVIRONMENT_NAMES.ssr];
       const prerenderEnvironment = viteServer.environments[ASTRO_VITE_ENVIRONMENT_NAMES.prerender];
       const runnableSsrEnvironment = isRunnableDevEnvironment(ssrEnvironment) ? ssrEnvironment : void 0;

package/dist/vite-plugin-css/index.js

@@ -122,7 +122,7 @@ function astroDevCssPlugin({ routesList, command }) {
             }
             for (const collected of collectCSSWithOrder(componentPageId, mod)) {
               if (!cssWithOrder.has(collected.idKey)) {
-                const content = cssContentCache.get(collected.id) || collected.content;
+                const content = cssContentCache.get(collected.idKey) || collected.content;
                 cssWithOrder.set(collected.idKey, { ...collected, content });
               }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astro",
-  "version": "7.0.5",
+  "version": "7.0.6",
   "description": "Astro is a modern site builder with web best practices, performance, and DX front-of-mind.",
   "type": "module",
   "author": "withastro",
@@ -146,15 +146,15 @@
     "xxhash-wasm": "^1.1.0",
     "yargs-parser": "^22.0.0",
     "zod": "^4.3.6",
-    "@astrojs/internal-helpers": "0.10.0",
-    "@astrojs/markdown-satteri": "0.3.2",
+    "@astrojs/internal-helpers": "0.10.1",
+    "@astrojs/markdown-satteri": "0.3.3",
     "@astrojs/telemetry": "3.3.2"
   },
   "optionalDependencies": {
     "sharp": "^0.34.0 || ^0.35.0"
   },
   "peerDependencies": {
-    "@astrojs/markdown-remark": "7.2.0"
+    "@astrojs/markdown-remark": "7.2.1"
   },
   "peerDependenciesMeta": {
     "@astrojs/markdown-remark": {
@@ -187,7 +187,7 @@
     "undici": "^7.22.0",
     "vitest": "^4.1.0",
     "@astrojs/check": "0.9.9",
-    "@astrojs/markdown-remark": "7.2.0",
+    "@astrojs/markdown-remark": "7.2.1",
     "astro-scripts": "0.0.14"
   },
   "engines": {

package/templates/content/types.d.ts

@@ -85,6 +85,10 @@ declare module 'astro:content' {
 		entry: DataEntryMap[C][string],
 	): Promise<RenderResult>;
 
+	export function render<C extends keyof LiveContentConfig['collections']>(
+		entry: import('astro').LiveDataEntry<LiveLoaderDataType<C>>,
+	): Promise<RenderResult>;
+
 	export function reference<
 		C extends
 			| keyof DataEntryMap

package/dist/core/app/middlewares.d.ts

@@ -1,8 +0,0 @@
-import type { MiddlewareHandler } from '../../types/public/common.js';
-/**
- * Returns a middleware function in charge to check the `origin` header.
- *
- * @private
- */
-export declare function createOriginCheckMiddleware(): MiddlewareHandler;
-export declare function hasFormLikeHeader(contentType: string | null): boolean;

package/dist/core/app/middlewares.js

@@ -1,49 +0,0 @@
-import { defineMiddleware } from "../middleware/defineMiddleware.js";
-const FORM_CONTENT_TYPES = [
-  "application/x-www-form-urlencoded",
-  "multipart/form-data",
-  "text/plain"
-];
-const SAFE_METHODS = ["GET", "HEAD", "OPTIONS"];
-function createOriginCheckMiddleware() {
-  return defineMiddleware((context, next) => {
-    const { request, url, isPrerendered } = context;
-    if (isPrerendered) {
-      return next();
-    }
-    if (SAFE_METHODS.includes(request.method)) {
-      return next();
-    }
-    const isSameOrigin = request.headers.get("origin") === url.origin;
-    const hasContentType = request.headers.has("content-type");
-    if (hasContentType) {
-      const formLikeHeader = hasFormLikeHeader(request.headers.get("content-type"));
-      if (formLikeHeader && !isSameOrigin) {
-        return new Response(`Cross-site ${request.method} form submissions are forbidden`, {
-          status: 403
-        });
-      }
-    } else {
-      if (!isSameOrigin) {
-        return new Response(`Cross-site ${request.method} form submissions are forbidden`, {
-          status: 403
-        });
-      }
-    }
-    return next();
-  });
-}
-function hasFormLikeHeader(contentType) {
-  if (contentType) {
-    for (const FORM_CONTENT_TYPE of FORM_CONTENT_TYPES) {
-      if (contentType.toLowerCase().includes(FORM_CONTENT_TYPE)) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-export {
-  createOriginCheckMiddleware,
-  hasFormLikeHeader
-};