astro 7.2.3 → 7.2.4

package/dist/assets/utils/vendor/image-size/types/heif.js

@@ -46,20 +46,25 @@ const HEIF = {
     const type = detectType(input, 8, metaBox.offset);
     const images = [];
     let currentOffset = ipcoBox.offset + 8;
-    while (currentOffset < ipcoBox.offset + ipcoBox.size) {
+    const ipcoEnd = ipcoBox.offset + ipcoBox.size;
+    while (currentOffset < ipcoEnd) {
       const ispeBox = findBox(input, "ispe", currentOffset);
       if (!ispeBox) break;
+      if (ispeBox.size < 8) break;
+      if (ispeBox.offset + ispeBox.size > ipcoEnd) break;
       const rawWidth = readUInt32BE(input, ispeBox.offset + 12);
       const rawHeight = readUInt32BE(input, ispeBox.offset + 16);
       const clapBox = findBox(input, "clap", currentOffset);
       let width = rawWidth;
       let height = rawHeight;
-      if (clapBox && clapBox.offset < ipcoBox.offset + ipcoBox.size) {
+      if (clapBox && clapBox.offset < ipcoEnd && clapBox.size >= 8) {
         const cropRight = readUInt32BE(input, clapBox.offset + 12);
         width = rawWidth - cropRight;
       }
       images.push({ height, width });
-      currentOffset = ispeBox.offset + ispeBox.size;
+      const nextOffset = ispeBox.offset + ispeBox.size;
+      if (nextOffset <= currentOffset) break;
+      currentOffset = nextOffset;
     }
     if (images.length === 0) {
       throw new TypeError("Invalid HEIF, no sizes found");

package/dist/assets/utils/vendor/image-size/types/icns.js

@@ -1,6 +1,7 @@
 import { readUInt32BE, toUTF8String } from "./utils.js";
 const SIZE_HEADER = 4 + 4;
 const FILE_LENGTH_OFFSET = 4;
+const MIN_ENTRY_LENGTH = 8;
 const ENTRY_LENGTH_OFFSET = 4;
 const ICON_TYPE_SIZE = {
   ICON: 32,
@@ -63,10 +64,17 @@ const ICNS = {
     let imageOffset = SIZE_HEADER;
     const images = [];
     while (imageOffset < fileLength && imageOffset < inputLength) {
+      if (inputLength - imageOffset < MIN_ENTRY_LENGTH) break;
       const imageHeader = readImageHeader(input, imageOffset);
+      const entryLength = imageHeader[1];
+      if (entryLength < MIN_ENTRY_LENGTH) break;
       const imageSize = getImageSize(imageHeader[0]);
-      images.push(imageSize);
-      imageOffset += imageHeader[1];
+      if (imageSize.width && imageSize.height) {
+        images.push(imageSize);
+      }
+      const nextOffset = imageOffset + entryLength;
+      if (nextOffset <= imageOffset) break;
+      imageOffset = nextOffset;
     }
     if (images.length === 0) {
       throw new TypeError("Invalid ICNS, no sizes found");

package/dist/assets/utils/vendor/image-size/types/jp2.js

@@ -10,8 +10,8 @@ const JP2 = {
   },
   calculate(input) {
     const jp2hBox = findBox(input, "jp2h", 0);
-    const ihdrBox = jp2hBox && findBox(input, "ihdr", jp2hBox.offset + 8);
-    if (ihdrBox) {
+    const ihdrBox = jp2hBox && jp2hBox.size >= 8 && findBox(input, "ihdr", jp2hBox.offset + 8);
+    if (ihdrBox && ihdrBox.size >= 8) {
       return {
         height: readUInt32BE(input, ihdrBox.offset + 8),
         width: readUInt32BE(input, ihdrBox.offset + 12)

package/dist/assets/utils/vendor/image-size/types/jxl.js

@@ -2,7 +2,7 @@ import { JXLStream } from "./jxl-stream.js";
 import { findBox, toUTF8String } from "./utils.js";
 function extractCodestream(input) {
   const jxlcBox = findBox(input, "jxlc", 0);
-  if (jxlcBox) {
+  if (jxlcBox && jxlcBox.size >= 8) {
     return input.slice(jxlcBox.offset + 8, jxlcBox.offset + jxlcBox.size);
   }
   const partialStreams = extractPartialStreams(input);
@@ -17,10 +17,13 @@ function extractPartialStreams(input) {
   while (offset < input.length) {
     const jxlpBox = findBox(input, "jxlp", offset);
     if (!jxlpBox) break;
+    if (jxlpBox.size < 12) break;
     partialStreams.push(
       input.slice(jxlpBox.offset + 12, jxlpBox.offset + jxlpBox.size)
     );
-    offset = jxlpBox.offset + jxlpBox.size;
+    const nextOffset = jxlpBox.offset + jxlpBox.size;
+    if (nextOffset <= offset) break;
+    offset = nextOffset;
   }
   return partialStreams;
 }

package/dist/assets/utils/vendor/image-size/types/utils.d.ts

@@ -9,7 +9,7 @@ export declare const readUInt32BE: (input: Uint8Array, offset?: number) => numbe
 export declare const readUInt32LE: (input: Uint8Array, offset?: number) => number;
 export declare const readUInt64: (input: Uint8Array, offset: number, isBigEndian: boolean) => bigint;
 export declare function readUInt(input: Uint8Array, bits: 16 | 32, offset?: number, isBigEndian?: boolean): number;
-export declare function findBox(input: Uint8Array, boxName: string, currentOffset: number): {
+export declare function findBox(input: Uint8Array, boxName: string, startOffset: number): {
     name: string;
     offset: number;
     size: number;

package/dist/assets/utils/vendor/image-size/types/utils.js

@@ -24,22 +24,36 @@ function readUInt(input, bits, offset = 0, isBigEndian = false) {
   const methodName = `readUInt${bits}${endian}`;
   return methods[methodName](input, offset);
 }
+const MIN_BOX_HEADER = 8;
 function readBox(input, offset) {
-  if (input.length - offset < 4) return;
+  if (input.length - offset < MIN_BOX_HEADER) return;
   const boxSize = readUInt32BE(input, offset);
+  if (boxSize === 0) {
+    return {
+      name: toUTF8String(input, offset + 4, offset + 8),
+      offset,
+      size: input.length - offset
+    };
+  }
+  if (boxSize === 1) return;
+  if (boxSize < MIN_BOX_HEADER) return;
   if (input.length - offset < boxSize) return;
   return {
-    name: toUTF8String(input, 4 + offset, 8 + offset),
+    name: toUTF8String(input, offset + 4, offset + 8),
     offset,
     size: boxSize
   };
 }
-function findBox(input, boxName, currentOffset) {
-  while (currentOffset < input.length) {
-    const box = readBox(input, currentOffset);
+function findBox(input, boxName, startOffset) {
+  let offset = startOffset;
+  while (offset < input.length) {
+    const box = readBox(input, offset);
     if (!box) break;
     if (box.name === boxName) return box;
-    currentOffset += box.size > 0 ? box.size : 8;
+    if (box.size < MIN_BOX_HEADER) break;
+    const nextOffset = offset + box.size;
+    if (nextOffset <= offset) break;
+    offset = nextOffset;
   }
 }
 export {

package/dist/cli/infra/build-time-astro-version-provider.js

@@ -1,6 +1,6 @@
 class BuildTimeAstroVersionProvider {
   // Injected during the build through esbuild define
-  version = "7.2.3";
+  version = "7.2.4";
 }
 export {
   BuildTimeAstroVersionProvider

package/dist/container/index.js

@@ -16,7 +16,7 @@ import { createConsoleLogger } from "../core/logger/impls/console.js";
 import { setLogger } from "../core/logger/manifest-logger.js";
 import { peekMiddleware } from "../core/middleware/load.js";
 import { getRouteTable } from "../core/routing/route-table.js";
-function createManifest(manifest, renderers, middleware) {
+function createManifest(manifest, renderers, middleware, site) {
   function middlewareInstance() {
     return {
       onRequest: middleware ?? NOOP_MIDDLEWARE_FN
@@ -54,6 +54,7 @@ function createManifest(manifest, renderers, middleware) {
     componentMetadata: manifest?.componentMetadata ?? /* @__PURE__ */ new Map(),
     inlinedScripts: manifest?.inlinedScripts ?? /* @__PURE__ */ new Map(),
     i18n: manifest?.i18n,
+    site: site ?? manifest?.site,
     checkOrigin: false,
     allowedDomains: manifest?.allowedDomains ?? [],
     actionBodySizeLimit: 1024 * 1024,
@@ -93,9 +94,10 @@ class experimental_AstroContainer {
     streaming = false,
     manifest,
     renderers,
-    resolve
+    resolve,
+    site
   }) {
-    const ssrManifest = createManifest(manifest, renderers);
+    const ssrManifest = createManifest(manifest, renderers, void 0, site);
     const containerRenderers = renderers ?? manifest?.renderers ?? [];
     const containerResolve = async (specifier) => {
       if (this.#withManifest) {
@@ -133,12 +135,13 @@ class experimental_AstroContainer {
    * @param {AstroContainerOptions=} containerOptions
    */
   static async create(containerOptions = {}) {
-    const { streaming = false, manifest, renderers = [], resolve } = containerOptions;
+    const { streaming = false, manifest, renderers = [], resolve, astroConfig } = containerOptions;
     return new experimental_AstroContainer({
       streaming,
       manifest,
       renderers,
-      resolve
+      resolve,
+      site: astroConfig?.site ?? manifest?.site
     });
   }
   /**

package/dist/content/content-layer.js

@@ -196,7 +196,7 @@ ${contentConfig.error.message}`
       logger.info("Content config changed");
       shouldClear = true;
     }
-    if (previousAstroVersion && previousAstroVersion !== "7.2.3") {
+    if (previousAstroVersion && previousAstroVersion !== "7.2.4") {
       logger.info("Astro version changed");
       shouldClear = true;
     }
@@ -204,8 +204,8 @@ ${contentConfig.error.message}`
       logger.info("Clearing content store");
       this.#store.clearAll();
     }
-    if ("7.2.3") {
-      this.#store.metaStore().set("astro-version", "7.2.3");
+    if ("7.2.4") {
+      this.#store.metaStore().set("astro-version", "7.2.4");
     }
     if (currentConfigDigest) {
       this.#store.metaStore().set("content-config-digest", currentConfigDigest);

package/dist/core/app/base.js

@@ -1,7 +1,7 @@
 import {
-  collapseDuplicateLeadingSlashes,
   prependForwardSlash,
-  removeTrailingForwardSlash
+  removeTrailingForwardSlash,
+  stripRequestBase
 } from "@astrojs/internal-helpers/path";
 import { matchPattern } from "@astrojs/internal-helpers/remote";
 import { computePathnameFromDomain } from "../i18n/domain.js";
@@ -146,11 +146,7 @@ class BaseApp {
     updateRouteTable(this.manifest, newManifestData.routes);
   }
   removeBase(pathname) {
-    pathname = collapseDuplicateLeadingSlashes(pathname);
-    if (pathname.startsWith(this.manifest.base)) {
-      return pathname.slice(this.baseWithoutTrailingSlash.length + 1);
-    }
-    return pathname;
+    return stripRequestBase(pathname, this.manifest.base);
   }
   /**
    * Decodes a pathname with `decodeURI`, falling back to the raw pathname when it

package/dist/core/constants.js

@@ -1,4 +1,4 @@
-const ASTRO_VERSION = "7.2.3";
+const ASTRO_VERSION = "7.2.4";
 const ASTRO_GENERATOR = `Astro v${ASTRO_VERSION}`;
 const ASTRO_ERROR_HEADER = "X-Astro-Error";
 const DEFAULT_404_COMPONENT = "astro-default-404.astro";

package/dist/core/dev/dev.js

@@ -26,7 +26,7 @@ async function dev(inlineConfig) {
   await telemetry.record([]);
   const restart = await createContainerWithAutomaticRestart({ inlineConfig, fs });
   const logger = restart.container.logger;
-  const currentVersion = "7.2.3";
+  const currentVersion = "7.2.4";
   const isPrerelease = currentVersion.includes("-");
   if (!isPrerelease) {
     try {

package/dist/core/fetch/fetch-state.js

@@ -1,9 +1,8 @@
 import colors from "piccolore";
 import {
-  collapseDuplicateLeadingSlashes,
   collapseDuplicateSlashes,
   prependForwardSlash,
-  removeTrailingForwardSlash
+  stripRequestBase
 } from "@astrojs/internal-helpers/path";
 import { deserializeActionResult } from "../../actions/runtime/client.js";
 import { createCallAction, createGetActionResult, hasActionPayload } from "../../actions/utils.js";
@@ -723,6 +722,9 @@ class FetchState {
   #stripHtmlExtension() {
     if (this.routeData && this.routeData.type === "page" && !routeHasHtmlExtension(this.routeData)) {
       this.pathname = this.pathname.replace(/\/index\.html$/, "/").replace(/\.html$/, "");
+      if (this.manifest.trailingSlash === "always" && this.pathname !== "" && !this.pathname.endsWith("/")) {
+        this.pathname += "/";
+      }
     }
   }
   #resolveRouteData() {
@@ -760,18 +762,12 @@ class FetchState {
    * Strips the manifest's base from a normalized request pathname and prepends
    * a forward slash.
    *
-   * Mirrors `BaseApp.removeBase`, including the
-   * `collapseDuplicateLeadingSlashes` fix that prevents middleware
-   * authorization bypass when the URL starts with `//`.
+   * Mirrors `BaseApp.removeBase`: the router matches against this stripped path
+   * while middleware reads the un-stripped `context.url.pathname`, so both must
+   * strip the base identically.
    */
   #computePathname(normalizedPathname) {
-    let pathname = collapseDuplicateLeadingSlashes(normalizedPathname);
-    const base = this.manifest.base;
-    if (pathname.startsWith(base)) {
-      const baseWithoutTrailingSlash = removeTrailingForwardSlash(base);
-      pathname = pathname.slice(baseWithoutTrailingSlash.length + 1);
-    }
-    return prependForwardSlash(pathname);
+    return prependForwardSlash(stripRequestBase(normalizedPathname, this.manifest.base));
   }
   /**
    * Decodes and normalizes the public request pathname before deriving the

package/dist/core/i18n/domain.js

@@ -1,9 +1,9 @@
 import {
   appendForwardSlash,
-  collapseDuplicateLeadingSlashes,
   joinPaths,
   prependForwardSlash,
-  removeTrailingForwardSlash
+  removeTrailingForwardSlash,
+  stripRequestBase
 } from "@astrojs/internal-helpers/path";
 import { normalizeTheLocale } from "../../i18n/path.js";
 function computePathnameFromDomain(request, url, i18n, base, trailingSlash, logger, pathnameFromRequest) {
@@ -32,13 +32,13 @@ function computePathnameFromDomain(request, url, i18n, base, trailingSlash, logg
           }
         }
         if (locale) {
-          const requestPathname = pathnameFromRequest ?? removeBase(url.pathname, base);
+          const requestPathname = pathnameFromRequest ?? stripRequestBase(url.pathname, base);
           pathname = prependForwardSlash(joinPaths(normalizeTheLocale(locale), requestPathname));
           if (trailingSlash === "always") {
             pathname = appendForwardSlash(pathname);
           } else if (trailingSlash === "never") {
             pathname = removeTrailingForwardSlash(pathname);
-          } else if (requestPathname.endsWith("/")) {
+          } else if (url.pathname.endsWith("/")) {
             pathname = appendForwardSlash(pathname);
           }
         }
@@ -53,13 +53,6 @@ function computePathnameFromDomain(request, url, i18n, base, trailingSlash, logg
   }
   return pathname;
 }
-function removeBase(pathname, base) {
-  pathname = collapseDuplicateLeadingSlashes(pathname);
-  if (pathname.startsWith(base)) {
-    return pathname.slice(removeTrailingForwardSlash(base).length + 1);
-  }
-  return pathname;
-}
 export {
   computePathnameFromDomain
 };

package/dist/core/messages/runtime.js

@@ -270,7 +270,7 @@ function printHelp({
     message.push(
       linebreak(),
       `  ${bgGreen(black(` ${commandName} `))} ${green(
-        `v${"7.2.3"}`
+        `v${"7.2.4"}`
       )} ${headline}`
     );
   }

package/dist/core/routing/match-request.js

@@ -1,19 +1,8 @@
-import {
-  collapseDuplicateLeadingSlashes,
-  prependForwardSlash,
-  removeTrailingForwardSlash
-} from "@astrojs/internal-helpers/path";
+import { prependForwardSlash, stripRequestBase } from "@astrojs/internal-helpers/path";
 import { computePathnameFromDomain } from "../i18n/domain.js";
 import { AstroIntegrationLogger } from "../logger/core.js";
 import { getLogger } from "../logger/manifest-logger.js";
 import { matchAllRoutes, matchRoute } from "./route-table.js";
-function removeBase(manifest, pathname) {
-  pathname = collapseDuplicateLeadingSlashes(pathname);
-  if (pathname.startsWith(manifest.base)) {
-    return pathname.slice(removeTrailingForwardSlash(manifest.base).length + 1);
-  }
-  return pathname;
-}
 function safeDecodeURI(manifest, pathname) {
   try {
     return decodeURI(pathname);
@@ -36,7 +25,7 @@ function matchRequest(manifest, request, allowPrerenderedRoutes = false) {
     getLogger(manifest)
   );
   if (!pathname) {
-    pathname = prependForwardSlash(removeBase(manifest, url.pathname));
+    pathname = prependForwardSlash(stripRequestBase(url.pathname, manifest.base));
   }
   const routeData = matchRoute(manifest, safeDecodeURI(manifest, pathname));
   if (!routeData) return void 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astro",
-  "version": "7.2.3",
+  "version": "7.2.4",
   "description": "Astro is a modern site builder with web best practices, performance, and DX front-of-mind.",
   "type": "module",
   "author": "withastro",
@@ -153,15 +153,15 @@
     "xxhash-wasm": "^1.1.0",
     "yargs-parser": "^22.0.0",
     "zod": "^4.3.6",
-    "@astrojs/internal-helpers": "0.10.3",
-    "@astrojs/markdown-satteri": "0.3.6",
+    "@astrojs/internal-helpers": "0.10.4",
+    "@astrojs/markdown-satteri": "0.3.7",
     "@astrojs/telemetry": "3.3.3"
   },
   "optionalDependencies": {
     "sharp": "^0.34.0 || ^0.35.0"
   },
   "peerDependencies": {
-    "@astrojs/markdown-remark": "7.2.3"
+    "@astrojs/markdown-remark": "7.2.4"
   },
   "peerDependenciesMeta": {
     "@astrojs/markdown-remark": {
@@ -194,7 +194,7 @@
     "undici": "^7.22.0",
     "vitest": "^4.1.0",
     "@astrojs/check": "0.9.10",
-    "@astrojs/markdown-remark": "7.2.3",
+    "@astrojs/markdown-remark": "7.2.4",
     "astro-scripts": "0.0.14"
   },
   "engines": {