astro 7.2.4 → 7.2.6

package/bin/astro.mjs

@@ -1,6 +1,21 @@
 #!/usr/bin/env node
 'use strict';
 
+import module from 'node:module';
+
+// In CI writing the cache is (most of the time) harmful, as it'll never get re-used and just slows down the CLI.
+if (!process.env.CI) {
+	try {
+		module.enableCompileCache?.();
+		// Long-running commands like `astro dev` never reach the flush that happens on process exit.
+		setTimeout(() => {
+			try {
+				module.flushCompileCache?.();
+			} catch {}
+		}, 10_000).unref();
+	} catch {}
+}
+
 const CI_INSTRUCTIONS = {
 	NETLIFY: 'https://docs.netlify.com/configure-builds/manage-dependencies/#node-js-and-javascript',
 	GITHUB_ACTIONS:

package/client.d.ts

@@ -7,7 +7,7 @@
 /// <reference path="./types/transitions.d.ts" />
 
 interface ImportMetaEnv {
-	// TODO: remove in Astro 7
+	// TODO: remove in Astro 8
 	/**
 	 * The prefix for Astro-generated asset links if the build.assetsPrefix config option is set. This can be used to create asset links not handled by Astro.
 	 * @deprecated This will be removed in a future major version of Astro. Use `build.assetsPrefix` from `astro:config/server` instead.
@@ -98,6 +98,10 @@ declare module '*.png' {
 	const metadata: ImageMetadata;
 	export default metadata;
 }
+declare module '*.apng' {
+	const metadata: ImageMetadata;
+	export default metadata;
+}
 declare module '*.tiff' {
 	const metadata: ImageMetadata;
 	export default metadata;
@@ -149,11 +153,11 @@ declare module 'astro:components' {
 	export * from 'astro/components';
 }
 
-// TODO: remove in Astro 7
+// TODO: remove in Astro 8
 /**
  * @deprecated
  * `import { z } from 'astro:schema'` is deprecated and will be removed
- * in Astro 7. Use `import { z } from 'astro/zod'` instead.
+ * in Astro 8. Use `import { z } from 'astro/zod'` instead.
  */
 declare module 'astro:schema' {
 	export * from 'astro/zod';
@@ -162,7 +166,7 @@ declare module 'astro:schema' {
 	/**
 	 * @deprecated
 	 * `import { z } from 'astro:schema'` is deprecated and will be removed
-	 * in Astro 7. Use `import { z } from 'astro/zod'` instead.
+	 * in Astro 8. Use `import { z } from 'astro/zod'` instead.
 	 */
 	export const z = zod.z;
 }

package/dist/assets/consts.d.ts

@@ -5,7 +5,7 @@ export declare const VIRTUAL_GET_IMAGE_ID = "virtual:astro:get-image";
 export declare const RESOLVED_VIRTUAL_GET_IMAGE_ID: string;
 export declare const VIRTUAL_IMAGE_STYLES_ID = "virtual:astro:image-styles.css";
 export declare const RESOLVED_VIRTUAL_IMAGE_STYLES_ID: string;
-export declare const VALID_INPUT_FORMATS: readonly ["jpeg", "jpg", "png", "tiff", "webp", "gif", "svg", "avif"];
+export declare const VALID_INPUT_FORMATS: readonly ["jpeg", "jpg", "png", "apng", "tiff", "webp", "gif", "svg", "avif"];
 /**
  * Valid formats that our base services support.
  * Certain formats can be imported (namely SVGs) but will not be processed.

package/dist/assets/consts.js

@@ -9,6 +9,7 @@ const VALID_INPUT_FORMATS = [
   "jpeg",
   "jpg",
   "png",
+  "apng",
   "tiff",
   "webp",
   "gif",

package/dist/assets/fonts/infra/remote-runtime-font-file-url-resolver.d.ts

@@ -5,9 +5,11 @@ import type { RuntimeFontFileUrlResolver } from '../definitions.js';
  * During prerendering, a temporary Node HTTP server is started to
  * serve font files.
  *
- * We send request to the provided server address. `requestUrl` on
- * `fetch` is not implemented because we have the information from
- * within the Vite plugin already.
+ * When possible, the resolver uses a statically known server
+ * {@link address}. When the address is not yet available (e.g. the
+ * virtual module was evaluated before the HTTP server started
+ * listening — see #17722), the resolver falls back to deriving the
+ * origin from the caller-supplied {@link requestUrl}.
  */
 export declare class RemoteRuntimeFontFileUrlResolver implements RuntimeFontFileUrlResolver {
     #private;
@@ -15,5 +17,5 @@ export declare class RemoteRuntimeFontFileUrlResolver implements RuntimeFontFile
         urls: Set<string>;
         address: AddressInfo | null;
     });
-    resolve(url: string): string | null;
+    resolve(url: string, requestUrl: URL | undefined): string | null;
 }

package/dist/assets/fonts/infra/remote-runtime-font-file-url-resolver.js

@@ -8,18 +8,25 @@ class RemoteRuntimeFontFileUrlResolver {
     this.#urls = urls;
     this.#address = address;
   }
-  resolve(url) {
+  resolve(url, requestUrl) {
     if (!this.#urls.has(url)) {
       return null;
     }
-    if (!this.#address) {
-      throw new Error("Server address unavailable, this should not happen. Open an issue.");
-    }
     if (!url.startsWith("/")) {
-      url = new URL(url).pathname;
+      if (this.#address) {
+        url = new URL(url).pathname;
+      } else {
+        return url;
+      }
+    }
+    if (this.#address) {
+      const host = this.#address.family === "IPv6" ? `[${this.#address.address}]` : this.#address.address;
+      return `http://${host}:${this.#address.port}${url}`;
+    }
+    if (requestUrl) {
+      return `${requestUrl.origin}${url}`;
     }
-    const host = this.#address.family === "IPv6" ? `[${this.#address.address}]` : this.#address.address;
-    return `http://${host}:${this.#address.port}${url}`;
+    throw new Error("Server address unavailable, this should not happen. Open an issue.");
   }
 }
 export {

package/dist/assets/utils/node.js

@@ -80,6 +80,9 @@ async function emitImageMetadata(id, fileEmitter) {
     throw err;
   }
   const fileMetadata = await imageMetadata(fileData, id);
+  if (path.extname(id).toLowerCase() === ".apng") {
+    fileMetadata.format = "apng";
+  }
   const emittedImage = {
     src: "",
     ...fileMetadata

package/dist/cli/infra/build-time-astro-version-provider.js

@@ -1,6 +1,6 @@
 class BuildTimeAstroVersionProvider {
   // Injected during the build through esbuild define
-  version = "7.2.4";
+  version = "7.2.6";
 }
 export {
   BuildTimeAstroVersionProvider

package/dist/cli/server.js

@@ -75,6 +75,19 @@ function buildBackgroundArgs(command, flags) {
   if (flags.root) args.push("--root", String(flags.root));
   if (flags.allowedHosts) args.push("--allowed-hosts", String(flags.allowedHosts));
   if (flags.json) args.push("--json");
+  if (flags.mode) args.push("--mode", String(flags.mode));
+  if (flags.site) args.push("--site", String(flags.site));
+  if (flags.base) args.push("--base", String(flags.base));
+  if (flags.outDir) args.push("--out-dir", String(flags.outDir));
+  if (flags.verbose) args.push("--verbose");
+  if (flags.silent) args.push("--silent");
+  if (flags.open != null) {
+    if (typeof flags.open === "string") {
+      args.push("--open", flags.open);
+    } else if (flags.open) {
+      args.push("--open");
+    }
+  }
   return args;
 }
 async function stopExistingServer(root, command, pid) {

package/dist/content/config.d.ts

@@ -13,7 +13,8 @@ type ImageFunction = () => z.ZodObject<{
         zCore.$ZodLiteral<'webp'>,
         zCore.$ZodLiteral<'gif'>,
         zCore.$ZodLiteral<'svg'>,
-        zCore.$ZodLiteral<'avif'>
+        zCore.$ZodLiteral<'avif'>,
+        zCore.$ZodLiteral<'apng'>
     ]>;
 }>;
 export interface DataEntry {

package/dist/content/content-layer.js

@@ -196,7 +196,7 @@ ${contentConfig.error.message}`
       logger.info("Content config changed");
       shouldClear = true;
     }
-    if (previousAstroVersion && previousAstroVersion !== "7.2.4") {
+    if (previousAstroVersion && previousAstroVersion !== "7.2.6") {
       logger.info("Astro version changed");
       shouldClear = true;
     }
@@ -204,8 +204,8 @@ ${contentConfig.error.message}`
       logger.info("Clearing content store");
       this.#store.clearAll();
     }
-    if ("7.2.4") {
-      this.#store.metaStore().set("astro-version", "7.2.4");
+    if ("7.2.6") {
+      this.#store.metaStore().set("astro-version", "7.2.6");
     }
     if (currentConfigDigest) {
       this.#store.metaStore().set("content-config-digest", currentConfigDigest);

package/dist/content/loaders/glob.js

@@ -12,7 +12,7 @@ function generateIdDefault({ entry, base, data }, isLegacy) {
   if (data.slug) {
     return String(data.slug);
   }
-  const entryURL = new URL(encodeURI(entry), base);
+  const entryURL = new URL("./" + encodeURI(entry), base);
   if (isLegacy) {
     const { id } = getContentEntryIdAndSlug({
       entry: entryURL,
@@ -69,7 +69,7 @@ function glob(globOptions) {
           logger.warn(`No entry type found for ${entry}`);
           return;
         }
-        const fileUrl = new URL(encodeURI(entry), base);
+        const fileUrl = new URL("./" + encodeURI(entry), base);
         const contents = await fs.readFile(fileUrl, "utf-8").catch((err) => {
           logger.error(`Error reading ${entry}: ${err.message}`);
           return;
@@ -212,7 +212,7 @@ function glob(globOptions) {
         ["config.js", "config.ts", "config.mjs"].map((file) => new URL(file, contentDir).href)
       );
       function isConfigFile(file) {
-        const fileUrl = new URL(file, baseDir);
+        const fileUrl = new URL("./" + encodeURI(file), baseDir);
         return configFiles.has(fileUrl.href);
       }
       await Promise.all(

package/dist/content/mutable-data-store.js

@@ -42,17 +42,20 @@ class MutableDataStore extends ImmutableDataStore {
       collection.delete(String(key));
       this.#saveToDiskDebounced();
       this.#writeAssetsImportsDebounced();
+      this.#writeModulesImportsDebounced();
     }
   }
   clear(collectionName) {
     this._collections.delete(collectionName);
     this.#saveToDiskDebounced();
     this.#writeAssetsImportsDebounced();
+    this.#writeModulesImportsDebounced();
   }
   clearAll() {
     this._collections.clear();
     this.#saveToDiskDebounced();
     this.#writeAssetsImportsDebounced();
+    this.#writeModulesImportsDebounced();
   }
   addAssetImport(assetImport, filePath) {
     const id = imageSrcToImportId(assetImport, filePath);
@@ -93,6 +96,26 @@ class MutableDataStore extends ImmutableDataStore {
       }
     }
   }
+  /**
+   * Rebuilds #moduleImports from the current entries in _collections.
+   * This ensures stale module entries are removed when content files are
+   * deleted or renamed, preventing Vite from attempting to resolve
+   * non-existent files listed in content-modules.mjs.
+   */
+  #rebuildModuleImports() {
+    this.#moduleImports.clear();
+    for (const collection of this._collections.values()) {
+      for (const entry of collection.values()) {
+        const typedEntry = entry;
+        if (typedEntry.deferredRender && typedEntry.filePath) {
+          const id = contentModuleToId(typedEntry.filePath);
+          if (id) {
+            this.#moduleImports.set(typedEntry.filePath, id);
+          }
+        }
+      }
+    }
+  }
   async writeAssetImports(filePath) {
     this.#assetsFile = filePath;
     this.#rebuildAssetImports();
@@ -130,12 +153,14 @@ export default new Map([${exports.join(", ")}]);
   }
   async writeModuleImports(filePath) {
     this.#modulesFile = filePath;
+    this.#rebuildModuleImports();
     if (this.#moduleImports.size === 0) {
       try {
         await this.#writeFileAtomic(filePath, "export default new Map();");
       } catch (err) {
         throw new AstroError(AstroErrorData.UnknownFilesystemError, { cause: err });
       }
+      return;
     }
     if (!this.#modulesDirty && existsSync(filePath)) {
       return;
@@ -264,7 +289,17 @@ ${lines.join(",\n")}]);
       entries: () => this.entries(collectionName),
       values: () => this.values(collectionName),
       keys: () => this.keys(collectionName),
-      set: ({ id: key, data, body, filePath, deferredRender, digest, rendered, assetImports }) => {
+      set: ({
+        id: key,
+        data,
+        body,
+        filePath,
+        deferredRender,
+        digest,
+        rendered,
+        assetImports,
+        imageImports: incomingImageImports
+      }) => {
         if (!key) {
           throw new Error(`ID must be a non-empty string`);
         }
@@ -277,11 +312,23 @@ ${lines.join(",\n")}]);
         }
         const foundAssets = new Set(assetImports);
         const imageImports = [];
+        const seenImageImportPaths = /* @__PURE__ */ new Set();
+        const recordImageImport = (imagePath) => {
+          const pathKey = JSON.stringify(imagePath);
+          if (seenImageImportPaths.has(pathKey)) {
+            return;
+          }
+          seenImageImportPaths.add(pathKey);
+          imageImports.push(imagePath);
+        };
+        for (const existingImagePath of incomingImageImports ?? []) {
+          recordImageImport([...existingImagePath]);
+        }
         forEach(data, function(ctx, val) {
           if (typeof val === "string" && val.startsWith(IMAGE_IMPORT_PREFIX)) {
             const src = val.replace(IMAGE_IMPORT_PREFIX, "");
             foundAssets.add(src);
-            imageImports.push(ctx.path.map((segment) => segment));
+            recordImageImport(ctx.path.map((segment) => segment));
             ctx.update(src);
           }
         });

package/dist/core/build/plugins/plugin-incremental.js

@@ -1,10 +1,11 @@
 import crypto from "node:crypto";
+import nodeFs from "node:fs";
 import { FONTS_SERVER_ADDRESS_PLACEHOLDER } from "../../../assets/fonts/constants.js";
 import { PROPAGATED_ASSET_FLAG } from "../../../content/consts.js";
 import { hasContentFlag } from "../../../content/utils.js";
 import { ASTRO_VITE_ENVIRONMENT_NAMES } from "../../constants.js";
 import { removeQueryString } from "../../path.js";
-import { rootRelativePath } from "../../viteUtils.js";
+import { CSS_LANGS_RE, rootRelativePath } from "../../viteUtils.js";
 import { moduleIsTopLevelPage } from "../graph.js";
 import { isContentDataIncrementalModule } from "../incremental-metadata.js";
 import { getPageDataByViteID } from "../internal.js";
@@ -38,8 +39,13 @@ function hashModules(graph, sortedIds) {
     hasher.update(id);
     hasher.update("\n");
     const code = graph.getModuleInfo(id)?.code;
-    if (code != null) {
+    if (code != null && code.length > 0) {
       hasher.update(resolveAssetPlaceholders(graph, code));
+    } else if (CSS_LANGS_RE.test(id)) {
+      try {
+        hasher.update(nodeFs.readFileSync(removeQueryString(id), "utf-8"));
+      } catch {
+      }
     }
     hasher.update("\n");
   }

package/dist/core/build/vite-build-config.js

@@ -19,6 +19,12 @@ const PRERENDER_ENTRY_FILENAME_PREFIX = "prerender-entry";
 function createViteBuildConfig(opts) {
   const { settings, viteConfig, routes, plugins, builder, isRolldownInput } = opts;
   const legacyAdapter = !settings.adapter || isLegacyAdapter(settings.adapter);
+  const {
+    [ASTRO_VITE_ENVIRONMENT_NAMES.ssr]: userSsr,
+    [ASTRO_VITE_ENVIRONMENT_NAMES.prerender]: userPrerender,
+    [ASTRO_VITE_ENVIRONMENT_NAMES.client]: userClient,
+    ...userEnvironments
+  } = viteConfig.environments ?? {};
   return {
     ...viteConfig,
     logLevel: viteConfig.logLevel ?? "error",
@@ -100,8 +106,9 @@ function createViteBuildConfig(opts) {
     envPrefix: viteConfig.envPrefix ?? "PUBLIC_",
     base: settings.config.base,
     environments: {
-      ...viteConfig.environments ?? {},
+      ...userEnvironments,
       [ASTRO_VITE_ENVIRONMENT_NAMES.prerender]: {
+        ...userPrerender,
         build: {
           emitAssets: true,
           outDir: fileURLToPath(getPrerenderOutputDirectory(settings)),
@@ -112,20 +119,21 @@ function createViteBuildConfig(opts) {
             output: {
               entryFileNames: `${PRERENDER_ENTRY_FILENAME_PREFIX}.[hash].mjs`,
               format: "esm",
-              ...viteConfig.environments?.prerender?.build?.rolldownOptions?.output
+              ...userPrerender?.build?.rolldownOptions?.output
             }
           },
           ssr: true
         }
       },
       [ASTRO_VITE_ENVIRONMENT_NAMES.client]: {
+        ...userClient,
         build: {
           emitAssets: true,
           target: "esnext",
           outDir: fileURLToPath(getClientOutputDirectory(settings)),
           copyPublicDir: true,
-          sourcemap: viteConfig.environments?.client?.build?.sourcemap ?? viteConfig.build?.sourcemap ?? false,
-          minify: viteConfig.environments?.client?.build?.minify ?? viteConfig.build?.minify ?? true,
+          sourcemap: userClient?.build?.sourcemap ?? viteConfig.build?.sourcemap ?? false,
+          minify: userClient?.build?.minify ?? viteConfig.build?.minify ?? true,
           rolldownOptions: {
             preserveEntrySignatures: "exports-only",
             output: {
@@ -148,17 +156,18 @@ function createViteBuildConfig(opts) {
                 }
                 return `${settings.config.build.assets}/[name].[hash][extname]`;
               },
-              ...viteConfig.environments?.client?.build?.rolldownOptions?.output
+              ...userClient?.build?.rolldownOptions?.output
             }
           }
         }
       },
       [ASTRO_VITE_ENVIRONMENT_NAMES.ssr]: {
+        ...userSsr,
         build: {
           outDir: fileURLToPath(getServerOutputDirectory(settings)),
           rolldownOptions: {
             output: {
-              ...viteConfig.environments?.ssr?.build?.rolldownOptions?.output
+              ...userSsr?.build?.rolldownOptions?.output
             }
           }
         }

package/dist/core/cache/memory-provider.js

@@ -1,4 +1,5 @@
 import picomatch from "picomatch";
+import { getCookiesFromResponse } from "../cookies/response.js";
 import { AstroError } from "../errors/errors.js";
 import { CacheQueryConfigConflict } from "../errors/errors-data.js";
 function parseCdnCacheControl(header) {
@@ -110,8 +111,12 @@ function matchesVary(request, entry) {
   }
   return true;
 }
+function hasAtLeastOneCookie(cookies) {
+  return cookies ? !cookies.headers().next().done : false;
+}
 function hasSetCookieHeader(response) {
-  return response.headers.has("set-cookie");
+  if (response.headers.has("set-cookie")) return true;
+  return hasAtLeastOneCookie(getCookiesFromResponse(response));
 }
 function warnSkippedSetCookie(url) {
   console.warn(

package/dist/core/compile/compile.js

@@ -31,7 +31,7 @@ async function compile({
       normalizedFilename: normalizeFilename(filename, astroConfig.root),
       sourcemap: "both",
       internalURL: "astro/compiler-runtime",
-      // TODO: remove in Astro v7
+      // TODO: remove in Astro v8
       astroGlobalArgs: JSON.stringify(astroConfig.site),
       scopedStyleStrategy: astroConfig.scopedStyleStrategy,
       resultScopedSlot: true,

package/dist/core/constants.js

@@ -1,4 +1,4 @@
-const ASTRO_VERSION = "7.2.4";
+const ASTRO_VERSION = "7.2.6";
 const ASTRO_GENERATOR = `Astro v${ASTRO_VERSION}`;
 const ASTRO_ERROR_HEADER = "X-Astro-Error";
 const DEFAULT_404_COMPONENT = "astro-default-404.astro";

package/dist/core/create-vite.js

@@ -223,7 +223,7 @@ async function createVite(commandConfig, { settings, logger, mode, command, fs =
           find: "astro:middleware",
           replacement: "astro/virtual-modules/middleware.js"
         },
-        // TODO: remove in Astro 7
+        // TODO: remove in Astro 8
         {
           find: "astro:schema",
           replacement: "astro/zod"

package/dist/core/dev/dev.js

@@ -26,7 +26,7 @@ async function dev(inlineConfig) {
   await telemetry.record([]);
   const restart = await createContainerWithAutomaticRestart({ inlineConfig, fs });
   const logger = restart.container.logger;
-  const currentVersion = "7.2.4";
+  const currentVersion = "7.2.6";
   const isPrerelease = currentVersion.includes("-");
   if (!isPrerelease) {
     try {

package/dist/core/dev/lockfile.js

@@ -48,6 +48,9 @@ function isAstroCommand(command) {
   return ASTRO_COMMAND_PATTERN.test(command);
 }
 async function isLockFileProcessAlive(data, find = findProcess) {
+  if (data.pid === process.pid) {
+    return false;
+  }
   if (!isProcessAlive(data.pid)) {
     return false;
   }

package/dist/core/errors/dev/utils.js

@@ -12,8 +12,8 @@ import { normalizeLF } from "../utils.js";
 function collectErrorMetadata(e, rootFolder) {
   const err = AggregateError.is(e) || Array.isArray(e.errors) ? e.errors : [e];
   err.forEach((error) => {
-    if (e.stack) {
-      const stackInfo = collectInfoFromStacktrace(e);
+    if (error.stack) {
+      const stackInfo = collectInfoFromStacktrace(error);
       try {
         error.stack = stripVTControlCharacters(stackInfo.stack);
       } catch {
@@ -40,7 +40,7 @@ function collectErrorMetadata(e, rootFolder) {
       } catch {
       }
     }
-    error.hint = generateHint(e);
+    error.hint = generateHint(error);
     if (error.message) {
       try {
         error.message = stripVTControlCharacters(error.message);

package/dist/core/fetch/fetch-state.js

@@ -27,6 +27,7 @@ import { getParams, getProps } from "../render/index.js";
 import { executeRewrite } from "../rewrites/handler.js";
 import { isRoute404or500, isRouteServerIsland } from "../routing/match.js";
 import { MultiLevelEncodingError, validateAndDecodePathname } from "../util/pathname.js";
+import { setPathname } from "../util/normalized-url.js";
 import { getOriginPathname, setOriginPathname } from "../routing/rewrite.js";
 import { computePathnameFromDomain } from "../i18n/domain.js";
 import { getCustom404Route, routeHasHtmlExtension } from "../routing/helpers.js";
@@ -210,8 +211,8 @@ class FetchState {
     const url = new URL(request.url);
     const publicPathname = this.#normalizePathname(url.pathname);
     const pathname = this.#computePathname(publicPathname);
-    url.pathname = publicPathname;
-    url.pathname = collapseDuplicateSlashes(url.pathname);
+    setPathname(url, publicPathname);
+    setPathname(url, collapseDuplicateSlashes(url.pathname));
     const domainPathname = computePathnameFromDomain(
       request,
       url,

package/dist/core/i18n/handler.js

@@ -102,7 +102,11 @@ async function finalizeI18n(compiled, state, response) {
           headers: { Location: fallbackDecision.pathname + url.search }
         });
       case "rewrite":
-        return await state.rewrite(fallbackDecision.pathname + url.search);
+        try {
+          return await state.rewrite(fallbackDecision.pathname + url.search);
+        } catch {
+          break;
+        }
       case "none":
         break;
     }

package/dist/core/messages/runtime.js

@@ -270,7 +270,7 @@ function printHelp({
     message.push(
       linebreak(),
       `  ${bgGreen(black(` ${commandName} `))} ${green(
-        `v${"7.2.4"}`
+        `v${"7.2.6"}`
       )} ${headline}`
     );
   }

package/dist/core/session/runtime.js

@@ -5,6 +5,7 @@ import { createStorage } from "unstorage";
 const PERSIST_SYMBOL = /* @__PURE__ */ Symbol();
 const DEFAULT_COOKIE_NAME = "astro-session";
 const VALID_COOKIE_REGEX = /^[\w-]+$/;
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const unflatten = (parsed, _) => {
   return rawUnflatten(parsed, {
     URL: (href) => new URL(href)
@@ -170,7 +171,8 @@ class AstroSession {
    * Destroys the session, clearing the cookie and storage if it exists.
    */
   destroy() {
-    const sessionId = this.#sessionID ?? this.#cookies.get(this.#cookieName)?.value;
+    const cookieValue = this.#cookies.get(this.#cookieName)?.value;
+    const sessionId = this.#sessionID ?? (cookieValue && UUID_REGEX.test(cookieValue) ? cookieValue : void 0);
     if (sessionId) {
       this.#toDestroy.add(sessionId);
     }
@@ -340,7 +342,7 @@ class AstroSession {
   #ensureSessionID() {
     if (!this.#sessionID) {
       const cookieValue = this.#cookies.get(this.#cookieName)?.value;
-      if (cookieValue) {
+      if (cookieValue && UUID_REGEX.test(cookieValue)) {
         this.#sessionID = cookieValue;
         this.#sessionIDFromCookie = true;
       } else {

package/dist/core/session/types.d.ts

@@ -34,30 +34,30 @@ export interface BaseSessionConfig {
 interface DriverConfig<TDriver extends SessionDriverConfig> extends BaseSessionConfig {
     /** Config object for a session driver */
     driver: TDriver;
-    /** @deprecated Pass options to the driver function directly. This will be removed in Astro 7 */
+    /** @deprecated Pass options to the driver function directly. This will be removed in Astro 8 */
     options?: never;
 }
 interface UnstorageConfig<TDriver extends keyof BuiltinDriverOptions | undefined, TOptions = TDriver extends keyof BuiltinDriverOptions ? NoInfer<BuiltinDriverOptions[TDriver]> : undefined> extends BaseSessionConfig {
     /**
      * Entrypoint for an unstorage session driver
-     * @deprecated Use `import { sessionDrivers } from 'astro/config'` instead. This will be removed in Astro 7
+     * @deprecated Use `import { sessionDrivers } from 'astro/config'` instead. This will be removed in Astro 8
      */
     driver?: TDriver;
     /**
      * Options for the unstorage driver
-     * @deprecated Use `import { sessionDrivers } from 'astro/config'` instead. This will be removed in Astro 7
+     * @deprecated Use `import { sessionDrivers } from 'astro/config'` instead. This will be removed in Astro 8
      */
     options?: TOptions;
 }
 interface CustomConfig extends BaseSessionConfig {
     /**
      * Entrypoint for a custom session driver
-     * @deprecated Use the object shape (type `SessionDriverConfig`). This will be removed in Astro 7
+     * @deprecated Use the object shape (type `SessionDriverConfig`). This will be removed in Astro 8
      */
     driver?: string;
     /**
      * Options for the custom session driver
-     * @deprecated Use the object shape (type `SessionDriverConfig`). This will be removed in Astro 7
+     * @deprecated Use the object shape (type `SessionDriverConfig`). This will be removed in Astro 8
      */
     options?: Record<string, unknown>;
 }

package/dist/core/util/normalized-url.d.ts

@@ -3,8 +3,16 @@
  * Decodes and validates the pathname, collapses duplicate slashes.
  */
 export declare function createNormalizedUrl(requestUrl: string): URL;
+/**
+ * Assigns `url.pathname` only when the value differs.
+ * The setter re-parses the whole URL, so a no-op write is still expensive.
+ */
+export declare function setPathname(url: URL, pathname: string): void;
 /**
  * Normalizes an already-parsed URL in place: decodes and validates the
  * pathname, collapses duplicate slashes. Returns the same URL object.
+ *
+ * Collapse runs after the decode is written back: the pathname setter
+ * rewrites `\` to `/`, so a decoded backslash only becomes `//` once assigned.
  */
 export declare function normalizeUrl(url: URL): URL;

package/dist/core/util/normalized-url.js

@@ -3,19 +3,25 @@ import { validateAndDecodePathname } from "./pathname.js";
 function createNormalizedUrl(requestUrl) {
   return normalizeUrl(new URL(requestUrl));
 }
+function setPathname(url, pathname) {
+  if (url.pathname !== pathname) {
+    url.pathname = pathname;
+  }
+}
 function normalizeUrl(url) {
   try {
-    url.pathname = validateAndDecodePathname(url.pathname);
+    setPathname(url, validateAndDecodePathname(url.pathname));
   } catch {
     try {
-      url.pathname = decodeURI(url.pathname);
+      setPathname(url, decodeURI(url.pathname));
     } catch {
     }
   }
-  url.pathname = collapseDuplicateSlashes(url.pathname);
+  setPathname(url, collapseDuplicateSlashes(url.pathname));
   return url;
 }
 export {
   createNormalizedUrl,
-  normalizeUrl
+  normalizeUrl,
+  setPathname
 };

package/dist/i18n/utils.js

@@ -43,10 +43,9 @@ function sortAndFilterLocales(browserLocaleList, locales) {
     }
     return true;
   }).sort((a, b) => {
-    if (a.qualityValue && b.qualityValue) {
-      return Math.sign(b.qualityValue - a.qualityValue);
-    }
-    return 0;
+    const qa = a.locale === "*" ? a.qualityValue ?? 0 : a.qualityValue ?? 1;
+    const qb = b.locale === "*" ? b.qualityValue ?? 0 : b.qualityValue ?? 1;
+    return qb - qa;
   });
 }
 function computePreferredLocale(request, locales) {

package/dist/manifest/serialized.js

@@ -56,6 +56,19 @@ function serializedManifestPlugin({
   return {
     name: SERIALIZED_MANIFEST_ID,
     enforce: "pre",
+    // Dependency optimization runs as a nested Rolldown build that cannot load Vite virtual
+    // modules. Keep this import external so the server module graph resolves it below.
+    configEnvironment(environmentName) {
+      if (command === "dev" && (environmentName === ASTRO_VITE_ENVIRONMENT_NAMES.astro || environmentName === ASTRO_VITE_ENVIRONMENT_NAMES.ssr || environmentName === ASTRO_VITE_ENVIRONMENT_NAMES.prerender)) {
+        return {
+          optimizeDeps: {
+            rolldownOptions: {
+              external: [AMBIENT_MANIFEST_SPECIFIER]
+            }
+          }
+        };
+      }
+    },
     configureServer(server) {
       server.watcher.on("add", (path) => reloadManifest(path, server));
       server.watcher.on("unlink", (path) => reloadManifest(path, server));

package/dist/runtime/server/astro-global.js

@@ -8,14 +8,14 @@ function createError(name) {
 }
 function createAstro(site) {
   return {
-    // TODO: throw in Astro 7
+    // TODO: throw in Astro 8
     get site() {
       console.warn(
         `Astro.site inside getStaticPaths is deprecated and will be removed in a future major version of Astro. Use import.meta.env.SITE instead`
       );
       return site ? new URL(site) : void 0;
     },
-    // TODO: throw in Astro 7
+    // TODO: throw in Astro 8
     get generator() {
       console.warn(
         `Astro.generator inside getStaticPaths is deprecated and will be removed in a future major version of Astro.`

package/dist/runtime/server/render/csp.js

@@ -28,12 +28,14 @@ function renderCspContent(result) {
   const scriptElemActive = isEnabled(script.element);
   const styleElemActive = isEnabled(style.element);
   const strictDynamicSuffix = scriptDirective.strictDynamic ? ` 'strict-dynamic'` : "";
+  const scriptDefaultHasUnsafeInline = hasUnsafeInline(script.default.resources);
+  const styleDefaultHasUnsafeInline = hasUnsafeInline(style.default.resources);
   const scriptBaselineTokens = [
-    ...scriptElemActive ? [] : [...finalScriptHashes],
+    ...scriptElemActive || scriptDefaultHasUnsafeInline ? [] : [...finalScriptHashes],
     ...scriptDirective.strictDynamic ? [`'strict-dynamic'`] : []
   ];
   const scriptSrc = `script-src ${scriptResources} ${scriptBaselineTokens.join(" ")};`;
-  const styleSrc = `style-src ${styleResources} ${(styleElemActive ? [] : [...finalStyleHashes]).join(" ")};`;
+  const styleSrc = `style-src ${styleResources} ${(styleElemActive || styleDefaultHasUnsafeInline ? [] : [...finalStyleHashes]).join(" ")};`;
   const scriptSrcElem = scriptElemActive ? renderSpecificDirective(
     "script-src-elem",
     script.element.resources,
@@ -73,13 +75,19 @@ function renderCspContent(result) {
     styleSrcAttr
   ].filter(Boolean).join(" ");
 }
+function hasUnsafeInline(resources) {
+  return resources.includes("'unsafe-inline'");
+}
 function isEnabled(sources) {
   return sources.resources.length > 0 || sources.hashes.length > 0;
 }
 function renderSpecificDirective(name, resources, defaultResource, sharedHashes, ownHashes, suffix = "") {
-  const hashes = new Set(sharedHashes);
-  for (const hash of ownHashes) {
-    hashes.add(`'${hash}'`);
+  const unsafeInline = hasUnsafeInline(resources);
+  const hashes = new Set(unsafeInline ? void 0 : sharedHashes);
+  if (!unsafeInline) {
+    for (const hash of ownHashes) {
+      hashes.add(`'${hash}'`);
+    }
   }
   let finalResources;
   if (resources.length > 0) {

package/dist/transitions/swap-functions.js

@@ -93,6 +93,7 @@ function swapHeadElements(doc) {
 function swapBodyElement(newElement, oldElement) {
   const persistPairs = [];
   const docEl = oldElement.ownerDocument.documentElement;
+  const liveMedia = new Set(oldElement.querySelectorAll("video, audio"));
   const moveBefore = typeof docEl.moveBefore === "function" ? (parent, node, child) => parent.moveBefore(node, child) : null;
   for (const el of oldElement.querySelectorAll(`[${PERSIST_ATTR}]`)) {
     const id = el.getAttribute(PERSIST_ATTR);
@@ -119,10 +120,11 @@ function swapBodyElement(newElement, oldElement) {
     }
   }
   attachShadowRoots(newElement);
-  reifyMediaElements(newElement);
+  reifyMediaElements(newElement, liveMedia);
 }
-function reifyMediaElements(root) {
+function reifyMediaElements(root, liveMedia) {
   for (const media of root.querySelectorAll("video, audio")) {
+    if (liveMedia.has(media)) continue;
     const fresh = document.createElement(media.localName);
     for (const attr of media.attributes) {
       fresh.setAttribute(attr.name, attr.value);

package/dist/types/public/config.d.ts

@@ -749,7 +749,7 @@ export interface AstroUserConfig<TLocales extends Locales = never, TDriver exten
          * - External scripts and external styles are not supported out of the box, but you can [provide your own hashes](https://docs.astro.build/en/reference/configuration-reference/#securitycspscriptdirectivehashes).
          * - [Astro's view transitions](https://docs.astro.build/en/guides/view-transitions/) using the `<ClientRouter />` are not supported, but you can [consider migrating to the browser native View Transition API](https://events-3bg.pages.dev/jotter/astro-view-transitions/) instead if you are not using Astro's enhancements to the native View Transitions and Navigation APIs.
          * - Shiki isn't currently supported. By design, Shiki functions use inline styles that cannot work with Astro CSP implementation. Consider [using `<Prism />`](https://docs.astro.build/en/guides/syntax-highlighting/#prism-) when your project requires both CSP and syntax highlighting.
-         * - `unsafe-inline` directives are incompatible with Astro's CSP implementation. By default, Astro will emit hashes for all its bundled scripts (e.g. client islands) and all modern browsers will automatically reject `unsafe-inline` when it occurs in a directive with a hash or nonce.
+         * - When `'unsafe-inline'` is included as a resource in a directive, Astro will not emit hashes on that directive. Per the CSP spec, browsers ignore `'unsafe-inline'` when a hash or nonce is present in the same directive, so Astro suppresses hashes to preserve `'unsafe-inline'` behavior. Note that this reduces the security of that directive to the level of `'unsafe-inline'`.
          *
          * :::note
          * Due to the nature of the Vite dev server, this feature isn't supported while working in `dev` mode. Instead, you can test this in your Astro project using `build` and `preview`.

package/dist/vite-plugin-routes/index.js

@@ -137,7 +137,7 @@ async function astroPluginRoutes({
           return true;
         });
         const code = `
-				import { deserializeRouteInfo } from 'astro/app';
+				import { deserializeRouteInfo } from 'astro/app/manifest';
 				const serializedData = ${JSON.stringify(filteredRoutes)};
 				const routes = serializedData.map(deserializeRouteInfo);
 				export { routes };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astro",
-  "version": "7.2.4",
+  "version": "7.2.6",
   "description": "Astro is a modern site builder with web best practices, performance, and DX front-of-mind.",
   "type": "module",
   "author": "withastro",
@@ -103,7 +103,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@astrojs/compiler-rs": "^0.3.2",
+    "@astrojs/compiler-rs": "^0.4.0",
     "@capsizecss/unpack": "^4.0.0",
     "@clack/prompts": "^1.1.0",
     "@oslojs/encoding": "^1.1.0",
@@ -115,7 +115,7 @@
     "common-ancestor-path": "^2.0.0",
     "cookie": "^2.0.1",
     "devalue": "^5.8.1",
-    "diff": "^8.0.3",
+    "diff": "^9.0.0",
     "dset": "^3.1.4",
     "es-module-lexer": "^2.0.0",
     "esbuild": "^0.28.0",
@@ -154,7 +154,7 @@
     "yargs-parser": "^22.0.0",
     "zod": "^4.3.6",
     "@astrojs/internal-helpers": "0.10.4",
-    "@astrojs/markdown-satteri": "0.3.7",
+    "@astrojs/markdown-satteri": "0.3.8",
     "@astrojs/telemetry": "3.3.3"
   },
   "optionalDependencies": {
@@ -193,8 +193,8 @@
     "typescript": "^6.0.3",
     "undici": "^7.22.0",
     "vitest": "^4.1.0",
-    "@astrojs/check": "0.9.10",
     "@astrojs/markdown-remark": "7.2.4",
+    "@astrojs/check": "0.9.10",
     "astro-scripts": "0.0.14"
   },
   "engines": {

package/templates/content/module.mjs

@@ -13,7 +13,7 @@ export {
 	defineLiveCollection,
 	renderEntry as render,
 } from 'astro/content/runtime';
-// TODO: remove in Astro 7
+// TODO: remove in Astro 8
 export { z } from 'astro/zod';
 
 /* @@LIVE_CONTENT_CONFIG@@ */
@@ -38,8 +38,8 @@ export const getLiveEntry = createGetLiveEntry({
 	liveCollections,
 });
 
-// TODO: remove in Astro 7
+// TODO: remove in Astro 8
 export const getEntryBySlug = createDeprecatedFunction('getEntryBySlug');
 
-// TODO: remove in Astro 7
+// TODO: remove in Astro 8
 export const getDataEntryById = createDeprecatedFunction('getDataEntryById');

package/types/content.d.ts

@@ -10,11 +10,11 @@ declare module 'astro:content' {
 	} from 'astro/content/config';
 	export { defineLiveCollection, defineCollection } from 'astro/content/config';
 
-	// TODO: remove in Astro 7
+	// TODO: remove in Astro 8
 	/**
 	 * @deprecated
 	 * `import { z } from 'astro:content'` is deprecated and will be removed
-	 * in Astro 7. Use `import { z } from 'astro/zod'` instead.
+	 * in Astro 8. Use `import { z } from 'astro/zod'` instead.
 	 */
 	export const z = zod.z;