astro 7.2.6 → 7.2.8

package/dist/assets/svg/config.d.ts

@@ -1,5 +1,5 @@
 import * as z from 'zod/v4';
 export declare const SvgOptimizerSchema: z.ZodObject<{
     name: z.ZodString;
-    optimize: z.ZodCustom<(contents: string) => string | Promise<string>, (contents: string) => string | Promise<string>>;
+    optimize: z.ZodCustom<(contents: string, path: string) => string | Promise<string>, (contents: string, path: string) => string | Promise<string>>;
 }, z.core.$strip>;

package/dist/assets/svg/svgo.js

@@ -2,7 +2,7 @@ import { optimize } from "svgo";
 function svgoOptimizer(config) {
   return {
     name: "svgo",
-    optimize: (contents) => optimize(contents, config).data
+    optimize: (contents, path) => optimize(contents, { ...config, path }).data
   };
 }
 export {

package/dist/assets/svg/types.d.ts

@@ -1,4 +1,4 @@
 export interface SvgOptimizer {
     name: string;
-    optimize: (contents: string) => string | Promise<string>;
+    optimize: (contents: string, path: string) => string | Promise<string>;
 }

package/dist/assets/svg/utils.js

@@ -9,7 +9,7 @@ async function parseSvg({
   let processedContents = contents;
   if (svgOptimizer) {
     try {
-      processedContents = await svgOptimizer.optimize(contents);
+      processedContents = await svgOptimizer.optimize(contents, path);
     } catch (cause) {
       throw new AstroError(
         {

package/dist/cli/add/cloudflare.d.ts

@@ -0,0 +1 @@
+export declare function getCloudflareCompatibilityDate(root: URL): Promise<string>;

package/dist/cli/add/cloudflare.js

@@ -0,0 +1,12 @@
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+async function getCloudflareCompatibilityDate(root) {
+  const require2 = createRequire(root);
+  const infoPath = require2.resolve("@astrojs/cloudflare/info");
+  const infoUrl = pathToFileURL(infoPath).toString();
+  const infoModule = await import(infoUrl);
+  return infoModule.getLocalWorkerdCompatibilityDate().date;
+}
+export {
+  getCloudflareCompatibilityDate
+};

package/dist/cli/add/index.js

@@ -28,6 +28,7 @@ import { eventCliSession, telemetry } from "../../events/index.js";
 import { exec } from "../exec.js";
 import { createLoggerFromFlags, flagsToAstroInlineConfig } from "../flags.js";
 import { fetchPackageJson, fetchPackageVersions } from "../install-package.js";
+import { getCloudflareCompatibilityDate } from "./cloudflare.js";
 const { bold, cyan, dim, green, magenta, red, yellow } = colors;
 const ALIASES = /* @__PURE__ */ new Map([
   ["solid", "solid-js"],
@@ -167,7 +168,7 @@ async function add(names, { flags }) {
           );
           if (await askToContinue({ flags, logger })) {
             const data = await getPackageJson();
-            let compatibilityDate = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+            const compatibilityDate = await getCloudflareCompatibilityDate(root);
             await fs.writeFile(
               wranglerConfigURL,
               STUBS.CLOUDFLARE_WRANGLER_CONFIG(data?.name ?? "example", compatibilityDate),

package/dist/cli/infra/build-time-astro-version-provider.js

@@ -1,6 +1,6 @@
 class BuildTimeAstroVersionProvider {
   // Injected during the build through esbuild define
-  version = "7.2.6";
+  version = "7.2.8";
 }
 export {
   BuildTimeAstroVersionProvider

package/dist/content/content-layer.js

@@ -196,7 +196,7 @@ ${contentConfig.error.message}`
       logger.info("Content config changed");
       shouldClear = true;
     }
-    if (previousAstroVersion && previousAstroVersion !== "7.2.6") {
+    if (previousAstroVersion && previousAstroVersion !== "7.2.8") {
       logger.info("Astro version changed");
       shouldClear = true;
     }
@@ -204,8 +204,8 @@ ${contentConfig.error.message}`
       logger.info("Clearing content store");
       this.#store.clearAll();
     }
-    if ("7.2.6") {
-      this.#store.metaStore().set("astro-version", "7.2.6");
+    if ("7.2.8") {
+      this.#store.metaStore().set("astro-version", "7.2.8");
     }
     if (currentConfigDigest) {
       this.#store.metaStore().set("content-config-digest", currentConfigDigest);

package/dist/core/app/base.d.ts

@@ -144,14 +144,11 @@ export declare abstract class BaseApp {
     set setManifestData(newManifestData: RoutesList);
     removeBase(pathname: string): string;
     /**
-     * Decodes a pathname with `decodeURI`, falling back to the raw pathname when it
-     * contains an invalid percent-sequence (e.g. `%C0%AF`, an overlong-UTF-8 encoding of
-     * `/` commonly sent by path-traversal scanners). A raw `decodeURI()` would throw
-     * `URIError: URI malformed`, and because `match()` runs before `render()` that error
-     * escapes the adapter's request handler as an uncaught exception (HTTP 500) that user
-     * middleware can't catch.
-     */
-    private safeDecodeURI;
+     * Fully decodes a pathname, falling back to a single decode and then the raw pathname
+     * when validation fails. Adapter matching runs before `render()`, so it must not throw
+     * for request input that render-time validation handles.
+     */
+    private safeDecodePathname;
     /**
      * Extracts the base-stripped, decoded pathname from a request.
      * Used by adapters to compute the pathname for dev-mode route matching.

package/dist/core/app/base.js

@@ -18,6 +18,7 @@ import { handleRequest } from "../routing/handler.js";
 import { getDefaultStatusCode } from "../routing/helpers.js";
 import { matchRequest } from "../routing/match-request.js";
 import { getRouteTable, matchRoute, updateRouteTable } from "../routing/route-table.js";
+import { validateAndDecodePathname } from "../util/pathname.js";
 import { setRenderOptions } from "./render-options.js";
 class BaseApp {
   manifest;
@@ -149,19 +150,20 @@ class BaseApp {
     return stripRequestBase(pathname, this.manifest.base);
   }
   /**
-   * Decodes a pathname with `decodeURI`, falling back to the raw pathname when it
-   * contains an invalid percent-sequence (e.g. `%C0%AF`, an overlong-UTF-8 encoding of
-   * `/` commonly sent by path-traversal scanners). A raw `decodeURI()` would throw
-   * `URIError: URI malformed`, and because `match()` runs before `render()` that error
-   * escapes the adapter's request handler as an uncaught exception (HTTP 500) that user
-   * middleware can't catch.
+   * Fully decodes a pathname, falling back to a single decode and then the raw pathname
+   * when validation fails. Adapter matching runs before `render()`, so it must not throw
+   * for request input that render-time validation handles.
    */
-  safeDecodeURI(pathname) {
+  safeDecodePathname(pathname) {
     try {
-      return decodeURI(pathname);
+      return validateAndDecodePathname(pathname);
     } catch (e) {
       this.adapterLogger.debug(e.toString());
-      return pathname;
+      try {
+        return decodeURI(pathname);
+      } catch {
+        return pathname;
+      }
     }
   }
   /**
@@ -171,7 +173,7 @@ class BaseApp {
   getPathnameFromRequest(request) {
     const url = new URL(request.url);
     const pathname = prependForwardSlash(this.removeBase(url.pathname));
-    return this.safeDecodeURI(pathname);
+    return this.safeDecodePathname(pathname);
   }
   /**
    * Given a `Request`, it returns the `RouteData` that matches its `pathname`. By default, prerendered
@@ -243,7 +245,7 @@ class BaseApp {
     if (!routeData) {
       const domainPathname = this.computePathnameFromDomain(request);
       if (domainPathname) {
-        routeData = matchRoute(this.manifest, this.safeDecodeURI(domainPathname));
+        routeData = matchRoute(this.manifest, this.safeDecodePathname(domainPathname));
       }
     }
     const resolvedOptions = {

package/dist/core/app/manifest.js

@@ -8,8 +8,6 @@ function deserializeManifest(serializedManifest, routesList) {
         ...serializedRoute,
         routeData: deserializeRouteData(serializedRoute.routeData)
       });
-      const route = serializedRoute;
-      route.routeData = deserializeRouteData(serializedRoute.routeData);
     }
   }
   if (routesList) {

package/dist/core/config/schemas/base.d.ts

@@ -487,7 +487,7 @@ export declare const AstroConfigSchema: z.ZodObject<{
         incrementalBuild: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         svgOptimizer: z.ZodOptional<z.ZodObject<{
             name: z.ZodString;
-            optimize: z.ZodCustom<(contents: string) => string | Promise<string>, (contents: string) => string | Promise<string>>;
+            optimize: z.ZodCustom<(contents: string, path: string) => string | Promise<string>, (contents: string, path: string) => string | Promise<string>>;
         }, z.core.$strip>>;
         collectionStorage: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"single-file">, z.ZodLiteral<"chunked">, z.ZodObject<{
             type: z.ZodLiteral<"chunked">;

package/dist/core/config/schemas/relative.d.ts

@@ -439,7 +439,7 @@ export declare function createRelativeSchema(cmd: string, fileProtocolRoot: stri
         incrementalBuild: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         svgOptimizer: z.ZodOptional<z.ZodObject<{
             name: z.ZodString;
-            optimize: z.ZodCustom<(contents: string) => string | Promise<string>, (contents: string) => string | Promise<string>>;
+            optimize: z.ZodCustom<(contents: string, path: string) => string | Promise<string>, (contents: string, path: string) => string | Promise<string>>;
         }, z.core.$strip>>;
         collectionStorage: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"single-file">, z.ZodLiteral<"chunked">, z.ZodObject<{
             type: z.ZodLiteral<"chunked">;
@@ -638,7 +638,7 @@ export declare function createRelativeSchema(cmd: string, fileProtocolRoot: stri
         };
         svgOptimizer?: {
             name: string;
-            optimize: (contents: string) => string | Promise<string>;
+            optimize: (contents: string, path: string) => string | Promise<string>;
         } | undefined;
     };
     legacy: {
@@ -905,7 +905,7 @@ export declare function createRelativeSchema(cmd: string, fileProtocolRoot: stri
         };
         svgOptimizer?: {
             name: string;
-            optimize: (contents: string) => string | Promise<string>;
+            optimize: (contents: string, path: string) => string | Promise<string>;
         } | undefined;
     };
     legacy: {

package/dist/core/constants.js

@@ -1,4 +1,4 @@
-const ASTRO_VERSION = "7.2.6";
+const ASTRO_VERSION = "7.2.8";
 const ASTRO_GENERATOR = `Astro v${ASTRO_VERSION}`;
 const ASTRO_ERROR_HEADER = "X-Astro-Error";
 const DEFAULT_404_COMPONENT = "astro-default-404.astro";

package/dist/core/dev/dev.js

@@ -26,7 +26,7 @@ async function dev(inlineConfig) {
   await telemetry.record([]);
   const restart = await createContainerWithAutomaticRestart({ inlineConfig, fs });
   const logger = restart.container.logger;
-  const currentVersion = "7.2.6";
+  const currentVersion = "7.2.8";
   const isPrerelease = currentVersion.includes("-");
   if (!isPrerelease) {
     try {

package/dist/core/dev/lockfile.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, unlinkSync, writeFileSync, mkdirSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import findProcess from "find-process";
+import findProcess from "find-proc";
 const GRACEFUL_SHUTDOWN_TIMEOUT = 5e3;
 function getLockFileURL(root, command = "dev") {
   return new URL(`.astro/${command}.json`, root);

package/dist/core/messages/runtime.js

@@ -270,7 +270,7 @@ function printHelp({
     message.push(
       linebreak(),
       `  ${bgGreen(black(` ${commandName} `))} ${green(
-        `v${"7.2.6"}`
+        `v${"7.2.8"}`
       )} ${headline}`
     );
   }

package/dist/core/middleware/sequence.js

@@ -3,7 +3,7 @@ import { getEnvironment } from "../environment/index.js";
 import { ForbiddenRewrite } from "../errors/errors-data.js";
 import { AstroError } from "../errors/index.js";
 import { getParams } from "../render/params-and-props.js";
-import { setOriginPathname } from "../routing/rewrite.js";
+import { copyRequest, setOriginPathname } from "../routing/rewrite.js";
 import { defineMiddleware } from "./defineMiddleware.js";
 function sequence(...handlers) {
   const filtered = handlers.filter((h) => !!h);
@@ -21,17 +21,6 @@ function sequence(...handlers) {
       const result = handle(handleContext, async (payload) => {
         if (i < length - 1) {
           if (payload) {
-            let newRequest;
-            if (payload instanceof Request) {
-              newRequest = payload;
-            } else if (payload instanceof URL) {
-              newRequest = new Request(payload, handleContext.request.clone());
-            } else {
-              newRequest = new Request(
-                new URL(payload, handleContext.url.origin),
-                handleContext.request.clone()
-              );
-            }
             const oldPathname = handleContext.url.pathname;
             const state = Reflect.get(handleContext, fetchStateSymbol);
             if (!state) {
@@ -45,6 +34,14 @@ function sequence(...handlers) {
               payload,
               handleContext.request
             );
+            let newRequest;
+            if (payload instanceof Request) {
+              newRequest = payload;
+            } else {
+              const request = handleContext.request.method === "GET" || handleContext.request.method === "HEAD" ? handleContext.request : handleContext.request.clone();
+              const newUrl = payload instanceof URL ? payload : new URL(payload, handleContext.url.origin);
+              newRequest = copyRequest(newUrl, request, false, state.logger, routeData.route);
+            }
             if (manifest.serverLike === true && handleContext.isPrerendered === false && routeData.prerender === true) {
               throw new AstroError({
                 ...ForbiddenRewrite,

package/dist/core/routing/match-request.js

@@ -2,15 +2,20 @@ import { prependForwardSlash, stripRequestBase } from "@astrojs/internal-helpers
 import { computePathnameFromDomain } from "../i18n/domain.js";
 import { AstroIntegrationLogger } from "../logger/core.js";
 import { getLogger } from "../logger/manifest-logger.js";
+import { validateAndDecodePathname } from "../util/pathname.js";
 import { matchAllRoutes, matchRoute } from "./route-table.js";
-function safeDecodeURI(manifest, pathname) {
+function safeDecodePathname(manifest, pathname) {
   try {
-    return decodeURI(pathname);
+    return validateAndDecodePathname(pathname);
   } catch (e) {
     new AstroIntegrationLogger(getLogger(manifest).options, manifest.adapterName).debug(
       e.toString()
     );
-    return pathname;
+    try {
+      return decodeURI(pathname);
+    } catch {
+      return pathname;
+    }
   }
 }
 function matchRequest(manifest, request, allowPrerenderedRoutes = false) {
@@ -27,14 +32,15 @@ function matchRequest(manifest, request, allowPrerenderedRoutes = false) {
   if (!pathname) {
     pathname = prependForwardSlash(stripRequestBase(url.pathname, manifest.base));
   }
-  const routeData = matchRoute(manifest, safeDecodeURI(manifest, pathname));
+  pathname = safeDecodePathname(manifest, pathname);
+  const routeData = matchRoute(manifest, pathname);
   if (!routeData) return void 0;
   if (allowPrerenderedRoutes) {
     return routeData;
   }
   if (routeData.prerender) {
     if (routeData.params.length > 0) {
-      const allMatches = matchAllRoutes(manifest, safeDecodeURI(manifest, pathname));
+      const allMatches = matchAllRoutes(manifest, pathname);
       return allMatches.find((r) => !r.prerender);
     }
     return void 0;

package/dist/core/routing/rewrite.js

@@ -80,13 +80,14 @@ function findRouteToRewrite({
   }
 }
 function copyRequest(newUrl, oldRequest, isPrerendered, logger, routePattern) {
-  if (oldRequest.bodyUsed) {
+  const canHaveBody = oldRequest.method !== "GET" && oldRequest.method !== "HEAD";
+  if (canHaveBody && oldRequest.bodyUsed) {
     throw new AstroError(AstroErrorData.RewriteWithBodyUsed);
   }
   return createRequest({
     url: newUrl,
     method: oldRequest.method,
-    body: oldRequest.body,
+    body: canHaveBody ? oldRequest.body : void 0,
     isPrerendered,
     logger,
     headers: isPrerendered ? {} : oldRequest.headers,

package/dist/vite-plugin-app/handle-request.js

@@ -5,6 +5,7 @@ import { getEnvironment, setEnvironment } from "../core/environment/index.js";
 import { createSafeError } from "../core/errors/index.js";
 import { setLogger } from "../core/logger/manifest-logger.js";
 import { createRequest } from "../core/request.js";
+import { validateAndDecodePathname } from "../core/util/pathname.js";
 import { SERIALIZED_MANIFEST_ID } from "../manifest/serialized.js";
 import { recordServerError } from "../vite-plugin-astro-server/error.js";
 import { runWithErrorHandling } from "../vite-plugin-astro-server/index.js";
@@ -39,7 +40,11 @@ async function handleDevRequest(app, deps, { incomingRequest, incomingResponse,
   if (manifest.trailingSlash === "never" && !incomingRequest.url) {
     pathname = "";
   } else {
-    pathname = decodeURI(url.pathname);
+    try {
+      pathname = validateAndDecodePathname(url.pathname);
+    } catch {
+      pathname = decodeURI(url.pathname);
+    }
   }
   url.pathname = removeTrailingForwardSlash(manifest.base) + url.pathname;
   if (url.pathname.endsWith("/") && !shouldAppendForwardSlash(manifest.trailingSlash, manifest.buildFormat)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astro",
-  "version": "7.2.6",
+  "version": "7.2.8",
   "description": "Astro is a modern site builder with web best practices, performance, and DX front-of-mind.",
   "type": "module",
   "author": "withastro",
@@ -119,7 +119,7 @@
     "dset": "^3.1.4",
     "es-module-lexer": "^2.0.0",
     "esbuild": "^0.28.0",
-    "find-process": "^2.1.1",
+    "find-proc": "0.1.0",
     "flattie": "^1.1.1",
     "fontace": "~0.4.1",
     "get-tsconfig": "5.0.0-beta.4",
@@ -153,12 +153,12 @@
     "xxhash-wasm": "^1.1.0",
     "yargs-parser": "^22.0.0",
     "zod": "^4.3.6",
-    "@astrojs/internal-helpers": "0.10.4",
     "@astrojs/markdown-satteri": "0.3.8",
+    "@astrojs/internal-helpers": "0.10.4",
     "@astrojs/telemetry": "3.3.3"
   },
   "optionalDependencies": {
-    "sharp": "^0.34.0 || ^0.35.0"
+    "sharp": "^0.35.4"
   },
   "peerDependencies": {
     "@astrojs/markdown-remark": "7.2.4"