Impact Score: 5/10
Astro [email protected] — Release Notes & Engineering Impact
Source available — automated, not human-reviewed
Component: astro · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Astro [email protected]. Source highlight: Adds a new `security.actionBodySizeLimit` option to configure the maximum size of Astro Actions request bodies.
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
✨ New Features & Capabilities (1)
- Adds a new `security.actionBodySizeLimit` option to configure the maximum size of Astro Actions request bodies.
🔧 Bug Fixes & Patches (1)
- Fix X-Forwarded-Proto validation when allowedDomains includes both protocol and hostname fields. The protocol check no longer fails due to hostname mismatch against the hardcoded test URL.
📄 View Raw Release Notes (Original Developer Log)
### Minor Changes
- [#15589](https://github.com/withastro/astro/pull/15589) [`b7dd447`](https://github.com/withastro/astro/commit/b7dd447e319a7b435c01ccd69347e5261bd9dc14) Thanks [@qzio](https://github.com/qzio)! - Adds a new `security.actionBodySizeLimit` option to configure the maximum size of Astro Actions request bodies.
This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.
If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.
```js
// astro.config.mjs
export default defineConfig({
security: {
actionBodySizeLimit: 10 * 1024 * 1024, // set to 10 MB
},
});
```
### Patch Changes
- [#15594](https://github.com/withastro/astro/pull/15594) [`efae11c`](https://github.com/withastro/astro/commit/efae11cef1ebe1f2f54ceb55db0d1ff1938351c6) Thanks [@qzio](https://github.com/qzio)! - Fix X-Forwarded-Proto validation when allowedDomains includes both protocol and hostname fields. The protocol check no longer fails due to hostname mismatch against the hardcoded test URL.