Impact Score: 5/10
Astro [email protected] — Release Notes & Engineering Impact
Source available — automated, not human-reviewed
Component: astro · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Astro [email protected]. Source highlight: Ensures transition directive values are HTML-escaped when rendered on hydrated islands
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
🔧 Bug Fixes & Patches (6)
- Ensures transition directive values are HTML-escaped when rendered on hydrated islands
- Fixes trailing slash handling for dynamic file endpoints in dev mode. Dynamic file endpoints (e.g., `src/pages/api/[name].json.ts`) with `trailingSlash: "always"` incorrectly required a trailing slash in dev mode, returning 404 for `/api/bar.json` and 200 for `/api/bar.json/`.
- Fixed a bug where the development toolbar did not output a warning even though the implicit ARIA role and the manually specified role were duplicated.
- Adds support for `sharp` v0.35. pnpm users no longer need to approve `sharp`'s build script (see `allowBuilds`) when on v0.35.
- Fixes `getCollection()` returning empty in dev mode for large content collections (500k+ entries)
- Upgrades the Rust compiler to the latest, which fixes some bugs. Refer to its changelog for more information.
📄 View Raw Release Notes (Original Developer Log)
### Patch Changes
- [#17212](https://github.com/withastro/astro/pull/17212) [`7ba0bb1`](https://github.com/withastro/astro/commit/7ba0bb1dc7516e88caff9abd7767322af44b0294) Thanks [@matthewp](https://github.com/matthewp)! - Ensures transition directive values are HTML-escaped when rendered on hydrated islands
- [#17224](https://github.com/withastro/astro/pull/17224) [`dc5e52f`](https://github.com/withastro/astro/commit/dc5e52f96c44a0dbf59edaf0503b53524e4e2da0) Thanks [@astrobot-houston](https://github.com/astrobot-houston)! - Fixes trailing slash handling for dynamic file endpoints in dev mode. Dynamic file endpoints (e.g., `src/pages/api/[name].json.ts`) with `trailingSlash: "always"` incorrectly required a trailing slash in dev mode, returning 404 for `/api/bar.json` and 200 for `/api/bar.json/`.
- [#17067](https://github.com/withastro/astro/pull/17067) [`23f9446`](https://github.com/withastro/astro/commit/23f9446a5666f249066c18cb9f6a7a4e261eb090) Thanks [@fkatsuhiro](https://github.com/fkatsuhiro)! - Fixed a bug where the development toolbar did not output a warning even though the implicit ARIA role and the manually specified role were duplicated.
- [#17234](https://github.com/withastro/astro/pull/17234) [`d5fbee8`](https://github.com/withastro/astro/commit/d5fbee8ec341049dc5ddc7b6c251b7a859abf437) Thanks [@ocavue](https://github.com/ocavue)! - Adds support for [`sharp` v0.35](https://github.com/lovell/sharp/releases/tag/v0.35.0). pnpm users no longer need to approve `sharp`'s build script (see [`allowBuilds`](https://pnpm.io/settings#allowbuilds)) when on v0.35.
- [#17223](https://github.com/withastro/astro/pull/17223) [`5970ef4`](https://github.com/withastro/astro/commit/5970ef4f7d99b692a54df019e7b3c161ce2f842c) Thanks [@astrobot-houston](https://github.com/astrobot-houston)! - Fixes `getCollection()` returning empty in dev mode for large content collections (500k+ entries)
- [#17184](https://github.com/withastro/astro/pull/17184) [`799e5cd`](https://github.com/withastro/astro/commit/799e5cd860f85a0d2eb5f77951f7593f474f3ad8) Thanks [@Princesseuh](https://github.com/Princesseuh)! - Upgrades the Rust compiler to the latest, which fixes some bugs. Refer to its [changelog](https://github.com/withastro/compiler-rs/releases/tag/%40astrojs%2Fcompiler-rs%400.3.0) for more information.
- [#17208](https://github.com/withastro/astro/pull/17208) [`da8b573`](https://github.com/withastro/astro/commit/da8b57354b25e2776324848f7e08530ae828e62f) Thanks [@matthewp](https://github.com/matthewp)! - Hardens forwarded header handling so the internal request helper validates `X-Forwarded-Host` against `security.allowedDomains` before trusting `X-Forwarded-For` for `clientAddress`. Previously it only checked that the header was present, which was inconsistent with the public `createRequest` helper. This aligns both code paths; behavior is unchanged for correctly configured proxies.