• Document next analyze export in the package bundling guide: #99735
• Revert stabilization of forbidden() and unauthorized(): #99734
• Preserve configured output directories during static export: #99507
• Rename skill to next-bundle-optimizer and document its usage: #99731
• [turbo-tasks-backend] Clean up task state before publishing execution completion: #99729

Huge thanks to @wbinnssmith, @acdlite, @gnoff, and @sokra for helping!

• Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. #54598

• Improve static route error guidance: #99724
• docs: add Turbopack experimental config references: #99723
• Show choices for agent upgrade prompt: #99727
• docs: add Keeping pages static guide and align the navigation stage docs: #99493
• Turbopack: Check the invalidator map before adding a path to a batch: #99711
• docs: add guide for optimizing the static shell: #97737
• Keep dev and build running during upgrade prompts: #99702
• docs: use auth interruption APIs in examples: #99698
• docs: recommend auth interruption APIs in error handling: #99696
• [test] Update snapshots: #99713
• Bundle Analyzer Agent Skill: Trace conditional async and worker chunk loading: #99174
• Bundle Analyzer Agent Skill: Show route chunk groups: #99170
• Bundle Analyzer Agent Skill: Show modules in generated JS/CSS files: #99173
• Bundle Analyzer Agent Skill: Expose more route details in analyze data: #99172
• turbo-tasks-backend: stop dirtying dependents of GC-collected tasks: #99647
• turbo-tasks-backend: treat reads and connects of collected tasks as errors: #99646
• turbo-tasks-backend: stop pinning tasks during restores and always discard missing tasks: #99645
• Bundle Analyzer Agent Skill: Add analyzer skill: #99169

Huge thanks to @aurorascharff, @devjiwonchoi, @bgw, @wbinnssmith, and @lukesandberg for helping!

• 1d9e910 Thanks @matthewp! - Validates the Host header against security.allowedDomains when using the Node adapter
• Updated dependencies [6987261, 62b13ba]:
  • @astrojs/internal-helpers@0.12.0

• Updated dependencies [6987261, 62b13ba]:
  • @astrojs/internal-helpers@0.12.0

• #18166 5134d0f Thanks @astro-factory! - Fixes an intermittent dev server crash when using astro:actions inside a server island with adapters that use a pre-bundled SSR environment (e.g. @astrojs/cloudflare)

• #18076 8a2df66 Thanks @astro-factory! - Fixes stale scoped styles during HMR when both markup and <style> are changed in a single save

• #18252 2d29e7e Thanks @astro-factory! - Fixes CSS from other pages leaking into a page's <head> in dev when the page imports a module such as astro:config/server.

• #18000 6724575 Thanks @barclayd! - Fixes a bug where server islands containing framework components rendered empty in the dev server when using a custom src/fetch.ts

• #18241 7c5fd6f Thanks @astro-factory! - Fixes the composable i18n() handler from astro/fetch and astro/hono returning an empty 404 for paths without a locale prefix. It now renders the custom 404 page, matching astro().

• #18164 1a6997f Thanks @astro-factory! - Fixes CSS Module HMR in dev when a component is rendered both with and without hydration on the same page. Astro now uses path-based class name hashing in dev mode so that editing CSS declarations no longer changes the generated selectors, allowing Vite's CSS HMR to update styles without a full page reload.

• #18243 dd29d62 Thanks @astro-factory! - Fixes context.props being null in middleware and endpoints when the composable astro/hono or astro/fetch actions() handler runs before middleware(), or when pages() runs without middleware()

• #18193 95d5d16 Thanks @astro-factory! - Fixes astro build failing on Windows with Node.js 25+ with ERR_INVALID_ARG_VALUE when clearing the output directory hits a transient EPERM error

• #18220 d6c13a4 Thanks @astro-factory! - Fixes type errors reported in Astro's built-in <Picture /> and <Font /> components when type-checking a project with tsc and @astrojs/ts-content-mapper

• #18133 faac481 Thanks @astro-factory! - Fixes lost request state when Vite discovers server dependencies during a request in Cloudflare dev mode

• #18146 2af4516 Thanks @astro-factory! - Fixes CSS imported from an injectScript('page') script being dropped during build

• #18159 e5f8fe0 Thanks @astro-factory! - Fixes a hang when a server:defer component is inside a slot of another component in an MDX content collection entry

• #18246 c3b42ad Thanks @astro-factory! - Fixes the glob() loader skipping content files whose paths contain # or ?

• #18248 b97184e Thanks @astro-factory! - Fixes a bug where page routes added with injectRoute() returned a 404 when i18n.routing.prefixDefaultLocale was true and the route path had no locale prefix

• #18251 3415263 Thanks @astro-factory! - Fixes content collection changes being ignored in astro dev after the dev server restarts because of a config change

• #18226 ad54af0 Thanks @imharjot! - Fixes Astro.cookies.get() returning undefined for request cookies with empty values

• #18155 37ab0e4 Thanks @astro-factory! - Fixes nondeterministic ordering of the server manifest's assets array, ensuring builds with identical inputs produce byte-identical output

• #18099 6987261 Thanks @renovate! - Adds YAML parsing with timestamp and merge key support, and formats YAML errors consistently across Astro, Markdown, MDX, and Markdoc.

• #15595 64e4039 Thanks @qzio! - Improves CSRF protection by taking modern browsers headers into account

• #18215 941bd5e Thanks @ump45nose! - Fixes a runtime ReferenceError for inlined scripts that import a URL with /* @vite-ignore */.

  Astro now inlines scripts after Vite replaces its preload markers, so ignored dynamic imports can remain inline without shipping an unresolved __VITE_PRELOAD__ reference.

• #18179 6caa659 Thanks @matthewp! - Fixes custom View Transition direction names that are not valid CSS identifiers, such as names starting with a digit or containing spaces. These directions now match their animations correctly.

• #18250 7eae39b Thanks @astro-factory! - Fixes a 404 for a CSS file that a dynamic import preloads when the imported module uses a component that is also a hydrated island on the same page

• #18176 7c9d00d Thanks @astro-factory! - Fixes duplicate CSS in production builds when a component is both server-rendered and used with client:only on the same page

• #18245 492e95f Thanks @astro-factory! - Fixes the composable astro/fetch and astro/hono handlers (trailingSlash(), redirects(), actions(), middleware(), and pages()) so they reject over-encoded request paths with a 400 Bad Request, matching astro(). For these requests, redirects() and actions() return the 400 response instead of undefined, so no redirect is issued and no action runs.

• #18078 0a2ab10 Thanks @manuelgruber! - Fixes Astro.rewrite() and context.rewrite() selecting the wrong route in astro dev when two dynamic routes match the same path

• #18210 62b13ba Thanks @edmundhung! - Allows Astro CLI commands to install tagged package versions

• #18069 d39eb97 Thanks @astro-factory! - Fixes a dev server dependency scan failure when an .astro file contains a literal <script in frontmatter or a template expression

• #18114 c17d920 Thanks @matthewp! - Fixes Astro on StackBlitz and other WebContainer environments

• #18088 cb767f9 Thanks @astro-factory! - Fixes a MODULE_LEVEL_DIRECTIVE warning during build caused by a stale "use astro:head-inject" directive in content collection propagated asset modules

• #18247 2b3f73d Thanks @astro-factory! - Fixes actions returning 500 for malformed JSON request bodies and undecodable action names. A SyntaxError from invalid JSON now returns 400 (BAD_REQUEST), and a URIError from a malformed percent-encoded action name now returns 404 (NOT_FOUND).

• 1d9e910 Thanks @matthewp! - Validates the Host header against security.allowedDomains when using the Node adapter

• #18249 c7799a4 Thanks @astro-factory! - Fixes the fontsource font provider to resolve variable fonts when using the "Variable" suffix in the font name (e.g. "Inter Variable")

• #18163 e48da9d Thanks @astro-factory! - Fixes <video muted> losing its muted state after a ClientRouter navigation in Chrome

• #18244 f67e7f7 Thanks @astro-factory! - Fixes localized error pages such as src/pages/pt/404.astro returning a 200 status when rendered through the pages() handler from astro/fetch or astro/hono

• #18242 c5275e3 Thanks @astro-factory! - Fixes experimental_AstroContainer output including dev toolbar data-astro-source-file and data-astro-source-loc attributes when rendering components under Vitest

• Updated dependencies [6987261, 62b13ba]:

  • @astrojs/internal-helpers@0.12.0
  • @astrojs/markdown-satteri@0.4.3

• #18254 36f3a0c Thanks @astro-factory! - Fixes middleware rewrites returning 404 instead of 200 when the 404 page is server-rendered
• Updated dependencies [6987261, 62b13ba]:
  • @astrojs/internal-helpers@0.12.0

• #18187 8f5e7b5 Thanks @renovate! - Updates prettier-plugin-astro to 1.1.0

• Updated dependencies [6987261, 62b13ba]:
  • @astrojs/internal-helpers@0.12.0

• #18210 62b13ba Thanks @edmundhung! - Allows Astro CLI commands to install tagged package versions