[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/markdown-remark (source)	7.3.7 → 7.3.8
@astrojs/mdx (source)	8.1.4 → 8.1.5
astro (source)	7.4.10 → 7.4.11

---

Release Notes

withastro/astro (@​astrojs/markdown-remark)

v7.3.8

Compare Source

Patch Changes

• #​18698 d13beeb Thanks @​astro-factory! - Fixes MDX optimize emptying <style> and <script> elements nested in static HTML from plugins, and turning SVG attributes like marker-end into markerEnd when ignoreElementNames is set

withastro/astro (@​astrojs/mdx)

v8.1.5

Compare Source

Patch Changes

• Updated dependencies [d13beeb]:
  • @​astrojs/markdown-satteri@0.4.9

withastro/astro (astro)

v7.4.11

Compare Source

Patch Changes

• #​18641 08e2cee Thanks @​astro-factory! - Validates the protocol, host and port from X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port together against each security.allowedDomains entry, instead of one at a time:

  • A forwarded protocol is only applied when an entry allows it for the host in use.
  • A forwarded port is only applied when the entry for that host lists it.
  • A forwarded host without a forwarded protocol is validated with the protocol of the server.
  • An entry with port: '443' (or '80' for http) now matches a host that doesn't include a port.

• #​18651 93a9057 Thanks @​umeraamir69! - Returns 400 Bad Request for malformed percent-encoded paths in the dev server and static preview instead of bubbling into a 500

• #​18672 e901468 Thanks @​astro-factory! - Fixes astro check reporting @astrojs/check as missing when the package is installed but throws while loading. The original error is now shown instead of an install prompt.

• #​18641 08e2cee Thanks @​astro-factory! - Fixes security.allowedDomains accepting non-HTTP(S) X-Forwarded-Proto values (such as ftp or ws) when the list mixes patterns with and without a protocol

• #​18686 62bb716 Thanks @​astro-factory! - Fixes astro build deleting the license file generated by Vite's build.license option. Astro now removes only its own Vite manifest from the .vite/ output folder.

• #​18629 e9916e1 Thanks @​decrek! - Fixes spreading an object onto an element with scoped styles changing that object. When the same object was spread on every render, for example a constant imported from another module, its class grew with every request.

• #​18641 08e2cee Thanks @​astro-factory! - Tightens how security.allowedDomains validates the Host and X-Forwarded-Host headers. Only a plain hostname with an optional port is accepted, and the validated host is applied to Astro.url exactly as it was matched.

• Updated dependencies [d13beeb, e9916e1]:

  • @​astrojs/markdown-satteri@0.4.9
  • @​astrojs/runtime@0.1.1
  • @​astrojs/vite-plugin-astro@0.1.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8a88d49

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR