← All reportsPublic report

withastro/astro

The web framework for content-driven websites. ⭐️ Star to support our work!

62k stars TypeScript View on GitHubprofiled 11d ago
Try GitZoid
181PRs this week
45Contributors
21Deps scanned
0Issues found
01 · Repo overview

How astro is put together

This is the withastro/astro monorepo, the source of the Astro web framework (a content-driven site builder that compiles components to static HTML with optional server-side rendering). It is a pnpm + Turborepo workspace whose primary language is TypeScript; the core 'astro' package builds on Vite and exposes a CLI, config system, dev/build pipeline, runtime app entrypoints, assets/image services, fonts, content collections, actions, middleware, and client islands. Supporting workspace packages include create-astro (project scaffolding CLI), @astrojs/prism and @astrojs/rss (integrations), language-tools (VS Code extension/language server), telemetry, internal-helpers, underscore-redirects, and upgrade. Data flow: user projects are configured via astro.config.*, processed by the Vite-based compiler pipeline (@astrojs/compiler-rs), rendered to HTML or served via adapter entrypoints, with client-side hydration via astro-island scripts.

Languages

TypeScriptJavaScriptAstro (.astro components)CSS

Frameworks

AstroViteHonoZodPlaywrightVitestPrism.jsShiki

Infrastructure

Node.js >=22.12.0TurborepoGitHub Actions (CI implied by CI env usage)pkg-pr-newChangesets

Major components

packages/astro core

The Astro framework itself: CLI (bin/astro.mjs), config loading, Vite-based build/dev pipeline, SSR app entrypoints, routing, middleware, errors, logging, and virtual modules.

packages/astro runtime & client islands

Server render runtime plus client-side scripts (idle/load/media/only/visible) and astro-island custom element for partial hydration.

packages/astro assets & fonts

Image optimization endpoints/services (sharp or noop), responsive image/picture components, and font handling via unifont/fontace/capsize unpacking.

packages/astro content & actions

Content collections loaders/runtime and typed Actions for defining server endpoints with input validation.

create-astro

Interactive scaffolding CLI that downloads starter templates via giget-core into new projects.

@astrojs/rss

Generates RSS 2.0 feeds from validated options/items using Zod schemas and fast-xml-parser XML building.

@astrojs/prism

Syntax highlighting integration wrapping Prism.js with environment-specific language loaders (default vs workerd).

language-tools

Editor support: TypeScript plugin, VS Code extension, and Astro language server/check packages.

Over the past five weeks, the Astro team shipped a steady stream of bug fixes across its core rendering, content collections, i18n, and adapter (Cloudflare, Vercel, Netlify, Node) integrations, alongside a few notable features like experimental incremental static builds and a background mode for preview. A recurring theme was hardening edge cases: malformed requests, stale caches, image handling, and dev-server reliability all received targeted fixes. Tooling also improved, with better editor support, faster builds via Node's compile cache, and new internal code-review skills.

Week by week

2026-08-24A quieter week focused on polishing request handling, syntax highlighting, and fixing a handful of regressions in images and editor tooling.latest6 changes

Fix

Safer handling of GET/HEAD requests during rewrites

Rewrites now correctly handle request bodies for GET and HEAD requests, preventing unexpected behavior when pages redirect internally.

Fix

Better highlighting for multiline language tags

Code blocks whose language attribute spans multiple lines are now highlighted correctly.

Fix

Content image regression fixed

Fixed a regression that broke how images inside content collections were resolved.

Fix

Vercel build output fix

The Vercel adapter now correctly includes the build output directory in file traces when it lives outside the project root.

Fix

Vue auto-import completions restored

Editor auto-import suggestions for Vue components now work again in Astro files.

Refactor

Skip unnecessary URL rewrites

The server no longer performs URL normalization work when it wouldn't actually change the path, saving wasted effort.

2026-08-17A very busy week with nearly fifty commits, headlined by broad reliability fixes for internationalization, caching, sessions, and the Cloudflare/Vercel adapters.6 changes

Fix

i18n fallback returns 404 instead of 500

Missing prerendered pages under internationalized fallback routes now show a proper 'not found' page instead of crashing with a server error.

Refactor

Faster CLI startup via Node compile cache

Astro's command-line tools now use Node.js's built-in compile cache to start up faster.

Fix

Session cookie validation

Session cookies are now checked to be valid UUIDs before being used as storage keys, improving security.

Fix

APNG image format support

Animated PNG (.apng) files are now a supported image format throughout Astro.

Fix

Glob loader handles colons in filenames

Content files with colons in their names are no longer silently dropped by the glob loader.

Fix

CSP hashes suppressed with unsafe-inline

Content Security Policy hashes are no longer emitted when 'unsafe-inline' is already allowed in a directive, avoiding conflicts.

2026-08-10Heavy investment in build performance and stability, including shared hashing for incremental builds and fixes for crashes on large image jobs and malformed requests.6 changes

Refactor

Faster incremental builds with shared content hashing

Incremental builds got smarter by sharing a single content graph hash, cutting redundant work between builds.

Fix

No more crashes on large image builds

Image processing during big builds now limits concurrency and retries, preventing 'too many open files' errors.

Fix

Crash fix for malformed Host headers

Requests with an invalid port in their Host header no longer crash the dev server.

Fix

Node adapter returns proper 404s

Unknown prerendered endpoints now return a clean 404 instead of an error through the Node adapter.

Refactor

Request handling refactored into functional core

Internal request processing was restructured for clarity and maintainability without changing behavior.

Fix

CSS preserved across view-transition navigations

Hot-reloaded styles now survive client-side navigations when using the View Transitions router.

2026-08-03Two significant features landed—experimental incremental static builds and opt-out sessions—alongside many fixes for content collections, CSP, and the Cloudflare adapter.6 changes

Feature

Experimental incremental static builds

A new experimental mode lets static site builds reuse previous work, potentially speeding up rebuilds dramatically.

Feature

Opt out of session support

Sites can now set 'session: false' to completely disable session features they don't use.

Feature

Background mode for astro preview

The preview server can now run in the background, freeing up your terminal.

Fix

CSP covers speculation rules

Content Security Policy now includes the correct hash when client-side prerendering is enabled, so scripts aren't blocked.

Fix

Fix /_image errors with catch-all routes

The built-in image endpoint no longer fails with a 500 error when combined with certain prerendered route configurations.

Fix

Error pages keep their cookies

Cookies set by custom 404 or 500 error pages are now properly preserved and sent to visitors.

2026-07-27A wide-ranging week of fixes spanning Cloudflare image optimization, build race conditions, CSS hot-reloading, and a new internal code-review skill.6 changes

Feature

Opt-in Cloudflare image optimization at build time

Projects on Cloudflare can now choose to have images optimized using Cloudflare bindings during the build process.

Fix

Two-stage build prevents i18n rewrite races

Builds were restructured into two phases to stop a race condition when multiple translated-page redirects ran concurrently.

Fix

Custom 404 shown when middleware rewrite dead-ends

When a middleware rewrite leads nowhere, visitors now see the custom 404 page instead of a blank response.

Fix

CSS hot-reload refreshes stale styles

Editing a component's <style> block now reliably updates styles in the browser during development.

Chore

New code review skill added

An automated code-review helper was introduced to assist contributors with formatting and findings.

Fix

Long-CSS-data-URI crash fixed

Extremely long CSS embedded as data URIs no longer crash the build with a filename-too-long error.

03 · Security check

Dependencies and code review

21 dependencies scanned

Dependency advisories

Security Watch

No known advisories across 21 scanned dependencies.

No known advisories in the scanned dependencies.

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required