Update dependency astro to v7.0.4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
astro (source)	7.0.3 → 7.0.4

---

Release Notes

withastro/astro (astro)

v7.0.4

Compare Source

Patch Changes

• #​17212 7ba0bb1 Thanks @​matthewp! - Ensures transition directive values are HTML-escaped when rendered on hydrated islands

• #​17224 dc5e52f Thanks @​astrobot-houston! - Fixes trailing slash handling for dynamic file endpoints in dev mode. Dynamic file endpoints (e.g., src/pages/api/[name].json.ts) with trailingSlash: "always" incorrectly required a trailing slash in dev mode, returning 404 for /api/bar.json and 200 for /api/bar.json/.

• #​17067 23f9446 Thanks @​fkatsuhiro! - Fixed a bug where the development toolbar did not output a warning even though the implicit ARIA role and the manually specified role were duplicated.

• #​17234 d5fbee8 Thanks @​ocavue! - Adds support for sharp v0.35. pnpm users no longer need to approve sharp's build script (see allowBuilds) when on v0.35.

• #​17223 5970ef4 Thanks @​astrobot-houston! - Fixes getCollection() returning empty in dev mode for large content collections (500k+ entries)

• #​17184 799e5cd Thanks @​Princesseuh! - Upgrades the Rust compiler to the latest, which fixes some bugs. Refer to its changelog for more information.

• #​17208 da8b573 Thanks @​matthewp! - Hardens forwarded header handling so the internal request helper validates X-Forwarded-Host against security.allowedDomains before trusting X-Forwarded-For for clientAddress. Previously it only checked that the header was present, which was inconsistent with the public createRequest helper. This aligns both code paths; behavior is unchanged for correctly configured proxies.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The PR aims to update the 'astro' dependency to v7.0.4; however, the current submission contains no changes to 'package.json' or other manifest files. This omission means the primary acceptance criterion is unaddressed and the dependency remains unchanged. Only when the manifest files are updated can the security hardening and bug fixes in v7.0.4 be realized.

About this PR

• The pull request does not include modifications to 'package.json' or other manifest files required to perform the version update. Consequently, the core objective of the PR is currently unfulfilled.

Test suggestions

• Verify that the application builds successfully with Astro v7.0.4
• Confirm that transition directive values are HTML-escaped when rendered on hydrated islands
• Verify that X-Forwarded-Host is validated against allowed domains when determining clientAddress

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that the application builds successfully with Astro v7.0.4
2. Confirm that transition directive values are HTML-escaped when rendered on hydrated islands
3. Verify that X-Forwarded-Host is validated against allowed domains when determining clientAddress

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[github-actions]

Test Results

0 tests  ±0   0 ✅ ±0   0s ⏱️ ±0s
0 suites ±0   0 💤 ±0 
0 files   ±0   0 ❌ ±0 

Results for commit d874566. ± Comparison against base commit de751d4.