[doa-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
astro (source)	^7.4.10 → ^7.4.11

---

Release Notes

withastro/astro (astro)

v7.4.11

Compare Source

Patch Changes

• #​18641 08e2cee Thanks @​astro-factory! - Validates the protocol, host and port from X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port together against each security.allowedDomains entry, instead of one at a time:

  • A forwarded protocol is only applied when an entry allows it for the host in use.
  • A forwarded port is only applied when the entry for that host lists it.
  • A forwarded host without a forwarded protocol is validated with the protocol of the server.
  • An entry with port: '443' (or '80' for http) now matches a host that doesn't include a port.

• #​18651 93a9057 Thanks @​umeraamir69! - Returns 400 Bad Request for malformed percent-encoded paths in the dev server and static preview instead of bubbling into a 500

• #​18672 e901468 Thanks @​astro-factory! - Fixes astro check reporting @astrojs/check as missing when the package is installed but throws while loading. The original error is now shown instead of an install prompt.

• #​18641 08e2cee Thanks @​astro-factory! - Fixes security.allowedDomains accepting non-HTTP(S) X-Forwarded-Proto values (such as ftp or ws) when the list mixes patterns with and without a protocol

• #​18686 62bb716 Thanks @​astro-factory! - Fixes astro build deleting the license file generated by Vite's build.license option. Astro now removes only its own Vite manifest from the .vite/ output folder.

• #​18629 e9916e1 Thanks @​decrek! - Fixes spreading an object onto an element with scoped styles changing that object. When the same object was spread on every render, for example a constant imported from another module, its class grew with every request.

• #​18641 08e2cee Thanks @​astro-factory! - Tightens how security.allowedDomains validates the Host and X-Forwarded-Host headers. Only a plain hostname with an optional port is accepted, and the validated host is applied to Astro.url exactly as it was matched.

• Updated dependencies [d13beeb, e9916e1]:

  • @​astrojs/markdown-satteri@0.4.9
  • @​astrojs/runtime@0.1.1
  • @​astrojs/vite-plugin-astro@0.1.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.