[pull] main from withastro:main

.agents/skills/astro-pr-writer/SKILL.md

@@ -120,7 +120,7 @@ Load the `changeset` skill to create the changeset file and write the message. I
 
 When writing the PR body:
 
-- Always check that a changeset exists before posting the PR
+- Before posting, check whether a changeset exists. If the PR modifies a package and none exists, **create it now** using the `changeset` skill — do not post the PR without one.
 - Do not mention "added changeset" in the `Changes` section — it is process noise, not a behavior change
 
 ## Self-Check Before Posting
@@ -129,4 +129,4 @@ When writing the PR body:
 - `Changes` bullets describe behavior/implementation/impact
 - `Testing` lists test code added/changed, not test run results
 - `Docs` decision is explicit
-- Changeset file exists in `.changeset/` for any package-modifying PR
+- Changeset file exists in `.changeset/` for any package-modifying PR — if missing, create it before posting

.agents/skills/triage/fix.md

@@ -25,7 +25,7 @@ These variables are referenced throughout this skill. They may be passed as args
 6. Write a unit test
 7. Ensure no regressions
 8. Generate git diff
-9. Create a changeset
+9. Create a changeset (required for any fix that modifies a package)
 10. Append fix details to `report.md`
 11. Clean up the working directory
 
@@ -141,9 +141,22 @@ This captures all your changes for the report.
 
 ## Step 9: Create a Changeset
 
-**Only do this if the fix was successful** (i.e., you are on the high-confidence path and the fix resolves the issue). If the fix failed or was skipped, skip this step entirely.
+A changeset is **required** for every successful fix that modifies a package under `packages/`. This is not optional and does not scale with the size of the fix: one-line fixes, type-only fixes, and comment-only behavior changes all need a changeset. The only fixes that skip this step are ones that failed, were skipped, or touch nothing under `packages/` (e.g. `examples/*`-only changes).
 
-Load the `changeset` skill and follow its instructions to create a changeset for the fix. Since this is a bug fix, the bump type will almost always be `patch`.
+Create the changeset now:
+
+1. Run `pnpm changeset --empty` from the repo root. This writes a randomly-named `.md` file to `.changeset/`.
+2. Edit that file to add the package bump and a user-facing message. The bump type for a bug fix is almost always `patch`:
+
+   ```md
+   ---
+   '<package-name>': patch
+   ---
+
+   <one-line, user-facing description of the fix>
+   ```
+
+Load the `changeset` skill for the message conventions (present-tense verb, name the affected API, write for Astro users not reviewers) and the exact package name to use.
 
 ## Step 10: Write Output
 
@@ -158,7 +171,7 @@ The report must include all information needed for a final GitHub comment to be
 - Whether the fix was successful or not
 - Verification results (did the fix resolve the original error?)
 - Unit test details: what test was added, where it lives, and what it verifies. If no test was added, explain why.
-- Changeset details: what changeset file was created and which packages it covers. If no changeset was created, explain why.
+- Changeset details: the name of the changeset file created in `.changeset/` and which packages it covers. A successful fix that modified a package must have a changeset — there is no "skipped because trivial" outcome. The only valid reason to have no changeset is that the fix failed/was skipped or touched nothing under `packages/`; state which.
 - Any alternative approaches considered and their tradeoffs
 - If the fix failed: what was tried and why it didn't work
 
@@ -170,7 +183,7 @@ The report must include all information needed for a final GitHub comment to be
    - Changes outside `packages/` that were only needed for diagnosis/reproduction
    - Build artifacts that shouldn't be committed
 3. Use `git checkout -- <file>` to discard unwanted changes
-4. Confirm with a final `git status` that only the intended fix files remain
+4. Confirm with a final `git status` that only the intended fix files remain, and that they include a new `.changeset/*.md` file. If the fix modified a package but no changeset is present, go back and create it before finishing.
 5. DO NOT commit or push anything yet! The user will handle that at a later step.
 
 The `triage/` directory is already gitignored, so it won't appear in `git status`.

.changeset/better-zebras-notice.md

@@ -0,0 +1,5 @@
+---
+'astro': patch
+---
+
+Fixes a bug where `experimental_getFontFileURL()` rejected valid font URLs when using the Cloudflare adapter

.changeset/cyan-pigs-take.md

@@ -0,0 +1,5 @@
+---
+'astro': patch
+---
+
+Updates deprecation messages target from Astro 7 to 8

.changeset/famous-trains-like.md

@@ -0,0 +1,5 @@
+---
+'astro': patch
+---
+
+Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

.changeset/few-toys-rhyme.md

@@ -0,0 +1,5 @@
+---
+'astro': patch
+---
+
+Fixes `--mode`, `--site`, `--base`, `--out-dir`, `--verbose`, `--silent`, and `--open` flags being silently dropped when using `astro dev --background` or `astro preview --background`

.changeset/fix-content-modules-stale-import.md

@@ -0,0 +1,7 @@
+---
+'astro': patch
+---
+
+Fixes `content-modules.mjs` not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules
+
+As part of this fix, `#moduleImports` is now fully rebuilt from `deferredRender` entries before every write, so a module import added only through the public `addModuleImport()` API without a corresponding `deferredRender` entry in the store will no longer be preserved across writes.

.changeset/gentle-regions-shave.md

@@ -0,0 +1,6 @@
+---
+'astro': patch
+'@astrojs/mdx': patch
+---
+
+Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

.changeset/gold-roses-fetch.md

@@ -0,0 +1,5 @@
+---
+'astro': patch
+---
+
+Fixes an issue where Astro CSP support didn't correctly handle cases `"unsafe-inline"` resource. Now when `"unsafe-inline"`, Astro won't emit hashes for the directive specified.

.changeset/grumpy-bats-return.md

@@ -0,0 +1,6 @@
+---
+'@astrojs/mdx': patch
+'@astrojs/markdown-satteri': patch
+---
+
+Fixes Sätteri processor option types to accept all plugin entries supported by Sätteri v0.10.3.

.changeset/moody-geckos-train.md

@@ -0,0 +1,5 @@
+---
+'@astrojs/netlify': patch
+---
+
+Fixes generated Netlify Image CDN allowlists to reject remote URLs that contain an allowed image origin only within their path or query string

.changeset/persisted-media-keep-identity.md

@@ -0,0 +1,5 @@
+---
+'astro': patch
+---
+
+Fixes a regression where `transition:persist` stopped working for `<audio>` and `<video>` elements. 

.changeset/short-tables-thank.md

@@ -0,0 +1,5 @@
+---
+'create-astro': patch
+---
+
+Fixes `npm install` warnings on npm v11+ about esbuild's install scripts not being covered by `allowScripts`. Adds `ensureNpmScriptsAllowed()` to pre-approve esbuild in `package.json` before running `npm install`, matching the existing pnpm v11 compatibility fix.

.changeset/wicked-zebras-sip.md

@@ -0,0 +1,5 @@
+---
+'astro': patch
+---
+
+Fixes the dev server refusing to start in Docker containers after a restart due to PID reuse in the lock file check

.changeset/witty-cloths-do.md

@@ -0,0 +1,5 @@
+---
+'astro': patch
+---
+
+Fixes a build failure when defining `vite.environments.ssr` in the Astro config. User-provided environment config for `ssr`, `prerender`, or `client` is now properly deep-merged with Astro's internal environment settings instead of silently breaking the server entry naming.

.github/ISSUE_TEMPLATE/config.yml

@@ -2,7 +2,10 @@ blank_issues_enabled: false
 contact_links:
   - name: 💁 Support
     url: https://astro.build/chat
-    about: 'This issue tracker is not for support questions. Join us on Discord for assistance!'
+    about: This issue tracker is not for support questions. Join us on Discord for assistance!
+  - name: 💁 Support (GitHub)
+    url: https://github.com/withastro/community-support/discussions
+    about: No Discord account? Open a discussion on GitHub for assistance.
   - name: 📘 Documentation
     url: https://github.com/withastro/docs
     about: File an issue or make an improvement to the docs website.

examples/advanced-routing/package.json

@@ -16,5 +16,8 @@
     "@astrojs/node": "^11.1.4",
     "astro": "^7.2.4",
     "hono": "^4.12.14"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/basics/package.json

@@ -14,5 +14,8 @@
   },
   "dependencies": {
     "astro": "^7.2.4"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/blog/package.json

@@ -18,5 +18,8 @@
     "@astrojs/sitemap": "^3.7.3",
     "astro": "^7.2.4",
     "sharp": "^0.35.0"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/component/package.json

@@ -22,5 +22,8 @@
   },
   "peerDependencies": {
     "astro": "^5.0.0 || ^6.0.0"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/container-with-vitest/package.json

@@ -23,5 +23,8 @@
   "devDependencies": {
     "@types/react": "^18.3.28",
     "@types/react-dom": "^18.3.7"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/framework-alpine/package.json

@@ -17,5 +17,8 @@
     "@types/alpinejs": "^3.13.11",
     "alpinejs": "^3.15.8",
     "astro": "^7.2.4"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/framework-multiple/package.json

@@ -27,5 +27,8 @@
     "solid-js": "^1.9.11",
     "svelte": "^5.53.5",
     "vue": "^3.5.29"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/framework-preact/package.json

@@ -17,5 +17,8 @@
     "@preact/signals": "^2.8.1",
     "astro": "^7.2.4",
     "preact": "^10.28.4"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/framework-react/package.json

@@ -19,5 +19,8 @@
     "astro": "^7.2.4",
     "react": "^18.3.1",
     "react-dom": "^18.3.1"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/framework-solid/package.json

@@ -16,5 +16,8 @@
     "@astrojs/solid-js": "^7.0.2",
     "astro": "^7.2.4",
     "solid-js": "^1.9.11"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/framework-svelte/package.json

@@ -16,5 +16,8 @@
     "@astrojs/svelte": "^9.0.1",
     "astro": "^7.2.4",
     "svelte": "^5.53.5"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/framework-vue/package.json

@@ -16,5 +16,8 @@
     "@astrojs/vue": "^7.0.2",
     "astro": "^7.2.4",
     "vue": "^3.5.29"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/hackernews/package.json

@@ -15,5 +15,8 @@
   "dependencies": {
     "@astrojs/node": "^11.1.4",
     "astro": "^7.2.4"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/integration/package.json

@@ -22,5 +22,8 @@
   },
   "peerDependencies": {
     "astro": "^4.0.0"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/minimal/package.json

@@ -14,5 +14,8 @@
   },
   "dependencies": {
     "astro": "^7.2.4"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/portfolio/package.json

@@ -14,5 +14,8 @@
   },
   "dependencies": {
     "astro": "^7.2.4"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/ssr/package.json

@@ -18,5 +18,8 @@
     "@astrojs/svelte": "^9.0.1",
     "astro": "^7.2.4",
     "svelte": "^5.53.5"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/starlog/package.json

@@ -15,5 +15,8 @@
   },
   "engines": {
     "node": ">=22.12.0"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/toolbar-app/package.json

@@ -20,5 +20,8 @@
   },
   "engines": {
     "node": ">=22.12.0"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/with-markdoc/package.json

@@ -15,5 +15,8 @@
   "dependencies": {
     "@astrojs/markdoc": "^2.0.8",
     "astro": "^7.2.4"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/with-mdx/package.json

@@ -17,5 +17,8 @@
     "@astrojs/preact": "^6.0.4",
     "astro": "^7.2.4",
     "preact": "^10.28.4"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/with-nanostores/package.json

@@ -18,5 +18,8 @@
     "astro": "^7.2.4",
     "nanostores": "^1.1.1",
     "preact": "^10.28.4"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/with-tailwindcss/package.json

@@ -20,5 +20,8 @@
     "canvas-confetti": "^1.9.4",
     "tailwindcss": "^4.2.1",
     "vite": "^8.0.13"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }

examples/with-vitest/package.json

@@ -16,5 +16,8 @@
   "dependencies": {
     "astro": "^7.2.4",
     "vitest": "^5.0.0-beta.2"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }