withastro/astro astro@7.4.11 on GitHub

Patch Changes

#18641 08e2cee Thanks @astro-factory! - Validates the protocol, host and port from X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port together against each security.allowedDomains entry, instead of one at a time:
- A forwarded protocol is only applied when an entry allows it for the host in use.
- A forwarded port is only applied when the entry for that host lists it.
- A forwarded host without a forwarded protocol is validated with the protocol of the server.
- An entry with port: '443' (or '80' for http) now matches a host that doesn't include a port.
#18651 93a9057 Thanks @umeraamir69! - Returns 400 Bad Request for malformed percent-encoded paths in the dev server and static preview instead of bubbling into a 500
#18672 e901468 Thanks @astro-factory! - Fixes astro check reporting @astrojs/check as missing when the package is installed but throws while loading. The original error is now shown instead of an install prompt.
#18641 08e2cee Thanks @astro-factory! - Fixes security.allowedDomains accepting non-HTTP(S) X-Forwarded-Proto values (such as ftp or ws) when the list mixes patterns with and without a protocol
#18686 62bb716 Thanks @astro-factory! - Fixes astro build deleting the license file generated by Vite's build.license option. Astro now removes only its own Vite manifest from the .vite/ output folder.
#18629 e9916e1 Thanks @decrek! - Fixes spreading an object onto an element with scoped styles changing that object. When the same object was spread on every render, for example a constant imported from another module, its class grew with every request.
#18641 08e2cee Thanks @astro-factory! - Tightens how security.allowedDomains validates the Host and X-Forwarded-Host headers. Only a plain hostname with an optional port is accepted, and the validated host is applied to Astro.url exactly as it was matched.
Updated dependencies [d13beeb, e9916e1]:
- @astrojs/markdown-satteri@0.4.9
- @astrojs/runtime@0.1.1
- @astrojs/vite-plugin-astro@0.1.2