chore(deps-dev): bump astro from 4.16.18 to 5.4.0

[dependabot]

Bumps astro from 4.16.18 to 5.4.0.

Release notes

Sourced from astro's releases.

[email protected]

Minor Changes

• #12052 5be12b2 Thanks @​Fryuni! - Exposes extra APIs for scripting and testing.

  Config helpers

  Two new helper functions exported from astro/config:

  • mergeConfig() allows users to merge partially defined Astro configurations on top of a base config while following the merge rules of updateConfig() available for integrations.
  • validateConfig() allows users to validate that a given value is a valid Astro configuration and fills in default values as necessary.

  These helpers are particularly useful for integration authors and for developers writing scripts that need to manipulate Astro configurations programmatically.

  Programmatic build

  The build API now receives a second optional BuildOptions argument where users can specify:

  • devOutput (default false): output a development-based build similar to code transformed in astro dev.
  • teardownCompiler (default true): teardown the compiler WASM instance after build.

  These options provide more control when running Astro builds programmatically, especially for testing scenarios or custom build pipelines.

• #13278 4a43c4b Thanks @​ematipico! - Adds a new configuration option server.allowedHosts and CLI option --allowed-hosts.

  Now you can specify the hostnames that the dev and preview servers are allowed to respond to. This is useful for allowing additional subdomains, or running the dev server in a web container.

  allowedHosts checks the Host header on HTTP requests from browsers and if it doesn't match, it will reject the request to prevent CSRF and XSS attacks.

  astro dev --allowed-hosts=foo.bar.example.com,bar.example.com

  astro preview --allowed-hosts=foo.bar.example.com,bar.example.com

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  server: {
  allowedHosts: ['foo.bar.example.com', 'bar.example.com'],
  },
  });

  This feature is the same as Vite's server.allowHosts configuration.

... (truncated)

Changelog

Sourced from astro's changelog.

5.4.0

Minor Changes

• #12052 5be12b2 Thanks @​Fryuni! - Exposes extra APIs for scripting and testing.

  Config helpers

  Two new helper functions exported from astro/config:

  • mergeConfig() allows users to merge partially defined Astro configurations on top of a base config while following the merge rules of updateConfig() available for integrations.
  • validateConfig() allows users to validate that a given value is a valid Astro configuration and fills in default values as necessary.

  These helpers are particularly useful for integration authors and for developers writing scripts that need to manipulate Astro configurations programmatically.

  Programmatic build

  The build API now receives a second optional BuildOptions argument where users can specify:

  • devOutput (default false): output a development-based build similar to code transformed in astro dev.
  • teardownCompiler (default true): teardown the compiler WASM instance after build.

  These options provide more control when running Astro builds programmatically, especially for testing scenarios or custom build pipelines.

• #13278 4a43c4b Thanks @​ematipico! - Adds a new configuration option server.allowedHosts and CLI option --allowed-hosts.

  Now you can specify the hostnames that the dev and preview servers are allowed to respond to. This is useful for allowing additional subdomains, or running the dev server in a web container.

  allowedHosts checks the Host header on HTTP requests from browsers and if it doesn't match, it will reject the request to prevent CSRF and XSS attacks.

  astro dev --allowed-hosts=foo.bar.example.com,bar.example.com

  astro preview --allowed-hosts=foo.bar.example.com,bar.example.com

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  server: {
  allowedHosts: ['foo.bar.example.com', 'bar.example.com'],
  },
  });

  This feature is the same as Vite's server.allowHosts configuration.

... (truncated)

Commits

• 9aa5ac1 [ci] release (#13318)
• 80926fa chore(deps): update esbuild and vite versions (#13323)
• 5b6df02 [ci] format
• 5f72a58 fix(core): double encoding during match of routes (#13303)
• 2154ada [ci] format
• 5be12b2 feat(astro): Exposes extra APIs for script and testing (#12052)
• eb47231 [ci] format
• 9e7c71d fixes property shadowing for form.attributes (#13313)
• 2cdeaea [ci] format
• 4a43c4b feat: add new allowedHosts option (#13278)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[mergify]

Merge Protections

Your pull request matches the following merge protections and will not be merged until they are valid.

🟢 Changelog requirements

Wonderful, this rule succeeded.

• any of:
  • -title ~= ^feat
  • label = need changelog
  • label = skip changelog

🟢 Enforce conventional commit

Wonderful, this rule succeeded.

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|docs|style|refactor|perf|test|build|ci|chore|revert)(?:\(.+\))?:

🟢 🔎 Reviews

Wonderful, this rule succeeded.

• #changes-requested-reviews-by = 0
• #review-requested = 0
• #review-threads-unresolved = 0