chore(deps): update dependency astro to v5.18.1

[mend-for-github-com]

This PR contains the following updates:

Package	Type	Update	Change
astro (source)	dependencies	minor	5.16.15 → 5.18.1

By merging this PR, the issue #71 will be automatically resolved and closed:

Severity	CVSS Score	Vulnerability
Medium	5.3	CVE-2026-33769

---

Release Notes

withastro/astro (astro)

v5.18.1

Compare Source

Patch Changes

• Updated dependencies [c2cd371]:
  • @​astrojs/internal-helpers@​0.7.6
  • @​astrojs/markdown-remark@​6.3.11

v5.18.0

Compare Source

Minor Changes

• #​15589 b7dd447 Thanks @​qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.

  This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.

  If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.

  // astro.config.mjs
  export default defineConfig({
    security: {
      actionBodySizeLimit: 10 * 1024 * 1024, // set to 10 MB
    },
  });

Patch Changes

• #​15594 efae11c Thanks @​qzio! - Fix X-Forwarded-Proto validation when allowedDomains includes both protocol and hostname fields. The protocol check no longer fails due to hostname mismatch against the hardcoded test URL.

v5.17.3

Compare Source

Patch Changes

• #​15564 522f880 Thanks @​matthewp! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.

• #​15569 e01e98b Thanks @​matthewp! - Respect image allowlists when inferring remote image sizes and reject remote redirects.

v5.17.2

Compare Source

Patch Changes

• c13b536 Thanks @​matthewp! - Improves Host header handling for SSR deployments behind proxies

v5.17.1

Compare Source

Patch Changes

• #​15334 d715f1f Thanks @​florian-lefebvre! - BREAKING CHANGE to the experimental Fonts API only

  Removes the getFontBuffer() helper function exported from astro:assets when using the experimental Fonts API

  This experimental feature introduced in v15.6.13 ended up causing significant memory usage during build. This feature has been removed and will be reintroduced after further exploration and testing.

  If you were relying on this function, you can replicate the previous behavior manually:

  • On prerendered routes, read the file using node:fs
  • On server rendered routes, fetch files using URLs from fontData and context.url

v5.17.0

Compare Source

Minor Changes

• #​14932 b19d816 Thanks @​patrickarlt! - Adds support for returning a Promise from the parser() option of the file() loader

  This enables you to run asynchronous code such as fetching remote data or using async parsers when loading files with the Content Layer API.

  For example:

  import { defineCollection } from 'astro:content';
  import { file } from 'astro/loaders';
  
  const blog = defineCollection({
    loader: file('src/data/blog.json', {
      parser: async (text) => {
        const data = JSON.parse(text);
  
        // Perform async operations like fetching additional data
        const enrichedData = await fetch(`https://api.example.com/enrich`, {
          method: 'POST',
          body: JSON.stringify(data),
        }).then((res) => res.json());
  
        return enrichedData;
      },
    }),
  });
  
  export const collections = { blog };

  See the parser() reference documentation for more information.

• #​15171 f220726 Thanks @​mark-ignacio! - Adds a new, optional kernel configuration option to select a resize algorithm in the Sharp image service

  By default, Sharp resizes images with the lanczos3 kernel. This new config option allows you to set the default resizing algorithm to any resizing option supported by Sharp (e.g. linear, mks2021).

  Kernel selection can produce quite noticeable differences depending on various characteristics of the source image - especially drawn art - so changing the kernel gives you more control over the appearance of images on your site:

  export default defineConfig({
    image: {
      service: {
        entrypoint: 'astro/assets/services/sharp',
        config: {
          kernel: "mks2021"
        }
    }
  })

  This selection will apply to all images on your site, and is not yet configurable on a per-image basis. For more information, see Sharps documentation on resizing images.

• #​15063 08e0fd7 Thanks @​jmortlock! - Adds a new partitioned option when setting a cookie to allow creating partitioned cookies.

  Partitioned cookies can only be read within the context of the top-level site on which they were set. This allows cross-site tracking to be blocked, while still enabling legitimate uses of third-party cookies.

  You can create a partitioned cookie by passing partitioned: true when setting a cookie. Note that partitioned cookies must also be set with secure: true:

  Astro.cookies.set('my-cookie', 'value', {
    partitioned: true,
    secure: true,
  });

  For more information, see the AstroCookieSetOptions API reference.

• #​15022 f1fce0e Thanks @​ascorbic! - Adds a new retainBody option to the glob() loader to allow reducing the size of the data store.

  Currently, the glob() loader stores the raw body of each content file in the entry, in addition to the rendered HTML.

  The retainBody option defaults to true, but you can set it to false to prevent the raw body of content files from being stored in the data store. This significantly reduces the deployed size of the data store and helps avoid hitting size limits for sites with very large collections.

  The rendered body will still be available in the entry.rendered.html property for markdown files, and the entry.filePath property will still point to the original file.

  import { defineCollection } from 'astro:content';
  import { glob } from 'astro/loaders';
  
  const blog = defineCollection({
    loader: glob({
      pattern: '**/*.md',
      base: './src/content/blog',
      retainBody: false,
    }),
  });

  When retainBody is false, entry.body will be undefined instead of containing the raw file contents.

• #​15153 928529f Thanks @​jcayzac! - Adds a new background property to the <Image /> component.

  This optional property lets you pass a background color to flatten the image with. By default, Sharp uses a black background when flattening an image that is being converted to a format that does not support transparency (e.g. jpeg). Providing a value for background on an <Image /> component, or passing it to the getImage() helper, will flatten images using that color instead.

  This is especially useful when the requested output format doesn't support an alpha channel (e.g. jpeg) and can't support transparent backgrounds.

  ---
  import { Image } from 'astro:assets';
  ---
  
  <Image
    src="/transparent.png"
    alt="A JPEG with a white background!"
    format="jpeg"
    background="#ffffff"
  />

  See more about this new property in the image reference docs

• #​15015 54f6006 Thanks @​tony! - Adds optional placement config option for the dev toolbar.

  You can now configure the default toolbar position ('bottom-left', 'bottom-center', or 'bottom-right') via devToolbar.placement in your Astro config. This option is helpful for sites with UI elements (chat widgets, cookie banners) that are consistently obscured by the toolbar in the dev environment.

  You can set a project default that is consistent across environments (e.g. dev machines, browser instances, team members):

  // astro.config.mjs
  export default defineConfig({
    devToolbar: {
      placement: 'bottom-left',
    },
  });

  User preferences from the toolbar UI (stored in localStorage) still take priority, so this setting can be overridden in individual situations as necessary.

v5.16.16

Compare Source

Patch Changes

• #​15281 a1b80c6 Thanks @​matthewp! - Ensures server island requests carry an encrypted component export identifier so they do not accidentally resolve to the wrong component.

• #​15304 02ee3c7 Thanks @​cameronapak! - Fix: Remove await from getActionResult example

• #​15324 ab41c3e Thanks @​Princesseuh! - Fixes an issue where certain unauthorized links could be rendered as clickable in the error overlay

---

• If you want to rebase/retry this PR, check this box

[github-actions]

✅ Docs preview build completed successfully! All tests passed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 18.51%. Comparing base (34475bd) to head (d892aad).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #151   +/-   ##
=======================================
  Coverage   18.51%   18.51%           
=======================================
  Files           3        3           
  Lines          54       54           
  Branches       18       19    +1     
=======================================
  Hits           10       10           
  Misses         44       44           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

✅ Docs preview build completed successfully! All tests passed.

[github-actions]

✅ Docs preview build completed successfully! All tests passed.