astro@7.4.11
Wait — 7.4.7 is the safer choice for now.
Published 12 h ago; most regressions surface within 72 h.
Why this verdict
- Published 12 h ago; most regressions surface within 72 h.Evidence
- Release notes list 2 breaking changes: Security allowed domains validation for X-Forwarded headers has been tightened and now validates protocol, host, and po…Evidence
Confidence 100% · algorithm v1 · computed 2026-11-12. How verdicts work
Supply chain and security
- Malware reports
- None known (OSV)
- Known advisories
- None known (OSV)
- License
- MIT
- Install scripts
- None
- Build provenance
- Signed provenance
- Weekly downloads
- 0
Compatibility
No compatibility boundary is crossed: this is a patch or minor release on a stable major.
Breaking changes in the release notes
- Security allowed domains validation for X-Forwarded headers has been tightened and now validates protocol, host, and port together.“Validates the protocol, host and port from X Forwarded Proto, X Forwarded Host and X Forwarded Port together against each security.allowedDomains entry, instead of one at a time”
- Host and X-Forwarded Host headers now only accept a plain hostname with an optional port.“Only a plain hostname with an optional port is accepted, and the validated host is applied to Astro.url exactly as it was matched.”
AI-extracted from the official release notes and checked against the quoted text. Read the source
0 issues mention this version in withastro/astro so far (14-day window still open). See them on GitHub
Check the official release notes below for behaviour changes before merging.
Release notes
Read the Astro changelog on Changes.Watch or the package page on npm for this version’s features and fixes.
Deprecations and deadlines
The maintainer has not deprecated this version on npm.
Did upgrading to 7.4.11 work for you?
Results appear once three developers have voted.