- Fixed multiple dev server crashes and HMR bugs, including intermittent crashes with astro:actions, stale scoped styles, and CSS module HMR issues.
- Added security hardening by validating the Host header, rejecting over‑encoded request paths with 400 responses, and improving CSRF protection.
- Resolved numerous bugs such as CSS leaking into <head>, request state loss, cookie retrieval errors, 404 handling for i18n routes, and variable font resolution.