- Tightened security.allowedDomains validation for forwarded headers, host headers, and HTTP(S) protocols, and fixed 400 errors for malformed percent-encoded paths in dev and preview servers.
- Fixed astro check incorrectly reporting missing packages on load failure, prevented astro build from deleting Vite-generated license files, and fixed object mutation bugs when spreading objects onto scoped elements.
- This patch release ships in version astro@7.4.11.