Merge branch 'withastro:main' into main

.changeset/brave-colts-cover.md

@@ -0,0 +1,35 @@
+---
+"astro": minor
+---
+
+Introduces an experimental Container API to render `.astro` components in isolation.
+
+This API introduces three new functions to allow you to create a new container and render an Astro component returning either a string or a Response:
+
+- `create()`: creates a new instance of the container.
+- `renderToString()`: renders a component and return a string.
+- `renderToResponse()`: renders a component and returns the `Response` emitted by the rendering phase.
+
+The first supported use of this new API is to enable unit testing. For example, with  `vitest`, you can create a container to render your component with test data and check the result:
+
+```js
+import { experimental_AstroContainer as AstroContainer } from 'astro/container';
+import { expect, test } from 'vitest';
+import Card from '../src/components/Card.astro';
+
+test('Card with slots', async () => {
+	const container = await AstroContainer.create();
+	const result = await container.renderToString(Card, {
+		slots: {
+			default: 'Card content',
+		},
+	});
+
+	expect(result).toContain('This is a card');
+	expect(result).toContain('Card content');
+});
+```
+
+For a complete reference, see the [Container API docs](/en/reference/container-reference/).
+
+For a feature overview, and to give feedback on this experimental API, see the [Container API roadmap discussion](https://github.com/withastro/roadmap/pull/916).

.changeset/chatty-experts-smell.md

@@ -0,0 +1,30 @@
+---
+"astro": minor
+---
+
+The CSRF protection feature that was introduced behind a flag in [v4.6.0](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md#460) is no longer experimental and is available for general use. 
+
+To enable the stable version, add the new top-level `security` option in `astro.config.mjs`. If you were previously using the experimental version of this feature, also delete the experimental flag:
+
+```diff
+export default defineConfig({
+-  experimental: {
+-    security: {
+-      csrfProtection: {
+-        origin: true
+-      }
+-    }
+-  },
++  security: {
++    checkOrigin: true
++  }
+})
+```
+
+Enabling this setting performs a check that the `"origin"` header, automatically passed by all modern browsers, matches the URL sent by each Request.
+
+This check is executed only for pages rendered on demand, and only for the requests `POST`, `PATCH`, `DELETE` and `PUT` with one of the following `"content-type"` headers: `'application/x-www-form-urlencoded'`, `'multipart/form-data'`, `'text/plain'`.
+
+If the `"origin"` header doesn't match the pathname of the request, Astro will return a 403 status code and won't render the page.
+
+For more information, see the [`security` configuration docs](https://docs.astro.build/en/reference/configuration-reference/#security).

.changeset/five-crabs-rhyme.md

@@ -0,0 +1,23 @@
+---
+"astro": minor
+---
+
+The `i18nDomains` routing feature introduced behind a flag in [v3.4.0](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md#430) is no longer experimental and is available for general use.
+
+This routing option allows you to configure different domains for individual locales in entirely server-rendered projects using the [@astrojs/node](https://docs.astro.build/en/guides/integrations-guide/node/) or [@astrojs/vercel](https://docs.astro.build/en/guides/integrations-guide/vercel/) adapter with a `site` configured.
+
+If you were using this feature, please remove the experimental flag from your Astro config:
+
+```diff
+import { defineConfig } from 'astro'
+
+export default defineConfig({
+-  experimental: {
+-    i18nDomains: true,
+-  }
+})
+```
+
+If you have been waiting for stabilization before using this routing option, you can now do so. 
+
+Please see [the internationalization docs](https://docs.astro.build/en/guides/internationalization/#domains) for more about this feature.

.changeset/gentle-windows-enjoy.md

@@ -0,0 +1,46 @@
+---
+"@astrojs/react": minor
+"astro": minor
+---
+
+Adds two new functions `experimental_getActionState()` and `experimental_withState()` to support [the React 19 `useActionState()` hook](https://react.dev/reference/react/useActionState) when using Astro Actions. This introduces progressive enhancement when calling an Action with the `withState()` utility.
+
+This example calls a `like` action that accepts a `postId` and returns the number of likes. Pass this action to the `experimental_withState()` function to apply progressive enhancement info, and apply to `useActionState()` to track the result:
+
+```tsx
+import { actions } from 'astro:actions';
+import { experimental_withState } from '@astrojs/react/actions';
+
+export function Like({ postId }: { postId: string }) {
+	const [state, action, pending] = useActionState(
+		experimental_withState(actions.like),
+		0, // initial likes
+	);
+
+	return (
+		<form action={action}>
+			<input type="hidden" name="postId" value={postId} />
+      <button disabled={pending}>{state} ❤️</button>
+		</form>
+	);
+}
+```
+
+You can also access the state stored by `useActionState()` from your action `handler`. Call `experimental_getActionState()` with the API context, and optionally apply a type to the result:
+
+```ts
+import { defineAction, z } from 'astro:actions';
+import { experimental_getActionState } from '@astrojs/react/actions';
+
+export const server = {
+  like: defineAction({
+    input: z.object({
+      postId: z.string(),
+    }),
+    handler: async ({ postId }, ctx) => {
+      const currentLikes = experimental_getActionState<number>(ctx);
+      // write to database
+      return currentLikes + 1;
+    }
+  })
+}

.changeset/healthy-planets-dream.md

@@ -0,0 +1,7 @@
+---
+"astro": minor
+---
+
+Updates Astro's code for adapters to use the header `x-forwarded-for` to initialize the `clientAddress`.
+
+To take advantage of the new change, integration authors must upgrade the version of Astro in their adapter `peerDependencies` to `4.9.0`.

.changeset/six-icons-pump.md

@@ -0,0 +1,24 @@
+---
+"astro": patch
+---
+
+Deprecate the `getApiContext()` function. API Context can now be accessed from the second parameter to your Action `handler()`:
+
+```diff
+// src/actions/index.ts
+import {
+  defineAction,
+  z,
+-  getApiContext,
+} from 'astro:actions';
+
+export const server = {
+  login: defineAction({
+    input: z.object({ id: z.string }),
++    handler(input, context) {
+      const user = context.locals.auth(input.id);
+      return user;
+    }
+  }),
+}
+```

.changeset/sweet-needles-juggle.md

@@ -0,0 +1,21 @@
+---
+"@astrojs/vue": minor
+---
+
+Updates the `devtools` type to allow passing `VueDevToolsOptions`
+
+For more customization, you can pass options that the [Vue DevTools Vite Plugin](https://devtools-next.vuejs.org/guide/vite-plugin#options) supports. (Note: `appendTo` is not supported.) For example, you can set `launchEditor` to your preferred editor if you are not using Visual Studio Code:
+
+```js title="astro.config.mjs"
+import { defineConfig } from "astro/config";
+import vue from "@astrojs/vue";
+
+export default defineConfig({
+  // ...
+  integrations: [
+    vue({
+      devtools: { launchEditor: "webstorm" },
+    }),
+  ],
+});
+```

.changeset/twenty-cycles-bathe.md

@@ -0,0 +1,18 @@
+---
+"astro": minor
+---
+
+Adds compatibility for Astro Actions in the React 19 beta. Actions can be passed to a `form action` prop directly, and Astro will automatically add metadata for progressive enhancement.
+
+```tsx
+import { actions } from 'astro:actions';
+
+function Like() {
+  return (
+    <form action={actions.like}>
+      {/* auto-inserts hidden input for progressive enhancement */}
+      <button type="submit">Like</button>
+    </form>
+  )
+}
+```

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/devcontainers/javascript-node:0-18
+FROM mcr.microsoft.com/devcontainers/javascript-node:1-18
 
 # Install playwright
 RUN npm install -g @playwright/test

.devcontainer/examples.Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/devcontainers/javascript-node:0-18
+FROM mcr.microsoft.com/devcontainers/javascript-node:1-18
 
 # Install latest pnpm
 RUN npm install -g pnpm

.editorconfig

@@ -11,5 +11,5 @@ indent_style = tab
 insert_final_newline = true
 trim_trailing_whitespace = false
 
-[{.*,*.md,*.json,*.toml,*.yml,}]
+[{.*,*.md,*.json,*.toml,*.yml,*.json5}]
 indent_style = space