withastro · ematipico · Jun 9, 2025 · Jun 9, 2025
diff --git a/.changeset/hungry-boxes-wash.md b/.changeset/hungry-boxes-wash.md
diff --git a/.changeset/six-ducks-sit.md b/.changeset/six-ducks-sit.md
diff --git a/examples/basics/package.json b/examples/basics/package.json
@@ -10,6 +10,6 @@
     "astro": "astro"
   },
   "dependencies": {
-    "astro": "^5.9.1"
+    "astro": "^5.9.2"
   }
 }
diff --git a/examples/blog/package.json b/examples/blog/package.json
@@ -13,7 +13,7 @@
     "@astrojs/mdx": "^4.3.0",
     "@astrojs/rss": "^4.0.12",
     "@astrojs/sitemap": "^3.4.1",
-    "astro": "^5.9.1",
+    "astro": "^5.9.2",
     "sharp": "^0.34.2"
   }
 }
diff --git a/examples/component/package.json b/examples/component/package.json
@@ -15,7 +15,7 @@
   ],
   "scripts": {},
   "devDependencies": {
-    "astro": "^5.9.1"
+    "astro": "^5.9.2"
   },
   "peerDependencies": {
     "astro": "^4.0.0 || ^5.0.0"

diff --git a/examples/container-with-vitest/package.json b/examples/container-with-vitest/package.json
@@ -12,7 +12,7 @@
   },
   "dependencies": {
     "@astrojs/react": "^4.3.0",
-    "astro": "^5.9.1",
+    "astro": "^5.9.2",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "vitest": "^3.1.1"

diff --git a/examples/framework-alpine/package.json b/examples/framework-alpine/package.json
@@ -13,6 +13,6 @@
     "@astrojs/alpinejs": "^0.4.8",
     "@types/alpinejs": "^3.13.11",
     "alpinejs": "^3.14.9",
-    "astro": "^5.9.1"
+    "astro": "^5.9.2"
   }
 }
diff --git a/examples/framework-multiple/package.json b/examples/framework-multiple/package.json
@@ -17,7 +17,7 @@
     "@astrojs/vue": "^5.1.0",
     "@types/react": "^18.3.20",
     "@types/react-dom": "^18.3.6",
-    "astro": "^5.9.1",
+    "astro": "^5.9.2",
     "preact": "^10.26.5",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",

diff --git a/examples/framework-preact/package.json b/examples/framework-preact/package.json
@@ -12,7 +12,7 @@
   "dependencies": {
     "@astrojs/preact": "^4.1.0",
     "@preact/signals": "^2.0.3",
-    "astro": "^5.9.1",
+    "astro": "^5.9.2",
     "preact": "^10.26.5"
   }
 }
diff --git a/examples/framework-react/package.json b/examples/framework-react/package.json
@@ -13,7 +13,7 @@
     "@astrojs/react": "^4.3.0",
     "@types/react": "^18.3.20",
     "@types/react-dom": "^18.3.6",
-    "astro": "^5.9.1",
+    "astro": "^5.9.2",
     "react": "^18.3.1",
     "react-dom": "^18.3.1"
   }

diff --git a/examples/framework-solid/package.json b/examples/framework-solid/package.json
@@ -11,7 +11,7 @@
   },
   "dependencies": {
     "@astrojs/solid-js": "^5.1.0",
-    "astro": "^5.9.1",
+    "astro": "^5.9.2",
     "solid-js": "^1.9.5"
   }
 }
diff --git a/examples/framework-svelte/package.json b/examples/framework-svelte/package.json
@@ -11,7 +11,7 @@
   },
   "dependencies": {
     "@astrojs/svelte": "^7.1.0",
-    "astro": "^5.9.1",
+    "astro": "^5.9.2",
     "svelte": "^5.25.7"
   }
 }
diff --git a/examples/framework-vue/package.json b/examples/framework-vue/package.json
@@ -11,7 +11,7 @@
   },
   "dependencies": {
     "@astrojs/vue": "^5.1.0",
-    "astro": "^5.9.1",
+    "astro": "^5.9.2",
     "vue": "^3.5.13"
   }
 }
diff --git a/examples/hackernews/package.json b/examples/hackernews/package.json
@@ -11,6 +11,6 @@
   },
   "dependencies": {
     "@astrojs/node": "^9.2.2",
-    "astro": "^5.9.1"
+    "astro": "^5.9.2"
   }
 }
diff --git a/examples/integration/package.json b/examples/integration/package.json
@@ -15,7 +15,7 @@
   ],
   "scripts": {},
   "devDependencies": {
-    "astro": "^5.9.1"
+    "astro": "^5.9.2"
   },
   "peerDependencies": {
     "astro": "^4.0.0"

diff --git a/examples/minimal/package.json b/examples/minimal/package.json
@@ -10,6 +10,6 @@
     "astro": "astro"
   },
   "dependencies": {
-    "astro": "^5.9.1"
+    "astro": "^5.9.2"
   }
 }
diff --git a/examples/portfolio/package.json b/examples/portfolio/package.json
@@ -10,6 +10,6 @@
     "astro": "astro"
   },
   "dependencies": {
-    "astro": "^5.9.1"
+    "astro": "^5.9.2"
   }
 }
diff --git a/examples/ssr/package.json b/examples/ssr/package.json
@@ -13,7 +13,7 @@
   "dependencies": {
     "@astrojs/node": "^9.2.2",
     "@astrojs/svelte": "^7.1.0",
-    "astro": "^5.9.1",
+    "astro": "^5.9.2",
     "svelte": "^5.25.7"
   }
 }
diff --git a/examples/starlog/package.json b/examples/starlog/package.json
@@ -9,7 +9,7 @@
     "astro": "astro"
   },
   "dependencies": {
-    "astro": "^5.9.1",
+    "astro": "^5.9.2",
     "sass": "^1.86.3",
     "sharp": "^0.33.3"
   }

diff --git a/examples/toolbar-app/package.json b/examples/toolbar-app/package.json
@@ -16,6 +16,6 @@
   },
   "devDependencies": {
     "@types/node": "^18.17.8",
-    "astro": "^5.9.1"
+    "astro": "^5.9.2"
   }
 }
diff --git a/examples/with-markdoc/package.json b/examples/with-markdoc/package.json
@@ -11,6 +11,6 @@
   },
   "dependencies": {
     "@astrojs/markdoc": "^0.15.0",
-    "astro": "^5.9.1"
+    "astro": "^5.9.2"
   }
 }
diff --git a/examples/with-mdx/package.json b/examples/with-mdx/package.json
@@ -12,7 +12,7 @@
   "dependencies": {
     "@astrojs/mdx": "^4.3.0",
     "@astrojs/preact": "^4.1.0",
-    "astro": "^5.9.1",
+    "astro": "^5.9.2",
     "preact": "^10.26.5"
   }
 }
diff --git a/examples/with-nanostores/package.json b/examples/with-nanostores/package.json
@@ -12,7 +12,7 @@
   "dependencies": {
     "@astrojs/preact": "^4.1.0",
     "@nanostores/preact": "^0.5.2",
-    "astro": "^5.9.1",
+    "astro": "^5.9.2",
     "nanostores": "^0.11.4",
     "preact": "^10.26.5"
   }

diff --git a/examples/with-tailwindcss/package.json b/examples/with-tailwindcss/package.json
@@ -13,7 +13,7 @@
     "@astrojs/mdx": "^4.3.0",
     "@tailwindcss/vite": "^4.1.3",
     "@types/canvas-confetti": "^1.9.0",
-    "astro": "^5.9.1",
+    "astro": "^5.9.2",
     "canvas-confetti": "^1.9.3",
     "tailwindcss": "^4.1.3"
   }

diff --git a/examples/with-vitest/package.json b/examples/with-vitest/package.json
@@ -11,7 +11,7 @@
     "test": "vitest"
   },
   "dependencies": {
-    "astro": "^5.9.1",
+    "astro": "^5.9.2",
     "vitest": "^3.1.1"
   }
 }
diff --git a/packages/astro/CHANGELOG.md b/packages/astro/CHANGELOG.md
@@ -1,5 +1,51 @@
 # astro
 
+## 5.9.2
+
+### Patch Changes
+
+- [#13919](https://github.com/withastro/astro/pull/13919) [`423fe60`](https://github.com/withastro/astro/commit/423fe6048dfb4c24d198611f60a5815459efacd3) Thanks [@ematipico](https://github.com/ematipico)! - Fixes a bug where Astro added quotes to the CSP resources.
+
+  Only certain resources require quotes (e.g. `'self'` but not `https://cdn.example.com`), so Astro no longer adds quotes to any resources. You must now provide the quotes yourself for resources such as `'self'` when necessary:
+
+  ```diff
+  export default defineConfig({
+    experimental: {
+      csp: {
+        styleDirective: {
+          resources: [
+  -          "self",
+  +          "'self'",
+            "https://cdn.example.com"
+          ]
+        }
+      }
+    }
+  })
+  ```
+
+- [#13914](https://github.com/withastro/astro/pull/13914) [`76c5480`](https://github.com/withastro/astro/commit/76c5480ac0ab1f64df38c23a848f8d28f7640562) Thanks [@ematipico](https://github.com/ematipico)! - **BREAKING CHANGE to the experimental Content Security Policy feature only**
+
+  Removes support for experimental Content Security Policy (CSP) when using the `<ClientRouter />` component for view transitions.
+
+  It is no longer possible to enable experimental CSP while using Astro's view transitions. Support was already unstable with the `<ClientRouter />` because CSP required making its underlying implementation asynchronous. This caused breaking changes for several users and therefore, this PR removes support completely.
+
+  If you are currently using the component for view transitions, please remove the experimental CSP flag as they cannot be used together.
+
+  ```diff
+  import { defineConfig } from 'astro/config';
+
+  export default defineConfig({
+    experimental: {
+  -   csp: true
+     }
+  });
+  ```
+
+  Alternatively, to continue using experimental CSP in your project, you can [consider migrating to the browser native View Transition API](https://events-3bg.pages.dev/jotter/astro-view-transitions/) and remove the `<ClientRouter />` from your project. You may be able to achieve similar results if you are not using Astro's enhancements to the native View Transitions and Navigation APIs.
+
+  Support might be reintroduced in future releases. You can follow this experimental feature's development in [the CSP RFC](https://github.com/withastro/roadmap/blob/feat/rfc-csp/proposals/0055-csp.md).
+
 ## 5.9.1
 
 ### Patch Changes

diff --git a/packages/astro/package.json b/packages/astro/package.json
@@ -1,6 +1,6 @@
 {
   "name": "astro",
-  "version": "5.9.1",
+  "version": "5.9.2",
   "description": "Astro is a modern site builder with web best practices, performance, and DX front-of-mind.",
   "type": "module",
   "author": "withastro",