chore: merge main into next

.agents/skills/triage/comment.md

@@ -35,24 +35,38 @@ Generate and return a GitHub comment following the template below.
 
 The **Fix** line in the template has three possible forms. Choose the one that matches the triage outcome:
 
-1. **You created a fix:** Use `I was able to fix this issue.` and include the suggested fix link.
+1. **You created a fix:** Use `I found a potential fix for this issue.` and include the suggested fix link. Avoid claiming certainty, even if the fix passes tests, frame it as a suggestion that needs human review.
 2. **The issue is already fixed on main** (e.g. the user is on an older major version and the bug doesn't reproduce on current main): Use `This issue has already been fixed.` and tell the user how to get the fix (e.g. upgrade). Link the relevant upgrade guide if applicable: [v6](https://docs.astro.build/en/guides/upgrade-to/v6/), [v5](https://docs.astro.build/en/guides/upgrade-to/v5/).
-3. **You could not find or create a fix:** Use `I was unable to find a fix for this issue.` and give guidance or a best guess at where the fix might be.
+3. **Low-confidence or no fix:** Use `I wasn't able to find a fix, but I identified some areas that may be relevant.` and list the files/code paths that seem related. Frame this as a jumping-off point for a human, not a diagnosis. If a failing test was added, mention it.
+4. **No leads at all:** Use `I was unable to determine the cause of this issue.` This should be rare, only use it when you genuinely have nothing useful to point to.
 
 ### "Priority" Instructions
 
 The **Priority** line communicates the severity of this issue to maintainers. Its goal is to answer the question: **"How bad is it?"**
 
-Select exactly ONE priority label from the `priorityLabels` arg. Use the label descriptions to guide your decision, combined with the triage report's root cause and impact analysis. Render it in bold, with the `- ` prefix removed, like this: `**Priorty P2: Has Workaround.** Then, follow it with 1-2 sentences explaining _why_ you chose that priority. Answer: "who is likely to be affected and under what conditions?". If you are unsure, use your best judgment based on the label descriptions and the triage findings.
+Select exactly ONE priority label from the `priorityLabels` arg. Use the label descriptions to guide your decision, combined with the triage report's root cause and impact analysis. Render it in bold, with the `- ` prefix removed, like this: `**Priority P2: Has Workaround.**` Then, follow it with 1-2 sentences explaining _why_ you chose that priority. Answer: "who is likely to be affected and under what conditions?". If you are unsure, use your best judgment based on the label descriptions and the triage findings.
+
+**Priority calibration — err on the side of lower priority:**
+
+- **Experimental/unstable features** should almost never be higher than P3. Users of experimental features accept instability. (e.g. a broken option in `experimental.fonts`)
+- **Niche adapter/integration combos** (e.g. MDX + Svelte + Cloudflare) are typically P3 or lower unless they affect a core workflow.
+- **P4 vs P5** — the key question is breadth: how many typical Astro users would hit this in a standard workflow? (e.g. P4: wrong output for a common routing pattern; P5: `astro build` crashes for most projects)
+- **P2: Has Workaround vs P2: Nice to Have** — pick based on whether something behaves unexpectedly (but circumventable) vs. simply a convenience gap (e.g. Has Workaround: unexpected behavior with a way to restructure around it; Nice to Have: cosmetic issue in an error message). If there is no workaround at all, consider P3 or higher instead.
+- **When selecting between similar labels**, always refer to their descriptions in `priorityLabels` to make the final call.
+- **When in doubt, go lower.** A P3 that gets bumped up by a maintainer is much better than a P5 that causes false alarm.
 
 ### Template
 
+The comment must start with an at-a-glance summary, followed by short explanations, then the full report in a collapsible section. Keep the top section scannable, a maintainer should understand the status in under 5 seconds and be able to quickly jump into fixing the issue.
+
 ```markdown
-**[I was able to reproduce this issue. / I was unable to reproduce this issue.]** [2-3 sentences describing the root cause, result, and key observations.]
+- **Reproduced:** [Yes / No / Skipped — reason]
+- **Exploration:** [Yes / No / Partial / Already fixed on main] [If `branchName` is non-null: — [View branch](https://github.com/withastro/astro/compare/{branchName}?expand=1)]
+- **Priority:** [See "Priority" Instructions above. Keep to one line explaining why this priority was chosen, who is likely to be affected, and under what conditions (this section should answer the question: "how bad is it?")]
 
-**[See "Fix" Instructions above.]** [1-2 sentences describing the solution, where/when it was already fixed, or guidance on where a fix might be.] [If `branchName` is non-null: [View Suggested Fix](https://github.com/withastro/astro/compare/{branchName}?expand=1)]
+[2-3 sentences describing the root cause or key observations, or where/when it was already fixed. Be specific about what's happening and where in the codebase.]
 
-**[See "Priority" Instructions above.]** [1-2 sentences explaining why this priority was chosen, who is likely to be affected, and under what conditions (this section should answer the question: "how bad is it?")]
+**[See "Fix" Instructions above.]** [1-2 sentences describing the fix in more detail: what was changed, guidance on where a fix might be, or relevant code areas.]
 
 <details>
 <summary><em>Full Triage Report</em></summary>
@@ -61,7 +75,7 @@ Select exactly ONE priority label from the `priorityLabels` arg. Use the label d
 
 </details>
 
-_This report was made by an LLM. Mistakes happen, check important info._
+_This report was made by an LLM. The analysis may be wrong, and the potential fix might not work, but is intended as a starting point for exploring the issue._
 ```
 
 ## Result

.agents/skills/triage/diagnose.md

@@ -61,6 +61,8 @@ Iterate until you understand:
 - What data is being passed
 - Where the logic diverges from expected behavior
 
+Once done, **revert all instrumentation** before moving on. Use `git checkout -- <file>` to remove your `console.log` additions from `packages/`. Debug logs must not leak into downstream steps.
+
 ## Step 4: Identify Root Cause
 
 Once you understand the issue, document:
@@ -75,6 +77,9 @@ Consider:
 - Is this a regression from a recent change?
 - Does this affect other similar use cases?
 - Are there edge cases to consider?
+- Never suggest removing a user's dependency (adapters, framework integrations, features like MDX or DB) as a fix, those are things the user needs. The fix must work within the user's existing stack and expected feature-set.
+
+**Tone calibration:** Describe the root cause factually, not dramatically. Avoid language that overstates impact ("critical flaw", "fundamentally broken", "severe vulnerability") unless the evidence genuinely supports it. A missing null check is a missing null check, not a "critical oversight in the rendering pipeline." The diagnosis should help a maintainer understand what's wrong, guiding them towards a fix, not alarm them.
 
 ## Step 5: Write Output
 

.agents/skills/triage/fix.md

@@ -35,7 +35,19 @@ Read `report.md` from the `triageDir` directory to understand:
 - The suggested approach
 - Any edge cases to consider
 
-**Skip if prerequisites unmet:** Check `report.md`: If bug not reproduced/skipped OR diagnosis confidence is `low`/`null` OR no root cause found → append "FIX SKIPPED: [reason]" to `report.md` and return `fixed: false`.
+**Skip if prerequisites unmet:** Check `report.md`: If bug was not reproduced or was skipped → append "FIX SKIPPED: Not reproduced" to `report.md` and return `fixed: false`. Do NOT attempt a fix based on guesswork when you cannot reproduce or diagnose the issue.
+
+**Low-confidence path:** If diagnosis confidence is `low` or `null`, or no clear root cause was found → do NOT attempt a code fix. Instead:
+
+1. Identify the most likely area(s) of the codebase related to the issue (files, functions, code paths).
+2. If possible, write a failing test that demonstrates the expected behavior described in the issue. Place it alongside existing tests for that area.
+3. If you identified specific code paths, add brief inline comments (prefixed `// TRIAGE:`) near the most relevant lines in `packages/` to help the implementor orient quickly. Keep to 2-3 comments max — these are signposts, not a diagnosis.
+4. Append to `report.md`: the areas you identified, why they seem relevant, and any failing test or comments you added.
+5. Return `fixed: false`.
+
+This "breadcrumb" approach is more useful to maintainers than a wrong fix.
+
+**High-confidence path:** If diagnosis confidence is `medium` or `high` and a clear root cause was identified → proceed with implementing a fix as described in the steps below.
 
 **Note:** The repo may be messy from previous steps. Check `git status` and either work from the current state or `git reset --hard` to start clean.
 
@@ -55,6 +67,7 @@ Make changes in `packages/` source files. Follow these principles:
 - Only change what's necessary to fix the bug
 - Don't refactor unrelated code
 - Don't add new features
+- **Never "fix" an issue by removing a user's dependency.** Removing an adapter (Cloudflare, Netlify, Vercel, etc.), framework integration (Svelte, React, Vue, etc.), or feature (MDX, DB, etc.) is not a fix, these are things the user needs. The fix must work within the user's existing stack or expected feature set.
 
 **Consider edge cases:**
 

.changeset/two-eels-live.md

@@ -0,0 +1,5 @@
+---
+'astro': patch
+---
+
+Fixes an issue where i18n domains would return 404 when `trailingSlash` is set to `never`.

.flue/workflows/issue-triage/WORKFLOW.ts

@@ -241,19 +241,22 @@ export default async function triage(
 	const triageResult = await runTriagePipeline(flue, issueNumber, issueDetails);
 	let isPushed = false;
 
-	// If a successful fix was created, push the fix up to a new branch on GitHub.
+	// Push the fix branch if there are meaningful changes (fix, failing test, etc.).
 	// The comment we post below will reference that branch, then a maintainer can choose to:
 	// - checkout that branch locally, using the fix as a starting point
 	// - create a PR from that branch entirely in the GH UI
 	// - ignore it completely
-	if (triageResult.fixed) {
+	{
 		const diff = await flue.shell('git diff main --stat');
 		if (diff.stdout.trim()) {
 			const status = await flue.shell('git status --porcelain');
 			if (status.stdout.trim()) {
 				await flue.shell('git add -A');
+				const defaultMessage = triageResult.fixed
+					? 'fix(auto-triage): automated fix'
+					: 'test(auto-triage): failing test and investigation notes';
 				await flue.shell(
-					`git commit -m ${JSON.stringify(triageResult.commitMessage ?? 'fix(auto-triage): automated fix')}`,
+					`git commit -m ${JSON.stringify(triageResult.commitMessage ?? defaultMessage)}`,
 				);
 			}
 			const pushResult = await flue.shell(`git push -f origin ${branch}`);
@@ -274,7 +277,7 @@ export default async function triage(
 		result: v.pipe(
 			v.string(),
 			v.description(
-				'Return only the GitHub comment body generated from the template, following the included template directly. This returned comment must start with "**I was able to reproduce this issue.**" or "**I was unable to reproduce this issue.**"',
+				'Return only the GitHub comment body generated from the template, following the included template directly. This returned comment must start with the bullet-point summary (- **Reproduced:** ...)',
 			),
 		),
 	});

.github/scripts/tsconfig.json

@@ -0,0 +1,7 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "allowJs": true
+  }
+}

.github/workflows/check-merge.yml

@@ -39,10 +39,23 @@ jobs:
         with:
           files: |
             .changeset/**/*.md
-
+      # Intentionally ran after the changed-files step so the github API is used to identify
+      # changed files rather than a local git diff, this is more reliable for pull requests
+      # originating from a forked repository.
+      - name: Checkout files
+        id: checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        if: steps.changed-files.outputs.any_changed == 'true'
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          fetch-depth: 1
+          persist-credentials: false
+          sparse-checkout: |
+            .changeset
       - name: Check if any changesets contain minor or major changes
         id: check
-        if: steps.blocked.outputs.result != 'true'
+        if: steps.changed-files.outputs.any_changed == 'true'
         env:
           ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
         run: |

.github/workflows/check.yml

@@ -36,7 +36,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.14.0
+          node-version: 24.14.1
           cache: "pnpm"
 
       - name: Install dependencies

.github/workflows/ci.yml

@@ -124,7 +124,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.14.0
+          node-version: 24.14.1
           cache: "pnpm"
 
       - name: Install dependencies
@@ -141,7 +141,7 @@ jobs:
         run: pnpm run publint
 
       - name: Type-check test files
-        run: pnpm -C packages/astro run typecheck:tests
+        run: pnpm run typecheck:tests
 
   test:
     name: 'Test (${{ matrix.TEST_SUITE.name }}): ${{ matrix.os }} (node@${{ matrix.NODE_VERSION }})'

.github/workflows/congrats.yml

@@ -9,7 +9,7 @@ jobs:
   congrats:
     name: congratsbot
     if: ${{ github.repository_owner == 'withastro' && github.event.head_commit.message != '[ci] format' }}
-    uses: withastro/automation/.github/workflows/congratsbot.yml@main
+    uses: withastro/automation/.github/workflows/congratsbot.yml@a5bd0c5748c4d56e687cdd558064f9ee8adfb1f2 # main
     with:
       EMOJIS: '🎉,🎊,🧑‍🚀,🥳,🙌,🚀,👏,<:houston_golden:1068575433647456447>,<:astrocoin:894990669515489301>,<:astro_pride:1130501345326157854>'
     secrets:

.github/workflows/continuous_benchmark.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.14.0
+          node-version: 24.14.1
           cache: "pnpm"
 
       - name: Install dependencies
@@ -56,7 +56,7 @@ jobs:
         timeout-minutes: 15
 
       - name: Run the benchmarks
-        uses: CodSpeedHQ/action@1c8ae4843586d3ba879736b7f6b7b0c990757fab # v4.12.1
+        uses: CodSpeedHQ/action@db35df748deb45fdef0960669f57d627c1956c30 # v4.13.1
         timeout-minutes: 30
         with:
           working-directory: ./benchmark

.github/workflows/diff-dependencies.yml

@@ -20,7 +20,7 @@ jobs:
           fetch-depth: 0 # allows the diff action to access git history
 
       - name: Create Diff
-        uses: e18e/action-dependency-diff@d995338f3b229fe7b2cd82048df5da930f70c7c3 # v1.4.4
+        uses: e18e/action-dependency-diff@5d3c6ac2ad2de2eaca1dc120c5accfd9590764b6 # v1.5.1
         with:
           # We’re using this package primarily to track size changes, not as worried about duplicates
           duplicate-threshold: 100

.github/workflows/format.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   prettier:
     if: github.repository_owner == 'withastro'
-    uses: withastro/automation/.github/workflows/format.yml@main
+    uses: withastro/automation/.github/workflows/format.yml@a5bd0c5748c4d56e687cdd558064f9ee8adfb1f2 # main
     with:
       command: "format"
     secrets: inherit

.github/workflows/issue-close-cleanup.yml

@@ -0,0 +1,20 @@
+name: "Issue: Close Cleanup"
+
+on:
+  issues:
+    types: [closed]
+
+jobs:
+  cleanup-branch:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Delete triage fix branch
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          BRANCH="flue/fix-${{ github.event.issue.number }}"
+          # Delete the branch if it exists; ignore errors if it doesn't
+          gh api "repos/${{ github.repository }}/git/refs/heads/${BRANCH}" \
+            -X DELETE 2>/dev/null && echo "Deleted branch ${BRANCH}" || echo "No branch ${BRANCH} to clean up"

.github/workflows/issue-triage.yml

@@ -72,7 +72,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.14.0
+          node-version: 24.14.1
           cache: pnpm
 
       - name: Clone Astro Compiler (for debugging)

.github/workflows/preview-release.yml

@@ -48,7 +48,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.14.0
+          node-version: 24.14.1
           cache: "pnpm"
 
       - name: Install dependencies

.github/workflows/release.yml

@@ -36,7 +36,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.14.0
+          node-version: 24.14.1
           cache: "pnpm"
 
       - name: Install dependencies

.github/workflows/scripts.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.14.0
+          node-version: 24.14.1
           cache: "pnpm"
 
       - name: Install dependencies

.github/workflows/semgrep.yml

@@ -0,0 +1,14 @@
+name: Semgrep OSS scan
+on:
+  pull_request: {}
+  schedule:
+    - cron: '0 0 * * 6'
+jobs:
+  semgrep:
+    name: semgrep-oss
+    runs-on: ubuntu-latest
+    container:
+      image: semgrep/semgrep@sha256:500acf49f5e5785aa89af609b983f0427ac8cd08f7e34146277df6cffb002759 # v1.157.0
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
+      - run: semgrep scan --config=auto

biome.jsonc

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.4.2/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.4.10/schema.json",
   "files": {
     "includes": [
       "**",
@@ -46,7 +46,8 @@
         // Enforce separate type imports for type-only imports to avoid bundling unneeded code
         "useImportType": "error",
         "useExportType": "error",
-        "useNumberNamespace": "warn"
+        "useNumberNamespace": "warn",
+        "noInferrableTypes": "error"
       },
       "suspicious": {
         // This one is specific to catch `console.log`. The rest of logs are permitted
@@ -187,6 +188,26 @@
           }
         }
       }
+    },
+    {
+      "includes": ["**/astro/test/**"],
+      "linter": {
+        "rules": {
+          "style": {
+            "noRestrictedImports": {
+              "level": "error",
+              "options": {
+                "patterns": [
+                  {
+                    "group": ["**/src/**"],
+                    "message": "The test should not import the source code. Import the code from the dist/ folder instead."
+                  }
+                ]
+              }
+            }
+          }
+        }
+      }
     }
   ]
 }

eslint.config.js

@@ -65,6 +65,7 @@ export default [
 			'@typescript-eslint/consistent-indexed-object-style': 'off',
 			'@typescript-eslint/consistent-type-definitions': 'off',
 			'@typescript-eslint/dot-notation': 'off',
+			'@typescript-eslint/no-inferrable-types': 'off',
 			'@typescript-eslint/no-base-to-string': 'off',
 			'@typescript-eslint/no-empty-function': 'off',
 			'@typescript-eslint/no-floating-promises': 'off',

examples/basics/package.json

@@ -13,6 +13,6 @@
     "astro": "astro"
   },
   "dependencies": {
-    "astro": "^6.1.2"
+    "astro": "^6.1.8"
   }
 }

examples/blog/README.md

@@ -36,6 +36,7 @@ Inside of your Astro project, you'll see the following folders and files:
 ```text
 ├── public/
 ├── src/
+│   ├── assets/
 │   ├── components/
 │   ├── content/
 │   ├── layouts/