Respect path-segment boundaries when stripping the base in the dev server by ajfAfg · Pull Request #17889 · withastro/astro

ajfAfg · 2026-09-02T05:58:43Z

Changes

Fixes the dev server base middleware stripping the configured base from any request whose pathname merely starts with it as a string, ignoring path-segment boundaries.
With base: '/s', a request like /src/pages/index.astro was treated as being under the base and rewritten to /rc/pages/index.astro before reaching Vite, so it could never resolve. Any base value that is a non-segment prefix of a served path triggers this (/s vs /src); bases like /docs don't collide and hide the bug.
This is the same bug class Respect path-segment boundaries when stripping the configured base #17701 fixed for App.removeBase, FetchState, and the i18n domain helper: the dev middleware (evaluateBaseRewrite in vite-plugin-astro-server/base.ts) was the remaining spot still doing a plain startsWith check. It now strips the base only when the pathname is exactly the base or lies under base + '/', matching the policy of stripRequestBase.
Only the match condition changes. The rewrite itself (an url.replace that preserves query strings), the exact-base-match behavior (/s → /), and the not-found-subpath / not-found / check-public branches are unchanged. stripRequestBase isn't reused directly because it never strips a / base, while this middleware is always installed and must keep passing every request through when base is /.

Reproduction

pnpm create astro@latest (minimal template)
Set base: '/s' in astro.config.mjs
Run astro dev, then:
```
curl -i "http://localhost:4321/src/pages/index.astro"
```
Before this fix the request 404s because the middleware rewrote it to /rc/pages/index.astro; after it, Vite serves the module. In practice this broke the root-relative requests the dev server itself emits without the base, taking down every page.

Testing

Added unit tests to test/units/dev/base-rewrite.test.ts covering the segment-boundary cases: with base: '/s', /src/... requests are no longer rewritten while /s (exact) and /s/... still are, query strings are preserved, and /docs-archive/page with base: '/docs' falls through to not-found.

Also verified manually against examples/minimal with base: '/s': requests to /src/... now pass through to Vite untouched, pages under /s/ and the base root /s render, public assets under the base resolve, and URLs outside the base still 404.

Docs

No docs needed: this restores the documented behavior of base in dev; no user-facing API changes.

🤖 Generated with Claude Code

changeset-bot · 2026-09-02T05:58:51Z

🦋 Changeset detected

Latest commit: 24b9061

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

codspeed · 2026-09-02T06:06:07Z

Merging this PR will not alter performance

✅ 21 untouched benchmarks

_{Comparing ajfAfg:fix/dev-base-segment-boundary (24b9061) with main (26d69c0)}

ematipico · 2026-09-10T14:32:06Z

Please file a bug report first. Happy to open once we confirmed the bug

ajfAfg · 2026-09-11T05:35:59Z

@ematipico
Filed the bug report as requested: #17973 — it includes a minimal reproduction repo (https://github.com/ajfAfg/astro-base-prefix-dev-repro), confirmed against the latest release (astro 7.3.2).

astro-factory

This PR fixes the dev-server base middleware so it only strips the configured base at path-segment boundaries. The change is minimal and correct: evaluateBaseRewrite now matches pathname === devRoot || pathname.startsWith(appendForwardSlash(devRoot)), which prevents a base like /s from swallowing /src/... while preserving exact-base, subpath, query-string, and root-base behavior. Regression tests cover the reported collision cases and existing behavior. A patch changeset for astro is present. No merge-blocking issues found.

This review was made by an LLM. The analysis may be wrong, and reports might be incorrect.

ematipico · 2026-09-11T11:08:54Z

+'astro': patch
+---
+
+Fixes the dev server base middleware to respect path-segment boundaries when stripping the configured `base`. With a base such as `/s`, a request like `/src/pages/index.astro` is no longer treated as being under the base and rewritten to `/rc/pages/index.astro` during `astro dev`.


Can you reword the changeset? https://contribute.docs.astro.build/docs-for-code-changes/changesets/#tips-and-examples

After that, it's good to merge

Reworded the changeset following the guide — it now leads with "Fixes a bug where ..." and describes the behavior from the user's perspective. Thanks for the review!

…rver Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [astro](https://astro.build) ([source](https://github.com/withastro/astro/tree/HEAD/packages/astro)) | [`7.3.2` → `7.3.3`](https://renovatebot.com/diffs/npm/astro/7.3.2/7.3.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/astro/7.3.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/astro/7.3.2/7.3.3?slim=true) | --- ### Release Notes <details> <summary>withastro/astro (astro)</summary> ### [`v7.3.3`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#733) [Compare Source](https://github.com/withastro/astro/compare/astro@7.3.2...astro@7.3.3) ##### Patch Changes - [#17651](withastro/astro#17651) [`504333c`](withastro/astro@504333c) Thanks [@sxzz](https://github.com/sxzz)! - Refactors internal version handling to use a smaller, ESM-native dependency - [#17942](withastro/astro#17942) [`0bc5715`](withastro/astro@0bc5715) Thanks [@matthewp](https://github.com/matthewp)! - Returns appropriate 400 and 404 responses from the image endpoint for invalid and missing local image paths - [#17700](withastro/astro#17700) [`b2222fc`](withastro/astro@b2222fc) Thanks [@winklemad](https://github.com/winklemad)! - Fixes `Astro.preferredLocaleList` returning an empty list when a locale is configured with the object form (`{ path, codes }`) and the browser sends the code with different casing or an underscore, such as `en-US` matching a configured `en-us` - [#17941](withastro/astro#17941) [`394ff79`](withastro/astro@394ff79) Thanks [@matthewp](https://github.com/matthewp)! - Fixes `astro preview --ignore-lock` (and `astro dev --ignore-lock`) being refused when run from an AI agent environment. The flag now starts the server in the foreground instead of erroring, since agent detection only inferred background mode and was never explicitly requested. An explicit `--background` combined with `--ignore-lock` still errors. - [#17928](withastro/astro#17928) [`3277927`](withastro/astro@3277927) Thanks [@ArmandPhilippot](https://github.com/ArmandPhilippot)! - Fixes TypeScript autocompletion for `getImage()` to suggest all available predefined options. - [#17928](withastro/astro#17928) [`3277927`](withastro/astro@3277927) Thanks [@ArmandPhilippot](https://github.com/ArmandPhilippot)! - Fixes a type error in `getImage()` options that allowed passing both `widths` and `densities` at the same time. - [#17857](withastro/astro#17857) [`2637ed1`](withastro/astro@2637ed1) Thanks [@Princesseuh](https://github.com/Princesseuh)! - Improves rendering performance - [#17943](withastro/astro#17943) [`2fc7ce9`](withastro/astro@2fc7ce9) Thanks [@matthewp](https://github.com/matthewp)! - Fixes a WebAssembly error when importing `astro:actions` in tests that run under `@cloudflare/vitest-pool-workers` - [#18018](withastro/astro#18018) [`1b5a234`](withastro/astro@1b5a234) Thanks [@astro-factory](https://github.com/apps/astro-factory)! - Fixes trailing-slash redirect response body pointing to the incoming URL instead of the redirect target. The `location` header was correct, but the HTML body (`<meta http-equiv="refresh">`, `<title>`, and `<a>` tag) contained the original request path without the trailing-slash correction or query string. - [#17905](withastro/astro#17905) [`eaf70fa`](withastro/astro@eaf70fa) Thanks [@SudoDevStudio](https://github.com/SudoDevStudio)! - Fixes custom dev toolbar apps losing their UI after client-side navigation with `<ClientRouter />`. - [#18011](withastro/astro#18011) [`558b301`](withastro/astro@558b301) Thanks [@astro-factory](https://github.com/apps/astro-factory)! - Fixes prerendered Cloudflare pages rendering as `[object Object]` when `nodejs_compat` is enabled in `wrangler.toml` - [#17944](withastro/astro#17944) [`ba08e35`](withastro/astro@ba08e35) Thanks [@matthewp](https://github.com/matthewp)! - Fixes a regression in `astro dev` where writes outside the module graph (for example, `@astrojs/cloudflare`'s `.wrangler/state` files) invalidated the middleware on every request, causing repeated SSR reloads. Such writes no longer invalidate the middleware. - [#17531](withastro/astro#17531) [`ae837db`](withastro/astro@ae837db) Thanks [@danilloestrela](https://github.com/danilloestrela)! - Updates `svgo` to `4.0.2` to resolve a security advisory - [#17953](withastro/astro#17953) [`dbbf10e`](withastro/astro@dbbf10e) Thanks [@astro-factory](https://github.com/apps/astro-factory)! - Fixes a one-time page reload shortly after the first load on cold dev-server starts when a project has framework components imported from MDX content entries. MDX files are now included in the dev dependency pre-bundling scan, so their framework dependencies are bundled up front instead of being discovered (and reloaded for) at runtime. - [#17955](withastro/astro#17955) [`4e8ad9a`](withastro/astro@4e8ad9a) Thanks [@matthewp](https://github.com/matthewp)! - Improves dev server startup time. The content config and dev server app module graphs now begin compiling during server creation without blocking the server from listening. Request handling waits for the shared setup result when needed, cutting `astro dev` ready time by roughly a third on projects with a content config. - [#17960](withastro/astro#17960) [`9838049`](withastro/astro@9838049) Thanks [@Chy-Zaber-Bin-Zahid](https://github.com/Chy-Zaber-Bin-Zahid)! - Improves the diagnostics of some Astro errors. - [#17998](withastro/astro#17998) [`0e5478d`](withastro/astro@0e5478d) Thanks [@astro-factory](https://github.com/apps/astro-factory)! - Fixes SVG `<style>` elements nested inside `<defs>` or other container elements not being hashed for CSP - [#17994](withastro/astro#17994) [`80f9f1d`](withastro/astro@80f9f1d) Thanks [@astro-factory](https://github.com/apps/astro-factory)! - Fixes `experimental.incrementalBuild` restoring pages with stale CSS after a preprocessor partial changes or missing original images referenced by restored pages - [#17889](withastro/astro#17889) [`8ae6b46`](withastro/astro@8ae6b46) Thanks [@ajfAfg](https://github.com/ajfAfg)! - Fixes a bug where the dev server stripped the configured `base` from URLs that only share a prefix with it. With `base: '/s'`, requests to `/src/...` were rewritten to `/rc/...` and failed, breaking those pages during development. - [#17980](withastro/astro#17980) [`cfccafa`](withastro/astro@cfccafa) Thanks [@gameroman](https://github.com/gameroman)! - Improves JSDoc for fonts api - [#17953](withastro/astro#17953) [`dbbf10e`](withastro/astro@dbbf10e) Thanks [@astro-factory](https://github.com/apps/astro-factory)! - Fixes CSS HMR for framework components rendered through content entries after `ClientRouter` navigation - [#17970](withastro/astro#17970) [`0b4dc3a`](withastro/astro@0b4dc3a) Thanks [@matthewp](https://github.com/matthewp)! - Improves serialization of transition animation values in generated CSS - [#17999](withastro/astro#17999) [`30ef3cb`](withastro/astro@30ef3cb) Thanks [@astro-factory](https://github.com/apps/astro-factory)! - Fixes content collection HMR not updating prerendered pages when an adapter enables a separate prerender environment (e.g. `@astrojs/cloudflare` with `prerenderEnvironment: 'node'`) - [#18002](withastro/astro#18002) [`312ab49`](withastro/astro@312ab49) Thanks [@shoutoutuoadi325](https://github.com/shoutoutuoadi325)! - Fixes redirect targets being corrupted when a dynamic route parameter value contains `$` replacement patterns like `$&` - [#17937](withastro/astro#17937) [`e294953`](withastro/astro@e294953) Thanks [@matthewp](https://github.com/matthewp)! - Fixes a bug where the `glob()` content loader kept stale entries in the data store after the last file in a collection was deleted. Empty collections are now pruned correctly, and the file watcher is registered in dev so the first file added to an empty collection is picked up without a restart. - [#17945](withastro/astro#17945) [`750b4db`](withastro/astro@750b4db) Thanks [@matthewp](https://github.com/matthewp)! - Pre-bundles renderer server entrypoints and the default console logger during dev so they are included in the initial optimization pass, preventing a mid-request re-optimization that could crash the dev server on Cloudflare (workerd). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

github-actions Bot added the pkg: astro Related to the core `astro` package (scope) label Sep 2, 2026

ajfAfg force-pushed the fix/dev-base-segment-boundary branch 2 times, most recently from ac6b934 to f24566c Compare September 2, 2026 07:15

ematipico closed this Sep 10, 2026

ajfAfg mentioned this pull request Sep 11, 2026

Dev server strips base from unrelated URLs when the base is a non-segment prefix (e.g. base: '/s' breaks /src/... requests) #17973

Closed

1 task done

ematipico reopened this Sep 11, 2026

ematipico added the pr: astro-review Triggers a bot to do an automated review label Sep 11, 2026

astro-factory Bot removed the pr: astro-review Triggers a bot to do an automated review label Sep 11, 2026

astro-factory Bot reviewed Sep 11, 2026

View reviewed changes

ematipico reviewed Sep 11, 2026

View reviewed changes

Respect path-segment boundaries when stripping the base in the dev se…

24b9061

…rver Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ajfAfg force-pushed the fix/dev-base-segment-boundary branch from f24566c to 24b9061 Compare September 11, 2026 15:07

ematipico approved these changes Sep 14, 2026

View reviewed changes

ematipico merged commit 8ae6b46 into withastro:main Sep 14, 2026
29 checks passed

astrobot-houston mentioned this pull request Sep 14, 2026

[ci] release #17939

Merged

Navigation Menu

Repository navigation

Respect path-segment boundaries when stripping the base in the dev server - #17889

Respect path-segment boundaries when stripping the base in the dev server#17889
ematipico merged 1 commit into
withastro:mainfrom
ajfAfg:fix/dev-base-segment-boundary

ajfAfg commented Sep 2, 2026 •

edited by ematipico

Loading

Uh oh!

changeset-bot Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

codspeed Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

ematipico commented Sep 10, 2026

Uh oh!

ajfAfg commented Sep 11, 2026 •

edited

Loading

Uh oh!

astro-factory Bot left a comment

Uh oh!

ematipico Sep 11, 2026

Uh oh!

ajfAfg Sep 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ajfAfg commented Sep 2, 2026 • edited by ematipico Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Reproduction

Testing

Docs

Uh oh!

changeset-bot Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

codspeed Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

ematipico commented Sep 10, 2026

Uh oh!

ajfAfg commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

astro-factory Bot left a comment

Choose a reason for hiding this comment

Uh oh!

ematipico Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

ajfAfg Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ajfAfg commented Sep 2, 2026 •

edited by ematipico

Loading

changeset-bot Bot commented Sep 2, 2026 •

edited

Loading

codspeed Bot commented Sep 2, 2026 •

edited

Loading

ajfAfg commented Sep 11, 2026 •

edited

Loading