Fix double-escaped ampersands in Markdown image alt and title attributes

[ump45nose]

Changes

• Fix double-escaped ampersands in Markdown image alt and title attributes, e.g. ![A & B](../assets/diagram.svg "C & D") rendered alt="A & B".

Root cause

Markdown images are round-tripped through a __ASTRO_IMAGE_ markup attribute: rehypeImages JSON-serializes the image's properties (including alt/title) into that attribute, and the final <img> is rendered later by decoding it again. The decode step only handled the quote character references the Markdown processors emit — remark writes "/', satteri writes "/' — so an ampersand in the JSON survived the decode as entity text (& or &) and was escaped a second time when the attribute was finally rendered.

The decode chains in vite-plugin-markdown/images.ts (3 sites — this code is inlined into the browser bundle, so it stays self-contained) and content/runtime.ts (1 site) now decode the ampersand references as well, in both styles, ampersands last: quotes are decoded first so that a literal " in the operator's own alt text is not mistaken for one the serializer wrote, and only then is & un-escaped. Literal entity text in the source is preserved.

Testing

• Extended the core-image-remark-imgattr fixture with ![A & B](../assets/penguin2.jpg "C & D") and asserted via cheerio that the rendered alt/title are A & B / C & D (cheerio returns the decoded DOM value, so a double escape shows up as a literal &).
• Verified the test bites: with the ampersand decoding removed the new test fails (actual: 'A & B'), with it restored it passes.
• Ran the surrounding suites for regressions: core-image* (215 pass), astro-markdown* (47 pass), units/content-collections/image-references (11 pass), units/content-layer/asset-imports (3 pass). All green.
• Changeset added: .changeset/fix-image-attr-ampersand.md.

Docs

No docs change needed — the documented behavior of image alt/title is unchanged; this restores it.

---

Disclosure: implemented with AI assistance (Claude); the root-cause analysis, fix, and verification are mine and I can explain every line of the diff.

[changeset-bot]

🦋 Changeset detected

Latest commit: a564573

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
astro	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codspeed]

Merging this PR will not alter performance

✅ 21 untouched benchmarks

---

_{Comparing ump45nose:fix/18070-image-attr-escape (a564573) with main (cf5d72f)¹}

Footnotes

1. No successful run was found on main (db2eaf1) during the generation of this report, so cf5d72f was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[Princesseuh]

Looks great, thank you!