Astro 7.1 is here, and it's all about giving developers more control. This minor release packs significant enhancements to Content Security Policy (CSP) support, pagination, the development server, and content collections. These updates aim to improve security, flexibility, and developer experience without breaking existing workflows.
Key changes in Astro 7.1:
- CSP support: Astro now allows you to define a
Content-Security-Policyheader directly in yourastro.config.mjsvia theserver.cspoption. You can specify policies likedefault-src: 'self'and even usescript-src: 'nonce-{nonce}'for inline scripts. This is critical for preventing XSS attacks. - Pagination
paramsingetStaticPaths: Thepaginate()function now providesparamsin thepageobject, making it easier to access dynamic route parameters likeslugwithin paginated collections. This simplifies building paginated documentation or blog archives. - Dev server improvements: The development server now supports HMR for
.astrofiles when using the--hostflag, and the startup time has been reduced for large projects. Additionally, theastro devcommand now respects theserver.headersconfig for custom headers. - Content collections: The
defineCollection()function now accepts atype: 'data'option, allowing you to define collections for data files (JSON, YAML) alongside content files. This unifies the handling of structured data like team members or API endpoints. - New
injectScriptoption: InAstro.request, you can now inject scripts into theheadelement usingAstro.request.injectScript, useful for conditionally loading third-party scripts. - Deprecation of
Astro.fetchContent: This older API is deprecated in favor ofAstro.glob; migration warnings guide developers to the new syntax.
For developers, Astro 7.1 reduces boilerplate and enhances security. The CSP support alone is a major win for production sites, while pagination and content collections improvements streamline common patterns. The dev server enhancements mean faster iteration cycles.
Source: https://feat/blog/astro-710/