Astro 7.2

Apply the Node.js 24, TypeScript 6.0, and JavaScript ES2026 prompts first. These rules target Astro 7.2 and were checked against 7.2.9. Apply adapter-specific runtime requirements when deploying outside Node.js.

Version and build controls

• Run the newest Astro 7 release, moving to each new minor as it ships. Astro ships fixes in new releases of its current major and backports security fixes only to the previous major, so a 7.2 install stops getting them once a later 7.x minor is out. Application middleware doesn't stand in for those fixes.
• Run astro check before astro build using compatible @astrojs/check, TypeScript, and renderer tooling. astro build does not type-check, and plain tsc does not check .astro templates.
• Update adapters independently of Astro core. Each @astrojs/* adapter has its own releases and advisories, so check the resolved adapter versions with npm ls after every Astro upgrade, and review compatibility before changing adapter release lines.

Rendering and environment boundaries

• Put request-authenticated pages and endpoints behind an adapter with export const prerender = false, or use output: 'server'. Audit every prerender = true exception: middleware for prerendered output runs at build time and cannot authorize its later static delivery.
• Keep private data out of prerendered HTML and static endpoints, public/, hydrated client:* props, and define:vars. A server-rendered parent does not make serialized client props private.
• Define credentials with env.schema and envField using