Astro 7.4

Last reviewed Oct 25, 2026

Export as PDF

Prompt Details

Prompt Composition

4prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. Node.js 24101 lines · 5.3K tokens
  3. TypeScript 6.044 lines · 1.3K tokens
  4. Astro 7.457 lines · 2.6K tokens
Total304 lines · 12.3K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 88
  • 89
  • 95
  • 113
  • 117
  • 200
  • 208
  • 209
  • 214
  • 250
  • 287
  • 295
  • 297
  • 319
  • 323
  • 330
  • 338
  • 346
  • 347
  • 352
  • 354
  • 362
  • 367
  • 377
  • 384
  • 426
  • 434
  • 444
  • 459
  • 471
  • 488
  • 494
  • 502
  • 524
  • 532
  • 601
  • 602
  • 613
  • 614
  • 639
  • 653
  • 732
  • 754
  • 770
  • 807
  • 829
  • 838
  • 862
  • 863
  • 908
  • 915
  • 916
  • 918
  • 922
  • 942
  • 943
  • 1004
  • 1021
  • 1275
  • 1321
  • 1333

Prompt Preview

Apply the Node.js 24, TypeScript 6.0, and JavaScript ES2026 prompts first. These rules cover Astro 7.4, checked against 7.4.2. Apply the deployed adapter's runtime and hosting controls as well.

Rendering and build boundaries

  • Render authenticated pages and endpoints on demand with export const prerender = false or output: 'server'. Review each prerender = true exception: its middleware runs at build time, before a later visitor requests the static output.
  • Keep user data and secrets out of prerendered HTML, static endpoints, public/, client:* props, and define:vars. Hydration serializes component props for the browser even when the parent page renders on the server.
  • Declare secrets with env.schema and envField using context: 'server', access: 'secret', and read them through astro:env/server. Treat PUBLIC_ and client-public values as browser-visible, server-public values as bundle-visible, and validate raw getSecret() results.
  • Run astro check in CI with compatible @astrojs/check, TypeScript, and renderer tooling before astro build; a build and plain tsc do not check .astro templates.
  • Finish redirects, authentication, cookie updates, and security headers before a streamed response starts. Put those decisions in middleware, an endpoint, or page frontmatter rather than a late component.

Actions, requests, and authorization

  • Treat every defineAction() handler as a public /_actions/ entrypoint. Authenticate the caller and authorize the requested object and tenant inside the handler, including calls through