fix(core): fix Vercel skew protection bug for island hydration URLs by Strernd · Pull Request #15931 · withastro/astro

Strernd · 2026-03-16T09:06:18Z

Summary

This fixes a Vercel skew protection bug: astro-island hydration URLs were missing adapter assetQueryParams (for example ?dpl=), so island JS was not pinned to the active deployment.

Reproduction

I validated this against the reproduction project (repro-skew-protection) and Astro core changes from this branch:

VERCEL_DEPLOYMENT_ID=dpl_test123 VERCEL_SKEW_PROTECTION_ENABLED=1 npx astro build

Before this fix, rendered islands had:

component-url="/_astro/...js" (no dpl)
renderer-url="/_astro/...js" (no dpl)

With this fix, rendered islands have:

component-url="/_astro/...js?dpl=dpl_test123"
renderer-url="/_astro/...js?dpl=dpl_test123"

Changes

packages/astro/src/core/build/plugins/plugin-manifest.ts
- Serialize entryModules with appendAssetQuery(...) so island URL resolution gets assetQueryParams.
- Keep raw entry module values for static file tracking and page script handling to avoid double-appending.
packages/astro/src/core/render/ssr-element.ts
- Make createAssetLink() query/hash-aware:
  - extension detection now uses pathname without query/hash
  - query params are appended safely (? vs &, before hash)
- This preserves extension-based assetsPrefix routing when URLs already contain query params.
packages/astro/test/asset-query-params.test.js
- Add island coverage asserting component-url and renderer-url include ?dpl=test-deploy-id.
- Add regression coverage for assetsPrefix map (js/css/fallback) + assetQueryParams, ensuring island URLs still use JS CDN prefix.

Testing

pnpm -C packages/astro run build:ci
pnpm -C packages/astro exec astro-scripts test "test/asset-query-params.test.js"
pnpm -C packages/astro exec astro-scripts test "test/astro-assets-prefix-multi-cdn.test.js"

All pass.

Context

Related: #14545, #14543, #14627, #14853

changeset-bot · 2026-03-16T09:06:28Z

🦋 Changeset detected

Latest commit: 3fb9be3

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

codspeed-hq · 2026-03-16T09:24:20Z

Merging this PR will not alter performance

✅ 18 untouched benchmarks

_{Comparing Strernd:fix-skew-protection-island-hydration-urls (3fb9be3) with main (f5cc2b0)¹}

No successful run was found on main (4c54123) during the generation of this report, so f5cc2b0 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

matthewp · 2026-03-16T16:33:26Z

@Strernd looks great, can you add a changeset? pnpm run changeset ?

Strernd · 2026-03-17T07:55:48Z

@matthewp done!

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [astro](https://astro.build) ([source](https://github.com/withastro/astro/tree/HEAD/packages/astro)) | [`6.0.5` → `6.0.6`](https://renovatebot.com/diffs/npm/astro/6.0.5/6.0.6) | ![age](https://developer.mend.io/api/mc/badges/age/npm/astro/6.0.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/astro/6.0.5/6.0.6?slim=true) | --- ### Release Notes <details> <summary>withastro/astro (astro)</summary> ### [`v6.0.6`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#606) [Compare Source](https://github.com/withastro/astro/compare/astro@6.0.5...astro@6.0.6) ##### Patch Changes - [#15965](withastro/astro#15965) [`2dca307`](withastro/astro@2dca307) Thanks [@matthewp](https://github.com/matthewp)! - Fixes client hydration for components imported through Node.js subpath imports (`package.json#imports`, e.g. `#components/*`), for example when using the Cloudflare adapter in development. - [#15770](withastro/astro#15770) [`6102ca2`](withastro/astro@6102ca2) Thanks [@jpc-ae](https://github.com/jpc-ae)! - Updates the `create astro` welcome message to highlight the graceful dev/preview server quit command rather than the kill process shortcut - [#15953](withastro/astro#15953) [`7eddf22`](withastro/astro@7eddf22) Thanks [@Desel72](https://github.com/Desel72)! - fix(hmr): eagerly recompile on style-only change to prevent stale slots render - [#15916](withastro/astro#15916) [`5201ed4`](withastro/astro@5201ed4) Thanks [@trueberryless](https://github.com/trueberryless)! - Fixes `InferLoaderSchema` type inference for content collections defined with a loader that includes a `schema` - [#15864](withastro/astro#15864) [`d3c7de9`](withastro/astro@d3c7de9) Thanks [@florian-lefebvre](https://github.com/florian-lefebvre)! - Removes temporary support for Node >=20.19.1 because Stackblitz now uses Node 22 by default - [#15944](withastro/astro#15944) [`a5e1acd`](withastro/astro@a5e1acd) Thanks [@fkatsuhiro](https://github.com/fkatsuhiro)! - Fixes SSR dynamic routes with `.html` extension (e.g. `[slug].html.astro`) not working - [#15937](withastro/astro#15937) [`d236245`](withastro/astro@d236245) Thanks [@ematipico](https://github.com/ematipico)! - Fixes an issue where HMR didn't correctly work on Windows when adding/changing/deleting routes in `pages/`. - [#15931](withastro/astro#15931) [`98dfb61`](withastro/astro@98dfb61) Thanks [@Strernd](https://github.com/Strernd)! - Fix skew protection query params not being applied to island hydration `component-url` and `renderer-url`, and ensure query params are appended safely for asset URLs with existing search/hash parts. - Updated dependencies \[]: - [@astrojs/markdown-remark](https://github.com/astrojs/markdown-remark)@7.0.1 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Co-authored-by: Renovate Bot <renovate@zarantonello.dev> Co-committed-by: Renovate Bot <renovate@zarantonello.dev>

github-actions bot added the pkg: astro Related to the core `astro` package (scope) label Mar 16, 2026

Strernd marked this pull request as ready for review March 16, 2026 13:30

Strernd added 3 commits March 17, 2026 08:52

fix(core): fix skew protection for island hydration URLs

dfdbff6

refactor(core): parse asset links with URL in createAssetLink

85cf3de

chore: add changeset for skew protection fix

22461e2

Strernd force-pushed the fix-skew-protection-island-hydration-urls branch from 01ac7a7 to 22461e2 Compare March 17, 2026 07:54

chore: trigger CI rerun

3fb9be3

matthewp approved these changes Mar 17, 2026

View reviewed changes

matthewp merged commit 98dfb61 into withastro:main Mar 17, 2026
26 checks passed

astrobot-houston mentioned this pull request Mar 17, 2026

[ci] release #15938

Merged

philipprothmann2iterate mentioned this pull request Mar 17, 2026

Skew protection assetQueryParams not applied to hoisted scripts and inter-chunk JS imports (Vercel) #15964

Closed

1 task

tmimmanuel mentioned this pull request Mar 26, 2026

fix(core): append assetQueryParams to inter-chunk JS imports (#15964) #16110

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(core): fix Vercel skew protection bug for island hydration URLs#15931

fix(core): fix Vercel skew protection bug for island hydration URLs#15931
matthewp merged 4 commits intowithastro:mainfrom
Strernd:fix-skew-protection-island-hydration-urls

Strernd commented Mar 16, 2026 •

edited

Loading

Uh oh!

changeset-bot bot commented Mar 16, 2026 •

edited

Loading

Uh oh!

codspeed-hq bot commented Mar 16, 2026 •

edited

Loading

Uh oh!

matthewp commented Mar 16, 2026

Uh oh!

Strernd commented Mar 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Strernd commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Reproduction

Changes

Testing

Context

Uh oh!

changeset-bot bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

codspeed-hq bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

matthewp commented Mar 16, 2026

Uh oh!

Strernd commented Mar 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Strernd commented Mar 16, 2026 •

edited

Loading

changeset-bot bot commented Mar 16, 2026 •

edited

Loading

codspeed-hq bot commented Mar 16, 2026 •

edited

Loading