fix(svg): track inline styles for CSP by ematipico · Pull Request #15933 · withastro/astro

ematipico · 2026-03-16T11:31:46Z

Changes

We now track the style tags inside the SVG elements, and we pass them to createSvgComponent.

If there are styles, we pass the propagation hint so that we can write styles in the end, and correctly generate and track CSP hashes.

Testing

Added a new test, existing tests should pass

Docs

N/A

changeset-bot · 2026-03-16T11:31:58Z

🦋 Changeset detected

Latest commit: 3ecf45e

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Princesseuh · 2026-03-16T11:36:59Z

packages/astro/src/assets/runtime.ts

+	const Component = createComponent({
+		async factory(result: SSRResult, props: Record<string, any>) {
+			const normalizedProps = normalizeProps(attributes, props);
+			const svgContent = render`<svg${spreadAttributes(normalizedProps)}>${unescapeHTML(children)}</svg>`;


won't this cause the styles to be twice in the page? Because the style tag will still be inside the SVG?

True. I rebased the PR and it should be fixed now

codspeed-hq · 2026-03-16T11:48:29Z

Merging this PR will improve performance by 10.19%

⚠️

Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
✅ 17 untouched benchmarks

Performance Changes

	Mode	Benchmark	`BASE`	`HEAD`	Efficiency
⚡	Simulation	`Build: hybrid site (static + server)`	8.8 s	8 s	+10.19%

_{Comparing fix/csp-head-propagation (3ecf45e) with main (23d5244)}

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@astrojs/check](https://github.com/withastro/astro/tree/main/packages/language-tools/astro-check) ([source](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check)) | [`0.9.7` → `0.9.8`](https://renovatebot.com/diffs/npm/@astrojs%2fcheck/0.9.7/0.9.8) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@astrojs%2fcheck/0.9.8?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@astrojs%2fcheck/0.9.7/0.9.8?slim=true) | | [astro](https://astro.build) ([source](https://github.com/withastro/astro/tree/HEAD/packages/astro)) | [`6.0.4` → `6.0.5`](https://renovatebot.com/diffs/npm/astro/6.0.4/6.0.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/astro/6.0.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/astro/6.0.4/6.0.5?slim=true) | --- ### Release Notes <details> <summary>withastro/astro (@astrojs/check)</summary> ### [`v0.9.8`](https://github.com/withastro/astro/blob/HEAD/packages/language-tools/astro-check/CHANGELOG.md#098) [Compare Source](https://github.com/withastro/astro/compare/@astrojs/check@0.9.7...@astrojs/check@0.9.8) ##### Patch Changes - [#15892](withastro/astro#15892) [`a2f597d`](withastro/astro@a2f597d) Thanks [@Princesseuh](https://github.com/Princesseuh)! - Fixes Astro not being able to find astro check sometimes - Updated dependencies \[[`7b4b254`](withastro/astro@7b4b254)]: - [@astrojs/language-server](https://github.com/astrojs/language-server)@2.16.5 </details> <details> <summary>withastro/astro (astro)</summary> ### [`v6.0.5`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#605) [Compare Source](https://github.com/withastro/astro/compare/astro@6.0.4...astro@6.0.5) ##### Patch Changes - [#15891](withastro/astro#15891) [`b889231`](withastro/astro@b889231) Thanks [@matthewp](https://github.com/matthewp)! - Fix dev routing for `server:defer` islands when adapters opt into handling prerendered routes in Astro core. Server island requests are now treated as prerender-handler eligible so prerendered pages using `prerenderEnvironment: 'node'` can load island content without `400` errors. - [#15890](withastro/astro#15890) [`765a887`](withastro/astro@765a887) Thanks [@matthewp](https://github.com/matthewp)! - Fixes `astro:actions` validation to check resolved routes, so projects using default static output with at least one `prerender = false` page or endpoint no longer fail during startup. - [#15884](withastro/astro#15884) [`dcd2c8e`](withastro/astro@dcd2c8e) Thanks [@matthewp](https://github.com/matthewp)! - Avoid a `MaxListenersExceededWarning` during `astro dev` startup by increasing the shared Vite watcher listener limit when attaching content server listeners. - [#15904](withastro/astro#15904) [`23d5244`](withastro/astro@23d5244) Thanks [@jlukic](https://github.com/jlukic)! - Emit the `before-hydration` script chunk for the `client` Vite environment. The chunk was only emitted for `prerender` and `ssr` environments, causing a 404 when browsers tried to load it. This broke hydration for any integration using `injectScript('before-hydration', ...)`, including Lit SSR. - [#15933](withastro/astro#15933) [`325901e`](withastro/astro@325901e) Thanks [@ematipico](https://github.com/ematipico)! - Fixes an issue where `<style>` tags inside SVG components weren't correctly tracked when enabling CSP. - [#15875](withastro/astro#15875) [`c43ef8a`](withastro/astro@c43ef8a) Thanks [@matthewp](https://github.com/matthewp)! - Ensure custom prerenderers are always torn down during build, even when `getStaticPaths()` throws. - [#15887](withastro/astro#15887) [`1861fed`](withastro/astro@1861fed) Thanks [@ematipico](https://github.com/ematipico)! - Fixes an issue where the build incorrectly leaked server entrypoint into the client environment, causing adapters to emit warnings during the build. - [#15888](withastro/astro#15888) [`925252e`](withastro/astro@925252e) Thanks [@matthewp](https://github.com/matthewp)! - Fix a bug where `server:defer` could fail at runtime in prerendered pages for some adapters (including Cloudflare), causing errors like `serverIslandMap?.get is not a function`. - [#15901](withastro/astro#15901) [`07c1002`](withastro/astro@07c1002) Thanks [@delucis](https://github.com/delucis)! - Fixes JSON schema generation for content collection schemas that have differences between their input and output shapes. - [#15882](withastro/astro#15882) [`759f946`](withastro/astro@759f946) Thanks [@matthewp](https://github.com/matthewp)! - Fix `Astro.url.pathname` for the root page when using `build.format: "file"` so it resolves to `/index.html` instead of `/.html` during builds. </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Co-authored-by: Renovate Bot <renovate@zarantonello.dev> Co-committed-by: Renovate Bot <renovate@zarantonello.dev>

github-actions bot added the pkg: astro Related to the core `astro` package (scope) label Mar 16, 2026

Princesseuh reviewed Mar 16, 2026

View reviewed changes

fix(svg): track inline styles for CSP

3ecf45e

ematipico force-pushed the fix/csp-head-propagation branch from 08f8d5d to 3ecf45e Compare March 16, 2026 11:41

ematipico requested a review from Princesseuh March 16, 2026 11:41

matthewp approved these changes Mar 16, 2026

View reviewed changes

Princesseuh approved these changes Mar 16, 2026

View reviewed changes

ematipico merged commit 325901e into main Mar 16, 2026
26 checks passed

ematipico deleted the fix/csp-head-propagation branch March 16, 2026 13:20

astrobot-houston mentioned this pull request Mar 16, 2026

[ci] release #15889

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(svg): track inline styles for CSP#15933

fix(svg): track inline styles for CSP#15933
ematipico merged 1 commit intomainfrom
fix/csp-head-propagation

ematipico commented Mar 16, 2026

Uh oh!

changeset-bot bot commented Mar 16, 2026 •

edited

Loading

Uh oh!

Princesseuh Mar 16, 2026

Uh oh!

ematipico Mar 16, 2026

Uh oh!

codspeed-hq bot commented Mar 16, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

ematipico commented Mar 16, 2026

Changes

Testing

Docs

Uh oh!

changeset-bot bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Princesseuh Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

ematipico Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

codspeed-hq bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will improve performance by 10.19%

Performance Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

changeset-bot bot commented Mar 16, 2026 •

edited

Loading

codspeed-hq bot commented Mar 16, 2026 •

edited

Loading