Astro 6.3

Astro 6.3, released today, introduces experimental advanced routing that gives developers full control over the request pipeline, along with support for external image URL redirects and a security-focused change to SVG processing.

Experimental Advanced Routing

The headline feature in Astro 6.3 is experimental advanced routing. Previously, Astro ran middleware, actions, i18n, and rendering in a fixed order. For most projects that works fine, but as applications grow, developers often need to insert custom logic — authentication, logging, rate limiting, or platform-specific handlers — at specific points in the pipeline. The new system exposes each step as an individual handler, letting you compose them in any order.

Astro 6.3 supports two patterns for this: the fetch handler pattern used by Cloudflare Workers, Deno, and Bun, and first-class integration with the lightweight Hono framework. You can proxy certain paths to another service while letting Astro handle the rest:

import { FetchState, astro } from 'astro/fetch';

export default {
  fetch(request: Request) {
    const state = new FetchState(request);
    if (state.url.pathname.startsWith('/api')) {
      return fetch(new URL(state.url.pathname, 'https://api.example.com'));
    }
    return astro(state);
  }
};

With Hono, you can mix your own middleware with Astro's handlers in the exact order you choose:

import { Hono } from 'hono';
import { logger } from 'hono/logger';
import { actions, middleware, pages, i18n } from 'astro/hono';

const app = new Hono();

app.use(logger());
app.use(async (c, next) => {
  if (new URL(c.req.url).pathname.startsWith('/admin')) {
    return c.redirect('/login');
  }
  return next();
});

app.use(actions());
app.use(middleware());
app.use(pages());
app.use(i18n());

export default app;

Available handlers exported from both astro/fetch and astro/hono include: astro, trailingSlash, redirects, sessions, actions, middleware, pages, cache, and i18n.

Support for external image URL redirects

When optimizing remote images, Astro previously failed silently if the image URL returned a redirect. This was a problem for CDNs and image services that use redirects to route requests to the correct edge node or storage bucket — images would simply disappear from the build without explanation.

Astro 6.3 now follows up to 10 redirects when fetching remote images. Every URL in the redirect chain is validated against your image.remotePatterns and image.domains configuration. If a redirect leads to a host not in your allowlist, Astro throws a helpful error instead of silently ignoring the image.

import { defineConfig } from "astro/config";

export default defineConfig({
  image: {
    domains: ["example.com", "cdn.example.com"]
  }
});

If you trust all HTTPS hosts, you can allow them with a single remote pattern:

import { defineConfig } from "astro/config";

export default defineConfig({
  image: {
    remotePatterns: [{ protocol: 'https' }]
  }
});

SVG image processing disabled by default

Astro's Sharp image service can rasterize SVG files into other formats like PNG or WebP. However, this runs librsvg under the hood, and SVG files can contain embedded scripts and other active content. Processing untrusted SVGs this way is a potential security risk.

Starting in Astro 6.3, SVG image processing is disabled by default. If you pass an SVG source to the image optimization pipeline, Astro will now throw a helpful error instead of silently processing it. If you trust your SVG sources and want to restore the previous behavior, set the new image.dangerouslyProcessSVG option:

import { defineConfig } from "astro/config";

export default defineConfig({
  image: {
    dangerouslyProcessSVG: true,
  }
});

This change does not affect importing SVGs as components. It only applies to rasterizing SVG sources through the image optimization pipeline (e.g. converting an SVG to PNG via <Image />).

Other improvements

A new consume() method for AstroCookies marks cookies as consumed and returns the Set-Cookie header values. After consumption, any subsequent set() calls will log a warning since the headers have already been sent. This replaces the static AstroCookies.consume(cookies) method, which is now deprecated but kept for backward compatibility with existing adapters.

How to upgrade

To upgrade an existing project, use the automated @astrojs/upgrade CLI tool:

npx @astrojs/upgrade

Or upgrade manually:

npm install astro@latest
pnpm upgrade astro --latest
yarn upgrade astro --latest

Bottom line

Astro 6.3's experimental advanced routing is the most significant change here for developers building complex, data-driven applications. The ability to compose handlers in any order — and to bring in Hono — removes a long-standing limitation of Astro's fixed pipeline. The image redirect fix and SVG security change are smaller but welcome quality-of-life improvements.