v1.4.0

Added

• Metadata demo: Localized homepage examples link to generated site files and emit matching FAQPage data; demo team credits and a German RSS feed demonstrate additional site-files outputs.
• Site files: Blog llms.txt sections are generated from published article frontmatter in both languages.
• Contributors: e2e/starter/csp.spec.ts and e2e/blog/csp.spec.ts (helpers in e2e/shared/csp.ts) fail on any CSP violation and on an executable inline script before the CSP meta.

Changed

• Accessibility: Expanded automated axe checks to WCAG 2.2 AA.
• Build audit: @casoon/astro-post-audit 0.10.0 — html_validation runs much faster, AAA-only findings are reported once per element pattern, and the WebSite search-action hint is no longer reported; errors and warnings on both apps are unchanged.
• Dependencies: Updated workspace packages and Biome configuration; TypeScript stays on 6 because Astro check does not yet support 7, and Node types stay on 24 to match the runtime.
• Dependencies: @casoon/astro-structured-data 2.4.1, @casoon/astro-site-files 0.7.2, @casoon/astro-speed-measure 0.4.1, @casoon/astro-webvitals 0.4.11 and @casoon/nosecrets 0.3.9 — all published with npm provenance via Trusted Publishing; structured-data streams on-demand pages and fixes mainEntityOfPage and rewrite handling.

Fixed

• CSP: No page shipped a Content Security Policy, because csp sat at the top level of the shared Astro config, which Astro 7 silently ignores. It now lives under security.csp with explicit directives; projects created from the template should move their csp block the same way.
• CSP: The theme script ran inline before the CSP <meta> (outside the policy); it moved to public/theme-init.js in each app.
• Blog: Sitemap entries retain the full path of nested post slugs.
• Navigation: The logo returns to the homepage in the current language.
• SEO: Page languages now drive Open Graph locale and hreflang tags; articles include linked publisher IDs, keywords, image dimensions and reading statistics.
• Site files: Removed nonexistent archive links from llms.txt and duplicate blog sitemap sources; duplicate URLs now fail the build.

Security

• Dependencies: Updated vulnerable dependencies (including fast-xml-parser under @astrojs/rss) and added scoped overrides for Undici 7 and the typography selector parser. pnpm audit still lists one low-severity advisory for deepmerge in the Svelte Vite plugin (build-time only), for which no fixed version is published yet.

v1.3.5

Changed

• CI: timeout-minutes: 15 on the job and a concurrency group — a new push to a PR cancels its outdated run, runs on main/master always finish.
• scripts-info descriptions in package.json are in English.

Added

• README links the product website (astro-template.casoon.de) next to the live demos.
• README tip on opi under "Available Scripts".

Live demos: Starter · Blog

v1.3.4

Changed

• Volta pins Node.js 24.21.0 (latest Node 24 LTS, was 24.14.1); minimum stays >=22.12.0 like Astro's own engines.
• CI uses actions/checkout@v6 and actions/upload-artifact@v6 — the Node 24 runtimes — instead of the deprecated Node 20 @v4 versions.

Fixed

• OG image generation could fail with "Unsupported OpenType signature": the scripts passed fontData.buffer, the whole backing ArrayBuffer of a Node Buffer, ignoring its offset. generateOgImage() now takes the Buffer itself.

Live demos: Starter · Blog

v1.3.3

Added

• Unit tests for the shared utilities (pnpm test:unit, Node's built-in test runner), also run in CI.

Fixed

• shared was never type-checked (no type-check script), so missing Node types in shared/src/config/astro.ts went unnoticed. shared now runs tsc --noEmit as part of pnpm type-check, with @types/node as a dev dependency.

Changed

• Translation keys are typed: de.ts must match the keys of en.ts, and t(locale) only accepts known keys — missing or misspelled keys fail astro check instead of rendering the key name.
• The blog build fails when a published post is missing in a locale (the sitemap would otherwise advertise hreflang alternates that 404).
• Sessions are disabled (session: false); the unused SESSION KV binding and SessionData type are removed.
• JSON-LD now fills the recommended fields (Organization logo/contact/address/sameAs, WebPage dates/author/image, BlogPosting publisher logo) from a demo profile in shared/src/config/site.ts (example.com, 555-01xx) plus a logo.svg per app — no more structured-data warnings in the build.
• Starter hero subtitle uses text-balance (no orphaned last word).
• README deploy checklist: add rate limiting or Turnstile once the contact form actually sends mail.

Live demos: Starter · Blog

v1.3.2

Added

• Web Vitals RUM showcase with a typed, batch-reporting endpoint and Playwright coverage for payload validation and browser transport.
• Sitemap RUM test mode that opens every sitemap URL and verifies that it reports browser metrics.
• Local Web Vitals dashboard route backed by browser storage.
• Documentation explaining the complementary static Post-Audit and field Web Vitals checks.
• German blog posts (src/content/blog/de/) with their own OG images and sitemap lastmod.
• Contact form honeypot and a deliverContactMessage() hook; without a provider the page shows a demo notice instead of claiming the message was sent.
• PUBLIC_SECURITY_CONTACT env var for security.txt (with rolling Expires).
• Shared Astro base config in shared/src/config/astro.ts.

Fixed

• Contact form submission returned 405 in production: the contact pages were prerendered, and not_found_handling = "404-page" answered browser navigations to on-demand routes with the 404 page. Contact pages are now rendered on request and the starter no longer sets not_found_handling.
• Blog posts still referred to Astro v6.
• German blog pages rendered English post bodies.
• Starter "Astro v7" feature card described v6 features; blog footer lost the space before "RSS Feed" (compressHTML: 'jsx').
• PUBLIC_* values from an app's .env were ignored in astro.config.mjs (Vite loads the config with the VITE_ prefix), so site, canonical URLs and the sitemap always used the defaults. The config now reads .env via configEnv().

Changed

• Blog posts moved to one folder per locale; titleDe/descriptionDe frontmatter removed.

• Starter wrangler.toml no longer pins a KV namespace id or custom domain.

• Starter E2E tests run against wrangler dev instead of a static file server.

• Default PUBLIC_SITE_URL: starter https://astro-v7-template.casoon.dev (the live demo), blog https://astro-v7-blog.casoon.dev (both live demos; astrov7.casoon.dev / astrov7blog.casoon.dev no longer resolve).

• Dependencies: astro 7.3.5, @astrojs/cloudflare 14.3.3, @casoon/astro-post-audit 0.7.0, zod 4.6.5, wrangler 4.140, Biome 2.5.14.

• The Web Vitals endpoint is platform-independent; Cloudflare Analytics Engine is no longer required.

• Starter pages share a dedicated layout that applies Web Vitals consistently.

• The starter now uses @casoon/astro-webvitals 0.4.8 with browser-local page checks alongside the sitemap QA pass.

• pnpm audit:pages and pnpm audit:pages:dev print the sitemap page-check results in the terminal.

Live demos: Starter · Blog