fix(core): append assetQueryParams to inter-chunk JS imports (#15964) by tmimmanuel · Pull Request #16110 · withastro/astro

tmimmanuel · 2026-03-26T20:13:28Z

Changes

Fixes Case 3 from Skew protection assetQueryParams not applied to hoisted scripts and inter-chunk JS imports (Vercel) #15964: inter-chunk JS imports inside client bundles were missing assetQueryParams (e.g., ?dpl=<VERCEL_DEPLOYMENT_ID>), breaking Vercel skew protection for code-split apps
Adds a new Vite renderChunk plugin (plugin-chunk-imports.ts) that rewrites relative import paths in client chunks to include the configured query parameters
Plugin only runs on client chunks, and is a complete no-op when assetQueryParams is not configured
PR fix(core): fix Vercel skew protection bug for island hydration URLs #15931 fixed island hydration URLs and hoisted scripts (Cases 1 & 2) but could not reach imports baked inside compiled JS — this PR completes the fix

Before:

import{g as t}from"./shared.DuaLvmHQ.js"

After:

import{g as t}from"./shared.DuaLvmHQ.js?dpl=deploy-abc123"

Closes #15964

Testing

New test: appends assetQueryParams to relative imports inside client JS chunks
All 5 existing asset-query-params tests pass
Built JS chunks verified to contain ?dpl= on relative from"./..." imports
Plugin is a no-op when no assetQueryParams configured (no regression for non-Vercel builds)

Docs

No docs changes needed.

changeset-bot · 2026-03-26T20:13:35Z

🦋 Changeset detected

Latest commit: ebf6975

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

matthewp · 2026-03-26T20:28:06Z

can we use es-module-lexer for this? we already use it in some places like here:

astro/packages/integrations/mdx/src/vite-plugin-mdx-postprocess.ts

Line 4 in 23d60de

import {

Definitely want to make sure we're getting both static and dynamic imports.

codspeed-hq · 2026-03-26T20:30:43Z

Merging this PR will not alter performance

✅ 18 untouched benchmarks

_{Comparing tmimmanuel:fix/skew-protection-inter-chunk-imports (ebf6975) with main (47a394d)¹}

No successful run was found on main (15f1649) during the generation of this report, so 47a394d was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

tmimmanuel · 2026-03-26T20:46:09Z

can we use es-module-lexer for this? we already use it in some places like here:

astro/packages/integrations/mdx/src/vite-plugin-mdx-postprocess.ts

Line 4 in 23d60de

import {

Definitely want to make sure we're getting both static and dynamic imports.

@matthewp Thanks for the review! I'll refactor to use es-module-lexer instead of regex — makes sense to keep it consistent with the rest of the codebase. Will update the PR shortly.

…ro#15964)

tmimmanuel · 2026-03-27T15:37:44Z

Hi, @matthewp
I think current test failures are not from my code change.
Can you review again please? Thanks. 🙏

matthewp · 2026-03-30T14:03:40Z

No it's a flaky test, I'll rerun it.

matthewp · 2026-03-30T14:04:17Z

Fixes #14775

tmimmanuel · 2026-03-30T14:29:56Z

Hi @matthewp
Thanks for your review. CI tests are passed. Please review again.

matthewp · 2026-03-30T15:11:12Z

@tmimmanuel Code looks good, can you add a changeset? pnpm run changeset. This page explains how to write them: https://contribute.docs.astro.build/docs-for-code-changes/changesets/

tmimmanuel · 2026-03-30T20:54:22Z

@matthewp
I added a changeset and CI tests are passed. Please review again. Thanks.

tmimmanuel · 2026-03-31T16:10:03Z

@matthewp
I added a changeset and CI tests are passed. Can you review again please?

matthewp · 2026-03-31T16:17:13Z

packages/astro/src/core/build/plugins/plugin-chunk-imports.ts

+			await init;
+			const [imports] = parse(code);
+
+			// Filter to relative JS imports only


why filter to only relative imports?

I think Vite only generates relative paths for inter-chunk references in bundled output. But please let me know if there's a case I might be missing.

Ah yeah that's right, ok this is good.

tmimmanuel · 2026-03-31T17:35:38Z

@matthewp Thanks.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [astro](https://astro.build) ([source](https://github.com/withastro/astro/tree/HEAD/packages/astro)) | [`6.1.1` → `6.1.3`](https://renovatebot.com/diffs/npm/astro/6.1.1/6.1.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/astro/6.1.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/astro/6.1.1/6.1.3?slim=true) | --- ### Release Notes <details> <summary>withastro/astro (astro)</summary> ### [`v6.1.3`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#613) [Compare Source](https://github.com/withastro/astro/compare/astro@6.1.2...astro@6.1.3) ##### Patch Changes - [#16161](withastro/astro#16161) [`b51f297`](withastro/astro@b51f297) Thanks [@matthewp](https://github.com/matthewp)! - Fixes a dev rendering issue with the Cloudflare adapter where head metadata could be missing and dev CSS/scripts could be injected in the wrong place - [#16110](withastro/astro#16110) [`de669f0`](withastro/astro@de669f0) Thanks [@tmimmanuel](https://github.com/tmimmanuel)! - Fixes skew protection query parameters not being appended to inter-chunk JavaScript imports in client bundles, which could cause version mismatches during rolling deployments on Vercel - [#16162](withastro/astro#16162) [`a0a49e9`](withastro/astro@a0a49e9) Thanks [@rururux](https://github.com/rururux)! - Fixes an issue where HMR would not trigger when modifying files while using [@astrojs/cloudflare](https://github.com/astrojs/cloudflare) with prerenderEnvironment: 'node' enabled. - [#16142](withastro/astro#16142) [`7454854`](withastro/astro@7454854) Thanks [@rururux](https://github.com/rururux)! - Fixes HTML content being incorrectly escaped as plain text when rendering a MDX component using the `AstroContainer` APIs. - [#16116](withastro/astro#16116) [`12602a9`](withastro/astro@12602a9) Thanks [@riderx](https://github.com/riderx)! - Fixes a bug where page-level CSS could leak between unrelated pages when traversing style parents across top-level route boundaries - [#16178](withastro/astro#16178) [`a7e7567`](withastro/astro@a7e7567) Thanks [@matthewp](https://github.com/matthewp)! - Fixes SSR builds failing with "No matching renderer found" when a project only has injected routes and no `src/pages/` directory ### [`v6.1.2`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#612) [Compare Source](https://github.com/withastro/astro/compare/astro@6.1.1...astro@6.1.2) ##### Patch Changes - [#16104](withastro/astro#16104) [`47a394d`](withastro/astro@47a394d) Thanks [@matthewp](https://github.com/matthewp)! - Fixes `astro preview` ignoring `vite.preview.allowedHosts` set in `astro.config.mjs` - [#16047](withastro/astro#16047) [`711f837`](withastro/astro@711f837) Thanks [@matthewp](https://github.com/matthewp)! - Fixes catch-all routes incorrectly intercepting requests for static assets when using the `@astrojs/node` adapter in middleware mode. - [#15981](withastro/astro#15981) [`a60cbb6`](withastro/astro@a60cbb6) Thanks [@moktamd](https://github.com/moktamd)! - Fix Zod v4 validation error formatting to show human-readable messages instead of raw JSON </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Co-authored-by: Renovate Bot <renovate@zarantonello.dev> Co-committed-by: Renovate Bot <renovate@zarantonello.dev>

github-actions bot added the pkg: astro Related to the core `astro` package (scope) label Mar 26, 2026

tmimmanuel closed this Mar 26, 2026

tmimmanuel reopened this Mar 26, 2026

fix(core): append assetQueryParams to inter-chunk JS imports (withast…

6256749

…ro#15964)

tmimmanuel force-pushed the fix/skew-protection-inter-chunk-imports branch from 1453e8d to 6256749 Compare March 26, 2026 21:22

matthewp mentioned this pull request Mar 30, 2026

Dynamic import produces "Importing a module script failed" #14775

Closed

1 task

Add changeset for inter-chunk skew protection fix

ebf6975

matthewp reviewed Mar 31, 2026

View reviewed changes

matthewp approved these changes Mar 31, 2026

View reviewed changes

matthewp merged commit de669f0 into withastro:main Mar 31, 2026
27 checks passed

tmimmanuel deleted the fix/skew-protection-inter-chunk-imports branch March 31, 2026 17:35

This was referenced Mar 31, 2026

[ci] release #16159

Merged

Problem after upgrading from Astro 5 to 6: imported scripts run twice when imported multiple times using the Netlify adapter #16173

Open

auroursa mentioned this pull request Apr 3, 2026

fix(astro): preserve quoted import specifiers when appending asset query params #16207

Open

scalebloom mentioned this pull request Apr 3, 2026

Astro 6.1.3: Vite chunk hash placeholders unresolved on Linux, breaking Netlify SSR builds #16209

Closed

github-actions bot mentioned this pull request Apr 7, 2026

fix(deps): update dependency astro to v6.1.3 lacolaco/blog.lacolaco.net#1446

Merged

1 task

jmurty mentioned this pull request Apr 8, 2026

Astro 6 + @astrojs/vercel SSR can fail on generated component script chunks with esbuild parse error ("Expected ':' but found ')'") #16258

Open

1 task

leifmarcus mentioned this pull request Apr 10, 2026

Dynamic imports are broken when using assetQueryParams in adapter #16279

Open

1 task

Uh oh!

Conversation

tmimmanuel commented Mar 26, 2026

Changes

Testing

Docs

Uh oh!

changeset-bot bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

matthewp commented Mar 26, 2026

Uh oh!

codspeed-hq bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

tmimmanuel commented Mar 26, 2026

Uh oh!

tmimmanuel commented Mar 27, 2026

Uh oh!

matthewp commented Mar 30, 2026

Uh oh!

matthewp commented Mar 30, 2026

Uh oh!

tmimmanuel commented Mar 30, 2026

Uh oh!

matthewp commented Mar 30, 2026

Uh oh!

tmimmanuel commented Mar 30, 2026

Uh oh!

tmimmanuel commented Mar 31, 2026

Uh oh!

matthewp Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

tmimmanuel Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

matthewp Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tmimmanuel commented Mar 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

changeset-bot bot commented Mar 26, 2026 •

edited

Loading

codspeed-hq bot commented Mar 26, 2026 •

edited

Loading