fix(astro): Fix `isHTMLString` check failing in multi-realm environments by rururux · Pull Request #16142 · withastro/astro

rururux · 2026-03-29T11:26:49Z

Changes

When using the Astro Container API, passing child elements to a component inside an MDX file could cause those elements to be incorrectly escaped.
This happened because the value instanceof HTMLString check in the isHTMLString function failed to recognize the HTMLString instance correctly.

astro/packages/astro/src/runtime/server/escape.ts

Lines 50 to 52 in 0d24e3b

    
           export function isHTMLString(value: any): value is HTMLString { 
        
           	return value instanceof HTMLString; 
        
           }

(if(isHTMLString(child)) does not evaluate to true, so the program proceeds to the next if statement)

Following Erika’s suggestion, I have updated the logic to check for the presence of Symbol.for('astro:html-string') instead of using instanceof HTMLString.

Testing

Added a test to verify that child elements passed to a component inside an MDX file are not incorrectly escaped.

Docs

N/A, bug fix

changeset-bot · 2026-03-29T11:26:55Z

🦋 Changeset detected

Latest commit: e97d963

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

codspeed-hq · 2026-03-29T11:44:26Z

Merging this PR will not alter performance

✅ 18 untouched benchmarks

_{Comparing rururux:mdx-escape-issue (e97d963) with main (a7e7567)}

packages/astro/src/runtime/server/escape.ts

rururux · 2026-03-31T08:58:28Z

I’ve made a few changes.

Following Erika’s suggestion, I’ve changed the method to use Symbol.for(...) for the check instead of Symbol.toStringTag.
As a result, Symbol.toStringTag is no longer used in the HTMLString class, so I’ve removed it.
I found a check for value instanceof HTMLString in markHTMLString, so I changed it to use isHTMLString instead.
I’ve simplified the structure of the test fixture. I’ve confirmed that the test fails as it did with the previous test fixture before the change to the isHTMLString check logic.

Princesseuh · 2026-03-31T09:27:14Z

Did you get to see if adding virtual: to the server-app module name fixes this without requiring changes to HTMLString?

rururux · 2026-03-31T10:51:10Z

I just tested this, and confirmed that even if I change ASTRO_DEV_SERVER_APP_ID to "virtual:astro:server-app", the tests I added this time will not pass unless I apply this PRs change.
I also confirmed that the error with the <Steps> component we discussed on Discord still occurs without this change.

~~However, regarding the <Steps> component, HMR stopped working properly after this error and the astro:server-app error were resolved, so the issue hasn’t been fully resolved.~~

rururux · 2026-03-31T11:35:24Z

It seems that HMR not working when editing MDX files is by design, my apologies.
So, I think the issue with the <Steps> component can be fixed simply by applying the changes in this PR and updating “virtual:astro:server-app”.

rururux · 2026-04-01T13:12:19Z

Just to follow up on the HMR mention, by "HMR," I specifically meant changes being applied without a full page reload.
The automatic full reload is still working perfectly fine, so there's no issue with the changes being applied.

packages/astro/src/runtime/server/escape.ts

ematipico · 2026-04-01T13:44:28Z

.changeset/jolly-ideas-sell.md

+'astro': patch
+---
+
+Fix HTML escaping in `renderToString` for MDX slots during build


Can you reword the changeset to be more user-centric? https://contribute.docs.astro.build/docs-for-code-changes/changesets/#tips-and-examples

I've updated the changeset. does this look good to you?

ematipico · 2026-04-01T15:20:25Z

.changeset/jolly-ideas-sell.md

+'astro': patch
+---
+
+Fixes HTML content being incorrectly escaped as plain text due to a failed `isHTMLString` check


Suggested change

Fixes HTML content being incorrectly escaped as plain text due to a failed `isHTMLString` check

Fixes HTML content being incorrectly escaped as plain text when rendering a MDX component using the `AstroContainer` APIs.

cc @rururux for future reference

I appreciate you tidying that up for me. Thanks for the reference!

rururux · 2026-04-01T15:32:47Z

Thank you! ☺️

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [astro](https://astro.build) ([source](https://github.com/withastro/astro/tree/HEAD/packages/astro)) | [`6.1.1` → `6.1.3`](https://renovatebot.com/diffs/npm/astro/6.1.1/6.1.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/astro/6.1.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/astro/6.1.1/6.1.3?slim=true) | --- ### Release Notes <details> <summary>withastro/astro (astro)</summary> ### [`v6.1.3`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#613) [Compare Source](https://github.com/withastro/astro/compare/astro@6.1.2...astro@6.1.3) ##### Patch Changes - [#16161](withastro/astro#16161) [`b51f297`](withastro/astro@b51f297) Thanks [@matthewp](https://github.com/matthewp)! - Fixes a dev rendering issue with the Cloudflare adapter where head metadata could be missing and dev CSS/scripts could be injected in the wrong place - [#16110](withastro/astro#16110) [`de669f0`](withastro/astro@de669f0) Thanks [@tmimmanuel](https://github.com/tmimmanuel)! - Fixes skew protection query parameters not being appended to inter-chunk JavaScript imports in client bundles, which could cause version mismatches during rolling deployments on Vercel - [#16162](withastro/astro#16162) [`a0a49e9`](withastro/astro@a0a49e9) Thanks [@rururux](https://github.com/rururux)! - Fixes an issue where HMR would not trigger when modifying files while using [@astrojs/cloudflare](https://github.com/astrojs/cloudflare) with prerenderEnvironment: 'node' enabled. - [#16142](withastro/astro#16142) [`7454854`](withastro/astro@7454854) Thanks [@rururux](https://github.com/rururux)! - Fixes HTML content being incorrectly escaped as plain text when rendering a MDX component using the `AstroContainer` APIs. - [#16116](withastro/astro#16116) [`12602a9`](withastro/astro@12602a9) Thanks [@riderx](https://github.com/riderx)! - Fixes a bug where page-level CSS could leak between unrelated pages when traversing style parents across top-level route boundaries - [#16178](withastro/astro#16178) [`a7e7567`](withastro/astro@a7e7567) Thanks [@matthewp](https://github.com/matthewp)! - Fixes SSR builds failing with "No matching renderer found" when a project only has injected routes and no `src/pages/` directory ### [`v6.1.2`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#612) [Compare Source](https://github.com/withastro/astro/compare/astro@6.1.1...astro@6.1.2) ##### Patch Changes - [#16104](withastro/astro#16104) [`47a394d`](withastro/astro@47a394d) Thanks [@matthewp](https://github.com/matthewp)! - Fixes `astro preview` ignoring `vite.preview.allowedHosts` set in `astro.config.mjs` - [#16047](withastro/astro#16047) [`711f837`](withastro/astro@711f837) Thanks [@matthewp](https://github.com/matthewp)! - Fixes catch-all routes incorrectly intercepting requests for static assets when using the `@astrojs/node` adapter in middleware mode. - [#15981](withastro/astro#15981) [`a60cbb6`](withastro/astro@a60cbb6) Thanks [@moktamd](https://github.com/moktamd)! - Fix Zod v4 validation error formatting to show human-readable messages instead of raw JSON </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Co-authored-by: Renovate Bot <renovate@zarantonello.dev> Co-committed-by: Renovate Bot <renovate@zarantonello.dev>

fix(container): don't escape slot HTML in renderToString during build

4d2ab05

github-actions bot added pkg: integration Related to any renderer integration (scope) pkg: astro Related to the core `astro` package (scope) labels Mar 29, 2026

rururux added 2 commits March 29, 2026 21:09

performance issue

a375995

oops

ae1a48b

Princesseuh reviewed Mar 30, 2026

View reviewed changes

packages/astro/src/runtime/server/escape.ts Outdated Show resolved Hide resolved

rururux added 6 commits March 31, 2026 17:21

apply Erika's suggestion

9208800

use isHTMLString within markHTMLString

a023285

simplify test fixtures

1ff1de2

format

b6724c6

remove the no longer used Symbol.toStringTag from HTMLString

e02f949

Merge branch 'main' into mdx-escape-issue

98bd4fe

rururux changed the title ~~fix(container): don't escape slot HTML in renderToString during build~~ fix(astro): Fix isHTMLString check failing in multi-realm environments Mar 31, 2026

Merge branch 'main' into mdx-escape-issue

047a96d

ematipico reviewed Apr 1, 2026

View reviewed changes

rururux added 2 commits April 1, 2026 23:21

rename to htmlStringSymbol

0483c18

update changeset

f0f0ee0

ematipico approved these changes Apr 1, 2026

View reviewed changes

ematipico reviewed Apr 1, 2026

View reviewed changes

Apply suggestion from @ematipico

e97d963

ematipico merged commit 7454854 into withastro:main Apr 1, 2026
12 checks passed

astrobot-houston mentioned this pull request Apr 1, 2026

[ci] release #16159

Merged

rururux deleted the mdx-escape-issue branch April 1, 2026 15:32

scalebloom mentioned this pull request Apr 3, 2026

Astro 6.1.3: Vite chunk hash placeholders unresolved on Linux, breaking Netlify SSR builds #16209

Closed

	export function isHTMLString(value: any): value is HTMLString {
	return value instanceof HTMLString;
	}

	Fixes HTML content being incorrectly escaped as plain text due to a failed `isHTMLString` check
	Fixes HTML content being incorrectly escaped as plain text when rendering a MDX component using the `AstroContainer` APIs.

Uh oh!

Conversation

rururux commented Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Testing

Docs

Uh oh!

changeset-bot bot commented Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

codspeed-hq bot commented Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

Uh oh!

rururux commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Princesseuh commented Mar 31, 2026

Uh oh!

rururux commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rururux commented Mar 31, 2026

Uh oh!

rururux commented Apr 1, 2026

Uh oh!

Uh oh!

ematipico Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rururux Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

ematipico Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rururux Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rururux commented Apr 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rururux commented Mar 29, 2026 •

edited

Loading

changeset-bot bot commented Mar 29, 2026 •

edited

Loading

codspeed-hq bot commented Mar 29, 2026 •

edited

Loading

rururux commented Mar 31, 2026 •

edited

Loading

rururux commented Mar 31, 2026 •

edited

Loading

ematipico Apr 1, 2026 •

edited

Loading

ematipico Apr 1, 2026 •

edited

Loading