Astro 7.1 Adds Built-in CSP Support and Pagination URL Fixes
Astro 7.1 ships first-class Content Security Policy support with granular script and style directives, so you can tighten your policy without the classic migration pain.
Astro 7.1 shipped July 16 with first-class Content Security Policy support. You configure it under security.csp in astro.config.mjs, and the framework emits the policy header and nonces. No more maintaining a raw string that breaks on every inline script you add.
Granularity is the point. 7.1 supports four specialized directives: script-src-elem, script-src-attr, style-src-elem, and style-src-attr. You can allow inline styles while keeping a strict external stylesheet policy, or permit attribute-level handlers without letting arbitrary script elements run. The coarse script-src bucket forced you to loosen everything to keep one feature working; the granular directives let you tighten the policy without the painful migration.
paginate() gains a format function that transforms generated URLs. That fixes the mismatch with build: { format: 'file' }, where /blog/2 did not map to files on disk. If you use file output, pagination links now resolve to real pages instead of routes that 404.
The rest is smaller. The glob() loader gets deferRender to skip Markdown rendering during sync for lower memory, and astro dev --ignore-lock runs a second dev server without lock file contention. If you have been deferring a Content Security Policy because of the migration cost, 7.1 removes the excuse.