fix(templates): migrate Astro starter to v6.4.8 + Tailwind 4 (clears SSRF/XSS advisories)

.claude/test-fixtures/astro-hybrid.build-spec.json

@@ -11,7 +11,7 @@
     "capturedScreenshots": []
   },
   "appType": "web-app",
-  "framework": { "type": "astro", "version": "5.18.2", "outputDir": "src" },
+  "framework": { "type": "astro", "version": "6.4.8", "outputDir": "src" },
   "styling": { "approach": "tailwind", "uiLibrary": null, "existingTokens": false },
   "pages": [
     {

.gitignore

@@ -31,6 +31,7 @@ out/
 .output/
 .vercel/
 storybook-static/
+.astro/
 
 # Testing
 coverage/

docs/multi-framework/README.md

@@ -70,9 +70,9 @@ The intake skills (`figma-intake`, `canva-intake`, `screenshot-intake`) also ask
 - **Renderer:** `astro` (`language`/`outputTarget` = `react`)
 - **App type:** `web-app` — Astro produces standard web output (static HTML + optional SSR), so it uses the **`web-app`** app type in `pipeline.config.json`. App type describes the _kind_ of app (web-app / chrome-extension / pwa / react-native); the framework choice (Next.js / Vite / **Astro**) is the orthogonal `renderer`, owned by the renderer registry. `pipeline.config.json` recognizes Astro inputs via `astro.config.*` and `src/**/*.astro` in its cache categories.
 - **Scaffold:** `./scripts/setup-project.sh <name> --astro` copies `templates/astro/` (a complete starter) and installs it.
-- **Styling:** Tailwind CSS via `@astrojs/tailwind`
+- **Styling:** Tailwind CSS v4 via `@tailwindcss/vite`
 - **Test library:** Vitest + @testing-library/react (islands) + Astro Container API (`.astro` statics)
-- **Template:** `templates/astro/` (`@astrojs/react` islands + `@astrojs/tailwind`)
+- **Template:** `templates/astro/` (`@astrojs/react` islands + `@tailwindcss/vite`)
 - **Component pattern:** Hybrid — zero-JS static `.astro` files for presentational components, React islands (`.tsx`) for interactive ones, composed under file-based `src/pages/*.astro` routes.
 
 The `astro-converter` agent classifies every component from `build-spec.json`:

templates/README.md

@@ -79,7 +79,7 @@ Copies shared templates plus Vite-specific config.
 
 | File | Purpose |
 |------|---------|
-| `astro.config.mjs` | Astro config with `@astrojs/react` (islands) + `@astrojs/tailwind` |
+| `astro.config.mjs` | Astro config with `@astrojs/react` (islands) + `@tailwindcss/vite` (Tailwind v4) |
 | `package.json` | Astro + React island deps; Vitest + RTL + jsdom for tests |
 | `tsconfig.json` | Extends `astro/tsconfigs/strict`, `jsx: react-jsx` for islands |
 | `tailwind.config.mjs` | Tailwind content globs covering `.astro`, `.tsx`, `.ts`, `.md`, `.mdx` |

templates/astro/astro.config.mjs

@@ -1,17 +1,20 @@
 // @ts-check
 import { defineConfig } from "astro/config";
 import react from "@astrojs/react";
-import tailwind from "@astrojs/tailwind";
+import tailwindcss from "@tailwindcss/vite";
 
 // https://astro.build/config
 export default defineConfig({
   // React powers the interactive islands (.tsx). Static, presentational
-  // components stay zero-JS .astro files. Tailwind drives styling for both.
-  integrations: [
-    react(),
-    tailwind({
-      // Tailwind config lives in tailwind.config.mjs; let it own base styles.
-      applyBaseStyles: true,
-    }),
-  ],
+  // components stay zero-JS .astro files.
+  //
+  // Tailwind v4 is wired through its Vite plugin (@tailwindcss/vite). The old
+  // `@astrojs/tailwind` integration was dropped in the Astro 6 upgrade — its
+  // latest release supports Astro ≤5 only. Styles load from
+  // `src/styles/global.css` (imported by src/pages/index.astro), which pulls in
+  // Tailwind and bridges the token config via `@config`.
+  integrations: [react()],
+  vite: {
+    plugins: [tailwindcss()],
+  },
 });

templates/astro/package.json

@@ -13,12 +13,12 @@
     "format": "prettier --write ."
   },
   "dependencies": {
-    "@astrojs/react": "^4.4.2",
-    "@astrojs/tailwind": "^6.0.2",
-    "astro": "^5.18.2",
+    "@astrojs/react": "^6.0.0",
+    "@tailwindcss/vite": "^4.3.2",
+    "astro": "^6.4.8",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
-    "tailwindcss": "^3.4.19"
+    "tailwindcss": "^4.3.2"
   },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.9.1",
@@ -28,6 +28,7 @@
     "@types/react-dom": "^19.2.0",
     "jsdom": "^29.1.1",
     "typescript": "^5.9.3",
+    "vite": "^7.3.2",
     "vitest": "^3.2.0"
   }
 }