[Samuteg]

Fixes #18329.

Problem

In dev, getTemplates() inlines the full environment into the generated astro:env/server virtual module via:

server.replace('// @@GET_ENV@@', `return (${JSON.stringify(loadedEnv)})[key];`)

Because the replacement is a string, $ patterns ($`, $&, $', $1, …) in any env var value are interpreted as replacement patterns, injecting template text into the middle of the env JSON and producing an unterminated string literal. Dev then fails with Failed to parse source for import analysis … at astro:env/server:17:…. This hits e.g. every Kitty terminal user (KITTY_PUBLIC_KEY commonly contains $ + backtick) importing astro:env/server in dev.

Fix

One line: pass a replacer function, which is immune to $ patterns.

Test

Added works in dev when an env variable contains \$` replacement patternstopackages/astro/test/env-secret.test.ts, covering `` $ ``, $&, `$'` and `$1`. Verified it fails without the fix (dev returns 500) and passes with it. Full env suites green: `env-secret` (5/5), `env-public` (4/4), `astro-envs` (13/13).

Changeset

Patch bump for astro included.

[changeset-bot]

🦋 Changeset detected

Latest commit: fbc5f72

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
astro	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codspeed]

Merging this PR will not alter performance

⚠️ 3 benchmarks spent significant time in system calls

System calls cannot be consistently instrumented, so they are not included in the measure, which understates the real cost. Please switch to the Walltime instrument to accurately measure system calls.

Measurement and system calls

• Build: full server site
• Build: full static site
• Build: hybrid site (static + server)

ℹ️ 13 benchmarks have no flame graph

The flamegraph could not be generated because too much time was spent in runtime internals, making the visualization not useful for performance analysis.

• Build: full server site
• large-array (BufferedRenderer per child)
• many-components [streaming]
• head-propagation-2000 [streaming]
• many-slots (eager slot prerendering)
• head-propagation-2000 (propagator collection, 2x scale)
• head-propagation-1000 (propagator collection)
• many-expressions [streaming]
• static-heavy (markHTMLString baseline)
• many-components (markHTMLString, isHTMLString, validateProps)
• …and 3 more

✅ 21 untouched benchmarks

---

_{Comparing Samuteg:fix/env-replace-dollar-patterns (fbc5f72) with main (a85847e)¹}

Footnotes

1. No successful run was found on main (9050e38) during the generation of this report, so a85847e was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[kdelay]

The test only checks for a 200, which catches the patterns that break parsing but not $$. With a string replacement, $$ becomes $ and the module still parses, so the value changes silently:

"// @@GET_ENV@@".replace("// @@GET_ENV@@", `return (${JSON.stringify({ V: "a$$b" })})[key];`)
// => return ({"V":"a$b"})[key];

The fixture already renders getSecret("UNKNOWN_SECRET"), so setting it to the hostile value plus $$ and asserting data.UNKNOWN_SECRET matches exactly would cover both cases.