fix(core): fix Vercel skew protection bug for island hydration URLs

[Strernd]

Summary

This fixes a Vercel skew protection bug: astro-island hydration URLs were missing adapter assetQueryParams (for example ?dpl=), so island JS was not pinned to the active deployment.

Reproduction

I validated this against the reproduction project (repro-skew-protection) and Astro core changes from this branch:

VERCEL_DEPLOYMENT_ID=dpl_test123 VERCEL_SKEW_PROTECTION_ENABLED=1 npx astro build

Before this fix, rendered islands had:

• component-url="/_astro/...js" (no dpl)
• renderer-url="/_astro/...js" (no dpl)

With this fix, rendered islands have:

• component-url="/_astro/...js?dpl=dpl_test123"
• renderer-url="/_astro/...js?dpl=dpl_test123"

Changes

• packages/astro/src/core/build/plugins/plugin-manifest.ts

  • Serialize entryModules with appendAssetQuery(...) so island URL resolution gets assetQueryParams.
  • Keep raw entry module values for static file tracking and page script handling to avoid double-appending.

• packages/astro/src/core/render/ssr-element.ts

  • Make createAssetLink() query/hash-aware:
    • extension detection now uses pathname without query/hash
    • query params are appended safely (? vs &, before hash)
  • This preserves extension-based assetsPrefix routing when URLs already contain query params.

• packages/astro/test/asset-query-params.test.js

  • Add island coverage asserting component-url and renderer-url include ?dpl=test-deploy-id.
  • Add regression coverage for assetsPrefix map (js/css/fallback) + assetQueryParams, ensuring island URLs still use JS CDN prefix.

Testing

pnpm -C packages/astro run build:ci
pnpm -C packages/astro exec astro-scripts test "test/asset-query-params.test.js"
pnpm -C packages/astro exec astro-scripts test "test/astro-assets-prefix-multi-cdn.test.js"

All pass.

Context

Related: #14545, #14543, #14627, #14853

[changeset-bot]

⚠️ No Changeset found

Latest commit: 01ac7a7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codspeed-hq]

Merging this PR will not alter performance

✅ 18 untouched benchmarks

---

_{Comparing Strernd:fix-skew-protection-island-hydration-urls (2fad455) with main (23d5244)}