- Add support for Astro 7 and drop support for Astro 4. If you are still on Astro 4, follow the [Astro upgrade guide](https://docs.astro.build/en/guides/upgrade-to/v6/) to upgrade your project before updating `@clerk/astro`. ([#8974](https://github.com/clerk/javascript/pull/8974)) by [@wobsoriano](https://github.com/wobsoriano)

- Remove `createRouteMatcher` from `@clerk/astro/server`. Use resource-based auth checks instead: move auth checks into each Astro page, API route, or server-side handler that accesses protected data. Middleware-based auth checks rely on path matching, which can diverge from how Astro routes requests and leave protected resources reachable. ([#8974](https://github.com/clerk/javascript/pull/8974)) by [@wobsoriano](https://github.com/wobsoriano)

```ts

import type { APIRoute } from 'astro';

export const GET: APIRoute = ({ locals }) => {

const { userId } = locals.auth();

if (!userId) {

return new Response('Unauthorized', { status: 401 });

}

return Response.json({ userId });

};

```

If you want to hand this work to a coding agent, use this migration prompt:

```md

Migrate my Astro project away from Clerk's removed `createRouteMatcher` API.

1. Open `src/middleware.ts` (or `src/middleware.js`) and find every matcher created

with `createRouteMatcher` from `@clerk/astro/server`, along with the middleware

logic that uses it (returning 401s, calling `auth().redirectToSignIn()`, etc.).

2. For every route those matchers protected, move the auth check into the resource itself:

- In `.astro` pages, add this to the frontmatter:

const { userId, redirectToSignIn } = Astro.locals.auth();

if (!userId) return redirectToSignIn();

- In API routes and server handlers, add this at the top of the handler:

const { userId } = locals.auth();

if (!userId) return new Response('Unauthorized', { status: 401 });

- Keep any role or permission checks (`auth().has(...)`) with the resource as well.

3. Remove the `createRouteMatcher` import and calls from the middleware. Keep

`clerkMiddleware()` itself. Middleware logic unrelated to auth protection

(locale redirects, headers, etc.) may stay, using plain `URL`/pathname checks.

4. Make sure every page and endpoint previously covered by a matcher pattern

(including glob patterns like `/dashboard(.*)`) now has its own check, then

verify the project builds.

```

"version": "4.0.0",

- Remove the redundant `https://*.client.protect.clerk.com` source from CSP headers generated by `clerkMiddleware()`. ([#9207](https://github.com/clerk/javascript/pull/9207)) by [@mwickett](https://github.com/mwickett)

"version": "7.5.22",