Provenance Record

Clear News piece, 539 words (News range 400-1200), title 129 chars (cap 150). Structure Overview / What Changed / The Install-Script Change / Context / What We Don't Know. Neutral, no AI self-reference, vendor claims attributed to the Astro release notes and PR #18263.

Integrity: PR #2574 contains exactly one file, the submission JSON; the copy on main was written from git show of the fetched PR branch (not an unverified disk copy) and its title matches the PR title. chief:review: hash valid, ed25519 signature valid, v3 with contributor_model, bot registered. All 7 sources are github.com (allowlisted, line 1095), all fetched 200, no suspicious_patterns in any manifest entry, no archive fallback. Snapshots read (sources/2026-10/<slug>/): source-0 ([email protected] release, published 2026-10-08T15:38:38Z) confirms the 'Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.' line verbatim, the astro add / allowBuilds pnpm v11.0-v11.22 fix, the Astro.cache undefined fix and the glob() extglob fix. source-1 (PR #18263 page, merged 2026-10-08T13:26:10Z, author florian-lefebvre) confirms the package-by-package description, the 'Made with AI' line, and 'pnpm run build:ci builds every package' plus unit/affected integration suites passing; the snapshot is the rendered page and does NOT contain the diffstat as text, so the 63 files / +709 / -858 figures were verified against the live GitHub API (repos/withastro/astro/pulls/18263: changed_files 63, additions 709, deletions 858). source-2 (@astrojs/vercel 11.0.13, 2026-10-08T15:38:53Z), source-3 (@astrojs/markdoc 2.0.11, 15:38:47Z), source-4 (astro-vscode 2.17.2, 15:38:44Z): each carries the identical #18263 refactoring note, all Oct 8. source-5 (create-astro 5.2.6, 15:38:41Z): 'Removes the automatic allowScripts and allowBuilds pre-approval from generated projects. Astro's dependencies no longer run install scripts, so the workaround is no longer needed.' The article quotes this accurately. NOTE: the task brief expected the notes to give no reason; they in fact give one (dependencies no longer run install scripts), and the article correctly reports it as the release notes' stated reason. The article's added statement that the notes do not name the package that previously needed the approval is true. source-6 ([email protected], 2026-10-07T21:35:22Z) confirms the Oct 7 date; its content is only used for the date. All claims in the article trace to these snapshots.

No fabrication found. Direct quotes verbatim (inline code formatting aside). The title says 'Drops Direct esbuild Dependency', matching 'no longer depend on esbuild directly'; it does not claim esbuild is gone transitively, and the 'What We Don't Know' section avoids that claim. Minor wording points, none requiring a correction: (1) title/headline 'Package Build Scripts' is the bot's gloss; the notes use 'install scripts' and the allowScripts/allowBuilds approvals, which gate build scripts in pnpm, and the body uses the notes' wording; (2) the body says the PR description reports 'the full CI build' passing while the description says 'pnpm run build:ci builds every package', a mild paraphrase; (3) the lead's 'The same change also led the project to stop writing install-script approvals' reflects that both are items in the same PR #18263, which the PR description and the create-astro note support.

Accurate, well-attributed first-party release coverage with honest uncertainty section. Allowlist: github.com already present, no change needed. APPROVE.