Repository navigation
chore(deps): update dependency astro to v7.4.7 [security] - #411
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
added
dependencies
|
This PR is very large. Consider breaking it into smaller, more focused pull requests for easier review. |
.NET Test Results 2 files 2 suites 1m 27s ⏱️ Results for commit f56f8e9. |
|
SummarySummary
CoverageBoardGameTracker.Api - 99.8%
BoardGameTracker.Common - 99.3%
BoardGameTracker.Core - 99.2%
Default - 89.3%
|
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
7.3.3→7.4.7Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems
CVE-2026-126364 / GHSA-r3h5-4585-7x3w
More information
Details
Summary
The
/_imageendpoint used by the@astrojs/nodeadapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems (such as Linux), a directory whose path differs from the output directory only by letter case is a different directory, but it passed the check.For example, with the client output directory at
/srv/app/dist/client/, a request such as:resolved to
/srv/app/DIST/client/secret.pngand was served, even though that file is outside the output directory.Impact
An unauthenticated attacker can read image files from outside the output directory, but only when all of the following are true:
@astrojs/nodeadapter.DIST/clientnext todist/client). Such a layout is unusual, and the attacker cannot create it.Only files the image service accepts can be read. Raster images are returned after resizing; SVG files are returned unchanged. Other file types fail during processing. Plain path traversal outside the output directory (for example
/../../secret.png) was already rejected and is not affected.Affected versions
astro>= 5.14.3, <= 7.4.6, when used with@astrojs/node(all versions up to 11.1.11). The vulnerable image endpoint is provided byastroand used by the@astrojs/nodeadapter.Patches
Fixed in
astro7.4.7. The path check now compares paths exactly, and only ignores letter case for Windows drive-letter paths. The fix ships inastro, so upgrading@astrojs/nodealone is not enough.Workarounds
Upgrade to
astro7.4.7 or later. Before upgrading, make sure no directory next to the build output directory has a path that differs from it only by letter case.Credits
Reported by @zachariah-mithani.
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Astro: XSS via attribute injection in dynamic tag names
CVE-2026-126361 / GHSA-mh32-jxcr-mh9f
More information
Details
Summary
When a dynamic tag (
const Tag = ...; <Tag />) resolves to a string, Astro renders it as a raw HTML element name. The name was filtered to remove characters that could inject attributes, but the filter did not handle/. Because HTML parsers treat/inside a tag as an attribute separator, a tag name such asimg/src/onerror=alert(1)was rendered as an<img>element with anonerrorattribute. The JSX renderer used for MDX did not filter string tag names at all.For example:
rendered
?as=img/src/onerror=alert(1)as live HTML.Impact
Reflected or stored cross-site scripting, but only in applications that use untrusted input (such as a request parameter or an uncontrolled CMS field) as all or part of an element name. Astro itself never derives element names from request data.
Applications that let content choose an element should map that input to a fixed set of known tags. Letting untrusted input choose an element name is unsafe even with a correct filter, because it can still select elements such as
scriptoriframe.Affected versions
astro<= 7.4.4.Patches
Fixed in
astro7.4.5. String tag names in.astrodynamic tags, JSX, and MDX now render only the leading valid element name, so characters such as/or=can no longer change the generated markup. Strings that do not start with a valid element name now throw an error.Workarounds
Upgrade to
astro7.4.5 or later. Before upgrading, do not use untrusted input as an element name, or map it to a fixed set of known tags.Credits
Reported by @uttej-badwane.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
withastro/astro (astro)
v7.4.7Compare Source
Patch Changes
7da442bThanks @matthewp! - Fixes the image endpoint treating directories whose names differ only by letter case as being inside the build output directory on case-sensitive filesystems7da442b]:v7.4.6Compare Source
Patch Changes
#18565
cd09986Thanks @praveen-kumary! - Avoids attributing client-only components or scripts to unrelated pages importingastro:i18nby bounding top-level page graph traversal at virtual page entries#18608
babd96dThanks @umeraamir69! - Fixes an extra page reload on the first page load after startingastro devwithout an existing.astrodirectory#18589
402c0faThanks @astro-factory! - Fixesastro checkexiting with code 0 when@astrojs/checkortypescriptis not installed. The command now exits with code 1 so CI fails instead of silently skipping type checking.#18503
54fcdd5Thanks @SwastikTripathi! - Preserves the last-modified date of cached font files and unchanged public files when copying them into the build output. Public-file timestamp preservation respects the resolved public-directory configuration, follows source symlinks, and avoids backdating files overwritten by build plugins.#18605
76cd239Thanks @astro-factory! - Fixes theglob()loader adding files from a folder excluded with a negation pattern such as!_docswhen they change duringastro dev#18432
ed60d82Thanks @alexmv! - Improves theMissingSharperror to include the reason Sharp failed to load, such as its prebuilt binaries not supporting the current CPU#18474
59543c3Thanks @miottid! - Fixes i18n fallback for on-demand rendered pages. A locale-prefixed request for a page that only exists in the fallback locale (for example/de/aboutwithfallback: { de: 'en' }) was answered with status302and noLocationheader. Such requests are now rewritten or redirected to the fallback locale according toi18n.routing.fallbackType, including encoded paths and sites with a configuredbase. Query strings are preserved, and explicit page statuses and redirects are left unchanged.#18541
cfa2d2bThanks @ump45nose! - FixesmatchAllRoutesto considerfallbackRoutes, matchingmatchRouteand the production router. Dev-server i18n fallback requests now resolve to the source route's metadata instead of the 404 route, and SSR-only fallback candidates can fall through the prerender handler.#18602
d856064Thanks @astro-factory! - Fixesastro checklosing the end of its output, including theResultsummary, when stdout is piped to a slow reader. When the reader closes the pipe early, for exampleastro check | head,astro checknow exits with code 1 instead of crashing with anEPIPEstack trace.#18574
da0f149Thanks @astro-factory! - Fixes an unnecessary full page reload inastro devwhen a content loader callsstore.clear()orstore.delete()and the content store has no asset imports#18570
e71c038Thanks @astro-factory! - Fixes pages using<ClientRouter />briefly showing the top of the page on reload before jumping back to the previous scroll position. Full reloads now use the browser's native scroll restoration.#18531
f75553bThanks @praveen-kumary! - Fixes an unhandledTypeError: Cannot convert undefined or null to objectwhen callingroute.generate()without arguments on static routesv7.4.5Compare Source
Patch Changes
#18558
fac3c50Thanks @astro-factory! - Fixesastro dev statusand other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process#18559
10dae2fThanks @astro-factory! - Fixesimport.meta.envvalues containing$sequences (such as$$or$&) being corrupted inastro buildwhen server code reads theimport.meta.envobject directly, for example withconst { MY_SECRET } = import.meta.env#18544
e3bec3dThanks @skezo! - Fixes request paths with invalid percent-encoding (e.g./%C0%AFor a bare%) being logged as anInvalid URL encodingerror and routed with the undecoded path. These requests now return a400, the same as a path that is encoded too many times.#18520
e023abaThanks @matthewp! - Makes rendering of string tag names stricter and consistent across.astrodynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as/or=can no longer change the generated markup. A string that does not start with a valid element name (for example'!--'or'') now throws an error instead of producing invalid HTML.v7.4.4Compare Source
Patch Changes
df838daThanks @edmundhung! - Allowsastro addto configure tagged versions of official adaptersv7.4.3Compare Source
Patch Changes
#18488
e4e25faThanks @umeraamir69! - CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string intoscript-srcandstyle-src.#18500
e5a3a1bThanks @astro-factory! - Fixes<Image>and<Picture>emitting duplicatesrcsetcandidates whendensitiescontains equivalent values such as1and'1x'#18517
c3185b7Thanks @okxint! - Fix unhandledAbortErrorrejection whenClientRouterskips a pending view transition#18497
c712113Thanks @astro-factory! - Fixes an uncaughtTypeErrorin the browser when aserver:deferisland request fails due to a network error. The fallback content is kept, as it is for non-200 responses.#18525
d0240b9Thanks @astro-factory! - Fixes aDEP0190deprecation warning printed byastro infoon Node.js 24 and later#18522
776b9a6Thanks @astro-factory! - FixesmemoryCache()serving an empty body for cached pages that return an empty404or500response. These responses now render the404or500error page on every request.#18511
d060ff9Thanks @astro-factory! - Fixestransition:namestyles missing in dev when the element is inside a component that is only rendered through another component with no styles or scripts#18494
5fe699cThanks @astro-factory! - Fixes theastroCLI refusing to run on StackBlitz by allowing Node.js>=22.22.0inside WebContainers, whose Node.js version users cannot change#18506
bf43a60Thanks @astro-factory! - Fixes<ClientRouter />animating scroll restoration on back/forward navigation whenscroll-behavior: smoothis set. Saved scroll positions are now restored instantly, matching the browser's native behavior.#18476
8ea79a2Thanks @astro-factory! - Fixes aDataCloneErrorcrash when building pages that render SVG imports with<Image />orgetImage()whileexperimental.parallelPrerenderis enabled.#18504
6dbd737Thanks @astro-factory! - Fixes<Picture>emitting a duplicate1xcandidate in<source>srcsetwhendensitiesincludes1#18524
7524889Thanks @astro-factory! - Fixes type errors reported in Astro's built-in<Image />,<Picture />,<Code />,<Debug />and<ClientRouter />components when type-checking a project that extendsastro/tsconfigs/strictestwithtscand@astrojs/ts-content-mapper#18493
3773941Thanks @astro-factory! - Fixes scoped styles of unused Astro components being included in the build when those components are re-exported from a barrel file#18512
1151b9eThanks @jp-knj! - Fixes CSP hashes added withAstro.cspfrom components rendered inside<body>being left out of the CSP<meta>element in static builds, including MDX pagesUpdated dependencies [
6cf3423,edfbf4a]:v7.4.2Compare Source
Patch Changes
#18430
dda9ec3Thanks @Abhirup-99! - Speeds up content sync withexperimental.collectionStorage: "chunked"by computing each character's UTF-8 width from its code point instead of encoding every character throughTextEncoder. On a store of ~44k entries this cuts the chunking step from about 60 seconds to well under a second, with byte-identical output.#18438
5e0eaa4Thanks @astro-factory! - Fixesastro devwith@astrojs/cloudflarefailing withCalling `require` for "node-fetch"when a server dependency such ascross-fetchrequiresnode-fetch#18376
a4e201dThanks @okxint! - Fixesastro devtreating a stale lock file containing a Linux thread ID as a running Astro server. A successful process lookup with no matching PID now marks the lock as stale, preventingastro dev stopandastro dev --forcefrom killing the unrelated process that owns the thread.#18467
d1fb7d3Thanks @astro-factory! - Fixes thedefineConfig()types fori18n.defaultLocale,i18n.fallback, andi18n.domainsso they accept a custom locale'spathinstead of itscodes, matching how Astro validates and uses these values#18475
cf27e70Thanks @ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releasesThis is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.
#18451
7a0ba6fThanks @DenisCDev! - Fixesastro sync,astro checkandastro buildreplacing the optimized dependencies of a dev server running in the same project, which broke framework islands in that dev server until it was restarted with--force#18336
e943003Thanks @astro-factory! - Fixes inline styles in dev so that framework-transformed CSS is used, such as scoped styles andv-bind()in Vue single-file components#18399
829fc00Thanks @astro-factory! - Fixes a dev server error (Could not find server component name) for aserver:deferisland that importsastro:actionsorastro:config/server, when its page was not the first island page loaded after starting the server#18330
4db9e0dThanks @Samuteg! - Fixes theastro:env/servervirtual module being generated with invalid JS in dev when any environment variable contains$replacement patterns ($`,$&,$',$1, …). The inlined env JSON was passed as a string toString.replace, so e.g. theKITTY_PUBLIC_KEYvalue set by default in Kitty terminals corrupted the module and broke dev withFailed to parse source for import analysisUpdated dependencies [
cf27e70]:v7.4.1Compare Source
Patch Changes
#18409
2917650Thanks @matthewp! - Fixes a typo in the error message shown when a fontcssVariableis invalid#18709
6f1a2a8Thanks @ematipico! - Reduces memory usage duringastro buildby releasing content collection entries from memory once the content layer sync is complete.#18713
59052e7Thanks @delucis! - Unpins@astrojs/*dependencies to allow versions matching the^range to be installedUpdated dependencies [
59052e7]:v7.4.0Compare Source
Minor Changes
#17894
b7a1bd9Thanks @Princesseuh! - Adds a new--timingsflag toastro buildto help you find what slows down your buildsWhen a build takes longer than expected, it can be hard to tell whether the cause is an integration, a Markdown processor plugin, image processing, or even syntax highlighting. Add the
--timingsflag to your build command to print a summary once the build finishes:This is helpful to decide what to optimize first, or to compare build times before and after a change to your project.
#17830
a937b0dThanks @florian-lefebvre! - Adds a new optionalgetFontProperties()callback to font providersFont providers can now expose the weights, styles, subsets and formats a font family actually has. Astro uses it when resolving your font configuration to warn about values a provider cannot serve, for example a weight a font family does not offer.
All built-in providers implement it. If you maintain a custom font provider, implementing this callback is optional for now but it will be required in Astro 8:
#17830
a937b0dThanks @florian-lefebvre! - Adds afetch()function to the font providerinit()contextThis function requests a provider API, retrying transient failures and more. It lets providers that wrap a 3rd-party unifont provider pass the context to it directly:
#18015
0b30239Thanks @florian-lefebvre! - Addsexperimental.redirectPage, letting you provide your ownsrc/pages/3xx.astroin place of the redirect page Astro generates in static builds.A static site has no server to send an HTTP
Locationheader, so Astro generates a small HTML page with a<meta http-equiv="refresh">tag for each redirect it builds:redirectsentriesAstro.redirect()calls in prerendered pagesThat page's markup, wording, and refresh delay were fixed, so you could not brand or translate it.
To enable this feature, add the experimental flag to your Astro config:
Then create
src/pages/3xx.astro. Astro renders it once per redirect, passing that redirect's details as props:Your page must render a
<meta http-equiv="refresh">tag pointing atto, because in a static build that tag is the redirect. Astro logs a warning during the build if it is missing.See the experimental redirect page documentation for more information.
#18265
910ee69Thanks @astro-factory! - Adds anotFound()handler toastro/fetchandastro/honothat renders the custom 404 page when no route matches, including a prerendered404.astroAdd it before
pages()in a custom worker or server entrypoint that does not run insideApp.render, such as a Hono app used directly as a Cloudflare worker. Without it,pages()andmiddleware()return an empty 404 with an internalX-Astro-Errorheader for unmatched routes.astro()already includes this handling.#18177
7d814e5Thanks @Princesseuh! - Adds support for separatebuildandruntimeimage servicesimage.servicenow also accepts abuildand aruntimeservice. Thebuildservice optimizes images on prerendered pages when you build your site, and is also used during development. Theruntimeservice handles images on on-demand rendered pages and the image endpoint of your deployed site.The following example uses Sharp to optimize images on prerendered pages, and an image CDN for on-demand rendered pages:
Changes for integration authors
config.image.servicekeeps the shape the user configured it with. When a project setsbuildandruntimeservices,config.image.service.entrypointandconfig.image.service.configareundefined.If your integration reads
image.service, check for theruntimeproperty to get the service you need:Setting
image.servicewithupdateConfig()replaces the existing service instead of merging with it when the two use different shapes. For example, setting a single service in a project that usesbuildandruntimeservices replaces both.#18277
2715958Thanks @florian-lefebvre! - Increases the minimum Node.js version to 22.22.0The minimum supported Node.js version is now 22.22.0, the latest Node.js 22 release supported by StackBlitz. This change is in line with Astro's Node.js support policy.
#18313
71e2b24Thanks @matthewp! - Allows integrations to control where Astro writes client, server, and prerender build output.Custom prerenderers can access the final output locations through the new
outputDirectoriescontext:#18177
7d814e5Thanks @Princesseuh! - Lets custom prerenderers report the images used on prerendered pagesAstro now generates images on prerendered pages from the image information that a prerenderer's
getStaticPaths()andrender()return. If your prerenderer wraps Astro's default one, pass this information through:Returning a plain array from
getStaticPaths()or a plainResponsefromrender()still works, but is deprecated: images used on those pages are not generated.#17932
b905ff1Thanks @Princesseuh! - Adds support for experimental parallel prerenderingThis experimental feature makes
astro buildrender your static pages in parallel, using multiple CPU cores at once instead of one. On sites with many pages, this can significantly reduce build times, at the cost of higher memory usage.To enable this feature, add the experimental flag in your Astro config:
By default, Astro uses all available CPU cores but one. Each additional worker increases the memory used by your build. If your build runs out of memory, or does not get faster, set
workersto a lower number:Each worker renders as many pages at once as your
build.concurrencysetting allows.This feature has no effect when your adapter provides its own way of prerendering pages. Among official adapters, this only applies to
@astrojs/cloudflare. Astro logs a warning during the build when the flag is ignored.For more information on enabling and using this feature in your project, see the experimental parallel prerendering docs.
Patch Changes
#18313
71e2b24Thanks @matthewp! - Fixes deployment integrations being unable to use Vite manifests when preparing build output#18270
0c3bf11Thanks @ArmandPhilippot! - Fixes the JSDoc for CSP utilities to point to the render context reference in docs.#18368
1f04637Thanks @43081j! - Replaces internal use offind-procwithtinyps.#18355
59b9cc0Thanks @matthewp! - Fixes prerender errors being silently swallowed when using a customsrc/fetch.tswith an adapter that prerenders in its own runtime, such as@astrojs/cloudflare. Previously, a page that threw during prerendering was written as an empty HTML file and the build succeeded. The build now fails with the underlying error.#18177
7d814e5Thanks @Princesseuh! - Fixes original images being kept despite onlywidthorheightbeing read.#18353
af54bfaThanks @astro-factory! - Fixesglob()loader swallowing rendering errors during content sync, which allowedastro buildto exit successfully (code 0) even when a remark/rehype plugin threw an error#18271
23e8e28Thanks @ArmandPhilippot! - Fixes thesynccommand description inastro help, which only mentioned content collections.Updated dependencies [
b7a1bd9,2715958]:v7.3.8Compare Source
Patch Changes
#18293
28e7410Thanks @astro-factory! - FixesAstro.cachebeingundefinedwhen a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export#18298
0e9e857Thanks @matthewp! - Fixesastro addremoving existingallowBuildsapprovals frompnpm-workspace.yamlwith pnpm v11.0–v11.22#18263
882dd98Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-basedtransformWithOxcand Rolldown instead of esbuild. These packages no longer depend on esbuild directly.#18290
31f13c3Thanks @astro-factory! - Fixes theglob()loader not reloading changed files in dev when the pattern starts with an extglob such as!(drafts)/**/*.mdv7.3.7Compare Source
Patch Changes
#18266
cba76ccThanks @astro-factory! - Fixes a build error when a Markdown content collection entry loaded withglob({ deferRender: true })has alayoutfrontmatter property.layoutis now ignored for content collection entries, as documented.#18287
38f6793Thanks @astro-factory! - Fixesastro add cloudflarefailing to install dependencies with pnpm v11+ by approving theworkerdbuild script, and shows the package manager's error output whenastro addfails to install dependencies#18222 [
fcf6ed6](https://redirect.github.com/withaConfiguration
📅 Schedule: (in timezone Europe/Brussels)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.