fix(deps): update dependency astro to v7.2.8 [security] - #326
Open
renovate[bot] wants to merge 1 commit into
Open
fix(deps): update dependency astro to v7.2.8 [security]#326renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
✅ Deploy Preview for lively-frangollo-e43a02 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.2.0→7.2.8Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
CVE-2026-84376 / GHSA-376h-93r7-7g6f
More information
Details
Summary
Astro stripped a configured
basepath from request pathnames using a string-prefix check that did not verify a path-segment boundary. Withbase: "/app", a request to/appX/adminwas treated as being under the base and resolved internally to the/adminroute, while middleware still observed the public pathname/appX/admin. Middleware that authorizes routes by inspectingcontext.url.pathnamecould therefore be bypassed.Impact
An unauthenticated remote attacker can bypass pathname-based middleware authorization in applications that:
base.context.url.pathname.Because routing and middleware resolved different effective pathnames, a request such as
/appX/admin(or other single-character extensions like/app2/adminor/app-/admin) reached the protected/adminroute without passing the middleware check that guards/app/admin. Astro's authentication guide demonstrates protecting routes in middleware viacontext.url.pathname, so this is a reasonable and expected pattern.Affected versions
astro<= 7.2.3.Patches
Fixed in
astro7.2.4. Base stripping now requires the pathname to equal the base without its trailing slash, or to be followed by a/, so a prefix that does not end on a path-segment boundary is no longer treated as being under the base. Routing andcontext.url.pathnamenow resolve the same pathname.Workarounds
Upgrade to
astro7.2.4 or later. As a mitigation before upgrading, avoid relying solely on prefix checks ofcontext.url.pathnamefor authorization, or reject requests whose pathname does not begin with the configured base followed by a path-segment boundary.Credits
Reported by @Ryoga-exe.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Astro: Remote code execution through AVIF image optimization
GHSA-26w7-cxv4-gfx2
More information
Details
A vulnerability in
libheif, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized.Projects are affected when an attacker can cause Astro to process an untrusted AVIF image.
The fix was released in Astro 7.2.8, which requires Sharp 0.35.4.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
withastro/astro (astro)
v7.2.8Compare Source
Patch Changes
#17837
ecb4082Thanks @matthewp! - Updates the minimum supported version of Sharp to 0.35.4#17786
db7c53bThanks @gameroman! - Replaces the internalfind-processdependency with a smaller, lighter alternativev7.2.7Compare Source
Patch Changes
#17415
55d38c8Thanks @iseraph-dev! - Deserializes each route once when loading the SSR manifest#17772
023b48bThanks @matthewp! - Fixes route selection for normalized request paths in adapter and development request handling#17819
633855bThanks @matthewp! - Updates generated and default Cloudflarecompatibility_datevalues to match the installed runtime and requires Wrangler^4.125.0#17813
ae26d18Thanks @matthewp! - Fixesrewrite()andnext(payload)for GET and HEAD requests with host-provided bodies#17816
a0d2fe3Thanks @astro-factory! - Fixes the experimentalsvgOptimizernot generating unique per-file ID prefixes when using SVGO'sprefixIdspluginv7.2.6Compare Source
Patch Changes
29af6daThanks @matthewp! - Fixes a bug wherenew FetchState(request)could fail in development when server dependencies were optimizedv7.2.5Compare Source
Patch Changes
#17758
5f419e2Thanks @astro-factory! - Fixes a bug whereexperimental_getFontFileURL()rejected valid font URLs when using the Cloudflare adapter#17416
493796bThanks @iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs#17712
bd374b7Thanks @fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8#17719
dac1768Thanks @astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys#17770
84eb7e7Thanks @astro-factory! - Fixes--mode,--site,--base,--out-dir,--verbose,--silent, and--openflags being silently dropped when usingastro dev --backgroundorastro preview --background#17713
d035290Thanks @wakqasahmed! - Fixescontent-modules.mjsnot removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modulesAs part of this fix,
#moduleImportsis now fully rebuilt fromdeferredRenderentries before every write, so a module import added only through the publicaddModuleImport()API without a correspondingdeferredRenderentry in the store will no longer be preserved across writes.#17743
adc750fThanks @contactjawad! - FixesAstro.preferredLocaleandAstro.preferredLocaleListignoringAccept-Languagequality values when they are absent or0. An entry without an explicitq=now correctly counts as quality1.0(per RFC 7231) and an entry withq=0is treated as not acceptable, so the highest-quality locale is selected regardless of header order.#17757
660991cThanks @astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error#17783
60b14ffThanks @matthewp! - Fixes a type error when passing an image from a content collectionimage()schema to a component or<Image />. The schema returned byimage()was missing theapngformat, so it no longer matched the type of an imported image.#17664
d483125Thanks @astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases"unsafe-inline"resource. Now when"unsafe-inline", Astro won't emit hashes for the directive specified.#17810
0fc5f65Thanks @florian-lefebvre! - Fixes a regression in the content collections that could cause images to not be resolved#17781
aa33b44Thanks @matthewp! - FixesmemoryCache()storing responses that set cookies throughAstro.cookiesorAstro.session#17787
6661fbeThanks @astro-factory! - Fixesserver:defercrashing the dev server with "undefined is not a function" when a deferred component imports fromastro:i18n#17750
dd0e3acThanks @dobrodob! - Fixes a regression wheretransition:persiststopped working for<audio>and<video>elements.#17774
fe1d16dThanks @astro-factory! - Adds support for importing.apngfiles as image metadata for use with standard<img>elements. Astro's image components reject APNG files to avoid removing their animation#17799
8797754Thanks @astro-factory! - Fixes i18nfallbackType: "rewrite"returning 500 instead of 404 when the fallback locale also has no matching static path for a prerendered dynamic route#17741
99d3d3dThanks @ericswpark! - Bumps the Astro compiler to the latest version. Changelog.#17782
3578d45Thanks @Princesseuh! - Improves the performance of the Astro CLI in local by enabling Node's module compilation cache.#17705
2043e4fThanks @astrobot-houston! - Fixes incremental builds serving cached HTML that references stale CSS filenames after a stylesheet-only edit#17754
3d50dfdThanks @astro-factory! - Fixes the dev server refusing to start in Docker containers after a restart due to PID reuse in the lock file check#17769
bbda94dThanks @astro-factory! - Fixes a build failure when definingvite.environments.ssrin the Astro config. User-provided environment config forssr,prerender, orclientis now properly deep-merged with Astro's internal environment settings instead of silently breaking the server entry naming.#17776
0874da8Thanks @astro-factory! - Fixes theglob()content loader failing to load files with colons in their names (e.g.,Guide: Architecture.md)Updated dependencies [
0762a83,0c99615]:v7.2.4Compare Source
Patch Changes
#17747
a90ff66Thanks @Princesseuh! - Fixes builds hanging when an image file is malformed#17701
05763a0Thanks @matthewp! - Fixes base path stripping to respect path-segment boundaries. With a configuredbasesuch as/docs, a request like/docs-archive/pageis no longer treated as being under the base, so routing andcontext.url.pathnamenow agree on the same pathname.#17742
70b449dThanks @Kjubikstronk! - Fixesastro buildthrowingTypeError: Missing parameterfor dynamic routes whenbuild.format: 'preserve'andtrailingSlash: 'always'are used together. Stripping the framework-injected.htmlsuffix dropped the trailing slash that the compiled route pattern requires, so the route no longer matched itself and its params resolved as empty.#17703
771b0a9Thanks @astrobot-houston! - FixesAstro.sitealways beingundefinedwhen rendering components via the Container API, even whensiteis set inastroConfigUpdated dependencies [
05763a0,bc171af]:v7.2.3Compare Source
Patch Changes
#17724
97140b2Thanks @ematipico! - Fixes an issue where Astro could run out of memory whenexperimental.collectionStorageis set tochunkedand there are multiple concurrent updates to the same collection.#17636
51723b1Thanks @matthewp! - Fixes the dev server sometimes matching against stale routes after pages were added, removed, or renamed, requiring a dev server restart to pick up the change#17636
51723b1Thanks @matthewp! - Fixes the composable request helpers (astro/fetch) throwing an error when used on a request that had been rewritten withAstro.rewrite()ornext()#17636
51723b1Thanks @matthewp! - Refactors Astro's internal server-side request handling. This is an internal change: all documented public APIs, includingAppandNodeApp, keep their existing signatures and behavior.The undocumented internal
app.pipelineproperty and theAppPipelineexport fromastro/apphave been removed. Adapters that usedapp.pipeline.getLogger()to wait for the configured log destination can call the newapp.getLogger()instead.As a result of this refactor,
new FetchState(request)fromastro/fetchnow works anywhere inside a built Astro server — including customsrc/fetch.tsentrypoints — without the request needing to first pass throughapp.render(). Previously this threw an error, breaking patterns like the Cloudflare adapter's advanced custom-worker setup.#17723
c3b9aedThanks @florian-lefebvre! - Fixes a link in font providers JSDoc annotations#17699
e28d227Thanks @ArmandPhilippot! - Fixes several documentation issues related to the JSDoc for configuration options.serverandfontsoptions, the JSDoc for the nested options was displayed instead of the JSDoc for the top-level property.#17572
2066f39Thanks @matthewp! - Fixes a crash when a request arrives with a malformed port in theHostheader (for exampleexample.com:65536orexample.com:8080:8080). Such a host made the constructed request URL invalid, and the fallback that was meant to recover reused the same invalid host and threw again. The request URL now degrades to a host the server controls when the incoming host cannot be parsed, so the request is handled instead of erroring.#17685
9f15609Thanks @astrobot-houston! - Fixes a dev server error where an SSR full reload triggered by a third-party Vite plugin (such as@tailwindcss/vite) could fail withFailed to load url astro:server-app.js#17636
51723b1Thanks @matthewp! - Improves error handling for custom log destinations. When the configured logger fails to load, Astro now reports the error and continues with the default console logger instead of failing the first request.#17631
cf29becThanks @matthewp! - FixesgetCollection()andgetEntry()throwingDataCloneErrorwhen a collection schema transform returns aTemporal.PlainDateor other class instance.Updated dependencies [
8c193f6]:v7.2.2Compare Source
Patch Changes
#17611
9bc3207Thanks @thelazylamaGit! - Fixes component styles rendered from content entries remaining stale until a second save when an adapter uses Astro's fallback development environment#17634
2267eeeThanks @astrobot-houston! - Fixes incremental builds dropping optimized images for cached pages when using acollectStaticImagesprerenderer (e.g.@astrojs/cloudflarewith compile-time image optimization)#17650
4cdf128Thanks @astrobot-houston! - Fixes intermittentImageNotFounderrors during build on projects with many images. The build now limits concurrent image file reads to avoid exhausting OS file descriptors (EMFILE) and retries transient I/O errors with backoff. Non-transient errors are no longer silently swallowed.#17683
2378221Thanks @astrobot-houston! - FixesprerenderConflictBehaviornot applying to content collection duplicate ID warnings in theglob()andfile()loaders. Setting it to'error'now throws during content sync, and'ignore'suppresses the warning.#17659
90c6ea4Thanks @astrobot-houston! - Fixes the Fonts API breakingexperimental.incrementalBuildcaching by embedding a build-local, randomly-assigned server port in generated code used for the dependency hash#17630
fd1d9eeThanks @ericclemmons! - Fixes incremental builds becoming prohibitively slow for sites with many pages or content entries that share a large dependency graph.#17690
93beeccThanks @NgoQuocViet2001! - Prevents files in directories whose names start withpagesfrom being treated as page routes#17671
09f0dc7Thanks @tarikermis! - Fixesastro devrefusing to start after a Docker container restart when an unrelated process reuses the PID from a persisted lock file. Astro now checks the process command across platforms, so stale lock files are cleaned up and--forcedoes not signal the unrelated process.v7.2.1Compare Source
Patch Changes
#17612
7133730Thanks @thelazylamaGit! - Fixes CSS hot module replacement after navigating between pages withClientRouter#17628
4ada248Thanks @astrobot-houston! - Fixes a CSP violation when using bothsecurity.cspandexperimental.clientPrerenderwithdata-astro-prefetchlinks. The dynamically injected<script type="speculationrules">now uses a static"source": "document"approach with a CSS selector, producing a deterministic payload that is hashed and included in the CSPscript-srcdirective at build time.#17605
89e4647Thanks @ashleigh-yeoman! - Fixes middleware HMR not responding to changes in imported modules. Previously, only direct edits to the middleware file would trigger a reload.#17582
bd2c1a5Thanks @astrobot-houston! - Fixes a regression where content collectionreference()fields silently accepted entry IDs that don't exist, such as an ID that doesn't match a loader's slugified version of it. Astro now logs an error for references that point to a missing entry after all loaders finish syncing.#17661
97b0cc7Thanks @ArmandPhilippot! - Improves Markdown options documentation with links to the Markdown guide and official processors.#17349
4328c73Thanks @astrobot-houston! - Fixes an issue where requests handled by the dev prerender environment (e.g./_imagewith@astrojs/cloudflare'sprerenderEnvironment: 'node') returned a 500 when a prerendered catch-all route existed, because non-prerendered route modules were imported in an environment where their runtime-specific APIs are unavailable#17603
722eed6Thanks @astrobot-houston! - Fixes<video>and<audio>elements being non-functional after navigating via view transitions (<ClientRouter />)#17616
3a890d2Thanks @lazerg! - Fixesexperimental.incrementalBuildre-rendering unchanged routes that import more than one asset. The route's dependency hash depended on the order the assets finished building, so two builds of identical sources could produce different hashes. The hash is now based on the file name each asset resolves to.#17547
fba468cThanks @dmgawel! - ImprovesgetCollection()andgetEntry()performance for entries without local image references#17602
16e0d9dThanks @astrobot-houston! - Fixes a build error caused by hash collisions in generated content collection image import identifiersConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.