fix(deps): update dependency astro@<=5.15.6 to >=6.4.8 [security] by renovate[bot] · Pull Request #299 · anolilab/unplugin-favicons

renovate · 2026-07-21T05:52:42Z

This PR contains the following updates:

Package	Change	Age	Confidence
astro@<=5.15.6 (source)	`>=6.4.6` → `>=6.4.8`

Astro: Reflected XSS via unescaped View Transition animation properties

GHSA-4g3v-8h47-v7g6

More information

Details

Summary

Astro's server-side View Transition CSS generator interpolates animation properties into an inline <style> element without escaping them for the CSS and HTML contexts.

An attacker-controlled value passed to an animation property such as duration can contain a </style> sequence, terminate the generated style element, and inject arbitrary HTML or JavaScript.

This is similar to GHSA-8hv8-536x-4wqp, but exploits a different injection point: unescaped View Transition animation values in a server-generated <style> element rather than an unescaped slot name in a hydration template.

Like GHSA-8hv8-536x-4wqp, exploitation requires an application to pass attacker-controlled data to an Astro API. However, the value is subsequently inserted into the HTML response without context-appropriate escaping by Astro.

Details

packages/astro/src/runtime/server/transition.ts

The generated stylesheet is wrapped in a <style> element and marked as HTML-safe:

const css = sheet.toString();
result._metadata.extraHead.push(markHTMLString(`<style>${css}</style>`));

Animation properties are added to the stylesheet without escaping:

if (anim.duration) {
  addAnimationProperty(builder, 'animation-duration', toTimeValue(anim.duration));
}

For string values, toTimeValue() returns the input unchanged:

export function toTimeValue(num: number | string) {
  return typeof num === 'number' ? num + 'ms' : num;
}

As a result, a duration value containing </style> can escape from the generated style element.

Other TransitionAnimation properties, including easing, direction, delay, fillMode, and name, are serialized by the same animation builder. The following PoC only relies on the official fade() helper and its duration option.

PoC

Using:

astro@7.0.9
@astrojs/node@11.0.2

`astro.config.mjs`

import node from '@astrojs/node';
import { defineConfig } from 'astro/config';

export default defineConfig({
  output: 'server',
  adapter: node({ mode: 'standalone' }),
});

`src/pages/index.astro`

---
import { fade } from 'astro:transitions';

const duration = Astro.url.searchParams.get('duration') ?? '300ms';
---

<html lang="en">
  <head>
    <meta charset="utf-8" />
    <title>PoC</title>
  </head>
  <body>
    <div transition:animate={fade({ duration })}>
      Animated content
    </div>
  </body>
</html>

Payload:

open:

http://localhost:4321/?duration=%3C%2Fstyle%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E%3C!--

The browser interprets </style> as the end of the generated style element and executes the injected script. An alert dialog is displayed when the page is opened.

Impact

An attacker who can control a View Transition animation value can execute arbitrary JavaScript in the origin of the affected Astro application.

The query-based reflected XSS scenario affects on-demand/server-rendered routes, such as:

projects configured with output: "server";
pages using export const prerender = false;
other server-side data flows that pass attacker-controlled values into a View Transition animation definition.

Successful exploitation may allow access to sensitive page data and authenticated actions available to the victim.

Suggested Fix

Animation values should be serialized using context-appropriate CSS escaping or validation before being added to the generated stylesheet.

Additionally, content inserted into a raw <style> element must not be able to contain an HTML end-tag sequence such as </style>. The final generated CSS should be made safe for the HTML raw-text context before it is passed to markHTMLString().

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

CVE-2026-59727 / GHSA-7pw4-f3q4-r2p2

More information

Details

Summary

When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS).

Severity

Although a generic reflected XSS scores in the Medium range, exploitation here requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This mitigating precondition places the real-world severity at Low.

Details

In generateHydrateScript() (packages/astro/src/runtime/server/hydration.ts), every island property is HTML-escaped before serialization — the attrs, props, and opts assignments all pass through escapeHTML(). The transition directives, however, were copied verbatim:

transitionDirectivesToCopyOnIsland.forEach((name) => {
  if (typeof props[name] !== 'undefined') {
    island.props[name] = props[name]; // not escaped
  }
});

The <astro-island> element is serialized via renderElement('astro-island', island, false) with shouldEscape=false, and toAttributeString() returns the value unchanged in that mode. As a result there is no downstream re-escaping, and the raw directive value reaches the HTML response. This is the same output sink previously addressed for slot names in GHSA-8hv8-536x-4wqp.

The affected directives are:

data-astro-transition-scope (transition:scope)
data-astro-transition-persist (transition:persist)
data-astro-transition-persist-props (transition:persist-props)

Note that transition:persist is typed boolean | string, so passing a string value is a supported use of the API.

Proof of Concept

A component that reflects a query parameter into a transition directive:

---
const persist = Astro.url.searchParams.get('persist') ?? 'default';
---
<Island client:load transition:persist={persist} />

Request:

https://example.com/?persist="><img src=x onerror=alert(document.domain)>

Rendered output (before the fix):

<astro-island … data-astro-transition-persist=""><img src=x onerror=alert(document.domain)>></astro-island>

The " closes the attribute and the injected <img onerror=…> executes in the victim's browser.

Impact

Reflected XSS. An attacker who can induce a victim to visit a crafted URL can execute arbitrary script in the victim's session on the origin, subject to the requirement that the target application reflects untrusted input into one of the affected transition directives.

Affected Versions

astro >= 3.10.0, < 7.0.4 (introduced in 3.10.0, PR #7861).

Patched Versions

astro >= 7.0.4. Fixed in PR #17212 by HTML-escaping transition directive values before they are rendered onto the island element.

Workarounds

Do not pass untrusted or request-derived input into transition:persist, transition:scope, or transition:persist-props. If such input is required, HTML-escape or strictly validate it before passing it to the directive. Upgrading to astro@7.0.4 or later removes the need for manual mitigation.

Credits

Reported by @jlgore.

Severity

CVSS Score: 2.1 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

CVE-2026-59729 / GHSA-f48w-9m4c-m7f5

More information

Details

Summary

The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing "' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context, resulting in XSS.

Details

renderHTMLElement builds attributes directly:

for (const attr in props) {
  attrHTML += ` ${attr}="${toAttributeString(await props[attr])}"`;
}

The attribute name (attr) is interpolated raw; only the value is escaped via toAttributeString. By contrast, the hardened addAttribute in util.ts rejects invalid names:

if (INVALID_ATTR_NAME_CHAR.test(key)) { return ''; } // /[\s"'>/=]/

renderHTMLElement is reached from component.ts when the component is a native HTMLElement subclass:

if (!renderer && typeof HTMLElement === 'function' && componentIsHTMLElement(Component)) {
  const output = await renderHTMLElement(result, Component, _props, slots);
}

where _props carries spread props verbatim.

Reachability

The branch only runs when typeof HTMLElement === 'function' at SSR time. In default Node SSR HTMLElement is undefined, so the branch is dead. It becomes reachable when the SSR runtime exposes a global HTMLElement (Deno, Bun with a DOM shim, or jsdom/happy-dom in Node) and a class extending HTMLElement is used directly as an Astro component that receives untrusted-keyed spread props.

Proof of Concept

Given malicious spread props:

const maliciousProps = {
  'onmouseover=alert(document.domain) x': 'y',
  'x><script>alert(1)</script>': 'z',
};

addAttribute (post-fix) → <my-el></my-el> (key stripped — safe)
renderHTMLElement → <my-el onmouseover=alert(document.domain) x="y" x><script>alert(1)</script>="z"></my-el> (handler + <script> injected — XSS)

Equivalent Astro template, served by an SSR runtime that defines a global HTMLElement:

---
import MyElement from '../MyElement.js'; // class MyElement extends HTMLElement {}
const userInput = Astro.url.searchParams;  // untrusted keys
---
<MyElement {...Object.fromEntries(userInput)} />

Impact

Cross-site scripting (CWE-79) via attribute-name breakout — the same vulnerability class as CVE-2026-54298, in a code path its fix did not cover. An attacker who controls the keys of an object spread onto a native-HTMLElement-subclass component can inject arbitrary event-handler attributes or sibling elements (including <script>) into the SSR output. Reachability is constrained by the runtime and component preconditions described above.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

withastro/astro (astro@<=5.15.6)

`v6.4.8`

Compare Source

Patch Changes

#17109 27c80ea Thanks @ematipico! - Harden the limits on the number of decoding on the URL.

`v6.4.7`

Compare Source

Patch Changes

#17035 197e50e Thanks @astrobot-houston! - Fixes getRelativeLocaleUrl, getAbsoluteLocaleUrl, and getAbsoluteLocaleUrlList to strip trailing slashes when trailingSlash: 'never' is configured
#16967 3719765 Thanks @astrobot-houston! - Fixes double URL-encoded paths returning 400 Bad Request on on-demand routes

Previously, any URL containing a double-encoded character (like %255B, which is [ encoded twice) was unconditionally rejected with a 400 Bad Request before middleware or route handlers could run. This broke embedded tools like Sanity Studio whose client-side router legitimately produces double-encoded URLs.

The fix replaces the rejection approach with iterative decoding — multi-level percent-encoding is now fully resolved to its canonical form before being passed to middleware and route matching. This preserves the security fix for CVE-2025-66202 (middleware authorization bypass via double encoding) because middleware now always sees the fully decoded path, making bypass impossible. For example, /api/%2561dmin is decoded to /api/admin, which middleware can correctly block.
#17066 2f4d92a Thanks @matthewp! - Fixes prerendered redirect targets being incorrectly bundled into the SSR function in hybrid mode, causing massive bundle size inflation
#16882 621beb7 Thanks @jettwayio! - fix(render): honour compressHTML when joining head elements
#16892 8d753b0 Thanks @astrobot-houston! - Fixes custom elements in MDX having their children's slot attribute stripped by the JSX runtime

When custom elements (tags with hyphens like <my-element>) are used in MDX files, the slot HTML attribute on their children is now correctly preserved. Previously, the shared JSX runtime would treat slot as an Astro slot assignment and remove it from the output, breaking Shadow DOM named slot distribution for web components.
#16957 544ee76 Thanks @thelazylamaGit! - Fixes stale inline CSS in server-rendered HTML after CSS file edits during dev

When editing a CSS file (.css, .scss, etc.) during development, the inline <style> tags in server-rendered HTML would retain old CSS content instead of updating. This caused a brief flash of old CSS (FOUC) on fresh page loads before Vite's client-side HMR corrected the styles.

The fix ensures that Astro's per-route dev CSS virtual modules are invalidated in both the SSR module graph and the module runner's evaluation cache when a style file changes, so the next page render picks up the fresh CSS.
#17044 2220d22 Thanks @astrobot-houston! - Fixes CSS from client:only islands leaking to unrelated pages when Rollup bundles non-CSS-importing modules into the same chunk as CSS-importing modules
#17040 7c4763d Thanks @astrobot-houston! - Fixes HMR not triggering for files inside the src/middleware/ directory during dev
#16672 52fc862 Thanks @martinheidegger! - Fixes support for numeric IDs in YAML frontmatter when using content collection references
#16762 9de80ae Thanks @alexanderdombroski! - Adds a JSON schema to the Wrangler configuration file generated when running astro add cloudflare
#17046 ef771ec Thanks @ematipico! - Improves the diagnostics emitted when Astro parses incorrect .astro files.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-07-21T05:52:45Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

ERROR: This version of pnpm requires at least Node.js v22.13
The current version of Node.js is v18.20.8
Visit https://r.pnpm.io/comp to see the list of past pnpm versions with respective Node.js version support.

github-actions · 2026-07-21T05:52:58Z

Thank you for following the naming conventions! 🙏

BREAKING CHANGE: updated dependencies to major versions

# Conflicts: # pnpm-lock.yaml

…-08-19) ### ⚠ BREAKING CHANGES * **deps:** updated dependencies to major versions * chore: merge renovate update against main * chore: merge renovate update against main * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> ### Bug Fixes * **build:** resolve pnpm audit advisories ([60384be](60384be)) * **deps:** update angular monorepo to >=21.2.19 ([#433](#433)) ([d36dfe9](d36dfe9)) * **deps:** update anolilab/workflows digest to 7d86f54 ([#292](#292)) ([b23dcf1](b23dcf1)) * **deps:** update astro monorepo to >=7.1.6 ([#434](#434)) ([b20afcc](b20afcc)) * **deps:** update babel monorepo (patch) ([#294](#294)) ([f02eeb2](f02eeb2)) * **deps:** update dependency @angular/common@<19.2.16 to v20 [security] ([#361](#361)) ([2977531](2977531)) * **deps:** update dependency @angular/compiler@>=19.0.0-next.0 <19.2.17 to v20 [security] ([#362](#362)) ([a8fe1c8](a8fe1c8)) * **deps:** update dependency @angular/compiler@>=19.0.0-next.0 <19.2.18 to v20 [security] ([#363](#363)) ([5b5d10b](5b5d10b)) * **deps:** update dependency @angular/compiler@>=19.0.0-next.0 <19.2.20 to v20 [security] ([#364](#364)) ([e100192](e100192)) * **deps:** update dependency @babel/core to ^7.29.7 ([#435](#435)) ([4ab1585](4ab1585)) * **deps:** update dependency @nuxt/devtools@<2.6.4 to v3 [security] ([#373](#373)) ([98a78a1](98a78a1)) * **deps:** update dependency @rspack/core to ^2.0.8 ([#436](#436)) ([1f007d7](1f007d7)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#329](#329)) ([0d58b0d](0d58b0d)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#411](#411)) ([b17988b](b17988b)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#418](#418)) ([c0784eb](c0784eb)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#421](#421)) ([6c402e7](6c402e7)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#425](#425)) ([13ad0ea](13ad0ea)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#426](#426)) ([a360ce6](a360ce6)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#427](#427)) ([e84bce2](e84bce2)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#428](#428)) ([35d65b3](35d65b3)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#429](#429)) ([bc9cf64](bc9cf64)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#430](#430)) ([0d650bf](0d650bf)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#431](#431)) ([5ba4fd5](5ba4fd5)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#432](#432)) ([1a2bc7c](1a2bc7c)) * **deps:** update dependency @sveltejs/kit@<=2.57.0 to >=2.70.2 [security] ([#330](#330)) ([b0a4bfd](b0a4bfd)) * **deps:** update dependency @sveltejs/kit@>=2.0.0 <2.20.6 to >=2.70.2 [security] ([#331](#331)) ([885ca56](885ca56)) * **deps:** update dependency astro@<=5.15.6 to v7 [security] ([#299](#299)) ([390e511](390e511)) * **deps:** update dependency astro@<5.14.3 to >=6.4.8 [security] ([#300](#300)) ([4b3efa8](4b3efa8)) * **deps:** update dependency astro@<5.15.8 to >=6.4.8 [security] ([#301](#301)) ([aededa5](aededa5)) * **deps:** update dependency astro@<5.15.8 to v7 [security] ([#412](#412)) ([1b66e60](1b66e60)) * **deps:** update dependency astro@<5.15.9 to >=6.4.8 [security] ([#302](#302)) ([21b224a](21b224a)) * **deps:** update dependency astro@<5.15.9 to v7 [security] ([#413](#413)) ([c20e6c6](c20e6c6)) * **deps:** update dependency astro@<6.1.10 to >=6.4.8 [security] ([#304](#304)) ([b1c879a](b1c879a)) * **deps:** update dependency astro@<6.1.10 to v7 [security] ([#415](#415)) ([78e66eb](78e66eb)) * **deps:** update dependency astro@<6.1.6 to >=6.4.8 [security] ([#303](#303)) ([ef232a0](ef232a0)) * **deps:** update dependency astro@<6.1.6 to v7 [security] ([#414](#414)) ([c2f36b5](c2f36b5)) * **deps:** update dependency astro@>=2.10.10 <5.18.1 to >=6.4.8 [security] ([#305](#305)) ([51eae66](51eae66)) * **deps:** update dependency astro@>=2.10.10 <5.18.1 to v7 [security] ([#403](#403)) ([1ea12e9](1ea12e9)) * **deps:** update dependency astro@>=2.16.0 <5.15.5 to >=6.4.8 [security] ([#306](#306)) ([4fd07f6](4fd07f6)) * **deps:** update dependency astro@>=2.16.0 <5.15.5 to v7 [security] ([#404](#404)) ([3a51ad0](3a51ad0)) * **deps:** update dependency astro@>=5.0.0-alpha.0 <5.13.2 to >=6.4.8 [security] ([#307](#307)) ([ac1639c](ac1639c)) * **deps:** update dependency astro@>=5.0.0-alpha.0 <5.13.2 to v7 [security] ([#405](#405)) ([f883968](f883968)) * **deps:** update dependency body-parser@<1.20.3 to >=1.20.6 [security] ([#311](#311)) ([310a672](310a672)) * **deps:** update dependency body-parser@<1.20.3 to v2 [security] ([#408](#408)) ([19e3663](19e3663)) * **deps:** update dependency brace-expansion@<1.1.13 to >=1.1.18 [security] ([#309](#309)) ([1e4f0f5](1e4f0f5)) * **deps:** update dependency brace-expansion@<1.1.13 to v2 [security] ([#406](#406)) ([3fc16d8](3fc16d8)) * **deps:** update dependency brace-expansion@<1.1.13 to v3 [security] ([#416](#416)) ([ca94d94](ca94d94)) * **deps:** update dependency brace-expansion@<1.1.13 to v4 [security] ([#419](#419)) ([c1a4004](c1a4004)) * **deps:** update dependency brace-expansion@<1.1.13 to v5 [security] ([#422](#422)) ([007be58](007be58)) * **deps:** update dependency brace-expansion@>=1.0.0 <=1.1.11 to >=1.1.18 [security] ([#310](#310)) ([ff22c18](ff22c18)) * **deps:** update dependency brace-expansion@>=1.0.0 <=1.1.11 to v2 [security] ([#407](#407)) ([c34bcda](c34bcda)) * **deps:** update dependency brace-expansion@>=1.0.0 <=1.1.11 to v3 [security] ([#417](#417)) ([78f61f9](78f61f9)) * **deps:** update dependency brace-expansion@>=1.0.0 <=1.1.11 to v4 [security] ([#420](#420)) ([2464bd7](2464bd7)) * **deps:** update dependency brace-expansion@>=1.0.0 <=1.1.11 to v5 [security] ([#423](#423)) ([1801dbe](1801dbe)) * **deps:** update dependency fast-uri@<=3.1.0 to >=3.1.5 [security] ([#316](#316)) ([305bff7](305bff7)) * **deps:** update dependency fast-uri@<=3.1.1 to >=3.1.5 [security] ([#317](#317)) ([f17b009](f17b009)) * **deps:** update dependency hono@<4.12.25 to >=4.12.34 [security] ([#312](#312)) ([812ee1c](812ee1c)) * **deps:** update dependency immutable@>=4.0.0-rc.1 <4.3.8 to >=5.1.9 [security] ([#314](#314)) ([28a49b5](28a49b5)) * **deps:** update dependency immutable@>=5.0.0 <5.1.5 to >=5.1.9 [security] ([#315](#315)) ([95a7cdf](95a7cdf)) * **deps:** update dependency ip-address@<=10.1.0 to >=10.2.2 [security] ([#366](#366)) ([9d6f81e](9d6f81e)) * **deps:** update dependency ip-address@<=10.1.0 to >=10.5.0 [security] ([#399](#399)) ([cabff7e](cabff7e)) * **deps:** update dependency js-yaml@<=4.1.1 to >=4.3.1 [security] ([#332](#332)) ([59ebe41](59ebe41)) * **deps:** update dependency js-yaml@>=4.0.0 <4.1.1 to >=4.3.1 [security] ([#333](#333)) ([0720f4c](0720f4c)) * **deps:** update dependency nanoid@<3.3.8 to >=3.3.18 [security] ([#375](#375)) ([bec65e0](bec65e0)) * **deps:** update dependency next@>=10.0.0 <15.5.10 to >=15.5.23 [security] ([#336](#336)) ([b14de33](b14de33)) * **deps:** update dependency next@>=10.0.0 <15.5.10 to v16 [security] ([#383](#383)) ([5f2c9f4](5f2c9f4)) * **deps:** update dependency next@>=10.0.0 <15.5.14 to >=15.5.23 [security] ([#337](#337)) ([c08c1d3](c08c1d3)) * **deps:** update dependency next@>=10.0.0 <15.5.14 to v16 [security] ([#384](#384)) ([398f463](398f463)) * **deps:** update dependency next@>=10.0.0 <15.5.16 to >=15.5.23 [security] ([#338](#338)) ([32902ae](32902ae)) * **deps:** update dependency next@>=12.2.0 <15.5.16 to >=15.5.23 [security] ([#339](#339)) ([95794be](95794be)) * **deps:** update dependency next@>=13.0.0 <15.5.15 to >=15.5.23 [security] ([#340](#340)) ([446ac42](446ac42)) * **deps:** update dependency next@>=13.0.0 <15.5.16 to >=15.5.23 [security] ([#341](#341)) ([fe1bf79](fe1bf79)) * **deps:** update dependency next@>=13.4.0 <15.5.16 to >=15.5.23 [security] ([#342](#342)) ([6795985](6795985)) * **deps:** update dependency next@>=13.4.0 <15.5.16 to v16 [security] ([#381](#381)) ([6ba9b17](6ba9b17)) * **deps:** update dependency next@>=13.4.13 <15.5.16 to >=15.5.23 [security] ([#344](#344)) ([03724c5](03724c5)) * **deps:** update dependency next@>=13.4.13 <15.5.16 to v16 [security] ([#386](#386)) ([83e2c6a](83e2c6a)) * **deps:** update dependency next@>=13.4.6 <15.5.16 to >=15.5.23 [security] ([#343](#343)) ([c9aa1b8](c9aa1b8)) * **deps:** update dependency next@>=13.4.6 <15.5.16 to v16 [security] ([#385](#385)) ([ceddf47](ceddf47)) * **deps:** update dependency next@>=14.2.0 <15.5.16 to >=15.5.23 [security] ([#345](#345)) ([7c12d4a](7c12d4a)) * **deps:** update dependency next@>=14.2.0 <15.5.16 to v16 [security] ([#387](#387)) ([051039f](051039f)) * **deps:** update dependency next@>=15.0.0 <=15.4.4 to >=15.5.23 [security] ([#346](#346)) ([b63b535](b63b535)) * **deps:** update dependency next@>=15.0.0 <=15.4.4 to v16 [security] ([#388](#388)) ([da58d8b](da58d8b)) * **deps:** update dependency next@>=15.0.0 <15.1.2 to >=15.5.23 [security] ([#347](#347)) ([358ceaf](358ceaf)) * **deps:** update dependency next@>=15.0.0 <15.1.2 to v16 [security] ([#389](#389)) ([013ca1c](013ca1c)) * **deps:** update dependency next@>=15.0.0 <15.1.6 to >=15.5.23 [security] ([#348](#348)) ([3c861ba](3c861ba)) * **deps:** update dependency next@>=15.0.0 <15.1.6 to v16 [security] ([#390](#390)) ([823d871](823d871)) * **deps:** update dependency next@>=15.0.0 <15.2.2 to >=15.5.23 [security] ([#349](#349)) ([1457d9f](1457d9f)) * **deps:** update dependency next@>=15.0.0 <15.2.2 to v16 [security] ([#391](#391)) ([2593ec4](2593ec4)) * **deps:** update dependency next@>=15.0.0 <15.2.3 to >=15.5.23 [security] ([#350](#350)) ([f0d43fd](f0d43fd)) * **deps:** update dependency next@>=15.0.0 <15.2.3 to v16 [security] ([#392](#392)) ([4e6d492](4e6d492)) * **deps:** update dependency next@>=15.0.0 <15.5.16 to >=15.5.23 [security] ([#351](#351)) ([a8a04c3](a8a04c3)) * **deps:** update dependency next@>=15.0.0-canary.0 <15.4.7 to >=15.5.23 [security] ([#352](#352)) ([a310acc](a310acc)) * **deps:** update dependency next@>=15.0.4-canary.51 <15.1.8 to >=15.5.23 [security] ([#353](#353)) ([a0a1766](a0a1766)) * **deps:** update dependency next@>=15.1.0-canary.0 <15.1.9 to >=15.5.23 [security] ([#354](#354)) ([c631912](c631912)) * **deps:** update dependency next@>=15.1.1-canary.0 <15.1.10 to >=15.5.23 [security] ([#355](#355)) ([afe9af6](afe9af6)) * **deps:** update dependency next@>=15.1.1-canary.0 <15.1.12 to >=15.5.23 [security] ([#356](#356)) ([028e577](028e577)) * **deps:** update dependency next@>=9.5.0 <15.5.13 to >=15.5.23 [security] ([#335](#335)) ([3a409d6](3a409d6)) * **deps:** update dependency next@>=9.5.0 <15.5.13 to v16 [security] ([#382](#382)) ([b53de81](b53de81)) * **deps:** update dependency nuxt@>=3.0.0 <3.16.0 to >=4.4.8 [security] ([#369](#369)) ([17a7659](17a7659)) * **deps:** update dependency nuxt@>=3.0.0 <3.16.0 to >=4.5.2 [security] ([#400](#400)) ([5accda0](5accda0)) * **deps:** update dependency nuxt@>=3.1.0 <=3.21.5 to >=4.4.8 [security] ([#370](#370)) ([3e3006f](3e3006f)) * **deps:** update dependency nuxt@>=3.1.0 <=3.21.5 to >=4.5.2 [security] ([#401](#401)) ([9b56a6e](9b56a6e)) * **deps:** update dependency nuxt@>=3.4.3 <=3.21.5 to >=4.4.8 [security] ([#371](#371)) ([b8ec514](b8ec514)) * **deps:** update dependency nuxt@>=3.4.3 <=3.21.5 to >=4.5.2 [security] ([#402](#402)) ([825a509](825a509)) * **deps:** update dependency nuxt@>=3.6.0 <3.19.0 to >=4.4.8 [security] ([#372](#372)) ([513f91e](513f91e)) * **deps:** update dependency postcss@<8.5.10 to >=8.5.18 [security] ([#358](#358)) ([938be88](938be88)) * **deps:** update dependency postcss@<8.5.10 to >=8.5.26 [security] ([#376](#376)) ([14935a6](14935a6)) * **deps:** update dependency svgo@>=3.0.0 <3.3.3 to >=3.3.4 [security] ([#313](#313)) ([b7745dd](b7745dd)) * **deps:** update dependency svgo@>=3.0.0 <3.3.3 to v4 [security] ([#409](#409)) ([6c4d8e0](6c4d8e0)) * **deps:** update dependency tar@<=7.5.10 to >=7.5.22 [security] ([#321](#321)) ([2a0d62a](2a0d62a)) * **deps:** update dependency tar@<=7.5.2 to >=7.5.22 [security] ([#318](#318)) ([5cab03e](5cab03e)) * **deps:** update dependency tar@<=7.5.3 to >=7.5.22 [security] ([#319](#319)) ([57cb914](57cb914)) * **deps:** update dependency tar@<=7.5.9 to >=7.5.22 [security] ([#320](#320)) ([3e7262b](3e7262b)) * **deps:** update dependency tar@<6.2.1 to >=7.5.22 [security] ([#322](#322)) ([60dcad8](60dcad8)) * **deps:** update dependency tar@<7.5.7 to >=7.5.22 [security] ([#323](#323)) ([58b7381](58b7381)) * **deps:** update dependency tar@<7.5.8 to >=7.5.22 [security] ([#324](#324)) ([21d91ae](21d91ae)) * **deps:** update dependency tar@=7.5.1 to >=7.5.22 [security] ([#325](#325)) ([89bb7a6](89bb7a6)) * **deps:** update dependency undici@>=7.0.0 <7.28.0 to >=7.29.0 [security] ([#367](#367)) ([2c5c65c](2c5c65c)) * **deps:** update dependency undici@>=7.0.0 <7.28.0 to v8 [security] ([#410](#410)) ([87970b6](87970b6)) * **deps:** update dependency webpack-dev-server@<=5.2.0 to >=5.2.6 [security] ([#326](#326)) ([3d30b78](3d30b78)) * **deps:** update dependency webpack-dev-server@<=5.2.3 to >=5.2.6 [security] ([#327](#327)) ([be5a7e9](be5a7e9)) * **deps:** update patch updates ([#297](#297)) ([ddf53ab](ddf53ab)) ### Miscellaneous Chores * **deps:** lock file maintenance ([b120570](b120570)) * format pnpm-workspace.yaml with prettier ([#424](#424)) ([fd3caa3](fd3caa3))

renovate Bot requested a review from prisis as a code owner July 21, 2026 05:52

renovate Bot added priority-critical security labels Jul 21, 2026

renovate Bot enabled auto-merge (squash) July 21, 2026 05:52

renovate Bot force-pushed the renovate/npm-astro-=5.15.6-vulnerability branch from 0c62dad to daedc1e Compare July 24, 2026 21:15

renovate Bot changed the title ~~fix(deps): update dependency astro@<=5.15.6 to v7 [security]~~ fix(deps): update dependency astro@<=5.15.6 to >=6.4.8 [security] Jul 24, 2026

renovate Bot force-pushed the renovate/npm-astro-=5.15.6-vulnerability branch from daedc1e to ba3bf05 Compare July 25, 2026 01:49

renovate Bot changed the title ~~fix(deps): update dependency astro@<=5.15.6 to >=6.4.8 [security]~~ fix(deps): update dependency astro@<=5.15.6 to v7 [security] Jul 25, 2026

renovate Bot force-pushed the renovate/npm-astro-=5.15.6-vulnerability branch from ba3bf05 to 73d6ec2 Compare July 30, 2026 20:57

renovate Bot changed the title ~~fix(deps): update dependency astro@<=5.15.6 to v7 [security]~~ fix(deps): update dependency astro@<=5.15.6 to >=6.4.8 [security] Jul 30, 2026

renovate Bot force-pushed the renovate/npm-astro-=5.15.6-vulnerability branch from 73d6ec2 to ddbbbab Compare July 31, 2026 03:39

renovate Bot changed the title ~~fix(deps): update dependency astro@<=5.15.6 to >=6.4.8 [security]~~ fix(deps): update dependency astro@<=5.15.6 to v7 [security] Jul 31, 2026

renovate Bot force-pushed the renovate/npm-astro-=5.15.6-vulnerability branch from ddbbbab to dd80130 Compare August 10, 2026 21:10

renovate Bot changed the title ~~fix(deps): update dependency astro@<=5.15.6 to v7 [security]~~ fix(deps): update dependency astro@<=5.15.6 to >=6.4.8 [security] Aug 10, 2026

renovate Bot force-pushed the renovate/npm-astro-=5.15.6-vulnerability branch 8 times, most recently from 1e19c91 to 87b21be Compare August 10, 2026 22:41

fix(deps): update dependency astro@<=5.15.6 to v7 [security]

e8cbcd2

BREAKING CHANGE: updated dependencies to major versions

renovate Bot force-pushed the renovate/npm-astro-=5.15.6-vulnerability branch from 87b21be to e8cbcd2 Compare August 10, 2026 22:46

renovate Bot changed the title ~~fix(deps): update dependency astro@<=5.15.6 to >=6.4.8 [security]~~ fix(deps): update dependency astro@<=5.15.6 to v7 [security] Aug 10, 2026

chore: merge renovate update against main

a7439e3

Merge remote-tracking branch 'origin/main' into tmp299

6dee3d0

# Conflicts: # pnpm-lock.yaml

prisis merged commit 390e511 into main Aug 10, 2026
5 of 11 checks passed

prisis deleted the renovate/npm-astro-=5.15.6-vulnerability branch August 10, 2026 22:49

renovate Bot changed the title ~~fix(deps): update dependency astro@<=5.15.6 to v7 [security]~~ fix(deps): update dependency astro@<=5.15.6 to >=6.4.8 [security] Aug 10, 2026

Navigation Menu

Uh oh!

Uh oh!

fix(deps): update dependency astro@<=5.15.6 to >=6.4.8 [security] - #299

fix(deps): update dependency astro@<=5.15.6 to >=6.4.8 [security]#299
prisis merged 3 commits into
mainfrom
renovate/npm-astro-=5.15.6-vulnerability

renovate Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Jul 21, 2026

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

renovate Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Astro: Reflected XSS via unescaped View Transition animation properties

Details

Summary

Details

PoC

astro.config.mjs

src/pages/index.astro

Payload:

Impact

Suggested Fix

Severity

References

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Details

Summary

Severity

Details

Proof of Concept

Impact

Affected Versions

Patched Versions

Workarounds

Credits

Severity

References

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

Details

Summary

Details

Reachability

Proof of Concept

Impact

Severity

References

Release Notes

v6.4.8

Patch Changes

v6.4.7

Patch Changes

Configuration

Uh oh!

renovate Bot commented Jul 21, 2026

⚠️ Artifact update problem

File name: pnpm-lock.yaml

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Jul 21, 2026 •

edited

Loading

`astro.config.mjs`

`src/pages/index.astro`

`v6.4.8`

`v6.4.7`