fix(deps): update dependency astro@>=2.10.10 <5.18.1 to v7 [security] by renovate[bot] · Pull Request #403 · anolilab/unplugin-favicons

renovate · 2026-08-10T22:07:26Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
astro@>=2.10.10 <5.18.1 (source)	[`>=6.4.8` → `>=7.2.0`](https://renovatebot.com/diffs/npm/astro@>=2.10.10 <5.18.1/6.4.8/7.2.0)

Astro: Reflected XSS via unescaped View Transition animation properties

GHSA-4g3v-8h47-v7g6

More information

Details

Summary

Astro's server-side View Transition CSS generator interpolates animation properties into an inline <style> element without escaping them for the CSS and HTML contexts.

An attacker-controlled value passed to an animation property such as duration can contain a </style> sequence, terminate the generated style element, and inject arbitrary HTML or JavaScript.

This is similar to GHSA-8hv8-536x-4wqp, but exploits a different injection point: unescaped View Transition animation values in a server-generated <style> element rather than an unescaped slot name in a hydration template.

Like GHSA-8hv8-536x-4wqp, exploitation requires an application to pass attacker-controlled data to an Astro API. However, the value is subsequently inserted into the HTML response without context-appropriate escaping by Astro.

Details

packages/astro/src/runtime/server/transition.ts

The generated stylesheet is wrapped in a <style> element and marked as HTML-safe:

const css = sheet.toString();
result._metadata.extraHead.push(markHTMLString(`<style>${css}</style>`));

Animation properties are added to the stylesheet without escaping:

if (anim.duration) {
  addAnimationProperty(builder, 'animation-duration', toTimeValue(anim.duration));
}

For string values, toTimeValue() returns the input unchanged:

export function toTimeValue(num: number | string) {
  return typeof num === 'number' ? num + 'ms' : num;
}

As a result, a duration value containing </style> can escape from the generated style element.

Other TransitionAnimation properties, including easing, direction, delay, fillMode, and name, are serialized by the same animation builder. The following PoC only relies on the official fade() helper and its duration option.

PoC

Using:

astro@7.0.9
@astrojs/node@11.0.2

`astro.config.mjs`

import node from '@astrojs/node';
import { defineConfig } from 'astro/config';

export default defineConfig({
  output: 'server',
  adapter: node({ mode: 'standalone' }),
});

`src/pages/index.astro`

---
import { fade } from 'astro:transitions';

const duration = Astro.url.searchParams.get('duration') ?? '300ms';
---

<html lang="en">
  <head>
    <meta charset="utf-8" />
    <title>PoC</title>
  </head>
  <body>
    <div transition:animate={fade({ duration })}>
      Animated content
    </div>
  </body>
</html>

Payload:

open:

http://localhost:4321/?duration=%3C%2Fstyle%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E%3C!--

The browser interprets </style> as the end of the generated style element and executes the injected script. An alert dialog is displayed when the page is opened.

Impact

An attacker who can control a View Transition animation value can execute arbitrary JavaScript in the origin of the affected Astro application.

The query-based reflected XSS scenario affects on-demand/server-rendered routes, such as:

projects configured with output: "server";
pages using export const prerender = false;
other server-side data flows that pass attacker-controlled values into a View Transition animation definition.

Successful exploitation may allow access to sensitive page data and authenticated actions available to the victim.

Suggested Fix

Animation values should be serialized using context-appropriate CSS escaping or validation before being added to the generated stylesheet.

Additionally, content inserted into a raw <style> element must not be able to contain an HTML end-tag sequence such as </style>. The final generated CSS should be made safe for the HTML raw-text context before it is passed to markHTMLString().

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

CVE-2026-59727 / GHSA-7pw4-f3q4-r2p2

More information

Details

Summary

When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS).

Severity

Although a generic reflected XSS scores in the Medium range, exploitation here requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This mitigating precondition places the real-world severity at Low.

Details

In generateHydrateScript() (packages/astro/src/runtime/server/hydration.ts), every island property is HTML-escaped before serialization — the attrs, props, and opts assignments all pass through escapeHTML(). The transition directives, however, were copied verbatim:

transitionDirectivesToCopyOnIsland.forEach((name) => {
  if (typeof props[name] !== 'undefined') {
    island.props[name] = props[name]; // not escaped
  }
});

The <astro-island> element is serialized via renderElement('astro-island', island, false) with shouldEscape=false, and toAttributeString() returns the value unchanged in that mode. As a result there is no downstream re-escaping, and the raw directive value reaches the HTML response. This is the same output sink previously addressed for slot names in GHSA-8hv8-536x-4wqp.

The affected directives are:

data-astro-transition-scope (transition:scope)
data-astro-transition-persist (transition:persist)
data-astro-transition-persist-props (transition:persist-props)

Note that transition:persist is typed boolean | string, so passing a string value is a supported use of the API.

Proof of Concept

A component that reflects a query parameter into a transition directive:

---
const persist = Astro.url.searchParams.get('persist') ?? 'default';
---
<Island client:load transition:persist={persist} />

Request:

https://example.com/?persist="><img src=x onerror=alert(document.domain)>

Rendered output (before the fix):

<astro-island … data-astro-transition-persist=""><img src=x onerror=alert(document.domain)>></astro-island>

The " closes the attribute and the injected <img onerror=…> executes in the victim's browser.

Impact

Reflected XSS. An attacker who can induce a victim to visit a crafted URL can execute arbitrary script in the victim's session on the origin, subject to the requirement that the target application reflects untrusted input into one of the affected transition directives.

Affected Versions

astro >= 3.10.0, < 7.0.4 (introduced in 3.10.0, PR #7861).

Patched Versions

astro >= 7.0.4. Fixed in PR #17212 by HTML-escaping transition directive values before they are rendered onto the island element.

Workarounds

Do not pass untrusted or request-derived input into transition:persist, transition:scope, or transition:persist-props. If such input is required, HTML-escape or strictly validate it before passing it to the directive. Upgrading to astro@7.0.4 or later removes the need for manual mitigation.

Credits

Reported by @jlgore.

Severity

CVSS Score: 2.1 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

CVE-2026-59729 / GHSA-f48w-9m4c-m7f5

More information

Details

Summary

The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing "' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context, resulting in XSS.

Details

renderHTMLElement builds attributes directly:

for (const attr in props) {
  attrHTML += ` ${attr}="${toAttributeString(await props[attr])}"`;
}

The attribute name (attr) is interpolated raw; only the value is escaped via toAttributeString. By contrast, the hardened addAttribute in util.ts rejects invalid names:

if (INVALID_ATTR_NAME_CHAR.test(key)) { return ''; } // /[\s"'>/=]/

renderHTMLElement is reached from component.ts when the component is a native HTMLElement subclass:

if (!renderer && typeof HTMLElement === 'function' && componentIsHTMLElement(Component)) {
  const output = await renderHTMLElement(result, Component, _props, slots);
}

where _props carries spread props verbatim.

Reachability

The branch only runs when typeof HTMLElement === 'function' at SSR time. In default Node SSR HTMLElement is undefined, so the branch is dead. It becomes reachable when the SSR runtime exposes a global HTMLElement (Deno, Bun with a DOM shim, or jsdom/happy-dom in Node) and a class extending HTMLElement is used directly as an Astro component that receives untrusted-keyed spread props.

Proof of Concept

Given malicious spread props:

const maliciousProps = {
  'onmouseover=alert(document.domain) x': 'y',
  'x><script>alert(1)</script>': 'z',
};

addAttribute (post-fix) → <my-el></my-el> (key stripped — safe)
renderHTMLElement → <my-el onmouseover=alert(document.domain) x="y" x><script>alert(1)</script>="z"></my-el> (handler + <script> injected — XSS)

Equivalent Astro template, served by an SSR runtime that defines a global HTMLElement:

---
import MyElement from '../MyElement.js'; // class MyElement extends HTMLElement {}
const userInput = Astro.url.searchParams;  // untrusted keys
---
<MyElement {...Object.fromEntries(userInput)} />

Impact

Cross-site scripting (CWE-79) via attribute-name breakout — the same vulnerability class as CVE-2026-54298, in a code path its fix did not cover. An attacker who controls the keys of an object spread onto a native-HTMLElement-subclass component can inject arbitrary event-handler attributes or sibling elements (including <script>) into the SSR output. Reachability is constrained by the runtime and component preconditions described above.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

withastro/astro (astro@>=2.10.10 <5.18.1)

`v7.2.0`

Compare Source

Minor Changes

#17174 0224a3a Thanks @matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.
```
astro preview --background
```
When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:
```
astro preview status
astro preview logs
astro preview logs --follow
astro preview stop
```
If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.
#17532 7f94895 Thanks @florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:
```
// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  logger: {
-    entrypoint: new URL('./src/logger.js', import.meta.url),
+    entrypoint: './src/logger.js',
  },
});
```
Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.
#17084 961bbe5 Thanks @matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.
```
import type { AstroPrerenderer, PrerenderResult } from 'astro';

const prerenderer: AstroPrerenderer = {
  name: 'my-adapter:prerenderer',
  getStaticPaths,
  async render(request, { routeData }): Promise<PrerenderResult> {
    const { response, metadata } = await renderInRuntime(request, routeData);
    return { response, metadata };
  },
};
```
This is a non-breaking widening: prerenderers that return a bare Response continue to work unchanged, and in-process prerenderers can keep returning a Response since the build collects their metadata directly.
#16871 90c98ae Thanks @adamchal! - Adds session: false in astro.config to opt out of session support. Projects that do not set session: false see no behavior change.
```
import { defineConfig } from 'astro/config';

export default defineConfig({
  session: false,
});
```
The session runtime and dependencies (unstorage) are now tree-shaken out of the SSR bundle for any project where no session driver is wired via:
- session: false
- no session config at all
- a session config without a driver
Useful for serverless/edge runtimes where cold-start parse time is sensitive.
#17084 961bbe5 Thanks @matthewp! - Adds experimental support for incremental static builds with experimental.incrementalBuild.

When enabled, Astro can skip regenerating static pages from dynamic routes when both the page's module dependencies and its data cache key are unchanged from the previous build. This currently applies to pages returned from getStaticPaths() that include a cacheKey.
```
// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  experimental: {
    incrementalBuild: true,
  },
});
```
Return a cacheKey for each generated page from getStaticPaths():
```
---
export async function getStaticPaths() {
  const posts = await fetchPosts();

  return posts.map((post) => ({
    params: { slug: post.slug },
    props: { post },
    cacheKey: post.digest,
  }));
}
---
```
For incremental builds to skip rendering in CI, Astro's cache directory must be preserved between builds. Astro empties the output directory on each build and restores skipped pages from the cache directory, so only that directory needs to persist. For the default config, cache and restore node_modules/.astro/ before running astro build.

See the experimental incremental static builds documentation for more information.
#17084 961bbe5 Thanks @matthewp! - Adds the optional digest property to content collection entries.

Loaders can provide an opaque digest value that changes when an entry changes. This is now reflected in the CollectionEntry type returned by getCollection() and getEntry(), making it easier to detect content changes without re-hashing large entry bodies.
```
---
import { getCollection } from 'astro:content';

const posts = await getCollection('blog');

for (const post of posts) {
  console.log(post.digest);
}
---
```
The property is optional because not every loader provides a digest. See incremental static builds for how digest can be used as a cacheKey.

Patch Changes

#17534 5a5337e Thanks @florian-lefebvre! - Improves logger.entrypoint reference docs
#17529 d52a787 Thanks @QVinto! - Fixes astro dev crashing with Invalid URL when --host is set to a specific non-loopback address

Vite only reports a local URL for loopback hosts. When the dev server was started with --host <custom-address> bound to a specific non-loopback address (a LAN or Tailscale IP, for example), the URL was reported under network and local was empty, so writing the dev lock file threw Invalid URL and killed a server that had already started successfully.

The lock file URL now falls back to the network URL, and a server that exposes no URL at all is left untracked rather than being taken down by lock file bookkeeping.
#17566 296248c Thanks @astrobot-houston! - Fixes fontProviders.googleicons() returning the full icon font (~3.9MB) instead of only the requested glyphs when multiple experimental.glyphs are specified
#17560 ef45de1 Thanks @astrobot-houston! - Fixes Astro.url.pathname for non-index pages when using build.format: 'preserve'. Previously, a page like src/pages/about-me.astro would output to dist/about-me.html but Astro.url.pathname would incorrectly return /about-me/ instead of /about-me.html.
#17573 0089f83 Thanks @astrobot-houston! - Fixes a Content Layer build crash that could occur when another dependency causes an older version of neotraverse to be hoisted to the project root
#17571 116f700 Thanks @astrobot-houston! - Fixes cookies set via Astro.cookies.set() inside a custom 404.astro or 500.astro error page being silently dropped from the final response
#17579 3ea55ce Thanks @bluwy! - Supports the devEngines field in package.json when detecting the package manager for install commands
#17422 e4e2037 Thanks @jiwonyoon-dev! - Fixes popover being rendered as popover="true"/popover="false" on custom elements (tag names containing a hyphen). Per the Popover API, the attribute only accepts "auto", "manual", or being absent, so boolean values are now always rendered as a bare popover attribute (or omitted), regardless of the tag name.

`v7.1.6`

Compare Source

Patch Changes

#17536 ff97b86 Thanks @dmgawel! - Fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes
#17383 296e1b0 Thanks @thelazylamaGit! - Fixes stale dev CSS after editing component style blocks and CSS files in dev

#17543 bbc1ec9 Thanks @ematipico! - Adds a feature to experimental.collectionStorage that allows to change the size of chunks.

For example, you can reduce the size of chunks to 1MB:

// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  experimental: {
    collectionStorage: {
      type: 'chunked',
      chunkSize: 1024 * 1024,
    },
  },
});

#17545 5214663 Thanks @ematipico! - Bumps the Astro compiler to the latest version. Changelog.

`v7.1.5`

Compare Source

Patch Changes

#17524 7613030 Thanks @matthewp! - Fixes a bug where an error while finalizing a request could prevent a response from being sent
#17480 f61ba9c Thanks @florian-lefebvre! - Fixes a case where a custom logger.entrypoint failed to load at runtime in a built server bundle.
#17525 e614b7b Thanks @matthewp! - Fixes action path resolution so that properties of a resolved action function are not treated as routable path segments
#17284 c775c1f Thanks @matthewp! - Fixes a bug where the custom 404 (or 500) page was not rendered when a middleware rewrite targeted a route that returned an empty 404/500 response, and a blank page was returned instead
#17474 c895b12 Thanks @nicksnyder! - Updates dependency js-yaml to v4.3.0
Updated dependencies [c895b12]:
- @astrojs/internal-helpers@0.10.2
- @astrojs/markdown-remark@7.2.2
- @astrojs/markdown-satteri@0.3.5

`v7.1.4`

Compare Source

Patch Changes

#17488 d4f266d Thanks @emerson-d-lopes! - Fixes duplicate CSS files being emitted in server output when a prerendered page and a server-rendered page share the same styles (e.g. a shared layout importing Tailwind). The prerender and SSR environments each emitted their own copy of the same stylesheet (index.X.css and _..Y.css); the SSR build now reuses the CSS asset filename from the prerender build when the stylesheet is backed by the same CSS source modules, so only a single file is emitted.
#17472 4dc590c Thanks @astrobot-houston! - Adds the missing background prop to the <Image /> and <Picture /> component types. The prop already worked at runtime, but was absent from the types, causing astro check to report that background does not exist on the component props
#17292 0fc519d Thanks @astrobot-houston! - Fixes missing scoped styles for child components inside client:only islands in production builds
#17421 f1448de Thanks @iamkaleemsajjad-hue! - Fixes session runtime errors being silently swallowed by console.error instead of routing through Astro's logger
#17421 f1448de Thanks @iamkaleemsajjad-hue! - Fixes a session being left in a partial state after a storage failure during session.regenerate(), preventing unnecessary storage reads on subsequent operations
#17517 82bf7e2 Thanks @Hashim1999164! - Prevents a visible terminal window from popping up on Windows when the dev server runs in background mode. The detached child process is now spawned with windowsHide: true, so console-subsystem grandchildren (such as workerd.exe) no longer get a new focus-stealing window allocated by Windows Terminal.
#17510 eaa1fb0 Thanks @astrobot-houston! - Fixes the glob() loader watcher so negation patterns like !docs/drafts/** correctly exclude files during development, matching the behavior of the initial scan. Previously, negations were treated as independent matchers, causing unrelated files (including .astro/data-store.json) to be ingested as collection entries
#17511 704e570 Thanks @astrobot-houston! - Fixes TypeScript path aliases from tsconfig.json not resolving in astro.config.ts

`v7.1.3`

Compare Source

Patch Changes

#17427 630b382 Thanks @astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

`v7.1.2`

Compare Source

Patch Changes

#17445 a5f7230 Thanks @ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.
#17402 a89c137 Thanks @farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)
#17405 91992ef Thanks @Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

`v7.1.1`

Compare Source

Patch Changes

#17399 4b03702 Thanks @matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

`v7.1.0`

Compare Source

Minor Changes

#17302 5f4dc03 Thanks @astrobot-houston! - Adds a new deferRender option to the glob() content loader

When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
```
// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';

const docs = defineCollection({
  loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
```
By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
#17296 30698a2 Thanks @ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
```
// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  experimental: {
    collectionStorage: 'chunked',
  },
});
```
Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.
#17214 44c4989 Thanks @ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

Scoping sources and hashes in your config

Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.

// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  security: {
    csp: {
      scriptDirective: {
        resources: [{ resource: 'https://cdn.example.com', kind: 'element' }],
      },
      styleDirective: {
        resources: [{ resource: "'unsafe-inline'", kind: 'attribute' }],
      },
    },
  },
});

Scoping at runtime

The same kind option is available on the runtime CSP API, where the existing methods now also accept an object:

ctx.csp.insertScriptResource({ resource: 'https://cdn.example.com', kind: 'element' });
ctx.csp.insertStyleResource({ resource: "'unsafe-inline'", kind: 'attribute' });

#17258 84814d4 Thanks @astrobot-houston! - Adds a new format() option to the paginate utility. The format() option is a function that accepts the current URL of the page, and returns a new URL.

For example, when your host only supports URLs using the .html extension, you can use format() to add it to the generated URLs:

---
export async function getStaticPaths({ paginate }) {
  // Load your data with fetch(), getCollection(), etc.
  const response = await fetch(`https://pokeapi.co/api/v2/pokemon?limit=150`);
  const result = await response.json();
  const allPokemon = result.results;

  // Return a paginated collection of paths for all items
  return paginate(allPokemon, {
    pageSize: 10,
    format: (url) => `${url}.html`,
  });
}

const { page } = Astro.props;
---

#17331 7db6420 Thanks @matthewp! - Adds a --ignore-lock flag to astro dev for starting a dev server without checking or writing the lock file, so it can run alongside an already-running dev server for the same project.

The new instance is not tracked by astro dev stop, astro dev status, or astro dev logs. --ignore-lock cannot be combined with --background (or an auto-detected AI agent environment, which runs dev servers in the background automatically) or --force, since those rely on the lock file.
```
astro dev --ignore-lock
```
#17389 16de021 Thanks @florian-lefebvre! - Allows passing URL entrypoints when configuring the logger

Matching other APIs like session drivers or font providers, the logger entrypoint can now be a URL:
```
import { defineConfig } from 'astro/config';

export default defineConfig({
  logger: {
    entrypoint: new URL('./logger.js', import.meta.url),
  },
});
```

Patch Changes

#17332 4407483 Thanks @astrobot-houston! - Fixes the JSON logger crashing with process is not defined in non-Node runtimes like Cloudflare's workerd. The JSON logger now uses console.log/console.error instead of process.stdout/process.stderr, matching the pattern already used by the console logger.
#17391 186a1e7 Thanks @florian-lefebvre! - Fixes a case where an integration could not update the logger with updateConfig()
#17394 d9f99e1 Thanks @matthewp! - Fixes element-specific CSP directives to preserve the existing behavior of configured script and style resources
#17374 b2d1b3e Thanks @astrobot-houston! - Fixes dev server returning 404 for ?url imported assets when accessed via browser navigation
#17390 ed71eaf Thanks @florian-lefebvre! - Removes an unused and undocumented generic from the AstroLoggerDestination type
#17393 092da56 Thanks @matthewp! - Hardens generated transition styles, development metadata, and server island URLs when embedding dynamic values

`v7.0.9`

Compare Source

Patch Changes

#17286 a249317 Thanks @astrobot-houston! - Fixes the first browser visit after astro dev starts triggering an immediate full page reload
#17369 a94d4a5 Thanks @adamchal! - Fixes an issue where a client island could permanently fail to hydrate if the first attempt to load its component failed. Islands now reliably recover from transient import failures, which previously did not work for React components during astro dev.

`v7.0.8`

Compare Source

Patch Changes

#17363 3f4efc5 Thanks @astrobot-houston! - Fixes astro preview --open not opening a browser when using an adapter with a custom preview entrypoint, such as @astrojs/cloudflare
#17313 e2e319d Thanks @ronits2407! - Exposes the AstroRuntimeLogger interface to allow users to properly type the logger functions at runtime.
#17328 025cc74 Thanks @matthewp! - Fixes astro dev --force not replacing an already-running dev server
#17353 2bba277 Thanks @ematipico! - Updates the Astro compiler to the latest version, which fixes many regressions. Refer to the changelog for more details.
#17344 79a41e0 Thanks @adamchal! - Improves rendering performance for pages with many component instances, such as repeated MDX <Content /> components.
Updated dependencies [64b0d66]:
- @astrojs/markdown-satteri@0.3.4

`v7.0.7`

Compare Source

Patch Changes

#17318 23a4120 Thanks @astrobot-houston! - Fixes CSS module scoped-name hash mismatch in astro dev when using vite.css.transformer: 'lightningcss' with content collections. Previously, a component importing a CSS module and rendered via content collection render() would get different class name hashes in the element and the injected <style> tag, causing styles not to apply.
#17323 4298883 Thanks @ematipico! - Fixes a dev server memory leak which caused Node.js to emit warnings in the console.
#17323 4298883 Thanks @ematipico! - Fixes a dev server crash when a .html or /index.html suffixed request (such as those netlify dev probes as pretty-URL fallbacks) matched a dynamic endpoint route, causing a TypeError: Missing parameter error
#17325 cebc404 Thanks @astrobot-houston! - Fixes a bug where CSS @import rules could end up mid-stylesheet after inline CSS chunks were merged during build, causing browsers to silently ignore them
#17323 4298883 Thanks @ematipico! - Fixes a build regression that could leave unresolved preload markers in inlined scripts with external dynamic imports
Updated dependencies [4298883, 4298883]:
- @astrojs/telemetry@3.3.3

`v7.0.6`

Compare Source

Patch Changes

#17261 79aa99c Thanks @astrobot-houston! - Fixes a false deprecation warning for markdown.gfm and markdown.smartypants when using the Container API
#17247 f94280d Thanks @chatman-media! - Fixes route generation throwing "Missing parameter" (or silently dropping the segment) when a dynamic param's value is 0. The generator used truthy checks instead of checking for undefined, so paginate(posts, { params: { categoryId: 0 } }) would crash even though 0 is a perfectly valid param value.
#17278 6f11739 Thanks @astrobot-houston! - Fixes missing CSS for virtual style modules (e.g., responsive image layout styles) in dev mode when JavaScript is disabled
#17250 0b30b35 Thanks @matthewp! - Fixes the security.checkOrigin check so it is applied consistently to Astro Actions and on-demand endpoints, regardless of how the request pipeline is composed. Previously, the origin check could be skipped in the composable astro/hono pipeline depending on the order of the middleware() primitive (or when it was omitted).
#17274 8c3579b Thanks @astrobot-houston! - Fixes missing render() type overload for live collection entries. Previously, calling render() on a LiveDataEntry produced a TypeScript error when using only live.config.ts without a content.config.ts.
#17257 4208297 Thanks @astrobot-houston! - Fixes astro check failing to find @astrojs/check and typescript when astro is installed in a directory outside the project tree (e.g. pnpm virtual store)
#17272 b428648 Thanks [@

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-08-10T22:07:30Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

ERROR: This version of pnpm requires at least Node.js v22.13
The current version of Node.js is v18.20.8
Visit https://r.pnpm.io/comp to see the list of past pnpm versions with respective Node.js version support.

github-actions · 2026-08-10T22:29:54Z

Thank you for following the naming conventions! 🙏

BREAKING CHANGE: updated dependencies to major versions

…-08-19) ### ⚠ BREAKING CHANGES * **deps:** updated dependencies to major versions * chore: merge renovate update against main * chore: merge renovate update against main * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions * chore: merge renovate update against main * **deps:** updated dependencies to major versions Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> ### Bug Fixes * **build:** resolve pnpm audit advisories ([60384be](60384be)) * **deps:** update angular monorepo to >=21.2.19 ([#433](#433)) ([d36dfe9](d36dfe9)) * **deps:** update anolilab/workflows digest to 7d86f54 ([#292](#292)) ([b23dcf1](b23dcf1)) * **deps:** update astro monorepo to >=7.1.6 ([#434](#434)) ([b20afcc](b20afcc)) * **deps:** update babel monorepo (patch) ([#294](#294)) ([f02eeb2](f02eeb2)) * **deps:** update dependency @angular/common@<19.2.16 to v20 [security] ([#361](#361)) ([2977531](2977531)) * **deps:** update dependency @angular/compiler@>=19.0.0-next.0 <19.2.17 to v20 [security] ([#362](#362)) ([a8fe1c8](a8fe1c8)) * **deps:** update dependency @angular/compiler@>=19.0.0-next.0 <19.2.18 to v20 [security] ([#363](#363)) ([5b5d10b](5b5d10b)) * **deps:** update dependency @angular/compiler@>=19.0.0-next.0 <19.2.20 to v20 [security] ([#364](#364)) ([e100192](e100192)) * **deps:** update dependency @babel/core to ^7.29.7 ([#435](#435)) ([4ab1585](4ab1585)) * **deps:** update dependency @nuxt/devtools@<2.6.4 to v3 [security] ([#373](#373)) ([98a78a1](98a78a1)) * **deps:** update dependency @rspack/core to ^2.0.8 ([#436](#436)) ([1f007d7](1f007d7)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#329](#329)) ([0d58b0d](0d58b0d)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#411](#411)) ([b17988b](b17988b)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#418](#418)) ([c0784eb](c0784eb)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#421](#421)) ([6c402e7](6c402e7)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#425](#425)) ([13ad0ea](13ad0ea)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#426](#426)) ([a360ce6](a360ce6)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#427](#427)) ([e84bce2](e84bce2)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#428](#428)) ([35d65b3](35d65b3)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#429](#429)) ([bc9cf64](bc9cf64)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#430](#430)) ([0d650bf](0d650bf)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#431](#431)) ([5ba4fd5](5ba4fd5)) * **deps:** update dependency @sveltejs/kit to v2.70.2 [security] ([#432](#432)) ([1a2bc7c](1a2bc7c)) * **deps:** update dependency @sveltejs/kit@<=2.57.0 to >=2.70.2 [security] ([#330](#330)) ([b0a4bfd](b0a4bfd)) * **deps:** update dependency @sveltejs/kit@>=2.0.0 <2.20.6 to >=2.70.2 [security] ([#331](#331)) ([885ca56](885ca56)) * **deps:** update dependency astro@<=5.15.6 to v7 [security] ([#299](#299)) ([390e511](390e511)) * **deps:** update dependency astro@<5.14.3 to >=6.4.8 [security] ([#300](#300)) ([4b3efa8](4b3efa8)) * **deps:** update dependency astro@<5.15.8 to >=6.4.8 [security] ([#301](#301)) ([aededa5](aededa5)) * **deps:** update dependency astro@<5.15.8 to v7 [security] ([#412](#412)) ([1b66e60](1b66e60)) * **deps:** update dependency astro@<5.15.9 to >=6.4.8 [security] ([#302](#302)) ([21b224a](21b224a)) * **deps:** update dependency astro@<5.15.9 to v7 [security] ([#413](#413)) ([c20e6c6](c20e6c6)) * **deps:** update dependency astro@<6.1.10 to >=6.4.8 [security] ([#304](#304)) ([b1c879a](b1c879a)) * **deps:** update dependency astro@<6.1.10 to v7 [security] ([#415](#415)) ([78e66eb](78e66eb)) * **deps:** update dependency astro@<6.1.6 to >=6.4.8 [security] ([#303](#303)) ([ef232a0](ef232a0)) * **deps:** update dependency astro@<6.1.6 to v7 [security] ([#414](#414)) ([c2f36b5](c2f36b5)) * **deps:** update dependency astro@>=2.10.10 <5.18.1 to >=6.4.8 [security] ([#305](#305)) ([51eae66](51eae66)) * **deps:** update dependency astro@>=2.10.10 <5.18.1 to v7 [security] ([#403](#403)) ([1ea12e9](1ea12e9)) * **deps:** update dependency astro@>=2.16.0 <5.15.5 to >=6.4.8 [security] ([#306](#306)) ([4fd07f6](4fd07f6)) * **deps:** update dependency astro@>=2.16.0 <5.15.5 to v7 [security] ([#404](#404)) ([3a51ad0](3a51ad0)) * **deps:** update dependency astro@>=5.0.0-alpha.0 <5.13.2 to >=6.4.8 [security] ([#307](#307)) ([ac1639c](ac1639c)) * **deps:** update dependency astro@>=5.0.0-alpha.0 <5.13.2 to v7 [security] ([#405](#405)) ([f883968](f883968)) * **deps:** update dependency body-parser@<1.20.3 to >=1.20.6 [security] ([#311](#311)) ([310a672](310a672)) * **deps:** update dependency body-parser@<1.20.3 to v2 [security] ([#408](#408)) ([19e3663](19e3663)) * **deps:** update dependency brace-expansion@<1.1.13 to >=1.1.18 [security] ([#309](#309)) ([1e4f0f5](1e4f0f5)) * **deps:** update dependency brace-expansion@<1.1.13 to v2 [security] ([#406](#406)) ([3fc16d8](3fc16d8)) * **deps:** update dependency brace-expansion@<1.1.13 to v3 [security] ([#416](#416)) ([ca94d94](ca94d94)) * **deps:** update dependency brace-expansion@<1.1.13 to v4 [security] ([#419](#419)) ([c1a4004](c1a4004)) * **deps:** update dependency brace-expansion@<1.1.13 to v5 [security] ([#422](#422)) ([007be58](007be58)) * **deps:** update dependency brace-expansion@>=1.0.0 <=1.1.11 to >=1.1.18 [security] ([#310](#310)) ([ff22c18](ff22c18)) * **deps:** update dependency brace-expansion@>=1.0.0 <=1.1.11 to v2 [security] ([#407](#407)) ([c34bcda](c34bcda)) * **deps:** update dependency brace-expansion@>=1.0.0 <=1.1.11 to v3 [security] ([#417](#417)) ([78f61f9](78f61f9)) * **deps:** update dependency brace-expansion@>=1.0.0 <=1.1.11 to v4 [security] ([#420](#420)) ([2464bd7](2464bd7)) * **deps:** update dependency brace-expansion@>=1.0.0 <=1.1.11 to v5 [security] ([#423](#423)) ([1801dbe](1801dbe)) * **deps:** update dependency fast-uri@<=3.1.0 to >=3.1.5 [security] ([#316](#316)) ([305bff7](305bff7)) * **deps:** update dependency fast-uri@<=3.1.1 to >=3.1.5 [security] ([#317](#317)) ([f17b009](f17b009)) * **deps:** update dependency hono@<4.12.25 to >=4.12.34 [security] ([#312](#312)) ([812ee1c](812ee1c)) * **deps:** update dependency immutable@>=4.0.0-rc.1 <4.3.8 to >=5.1.9 [security] ([#314](#314)) ([28a49b5](28a49b5)) * **deps:** update dependency immutable@>=5.0.0 <5.1.5 to >=5.1.9 [security] ([#315](#315)) ([95a7cdf](95a7cdf)) * **deps:** update dependency ip-address@<=10.1.0 to >=10.2.2 [security] ([#366](#366)) ([9d6f81e](9d6f81e)) * **deps:** update dependency ip-address@<=10.1.0 to >=10.5.0 [security] ([#399](#399)) ([cabff7e](cabff7e)) * **deps:** update dependency js-yaml@<=4.1.1 to >=4.3.1 [security] ([#332](#332)) ([59ebe41](59ebe41)) * **deps:** update dependency js-yaml@>=4.0.0 <4.1.1 to >=4.3.1 [security] ([#333](#333)) ([0720f4c](0720f4c)) * **deps:** update dependency nanoid@<3.3.8 to >=3.3.18 [security] ([#375](#375)) ([bec65e0](bec65e0)) * **deps:** update dependency next@>=10.0.0 <15.5.10 to >=15.5.23 [security] ([#336](#336)) ([b14de33](b14de33)) * **deps:** update dependency next@>=10.0.0 <15.5.10 to v16 [security] ([#383](#383)) ([5f2c9f4](5f2c9f4)) * **deps:** update dependency next@>=10.0.0 <15.5.14 to >=15.5.23 [security] ([#337](#337)) ([c08c1d3](c08c1d3)) * **deps:** update dependency next@>=10.0.0 <15.5.14 to v16 [security] ([#384](#384)) ([398f463](398f463)) * **deps:** update dependency next@>=10.0.0 <15.5.16 to >=15.5.23 [security] ([#338](#338)) ([32902ae](32902ae)) * **deps:** update dependency next@>=12.2.0 <15.5.16 to >=15.5.23 [security] ([#339](#339)) ([95794be](95794be)) * **deps:** update dependency next@>=13.0.0 <15.5.15 to >=15.5.23 [security] ([#340](#340)) ([446ac42](446ac42)) * **deps:** update dependency next@>=13.0.0 <15.5.16 to >=15.5.23 [security] ([#341](#341)) ([fe1bf79](fe1bf79)) * **deps:** update dependency next@>=13.4.0 <15.5.16 to >=15.5.23 [security] ([#342](#342)) ([6795985](6795985)) * **deps:** update dependency next@>=13.4.0 <15.5.16 to v16 [security] ([#381](#381)) ([6ba9b17](6ba9b17)) * **deps:** update dependency next@>=13.4.13 <15.5.16 to >=15.5.23 [security] ([#344](#344)) ([03724c5](03724c5)) * **deps:** update dependency next@>=13.4.13 <15.5.16 to v16 [security] ([#386](#386)) ([83e2c6a](83e2c6a)) * **deps:** update dependency next@>=13.4.6 <15.5.16 to >=15.5.23 [security] ([#343](#343)) ([c9aa1b8](c9aa1b8)) * **deps:** update dependency next@>=13.4.6 <15.5.16 to v16 [security] ([#385](#385)) ([ceddf47](ceddf47)) * **deps:** update dependency next@>=14.2.0 <15.5.16 to >=15.5.23 [security] ([#345](#345)) ([7c12d4a](7c12d4a)) * **deps:** update dependency next@>=14.2.0 <15.5.16 to v16 [security] ([#387](#387)) ([051039f](051039f)) * **deps:** update dependency next@>=15.0.0 <=15.4.4 to >=15.5.23 [security] ([#346](#346)) ([b63b535](b63b535)) * **deps:** update dependency next@>=15.0.0 <=15.4.4 to v16 [security] ([#388](#388)) ([da58d8b](da58d8b)) * **deps:** update dependency next@>=15.0.0 <15.1.2 to >=15.5.23 [security] ([#347](#347)) ([358ceaf](358ceaf)) * **deps:** update dependency next@>=15.0.0 <15.1.2 to v16 [security] ([#389](#389)) ([013ca1c](013ca1c)) * **deps:** update dependency next@>=15.0.0 <15.1.6 to >=15.5.23 [security] ([#348](#348)) ([3c861ba](3c861ba)) * **deps:** update dependency next@>=15.0.0 <15.1.6 to v16 [security] ([#390](#390)) ([823d871](823d871)) * **deps:** update dependency next@>=15.0.0 <15.2.2 to >=15.5.23 [security] ([#349](#349)) ([1457d9f](1457d9f)) * **deps:** update dependency next@>=15.0.0 <15.2.2 to v16 [security] ([#391](#391)) ([2593ec4](2593ec4)) * **deps:** update dependency next@>=15.0.0 <15.2.3 to >=15.5.23 [security] ([#350](#350)) ([f0d43fd](f0d43fd)) * **deps:** update dependency next@>=15.0.0 <15.2.3 to v16 [security] ([#392](#392)) ([4e6d492](4e6d492)) * **deps:** update dependency next@>=15.0.0 <15.5.16 to >=15.5.23 [security] ([#351](#351)) ([a8a04c3](a8a04c3)) * **deps:** update dependency next@>=15.0.0-canary.0 <15.4.7 to >=15.5.23 [security] ([#352](#352)) ([a310acc](a310acc)) * **deps:** update dependency next@>=15.0.4-canary.51 <15.1.8 to >=15.5.23 [security] ([#353](#353)) ([a0a1766](a0a1766)) * **deps:** update dependency next@>=15.1.0-canary.0 <15.1.9 to >=15.5.23 [security] ([#354](#354)) ([c631912](c631912)) * **deps:** update dependency next@>=15.1.1-canary.0 <15.1.10 to >=15.5.23 [security] ([#355](#355)) ([afe9af6](afe9af6)) * **deps:** update dependency next@>=15.1.1-canary.0 <15.1.12 to >=15.5.23 [security] ([#356](#356)) ([028e577](028e577)) * **deps:** update dependency next@>=9.5.0 <15.5.13 to >=15.5.23 [security] ([#335](#335)) ([3a409d6](3a409d6)) * **deps:** update dependency next@>=9.5.0 <15.5.13 to v16 [security] ([#382](#382)) ([b53de81](b53de81)) * **deps:** update dependency nuxt@>=3.0.0 <3.16.0 to >=4.4.8 [security] ([#369](#369)) ([17a7659](17a7659)) * **deps:** update dependency nuxt@>=3.0.0 <3.16.0 to >=4.5.2 [security] ([#400](#400)) ([5accda0](5accda0)) * **deps:** update dependency nuxt@>=3.1.0 <=3.21.5 to >=4.4.8 [security] ([#370](#370)) ([3e3006f](3e3006f)) * **deps:** update dependency nuxt@>=3.1.0 <=3.21.5 to >=4.5.2 [security] ([#401](#401)) ([9b56a6e](9b56a6e)) * **deps:** update dependency nuxt@>=3.4.3 <=3.21.5 to >=4.4.8 [security] ([#371](#371)) ([b8ec514](b8ec514)) * **deps:** update dependency nuxt@>=3.4.3 <=3.21.5 to >=4.5.2 [security] ([#402](#402)) ([825a509](825a509)) * **deps:** update dependency nuxt@>=3.6.0 <3.19.0 to >=4.4.8 [security] ([#372](#372)) ([513f91e](513f91e)) * **deps:** update dependency postcss@<8.5.10 to >=8.5.18 [security] ([#358](#358)) ([938be88](938be88)) * **deps:** update dependency postcss@<8.5.10 to >=8.5.26 [security] ([#376](#376)) ([14935a6](14935a6)) * **deps:** update dependency svgo@>=3.0.0 <3.3.3 to >=3.3.4 [security] ([#313](#313)) ([b7745dd](b7745dd)) * **deps:** update dependency svgo@>=3.0.0 <3.3.3 to v4 [security] ([#409](#409)) ([6c4d8e0](6c4d8e0)) * **deps:** update dependency tar@<=7.5.10 to >=7.5.22 [security] ([#321](#321)) ([2a0d62a](2a0d62a)) * **deps:** update dependency tar@<=7.5.2 to >=7.5.22 [security] ([#318](#318)) ([5cab03e](5cab03e)) * **deps:** update dependency tar@<=7.5.3 to >=7.5.22 [security] ([#319](#319)) ([57cb914](57cb914)) * **deps:** update dependency tar@<=7.5.9 to >=7.5.22 [security] ([#320](#320)) ([3e7262b](3e7262b)) * **deps:** update dependency tar@<6.2.1 to >=7.5.22 [security] ([#322](#322)) ([60dcad8](60dcad8)) * **deps:** update dependency tar@<7.5.7 to >=7.5.22 [security] ([#323](#323)) ([58b7381](58b7381)) * **deps:** update dependency tar@<7.5.8 to >=7.5.22 [security] ([#324](#324)) ([21d91ae](21d91ae)) * **deps:** update dependency tar@=7.5.1 to >=7.5.22 [security] ([#325](#325)) ([89bb7a6](89bb7a6)) * **deps:** update dependency undici@>=7.0.0 <7.28.0 to >=7.29.0 [security] ([#367](#367)) ([2c5c65c](2c5c65c)) * **deps:** update dependency undici@>=7.0.0 <7.28.0 to v8 [security] ([#410](#410)) ([87970b6](87970b6)) * **deps:** update dependency webpack-dev-server@<=5.2.0 to >=5.2.6 [security] ([#326](#326)) ([3d30b78](3d30b78)) * **deps:** update dependency webpack-dev-server@<=5.2.3 to >=5.2.6 [security] ([#327](#327)) ([be5a7e9](be5a7e9)) * **deps:** update patch updates ([#297](#297)) ([ddf53ab](ddf53ab)) ### Miscellaneous Chores * **deps:** lock file maintenance ([b120570](b120570)) * format pnpm-workspace.yaml with prettier ([#424](#424)) ([fd3caa3](fd3caa3))

renovate Bot requested a review from prisis as a code owner August 10, 2026 22:07

renovate Bot added priority-critical security labels Aug 10, 2026

renovate Bot enabled auto-merge (squash) August 10, 2026 22:07

renovate Bot force-pushed the renovate/npm-astro-=2.10.10-5.18.1-vulnerability branch 2 times, most recently from dbc50ef to 8be159d Compare August 10, 2026 22:27

renovate Bot force-pushed the renovate/npm-astro-=2.10.10-5.18.1-vulnerability branch 4 times, most recently from abb80f4 to 9ba74d2 Compare August 10, 2026 22:51

fix(deps): update dependency astro@>=2.10.10 <5.18.1 to v7 [security]

918457f

BREAKING CHANGE: updated dependencies to major versions

renovate Bot force-pushed the renovate/npm-astro-=2.10.10-5.18.1-vulnerability branch from 9ba74d2 to 918457f Compare August 10, 2026 22:56

prisis added 2 commits August 11, 2026 00:59

chore: merge renovate update against main

ef87b01

Merge remote-tracking branch 'origin/main' into tmp403

76fe655

prisis merged commit 1ea12e9 into main Aug 10, 2026
11 checks passed

prisis deleted the renovate/npm-astro-=2.10.10-5.18.1-vulnerability branch August 10, 2026 22:59

Navigation Menu

Uh oh!

Uh oh!

fix(deps): update dependency astro@>=2.10.10 <5.18.1 to v7 [security] - #403

fix(deps): update dependency astro@>=2.10.10 <5.18.1 to v7 [security]#403
prisis merged 3 commits into
mainfrom
renovate/npm-astro-=2.10.10-5.18.1-vulnerability

renovate Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Aug 10, 2026

Uh oh!

github-actions Bot commented Aug 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

renovate Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Astro: Reflected XSS via unescaped View Transition animation properties

Details

Summary

Details

PoC

astro.config.mjs

src/pages/index.astro

Payload:

Impact

Suggested Fix

Severity

References

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Details

Summary

Severity

Details

Proof of Concept

Impact

Affected Versions

Patched Versions

Workarounds

Credits

Severity

References

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

Details

Summary

Details

Reachability

Proof of Concept

Impact

Severity

References

Release Notes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Scoping sources and hashes in your config

Scoping at runtime

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

renovate Bot commented Aug 10, 2026

⚠️ Artifact update problem

File name: pnpm-lock.yaml

Uh oh!

github-actions Bot commented Aug 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Aug 10, 2026 •

edited

Loading

`astro.config.mjs`

`src/pages/index.astro`