Bump astro from 6.3.7 to 6.4.2

[dependabot]

Bumps astro from 6.3.7 to 6.4.2.

Release notes

Sourced from astro's releases.

astro@6.4.2

Patch Changes

• #16889 b94bcfd Thanks @​Princesseuh! - Fixes a plugins is not iterable crash when using a pre-6.0 @astrojs/mdx alongside integrations (e.g. Starlight) that set markdown.remarkPlugins, markdown.rehypePlugins, or markdown.remarkRehype.

• #16878 b9f6bb9 Thanks @​fkatsuhiro! - Fixes an issue where on-demand (SSR) dynamic routes would return 404 when a prerendered dynamic route with the same URL pattern was sorted first alphabetically. In production builds with @astrojs/node adapter, if [a_prebuild].astro (prerender=true) came before [b_ssr].astro alphabetically, requests to URLs not in the prerendered route's static paths would 404 instead of falling through to the SSR route. The fix adds fallthrough logic so that when a prerendered dynamic route matches but can't serve the request, Astro tries subsequent matching routes.

astro@6.4.0

Minor Changes

• #16468 4cff3a1 Thanks @​matthewp! - Adds a new preserveBuildServerDir adapter feature

  Adapters can now set preserveBuildServerDir: true in their adapter features to keep the dist/server/ directory structure for static builds, mirroring the existing preserveBuildClientDir option. This is useful for adapters that require a consistent dist/client/ and dist/server/ layout regardless of build output type.

  setAdapter({
    name: 'my-adapter',
    adapterFeatures: {
      buildOutput,
      preserveBuildClientDir: true,
      preserveBuildServerDir: true,
    },
  });

• #16848 f732f3c Thanks @​Princesseuh! - Adds a new markdown.processor configuration option, allowing you to choose an alternative Markdown processor.

  Websites with many Markdown/MDX files tend to be slow to build because the unified ecosystem (e.g., remark, rehype) is slow to process. This feature introduces the ability to replace this part of the build pipeline with another processor.

  The default processor is unified(). This means that existing configurations remain unchanged and your remark/rehype plugins continue to work.

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  import { unified } from '@astrojs/markdown-remark';
  import remarkToc from 'remark-toc';
  export default defineConfig({
  markdown: {
  processor: unified({
  remarkPlugins: [remarkToc],
  }),
  },
  });

  In addition to this new configuration option, Astro provides a new alternative processor based on Rust: Sätteri. You can choose to use it now by installing @astrojs/markdown-satteri, importing the satteri() processor, and adapting your existing configuration:

  // astro.config.mjs

... (truncated)

Changelog

Sourced from astro's changelog.

6.4.2

Patch Changes

• #16889 b94bcfd Thanks @​Princesseuh! - Fixes a plugins is not iterable crash when using a pre-6.0 @astrojs/mdx alongside integrations (e.g. Starlight) that set markdown.remarkPlugins, markdown.rehypePlugins, or markdown.remarkRehype.

• #16878 b9f6bb9 Thanks @​fkatsuhiro! - Fixes an issue where on-demand (SSR) dynamic routes would return 404 when a prerendered dynamic route with the same URL pattern was sorted first alphabetically. In production builds with @astrojs/node adapter, if [a_prebuild].astro (prerender=true) came before [b_ssr].astro alphabetically, requests to URLs not in the prerendered route's static paths would 404 instead of falling through to the SSR route. The fix adds fallthrough logic so that when a prerendered dynamic route matches but can't serve the request, Astro tries subsequent matching routes.

6.4.1

Patch Changes

• #16883 eeb064c Thanks @​Princesseuh! - Restores the astro/jsx/rehype.js entry point so that older versions of @astrojs/mdx continue to work when used with Astro 6.x. This entry point will be removed in Astro 7.0.

6.4.0

Minor Changes

• #16468 4cff3a1 Thanks @​matthewp! - Adds a new preserveBuildServerDir adapter feature

  Adapters can now set preserveBuildServerDir: true in their adapter features to keep the dist/server/ directory structure for static builds, mirroring the existing preserveBuildClientDir option. This is useful for adapters that require a consistent dist/client/ and dist/server/ layout regardless of build output type.

  setAdapter({
    name: 'my-adapter',
    adapterFeatures: {
      buildOutput,
      preserveBuildClientDir: true,
      preserveBuildServerDir: true,
    },
  });

• #16848 f732f3c Thanks @​Princesseuh! - Adds a new markdown.processor configuration option, allowing you to choose an alternative Markdown processor.

  Websites with many Markdown/MDX files tend to be slow to build because the unified ecosystem (e.g., remark, rehype) is slow to process. This feature introduces the ability to replace this part of the build pipeline with another processor.

  The default processor is unified(). This means that existing configurations remain unchanged and your remark/rehype plugins continue to work.

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  import { unified } from '@astrojs/markdown-remark';
  import remarkToc from 'remark-toc';
  export default defineConfig({
  markdown: {
  processor: unified({
  remarkPlugins: [remarkToc],
  }),

... (truncated)

Commits

• b82137b [ci] release (#16885)
• c8625e2 [ci] format
• b94bcfd fix(config): Keep legacy plugins data on the config (#16889)
• b9f6bb9 Fix SSR dynamic routes blocked by prerendered dynamic routes (#16878)
• 3b75dc6 [ci] release (#16884)
• eeb064c fix(mdx): Restore MDX rehype plugin entrypoint (#16883)
• c7157e6 [ci] release (#16870)
• f387eba [ci] format
• e0e26db Resolve X-Forwarded-* headers inside FetchState (#16811)
• 8153f8d [ci] format
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	astro@​6.3.7 ⏵ 6.4.2			+1	+1

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Publisher changed: npm tinyclip is now published by florian-lefebvre Author: florian-lefebvre From: ? → npm/astro@6.4.2 → npm/tinyclip@0.1.13 ℹ Read more on: This package | This alert | What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tinyclip@0.1.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Minified code present: npm @clack/core with 100.0% likelihood Confidence: 1.00 Location: Package overview From: ? → npm/astro@6.4.2 → npm/@clack/core@1.3.1 ℹ Read more on: This package | This alert | What's wrong with minified code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: In many cases minified code is harmless, however minified code can be used to hide a supply chain attack. Consider not shipping minified code on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@clack/core@1.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm @clack/prompts reads CI Env Vars: CI Location: Package overview From: ? → npm/astro@6.4.2 → npm/@clack/prompts@1.4.0 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@clack/prompts@1.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Minified code present: npm @clack/prompts with 100.0% likelihood Confidence: 1.00 Location: Package overview From: ? → npm/astro@6.4.2 → npm/@clack/prompts@1.4.0 ℹ Read more on: This package | This alert | What's wrong with minified code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: In many cases minified code is harmless, however minified code can be used to hide a supply chain attack. Consider not shipping minified code on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@clack/prompts@1.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm @shikijs/core URLs: https://shiki.style/guide/theme-colors#css-variables-theme, markup.underline.link Location: Package overview From: ? → npm/astro@6.4.2 → npm/@shikijs/core@4.1.0 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@shikijs/core@4.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm astro URLs: https://docs.astro.build/en/reference/modules/astro-actions/#actioninputschema, https://github.com/DefinitelyTyped/DefinitelyTyped/blob/master/types/babel-plugin-react-html-attrs/index.d.ts, https://github.com/DefinitelyTyped/DefinitelyTyped/blob/master/types/react/index.d.ts, https://www.w3.org/TR/wai-aria-1.2/#state_prop_def, https://docs.astro.build/en/guides/actions., https://docs.astro.build/en/guides/endpoints/#server-endpoints-api-routes, https://docs.netlify.com/configure-builds/manage-dependencies/#node-js-and-javascript, https://docs.github.com/en/actions/guides/building-and-testing-nodejs#specifying-the-nodejs-version, https://vercel.com/docs/runtimes#official-runtimes/node-js/node-js-version, imageConfig.domains, 127.0.0.1, https://docs.astro.build/en/reference/cli-reference/#astro-dev, https://cdn.example.com/..., https://example.com/image.png, https://registry.npmjs.org, https://docs.astro.build/en/reference/cli-reference/#astro-preview, https://docs.astro.build/, https://astro.build/config, https://astro.build/db/config, https://astro.build/db/seed, https://astro.build/integrations, https://docs.astro.build/en/guides/integrations-guide/tailwind/, https://docs.astro.build/en/guides/integrations/, https://docs.astro.build/en/guides/deploy/, https://docs.astro.build/en/guides/typescript/#errors-typing-multiple-jsx-frameworks-at-the-same-time, https://example.com, https://example.com/, image.domains, https://docs.astro.build/en/basics/astro-pages/#page-partials, example.com, https://docs.astro.build/en/reference/errors/, http://www.w3.org/2000/svg, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Error, import.meta.env.SITE, https://developer.mozilla.org/en-US/docs/Web/CSS/ident., https://docs.astro.build/en/guides/troubleshooting/#document-or-window-is-not-defined, https://astro.build/issues/compiler., https://docs.astro.build/en/guides/on-demand-rendering/, https://developer.mozilla.org/en-US/docs/Web/API/Response, https://docs.astro.build/en/guides/on-demand-rendering/#response, https://docs.astro.build/en/guides/framework-components/, https://docs.astro.build/en/reference/integrations-reference/#addrenderer-option, https://docs.astro.build/en/reference/directives-reference/#clientonly, https://docs.astro.build/en/reference/routing-reference/#getstaticpaths, https://docs.astro.build/en/guides/routing/#dynamic-routes, https://docs.astro.build/en/guides/imports/#other-assets, https://docs.astro.build/en/reference/modules/astro-assets/#getimage, https://docs.astro.build/en/guides/images/#images-in-content-collections, https://docs.astro.build/en/reference/modules/astro-assets/#src-required, https://vite.dev/guide/features.html#glob-import, https://sharp.pixelplumbing.com/install., https://docs.astro.build/en/reference/errors/missing-sharp, https://docs.astro.build/en/guides/images/#default-image-service, https://docs.astro.build/en/guides/imports/#glob-patterns, https://docs.astro.build/en/guides/internationalization, https://github.com/withastro/astro/issues., https://docs.astro.build/en/guides/markdown-content/#modifying-frontmatter-programmatically, https://docs.astro.build/en/guides/integrations-guide/mdx/, https://docs.astro.build/en/guides/upgrade-to/v6/#removed-legacy-content-collections, https://docs.astro.build/en/guides/content-collections/, https://docs.astro.build/en/reference/modules/astro-content/#definelivecollection, https://github.com/rich-harris/devalue, https://docs.astro.build/en/reference/content-loader-reference/#file-loader, https://docs.astro.build/en/reference/api-reference/#callaction, https://docs.astro.build/en/guides/sessions/, https://astro.build/issues/compiler, https://docs.astro.build/en/guides/integrations/#official-integrations, https://docs.astro.build/en/reference/api-reference/#clientaddress, https://www.ipify.org/, https://docs.astro.build/en/guides/client-side-scripts/, https://docs.astro.build/en/reference/api-reference/#params, site.com/blog/1, https://docs.astro.build/en/guides/routing/#rest-parameters, https://docs.astro.build/en/guides/routing/#static-ssg-mode, https://docs.astro.build/en/basics/astro-components/#named-slots, https://docs.astro.build/en/guides/routing/#pagination, https://docs.astro.build/en/guides/images/, https://docs.astro.build/en/reference/modules/astro-assets/#image-, https://docs.astro.build/en/reference/modules/astro-assets/#alt-required, https://docs.astro.build/en/reference/image-service-reference/, https://astro.build/issues/, https://docs.astro.build/en/reference/modules/astro-assets/#width-and-height-required-for-images-in-public, https://docs.astro.build/en/reference/modules/astro-assets/#infersize, https://docs.astro.build/en/guides/routing/#route-priority-order, https://docs.astro.build/en/reference/configuration-reference/#prerenderconflictbehavior, https://example.com/logo.png, https://docs.astro.build/en/guides/on-demand-rendering/#html-streaming, https://docs.astro.build/en/basics/astro-pages/, https://example.com/my_image.png, https://docs.astro.build/en/reference/api-reference/#redirect, https://docs.astro.build/en/guides/routing/#configured-redirects, https://docs.astro.build/en/guides/typescript/#type-imports, https://docs.astro.build/en/guides/internationalization/#routing, https://docs.astro.build/en/guides/internationalization/, https://docs.astro.build/en/reference/configuration-reference/#i18n, https://docs.astro.build/en/reference/cli-reference/#--config-path, https://docs.astro.build/en/reference/configuration-reference/, https://docs.astro.build/en/reference/modules/astro-content/#schema-1, https://docs.astro.build/en/guides/upgrade-to/v5/#updating-existing-collections, https://docs.astro.build/en/reference/content-loader-reference/#parser, https://astro.build, https://docs.astro.build/en/guides/upgrade-to/v6/#deprecated-session-driver-string-signature, https://docs.astro.build/en/guides/environment-variables/#variable-types, Astro.site, https://docs.astro.build/en/reference/experimental-flags/, https://astro.build/api/v1/dev-overlay/, https://github.com/withastro/astro/issues/new/choose, https://github.com/withastro/roadmap/discussions/new/choose, https://docs.astro.build, https://astro.build/chat, https://astro.build/integrations/, https://docs.astro.build/en/reference/cli-reference/#astro-preferences, https://docs.astro.build/en/reference/configuration-reference/#securitycsp, https://docs.astro.build/en/reference/configuration-reference/#trailingslash, https://example.com/es, https://example.com/es/getting-started, https://example.com/blog/es-us/getting-started, https://example.com/blog/es_US/getting-started, https://astro.build/chat., https://astro.build/telemetry, https://astro.build/issues, https://docs.astro.build/en/guides/upgrade-to/v6/#deprecated-createexports-and-start-adapter-api, https://docs.astro.build/en/reference/api-reference/#site, https://docs.astro.build/en/reference/api-reference/#generator, https://docs.astro.build/en/reference/api-reference/#cookies, https://docs.astro.build/en/reference/api-reference/#session, https://developer.mozilla.org/en-US/docs/Web/API/Request, https://docs.astro.build/en/reference/api-reference/#request, https://docs.astro.build/en/reference/api-reference/#url, https://docs.astro.build/en/reference/api-reference/#originpathname, https://docs.astro.build/en/reference/api-reference/#getactionresult, https://docs.astro.build/en/reference/api-reference/#props, https://developer.mozilla.org/en-US/docs/Glossary/Quality_values, https://docs.astro.build/en/reference/api-reference/#preferredlocale, https://docs.astro.build/en/reference/api-reference/#preferredlocalelist, https://docs.astro.build/en/reference/api-reference/#currentlocale, https://docs.astro.build/en/reference/api-reference/#isprerendered, https://docs.astro.build/en/reference/experimental-flags/csp/, https://docs.astro.build/en/reference/experimental-flags/csp/#cspinsertdirective, https://styles.cdn.example.com/, https://scripts.cdn.example.com/, staging.example.com, qa.example.com, http://example.com, https://www.my-site.dev, https://docs.astro.build/en/reference/configuration-reference/#redirects, https://example.com/about, https://example.com/news, https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta#http-equiv, https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#redirection_messages, https://docs.astro.build/en/guides/integrations-guide/cloudflare/, https://docs.astro.build/en/guides/integrations-guide/netlify/, https://docs.astro.build/en/guides/integrations-guide/node/, https://docs.astro.build/en/guides/integrations-guide/vercel/, https://astro.build/integrations/2/?search=&categories%5B%5D=adapters, sub.example.com, deep.sub.example.com, https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP, https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting, https://docs.astro.build/en/guides/view-transitions/, https://events-3bg.pages.dev/jotter/astro-view-transitions/, https://docs.astro.build/en/guides/syntax-highlighting/#prism-, https://docs.astro.build/en/reference/configuration-reference/#securitycspdirectives, https://developer.mozilla.org/en-US/docs/Glossary/Hash_function, https://content-security-policy.com/#directive, https://images.cdn.example.com, https://styles.cdn.example.com, https://docs.astro.build/en/reference/configuration-reference/#securitycspscriptdirectiveresources, https://docs.astro.build/en/reference/configuration-reference/#securitycspscriptdirectivehashes, https://cdn.example.com, https://cdn.example.com/_astro/..., https://js.cdn.example.com, https://css.cdn.example.com, 192.168.0.1, https://docs.astro.build/en/reference/configuration-reference/#imageremotepatterns, https://docs.astro.build/en/guides/images/#responsive-image-styles, https://docs.astro.build/en/reference/modules/astro-assets/#layout, https://developer.mozilla.org/en-US/docs/Web/CSS/object-fit, https://docs.astro.build/en/reference/modules/astro-assets/#fit, https://developer.mozilla.org/en-US/docs/Web/CSS/object-position, https://docs.astro.build/en/reference/modules/astro-assets/#position, https://shiki.style/themes, https://shiki.style/guide/dual-themes#without-default-color, https://shiki.style/languages, https://shiki.style/languages#bundled-languages, https://shiki.style/guide/load-lang#custom-language-aliases, https://shiki.style/guide/transformers, https://shiki.style/packages/transformers, https://shiki.style, https://prismjs.com/, https://docs.astro.build/en/guides/syntax-highlighting/#add-a-prism-stylesheet, https://github.com/remarkjs/remark, https://github.com/remarkjs/remark-rehype, https://github.com/remarkjs/remark-gfm, https://daringfireball.net/projects/smartypants/, https://github.com/retextjs/retext-smartypants?tab=readme-ov-file#fields, https://github.com/remarkjs/remark-rehype#api, https://docs.astro.build/en/reference/configuration-reference/#i18nfallback, https://docs.astro.build/en/guides/routing/#redirects, https://docs.astro.build/en/guides/routing/#rewrites, https://fr.example.com, https://example.es, https://docs.astro.build/en/reference/modules/astro-i18n/#getabsolutelocaleurl, https://docs.astro.build/en/reference/modules/astro-i18n/#getabsolutelocaleurllist, https://docs.astro.build/en/guides/internationalization/#domains, https://docs.astro.build/en/guides/environment-variables/, https://docs.astro.build/en/reference/modules/astro-config/#envfield, https://docs.astro.build/en/guides/fonts/, https://docs.astro.build/en/reference/font-provider-reference/#built-in-providers, https://docs.astro.build/en/reference/font-provider-reference/#building-a-font-provider, https://developer.mozilla.org/en-US/docs/Web/CSS/ident, https://developer.mozilla.org/en-US/docs/Web/CSS/font-family#generic-name, https://developer.chrome.com/blog/font-fallbacks, https://docs.astro.build/en/reference/configuration-reference/#fontfallbacks, https://developer.mozilla.org/en-US/docs/Web/CSS/font-weight, https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_fonts/Variable_fonts_guide, https://developer.mozilla.org/en-US/docs/Web/CSS/font-style, https://knaap.dev/posts/font-subsetting/, https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@font-face/src#font_formats, https://docs.astro.build/en/reference/configuration-reference/#fontprovider, https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face/font-display, https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face/unicode-range, https://docs.astro.build/en/reference/configuration-reference/#fontsubsets, https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face/font-stretch, https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face/font-feature-settings, https://developer.mozilla.org/en-US/docs/Web/CSS/@font-face/font-variation-settings, https://developer.mozilla.org/en-US/docs/Web/API/Speculation_Rules_API, https://developer.mozilla.org/en-US/docs/Web/API/Speculation_Rules_API#unsafe_prefetching, https://docs.astro.build/en/guides/prefetch/, https://developer.chrome.com/docs/devtools/workspaces, https://docs.astro.build/en/reference/experimental-flags/chrome-devtools-workspace/, https://docs.astro.build/en/reference/experimental-flags/svg-optimization/, file.md Location: Package overview From: package.json → npm/astro@6.4.2 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/astro@6.4.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm obug Location: Package overview From: ? → npm/astro@6.4.2 → npm/obug@2.1.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/obug@2.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm obug reads DEBUG Env Vars: DEBUG Location: Package overview From: ? → npm/astro@6.4.2 → npm/obug@2.1.1 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/obug@2.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm p-limit URLs: https://github.com/sindresorhus/p-map Location: Package overview From: ? → npm/astro@6.4.2 → npm/p-limit@7.3.0 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/p-limit@7.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm p-queue URLs: https://github.com/sindresorhus/p-queue#custom-queueclass, https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal, https://sindresorhus.com Location: Package overview From: ? → npm/astro@6.4.2 → npm/p-queue@9.3.0 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/p-queue@9.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Embedded URLs or IPs: npm p-timeout URLs: https://sinonjs.org/releases/latest/fake-timers/ Location: Package overview From: ? → npm/astro@6.4.2 → npm/p-timeout@7.0.1 ℹ Read more on: This package | This alert | What are URL strings? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Review all remote URLs to ensure they are intentional, pointing to trusted sources, and not being used for data exfiltration or loading untrusted code at runtime. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/p-timeout@7.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm tinyclip reads WSL_DISTRO_NAME Env Vars: WSL_DISTRO_NAME Location: Package overview From: ? → npm/astro@6.4.2 → npm/tinyclip@0.1.13 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tinyclip@0.1.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Environment variable access: npm tinyclip reads WAYLAND_DISPLAY Env Vars: WAYLAND_DISPLAY Location: Package overview From: ? → npm/astro@6.4.2 → npm/tinyclip@0.1.13 ℹ Read more on: This package | This alert | What is environment variable access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tinyclip@0.1.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Publisher changed: npm tinyclip is now published by florian-lefebvre instead of GitHub Actions New Author: florian-lefebvre Previous Author: [GitHub Actions](https://socket.dev/npm/user/GitHub Actions) From: ? → npm/astro@6.4.2 → npm/tinyclip@0.1.13 ℹ Read more on: This package | This alert | What is new author? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tinyclip@0.1.13. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[dependabot]

Superseded by #737.