Repository navigation
fix(deps): upgrade to astro 6 to patch security vulnerabilities - #415
Merged
Merged
Conversation
- Upgrade astro to 6.4.8 to fix reflected XSS, host header SSRF, and define:vars XSS - Upgrade starlight to 0.40.0 and sitemap to 3.7.3 for astro 6 compatibility - Pull patched devalue 5.8.1 via astro 6 to fix sparse array memory DoS - Override vite to 7.3.5 to fix server.fs.deny bypass and NTLMv2 hash disclosure - Override js-yaml to 4.2.0 and postcss to 8.5.10 to fix DoS and XSS - Migrate social config to array form for starlight 0.33 syntax change - Wrap autogenerated sidebar groups in items arrays for starlight 0.39 removal
- Update workflow matrix to node 22 to satisfy astro 6 engine requirement
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes all 9 Trivy-reported vulnerabilities (4 HIGH, 5 MEDIUM) in
package-lock.json. The Astro CVEs are only patched in Astro 6.x, which required a coordinated major upgrade of the toolchain.Dependency changes
astro@astrojs/starlight@astrojs/sitemapdevaluevite(override)js-yaml(override)postcss(override)Config migration (
astro.config.mjs)Required by the Starlight major bump:
socialconfig migrated to array form (Starlight 0.33 syntax change)labelwrapped initemsarrays (autogenerated groups removed in Starlight 0.39): Binding, Rendering, Middleware, Logging, Server Configuration, Build Tags, FAQ, BlogVerification
npm installsucceedsnpm run buildproduces all 1226 pagesnpm lsconfirms a single patched copy of each flagged packageNotes
npm auditstill reports 4 low-severity esbuild dev-server issues (Windows-only, dev-only) — not in the Trivy report and only fixable by Astro 7, which Starlight does not yet support.🤖 Generated with Claude Code