fix(deps): update dependency astro to v7.3.3 [security] by renovate[bot] · Pull Request #326 · sourcectl/webpage

renovate · 2026-09-09T00:48:14Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
astro (source)	`7.2.0` → `7.3.3`

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

CVE-2026-84376 / GHSA-376h-93r7-7g6f

More information

Details

Summary

Astro stripped a configured base path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With base: "/app", a request to /appX/admin was treated as being under the base and resolved internally to the /admin route, while middleware still observed the public pathname /appX/admin. Middleware that authorizes routes by inspecting context.url.pathname could therefore be bypassed.

Impact

An unauthenticated remote attacker can bypass pathname-based middleware authorization in applications that:

Configure a non-root base.
Protect base-prefixed routes in middleware using context.url.pathname.

Because routing and middleware resolved different effective pathnames, a request such as /appX/admin (or other single-character extensions like /app2/admin or /app-/admin) reached the protected /admin route without passing the middleware check that guards /app/admin. Astro's authentication guide demonstrates protecting routes in middleware via context.url.pathname, so this is a reasonable and expected pattern.

Affected versions

astro <= 7.2.3.

Patches

Fixed in astro 7.2.4. Base stripping now requires the pathname to equal the base without its trailing slash, or to be followed by a /, so a prefix that does not end on a path-segment boundary is no longer treated as being under the base. Routing and context.url.pathname now resolve the same pathname.

Workarounds

Upgrade to astro 7.2.4 or later. As a mitigation before upgrading, avoid relying solely on prefix checks of context.url.pathname for authorization, or reject requests whose pathname does not begin with the configured base followed by a path-segment boundary.

Credits

Reported by @Ryoga-exe.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Astro: Remote code execution through AVIF image optimization

GHSA-26w7-cxv4-gfx2

More information

Details

A vulnerability in libheif, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized.

Projects are affected when an attacker can cause Astro to process an untrusted AVIF image.

The fix was released in Astro 7.2.8, which requires Sharp 0.35.4.

Severity

CVSS Score: 9.8 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

CVE-2026-114128 / GHSA-98hj-9722-w3j8

More information

Details

Summary

Astro's JSX and MDX rendering pipeline treated string children of <script> and <style> elements as trusted HTML. When a dynamic value was passed through a JSX expression, such as <script>{value}</script>, an attacker-controlled value containing </script> or </style> could terminate the element and inject arbitrary HTML and JavaScript.

Other JSX expression contexts escaped dynamic strings automatically. This behavior was limited to <script> and <style> children rendered through Astro's astro:jsx renderer, including MDX components.

Details

The affected rendering paths marked all string children of <script> and <style> elements as safe HTML, without distinguishing literal content generated by the compiler from dynamic expression values. An application was vulnerable when attacker-controlled data, such as a query parameter or CMS field, was interpolated directly into one of these elements.

For example, a value containing </script><script>alert(1)</script> passed to <script>{value}</script> was emitted without escaping. The browser interpreted the first closing tag as markup and executed the injected script.

The fix preserves raw rendering for literal script and style content while escaping dynamic string children like other JSX expression values.

Impact

Affected applications could be vulnerable to reflected or stored cross-site scripting. Exploitation required an application to pass attacker-controlled data directly as a dynamic child of a <script> or <style> element in MDX or through the astro:jsx runtime. Successful exploitation allowed arbitrary JavaScript execution in the victim's browser under the application's origin.

Patches

This issue is patched in astro@7.3.2.

Workarounds

Do not interpolate untrusted dynamic values directly into <script> or <style> element children. Applications that cannot upgrade should validate and contextually encode these values before rendering them.

Credit

Reported by @RKasai127.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Astro: Arbitrary CSS injection in Astro View Transitions

CVE-2026-114127 / GHSA-mpr7-6m5w-76rw

More information

Details

Summary

Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as duration, a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page.

The injected content remains inside the generated <style> element. It cannot terminate that element or inject HTML or JavaScript because Astro escapes < before emitting the stylesheet.

Severity

Exploitation requires an application to pass untrusted, request-derived, or user-controlled content directly into a transition animation value. This is an uncommon application pattern, and applications using static or otherwise trusted transition values are unaffected.

The resulting capability is limited to CSS in the rendered document. The proof of concept does not demonstrate JavaScript execution, HTML injection, an origin-boundary bypass, or access to server-only data.

Details

Animation values are collected by stringifyAnimations() in packages/astro/src/runtime/server/transition.ts and passed to addAnimationProperty(). String values were converted directly with toString():

function addAnimationProperty(builder: AnimationBuilder, prop: string, value: string | number) {
  let arr = builder[prop];
  if (Array.isArray(arr)) {
    arr.push(value.toString());
  } else {
    builder[prop] = [value.toString()];
  }
}

The animation builder then interpolated each value into a declaration:

out += `\n\t${k}: ${value.join(', ')};`;

The completed stylesheet passes through escapeStyleText(), which escapes literal < characters to keep the content inside its HTML <style> element. CSS delimiters such as ;, {, and } remained active, allowing a value to escape its intended declaration and add another rule.

The shared serializer handles duration, delay, easing, direction, fillMode, and animation names, so custom transition objects using those string properties followed the same path.

The fix encodes CSS declaration delimiters while serializing each animation value. Supported CSS functions and strings, including calc() and var(), remain unchanged.

Proof of Concept

Using astro@7.3.2, create an on-demand rendered page:

---
import { fade } from "astro:transitions";
const duration = Astro.url.searchParams.get("duration") ?? "1ms";
---
<div id="target" transition:animate={fade({ duration })}>SAFE</div>

Request the page with:

/?duration=1ms%3B%7D%23target%7Bcolor%3Argb(1%2C2%2C3)%3Bfont-size%3A37px%7Dx%7Banimation-duration%3A1ms

Before the fix, the generated stylesheet contains an active rule equivalent to:

#target {
  color: rgb(1, 2, 3);
  font-size: 37px;
}

In Chromium, the target's computed styles change to rgb(1, 2, 3) and 37px. This behavior is reproducible in a production standalone SSR build, not only in the development server.

Impact

An attacker can inject CSS into the affected application's rendered page when the application places attacker-controlled data into a transition animation value. The CSS can restyle or conceal content, reposition existing controls, add generated text, or otherwise misrepresent the page's UI.

CSS selectors and conditional resource loads may expose data already present in selectable DOM attributes in some applications, depending on the page and its Content Security Policy. The issue does not expose cookies, server-only values, arbitrary DOM text, or cross-origin response data by itself.

Affected Versions

astro >= 7.1.0, <= 7.3.2.

Versions through 7.0.9 are covered by GHSA-4g3v-8h47-v7g6 / CVE-2026-73422, which had the stronger impact of escaping the <style> element and injecting HTML or JavaScript.

Patched Versions

This issue is patched in astro@7.3.3. Fix: https://github.com/withastro/astro/pull/17970

Workarounds

Do not pass untrusted or request-derived values into View Transition animation properties. If dynamic values are required, validate them according to the expected CSS grammar before constructing the transition. For duration and delay, prefer finite numbers or strictly validated CSS time values.

Credits

Reported by @avrlab233.

Severity

CVSS Score: 2.3 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

withastro/astro (astro)

`v7.3.3`

Compare Source

Patch Changes

#17651 504333c Thanks @sxzz! - Refactors internal version handling to use a smaller, ESM-native dependency
#17942 0bc5715 Thanks @matthewp! - Returns appropriate 400 and 404 responses from the image endpoint for invalid and missing local image paths
#17700 b2222fc Thanks @winklemad! - Fixes Astro.preferredLocaleList returning an empty list when a locale is configured with the object form ({ path, codes }) and the browser sends the code with different casing or an underscore, such as en-US matching a configured en-us
#17941 394ff79 Thanks @matthewp! - Fixes astro preview --ignore-lock (and astro dev --ignore-lock) being refused when run from an AI agent environment. The flag now starts the server in the foreground instead of erroring, since agent detection only inferred background mode and was never explicitly requested. An explicit --background combined with --ignore-lock still errors.
#17928 3277927 Thanks @ArmandPhilippot! - Fixes TypeScript autocompletion for getImage() to suggest all available predefined options.
#17928 3277927 Thanks @ArmandPhilippot! - Fixes a type error in getImage() options that allowed passing both widths and densities at the same time.
#17857 2637ed1 Thanks @Princesseuh! - Improves rendering performance
#17943 2fc7ce9 Thanks @matthewp! - Fixes a WebAssembly error when importing astro:actions in tests that run under @cloudflare/vitest-pool-workers
#18018 1b5a234 Thanks @astro-factory! - Fixes trailing-slash redirect response body pointing to the incoming URL instead of the redirect target. The location header was correct, but the HTML body (<meta http-equiv="refresh">, <title>, and <a> tag) contained the original request path without the trailing-slash correction or query string.
#17905 eaf70fa Thanks @SudoDevStudio! - Fixes custom dev toolbar apps losing their UI after client-side navigation with <ClientRouter />.
#18011 558b301 Thanks @astro-factory! - Fixes prerendered Cloudflare pages rendering as [object Object] when nodejs_compat is enabled in wrangler.toml
#17944 ba08e35 Thanks @matthewp! - Fixes a regression in astro dev where writes outside the module graph (for example, @astrojs/cloudflare's .wrangler/state files) invalidated the middleware on every request, causing repeated SSR reloads. Such writes no longer invalidate the middleware.
#17531 ae837db Thanks @danilloestrela! - Updates svgo to 4.0.2 to resolve a security advisory
#17953 dbbf10e Thanks @astro-factory! - Fixes a one-time page reload shortly after the first load on cold dev-server starts when a project has framework components imported from MDX content entries. MDX files are now included in the dev dependency pre-bundling scan, so their framework dependencies are bundled up front instead of being discovered (and reloaded for) at runtime.
#17955 4e8ad9a Thanks @matthewp! - Improves dev server startup time. The content config and dev server app module graphs now begin compiling during server creation without blocking the server from listening. Request handling waits for the shared setup result when needed, cutting astro dev ready time by roughly a third on projects with a content config.
#17960 9838049 Thanks @Chy-Zaber-Bin-Zahid! - Improves the diagnostics of some Astro errors.
#17998 0e5478d Thanks @astro-factory! - Fixes SVG <style> elements nested inside <defs> or other container elements not being hashed for CSP
#17994 80f9f1d Thanks @astro-factory! - Fixes experimental.incrementalBuild restoring pages with stale CSS after a preprocessor partial changes or missing original images referenced by restored pages
#17889 8ae6b46 Thanks @ajfAfg! - Fixes a bug where the dev server stripped the configured base from URLs that only share a prefix with it. With base: '/s', requests to /src/... were rewritten to /rc/... and failed, breaking those pages during development.
#17980 cfccafa Thanks @gameroman! - Improves JSDoc for fonts api
#17953 dbbf10e Thanks @astro-factory! - Fixes CSS HMR for framework components rendered through content entries after ClientRouter navigation
#17970 0b4dc3a Thanks @matthewp! - Improves serialization of transition animation values in generated CSS
#17999 30ef3cb Thanks @astro-factory! - Fixes content collection HMR not updating prerendered pages when an adapter enables a separate prerender environment (e.g. @astrojs/cloudflare with prerenderEnvironment: 'node')
#18002 312ab49 Thanks @shoutoutuoadi325! - Fixes redirect targets being corrupted when a dynamic route parameter value contains $ replacement patterns like $&
#17937 e294953 Thanks @matthewp! - Fixes a bug where the glob() content loader kept stale entries in the data store after the last file in a collection was deleted. Empty collections are now pruned correctly, and the file watcher is registered in dev so the first file added to an empty collection is picked up without a restart.
#17945 750b4db Thanks @matthewp! - Pre-bundles renderer server entrypoints and the default console logger during dev so they are included in the initial optimization pass, preventing a mid-request re-optimization that could crash the dev server on Cloudflare (workerd).

`v7.3.2`

Compare Source

Patch Changes

#17896 a548223 Thanks @matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.
#17931 c1a6a89 Thanks @astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover
#17908 42e9188 Thanks @astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about
#17936 4b92ddc Thanks @astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present
Updated dependencies [a548223]:
- @astrojs/markdown-satteri@0.4.1

`v7.3.1`

Compare Source

Patch Changes

#17899 0389640 Thanks @ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

`v7.3.0`

Compare Source

Minor Changes

#17767 ce7c91f Thanks @astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds a logger parameter to image services hooks

Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:
```
import type { LocalImageService } from 'astro';

const service: LocalImageService = {
  // ...
  async transform(inputBuffer, transform, imageConfig, logger) {
    logger.warn(`Could not optimize "${transform.src}". Passing it through unchanged.`);
    return { data: inputBuffer, format: 'png' };
  },
};
```
Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds logger to the context object passed to cache providers

Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:
```
import type { CacheProvider } from 'astro';

const provider: CacheProvider = {
  name: 'my-cache',
  async onRequest({ request, url, logger }, next) {
    logger.warn(`Skipping cache for ${url.pathname} because the response sets a cookie.`);
    return next();
  },
  // ...
};
```
Astro's built-in memoryCache() provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.

Patch Changes

#17818 c0b6581 Thanks @florian-lefebvre! - Updates Astro's remaining internal warnings and errors to be written through the configured logger instead of directly to the console, when possible
#17886 e747cba Thanks @matthewp! - Fixes the memory cache provider to skip responses with Vary: Cookie or Vary: *
#17885 916b738 Thanks @Princesseuh! - Improves build performance for sites with a large number of pages coming from a large amount of different modules.
#17795 15e2deb Thanks @matthewp! - Adds concurrent rendering support for experimental.incrementalBuild, including when using @astrojs/cloudflare

Incremental builds no longer disable caching when build.concurrency is greater than 1. Projects that set build.concurrency: 1 to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.
#17879 21c34a6 Thanks @matthewp! - Fixes missing styles, links, and scripts from content collection entries rendered inside server islands
#17861 3193988 Thanks @ethanstoner! - Fixes i18n fallback routes being generated with a corrupted path when the locale code also appears at the start of a later path segment. A page such as src/pages/en/enterprise.astro with fallback: { es: 'en' } produced the route /es/esterprise instead of /es/enterprise, so the fallback never matched the intended URL. Only the leading locale segment is rewritten now.

`v7.2.10`

Compare Source

Patch Changes

#17262 f8e9458 Thanks @Princesseuh! - Fixes @astrojs/markdown-remark being pinned to an exact version.
#17874 10c7e63 Thanks @astro-factory! - Fixes SSR manifest placeholder not being replaced when the server build is minified, which caused a runtime Invalid URL crash at server boot
#17869 2548abf Thanks @ematipico! - Fixes a case where the logger was improperly initialized at runtime in dev.
#17878 76eff3d Thanks @ematipico! - Fixes browser heuristic caching for cached responses that include Last-Modified or ETag validators
#17833 413a6e7 Thanks @astro-factory! - Fixes prerender conflict warnings to correctly identify the route that first rendered a duplicate pathname, instead of misattributing the conflict to an unrelated route that merely matches the URL pattern
#17872 f7191cc Thanks @jx-grxf! - Fixes Markdown images in content collections rendering an empty srcset attribute when no responsive candidates are generated.
#17755 157c500 Thanks @matthewp! - Fixes a bug where editing a content collection entry during astro dev on Windows kept serving stale content until the dev server was restarted. The data store now notifies the dev server directly after each write instead of relying only on the file watcher, which can miss the atomic rename that commits the write on some platforms.
Updated dependencies [f8e9458, f8e9458]:
- @astrojs/internal-helpers@0.11.0
- @astrojs/markdown-satteri@0.4.0

`v7.2.9`

Compare Source

Patch Changes

#17846 b441180 Thanks @Princesseuh! - Fixes importing .html files not being typed outside of .astro files
#17831 32e8b44 Thanks @astro-factory! - Fixes a crash when requesting /index.html against a dynamic page route like [slug].astro
#17841 c35448e Thanks @astro-factory! - Fixes SSR manifest containing stale entryModules references to prerender-only chunks that no longer exist in the final build output
#17847 eb87a23 Thanks @matthewp! - Fixes set:text escaping in MDX script and style elements

`v7.2.8`

Compare Source

Patch Changes

#17837 ecb4082 Thanks @matthewp! - Updates the minimum supported version of Sharp to 0.35.4
#17786 db7c53b Thanks @gameroman! - Replaces the internal find-process dependency with a smaller, lighter alternative

`v7.2.7`

Compare Source

Patch Changes

#17415 55d38c8 Thanks @iseraph-dev! - Deserializes each route once when loading the SSR manifest
#17772 023b48b Thanks @matthewp! - Fixes route selection for normalized request paths in adapter and development request handling
#17819 633855b Thanks @matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0
#17813 ae26d18 Thanks @matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies
#17816 a0d2fe3 Thanks @astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

`v7.2.6`

Compare Source

Patch Changes

#17812 29af6da Thanks @matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

`v7.2.5`

Compare Source

Patch Changes

#17758 5f419e2 Thanks @astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter
#17416 493796b Thanks @iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs
#17712 bd374b7 Thanks @fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8
#17719 dac1768 Thanks @astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys
#17770 84eb7e7 Thanks @astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background
#17713 d035290 Thanks @wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.
#17743 adc750f Thanks @contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.
#17757 660991c Thanks @astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error
#17783 60b14ff Thanks @matthewp! - Fixes a type error when passing an image from a content collection image() schema to a component or <Image />. The schema returned by image() was missing the apng format, so it no longer matched the type of an imported image.
#17664 d483125 Thanks @astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases "unsafe-inline" resource. Now when "unsafe-inline", Astro won't emit hashes for the directive specified.
#17810 0fc5f65 Thanks @florian-lefebvre! - Fixes a regression in the content collections that could cause images to not be resolved
#17781 aa33b44 Thanks @matthewp! - Fixes memoryCache() storing responses that set cookies through Astro.cookies or Astro.session
#17787 6661fbe Thanks @astro-factory! - Fixes server:defer crashing the dev server with "undefined is not a function" when a deferred component imports from astro:i18n
#17750 dd0e3ac Thanks @dobrodob! - Fixes a regression where transition:persist stopped working for <audio> and <video> elements.
#17774 fe1d16d Thanks @astro-factory! - Adds support for importing .apng files as image metadata for use with standard <img> elements. Astro's image components reject APNG files to avoid removing their animation
#17799 8797754 Thanks @astro-factory! - Fixes i18n fallbackType: "rewrite" returning 500 instead of 404 when the fallback locale also has no matching static path for a prerendered dynamic route
#17741 99d3d3d Thanks @ericswpark! - Bumps the Astro compiler to the latest version. Changelog.
#17782 3578d45 Thanks @Princesseuh! - Improves the performance of the Astro CLI in local by enabling Node's module compilation cache.
#17705 2043e4f Thanks @astrobot-houston! - Fixes incremental builds serving cached HTML that references stale CSS filenames after a stylesheet-only edit
#17754 3d50dfd Thanks @astro-factory! - Fixes the dev server refusing to start in Docker containers after a restart due to PID reuse in the lock file check
#17769 bbda94d Thanks @astro-factory! - Fixes a build failure when defining vite.environments.ssr in the Astro config. User-provided environment config for ssr, prerender, or client is now properly deep-merged with Astro's internal environment settings instead of silently breaking the server entry naming.
#17776 0874da8 Thanks @astro-factory! - Fixes the glob() content loader failing to load files with colons in their names (e.g., Guide: Architecture.md)
Updated dependencies [0762a83, 0c99615]:
- @astrojs/markdown-satteri@0.3.8

`v7.2.4`

Compare Source

Patch Changes

#17747 a90ff66 Thanks @Princesseuh! - Fixes builds hanging when an image file is malformed
#17701 05763a0 Thanks @matthewp! - Fixes base path stripping to respect path-segment boundaries. With a configured base such as /docs, a request like /docs-archive/page is no longer treated as being under the base, so routing and context.url.pathname now agree on the same pathname.
#17742 70b449d Thanks @Kjubikstronk! - Fixes astro build throwing TypeError: Missing parameter for dynamic routes when build.format: 'preserve' and trailingSlash: 'always' are used together. Stripping the framework-injected .html suffix dropped the trailing slash that the compiled route pattern requires, so the route no longer matched itself and its params resolved as empty.
#17703 771b0a9 Thanks @astrobot-houston! - Fixes Astro.site always being undefined when rendering components via the Container API, even when site is set in astroConfig
Updated dependencies [05763a0, bc171af]:
- @astrojs/internal-helpers@0.10.4
- @astrojs/markdown-satteri@0.3.7
- @astrojs/markdown-remark@7.2.4

`v7.2.3`

Compare Source

Patch Changes

#17724 97140b2 Thanks @ematipico! - Fixes an issue where Astro could run out of memory when experimental.collectionStorage is set to chunked and there are multiple concurrent updates to the same collection.
#17636 51723b1 Thanks @matthewp! - Fixes the dev server sometimes matching against stale routes after pages were added, removed, or renamed, requiring a dev server restart to pick up the change
#17636 51723b1 Thanks @matthewp! - Fixes the composable request helpers (astro/fetch) throwing an error when used on a request that had been rewritten with Astro.rewrite() or next()
#17636 51723b1 Thanks [@matthewp](https:/

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

netlify · 2026-09-09T00:48:20Z

✅ Deploy Preview for lively-frangollo-e43a02 ready!

Name	Link
🔨 Latest commit	`1d2735c`
🔍 Latest deploy log	https://app.netlify.com/projects/lively-frangollo-e43a02/deploys/6adaa0ddc85948a70ff7570f
😎 Deploy Preview	https://deploy-preview-326--lively-frangollo-e43a02.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

renovate Bot added the dependencies Pull requests that update a dependency file label Sep 9, 2026

renovate Bot assigned andygrunwald Sep 9, 2026

renovate Bot force-pushed the renovate/npm-astro-vulnerability branch 2 times, most recently from 5aa35cb to 6a902b9 Compare September 15, 2026 14:51

renovate Bot changed the title ~~fix(deps): update dependency astro to v7.2.8 [security]~~ fix(deps): update dependency astro to v7.2.8 [security] - autoclosed Sep 17, 2026

renovate Bot closed this Sep 17, 2026

renovate Bot deleted the renovate/npm-astro-vulnerability branch September 17, 2026 19:50

renovate Bot changed the title ~~fix(deps): update dependency astro to v7.2.8 [security] - autoclosed~~ fix(deps): update dependency astro to v7.2.8 [security] Sep 18, 2026

renovate Bot reopened this Sep 18, 2026

renovate Bot force-pushed the renovate/npm-astro-vulnerability branch 3 times, most recently from 47237ca to 5afc874 Compare September 24, 2026 23:16

renovate Bot force-pushed the renovate/npm-astro-vulnerability branch 2 times, most recently from c62b6db to c900593 Compare October 5, 2026 16:05

renovate Bot force-pushed the renovate/npm-astro-vulnerability branch from c900593 to 9ed09a2 Compare October 20, 2026 16:52

fix(deps): update dependency astro to v7.3.3 [security]

1d2735c

renovate Bot force-pushed the renovate/npm-astro-vulnerability branch from 9ed09a2 to 1d2735c Compare October 22, 2026 23:48

renovate Bot changed the title ~~fix(deps): update dependency astro to v7.2.8 [security]~~ fix(deps): update dependency astro to v7.3.3 [security] Oct 22, 2026

Navigation Menu

Repository navigation

fix(deps): update dependency astro to v7.3.3 [security] - #326

fix(deps): update dependency astro to v7.3.3 [security]#326
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-astro-vulnerability

renovate Bot commented Sep 9, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Sep 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

Details

Summary

Impact

Affected versions

Patches

Workarounds

Credits

Severity

References

Astro: Remote code execution through AVIF image optimization

Details

Severity

References

Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

Details

Summary

Details

Impact

Patches

Workarounds

Credit

Severity

References

Astro: Arbitrary CSS injection in Astro View Transitions

Details

Summary

Severity

Details

Proof of Concept

Impact

Affected Versions

Patched Versions

Workarounds

Credits

Severity

References

Release Notes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

netlify Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for lively-frangollo-e43a02 ready!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Sep 9, 2026 •

edited

Loading

netlify Bot commented Sep 9, 2026 •

edited

Loading