chore(deps): update dependency @astrojs/node to v9 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/node (source)	^8.2.3 -> ^9.0.0

GitHub Vulnerability Alerts

CVE-2025-55207

Summary

Following GHSA-cq8c-xv66-36gw, there's still an Open Redirect vulnerability in a subset of Astro deployment scenarios.

Details

Astro 5.12.8 fixed a case where https://example.com//astro.build/press would redirect to the external origin //astro.build/press. However, with the Node deployment adapter in standalone mode and trailingSlash set to "always" in the Astro configuration, https://example.com//astro.build/press still redirects to //astro.build/press.

Proof of Concept

1. Create a new minimal Astro project ([email protected])
2. Configure it to use the Node adapter (@astrojs/[email protected]) and force trailing slashes:

   // astro.config.mjs
   import { defineConfig } from 'astro/config';
   import node from '@​astrojs/node';
   
   export default defineConfig({
     trailingSlash: 'always',
     adapter: node({ mode: 'standalone' }),
   });

3. Build the site by running astro build.
4. Run the server, e.g. with astro preview.
5. Append //astro.build/press to the preview URL, e.g. http://localhost:4321//astro.build/press
6. The site will redirect to the external Astro Build origin.

Example reproduction

1. Open this StackBlitz reproduction.
2. Open the preview in a separate window so the StackBlitz embed doesn't cause security errors.
3. Append //astro.build/press to the preview URL, e.g. https://x.local-corp.webcontainer.io//astro.build/press.
4. See it redirect to the external Astro Build origin.

Impact

This is classified as an Open Redirection vulnerability (CWE-601). It affects any user who clicks on a specially crafted link pointing to the affected domain. Since the domain appears legitimate, victims may be tricked into trusting the redirected page, leading to possible credential theft, malware distribution, or other phishing-related attacks.

No authentication is required to exploit this vulnerability. Any unauthenticated user can trigger the redirect by clicking a malicious link.

CVE-2025-55303

Summary

In affected versions of astro, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served.

Details

On-demand rendered sites built with Astro include an /_image endpoint which returns optimized versions of images.

The /_image endpoint is restricted to processing local images bundled with the site and also supports remote images from domains the site developer has manually authorized (using the image.domains or image.remotePatterns options).

However, a bug in impacted versions of astro allows an attacker to bypass the third-party domain restrictions by using a protocol-relative URL as the image source, e.g. /_image?href=//example.com/image.png.

Proof of Concept

1. Create a new minimal Astro project ([email protected]).

2. Configure it to use the Node adapter (@astrojs/[email protected] — newer versions are not impacted):

   // astro.config.mjs
   import { defineConfig } from 'astro/config';
   import node from '@​astrojs/node';
   
   export default defineConfig({
   	adapter: node({ mode: 'standalone' }),
   });

3. Build the site by running astro build.

4. Run the server, e.g. with astro preview.

5. Append /_image?href=//placehold.co/600x400 to the preview URL, e.g. http://localhost:4321/_image?href=//placehold.co/600x400

6. The site will serve the image from the unauthorized placehold.co origin.

Impact

Allows a non-authorized third-party to create URLs on an impacted site’s origin that serve unauthorized image content.
In the case of SVG images, this could include the risk of cross-site scripting (XSS) if a user followed a link to a maliciously crafted SVG.

---

Release Notes

withastro/astro (@​astrojs/node)

v9.4.1

Compare Source

Patch Changes

• 5fc3c59 Thanks @​ematipico! - Fixes a routing bug in standalone mode with trailingSlash set to "always".

v9.4.0

Compare Source

Minor Changes

• #​14188 e3422aa Thanks @​ascorbic! - Adds support for specifying a host to load prerendered error pages

  By default, if a user defines a custom error page that is prerendered, Astro will load it from the same host as the one that the request is made to. This change allows users to specify a different host for loading prerendered error pages. This can be useful in scenarios such as where the server is running behind a reverse proxy or when prerendered pages are hosted on a different domain.

  To use this feature, set the experimentalErrorPageHost adapter option in your Astro configuration to the desired host URL. For example, if your server is running on localhost and served via a proxy, you can ensure the prerendered error pages are fetched via the localhost URL:

  import { defineConfig } from 'astro/config';
  import node from '@​astrojs/node';
  export default defineConfig({
    adapter: node({
      // If your server is running on localhost and served via a proxy, set the host like this to ensure prerendered error pages are fetched via the localhost URL
      experimentalErrorPageHost: 'http://localhost:4321',
    }),
  });

  For more information on enabling and using this experimental feature, see the @astrojs/node adapter docs.

v9.3.3

Compare Source

Patch Changes

• Updated dependencies [0567fb7]:
  • @​astrojs/internal-helpers@​0.7.1

v9.3.2

Compare Source

Patch Changes

• Updated dependencies [f4e8889]:
  • @​astrojs/internal-helpers@​0.7.0

v9.3.1

Compare Source

Patch Changes

• #​14148 e4d74ba Thanks @​ColoredCarrot! - fix(node): emit set-cookie header from middlewares for not-found routes (#​14136)

v9.3.0

Compare Source

Minor Changes

• #​14012 a125a14 Thanks @​florian-lefebvre! - Adds a new experimental configuration option experimentalDisableStreaming to allow you to opt out of Astro's default HTML streaming for pages rendered on demand.

  HTML streaming helps with performance and generally provides a better visitor experience. In most cases, disabling streaming is not recommended.

  However, when you need to disable HTML streaming (e.g. your host only supports non-streamed HTML caching at the CDN level), you can now opt out of the default behavior:

  import { defineConfig } from 'astro/config';
  import node from '@​astrojs/node';
  
  export default defineConfig({
    adapter: node({
      mode: 'standalone',
  +    experimentalDisableStreaming: true,
    }),
  });

• #​13972 db8f8be Thanks @​ematipico! - Adds support for the experimental static headers Astro feature.

  When the feature is enabled via the option experimentalStaticHeaders, and experimental Content Security Policy is enabled, the adapter will generate Response headers for static pages, which allows support for CSP directives that are not supported inside a <meta> tag (e.g. frame-ancestors).

  import { defineConfig } from 'astro/config';
  import node from '@​astrojs/node';
  
  export default defineConfig({
    adapter: node({
      mode: 'standalone',
      experimentalStaticHeaders: true,
    }),
    experimental: {
      cps: true,
    },
  });

v9.2.2

Compare Source

Patch Changes

• #​13507 660e83f Thanks @​TheOtterlord! - Handle errors where a module is not found when loading the server entrypoint

v9.2.1

Compare Source

Patch Changes

• #​13591 5dd2d3f Thanks @​florian-lefebvre! - Removes unused code

v9.2.0

Compare Source

Minor Changes

• #​13527 2fd6a6b Thanks @​ascorbic! - The experimental session API introduced in Astro 5.1 is now stable and ready for production use.

  Sessions are used to store user state between requests for on-demand rendered pages. You can use them to store user data, such as authentication tokens, shopping cart contents, or any other data that needs to persist across requests:

v9.1.3

Compare Source

Patch Changes

• Updated dependencies [042d1de]:
  • @​astrojs/internal-helpers@​0.6.1

v9.1.2

Compare Source

Patch Changes

• Updated dependencies [1e11f5e]:
  • @​astrojs/internal-helpers@​0.6.0

v9.1.1

Compare Source

Patch Changes

• #​13190 c6bf6b3 Thanks @​lee-arnold! - Fixes the image endpoint entrypoint

v9.1.0

Compare Source

Minor Changes

• #​13145 8d4e566 Thanks @​ascorbic! - Automatically configures filesystem storage when experimental session enabled

  If the experimental.session flag is enabled when using the Node adapter, Astro will automatically configure session storage using the filesystem driver. You can still manually configure session storage if you need to use a different driver or want to customize the session storage configuration.

  See the experimental session docs for more information on configuring session storage.

v9.0.3

Patch Changes

• #​13223 23094a1 Thanks @​ascorbic! - Fixes a bug that caused incorrect redirects for static files with numbers in the file extension

v9.0.2

Patch Changes

• #​514 ea4297b Thanks @​ascorbic! - Fixes a bug that caused the preview server to ignore wildcard host options

v9.0.1

Patch Changes

• #​454 83cedad Thanks @​alexanderniebuhr! - Improves Astro 5 support

v9.0.0

Major Changes

• #​375 e7881f7 Thanks @​Princesseuh! - Updates internal code to works with Astro 5 changes to hybrid rendering. No changes are necessary to your project, apart from using Astro 5

• #​397 776a266 Thanks @​Princesseuh! - Welcome to the Astro 5 beta! This release has no changes from the latest alpha of this package, but it does bring us one step closer to the final, stable release.

  Starting from this release, no breaking changes will be introduced unless absolutely necessary.

  To learn how to upgrade, check out the Astro v5.0 upgrade guide in our beta docs site.

• #​392 3a49eb7 Thanks @​Princesseuh! - Updates internal code for Astro 5 changes. No changes is required to your project, apart from using Astro 5

• #​451 167b369 Thanks @​ematipico! - Updates send dependency to v1.1.0

Minor Changes

• #​385 bb725b7 Thanks @​florian-lefebvre! - Cleans up astro:env support

v8.3.4

Patch Changes

• #​398 0cf7e91 Thanks @​bluwy! - Updates send dependency to 0.19.0

v8.3.3

Compare Source

Patch Changes

• #​11535 932bd2e Thanks @​matthewp! - Move polyfills up before awaiting the env module in the Node.js adapter.

  Previously the env setting was happening before the polyfills were applied. This means that if the Astro env code (or any dependencies) depended on crypto, it would not be polyfilled in time.

  Polyfills should be applied ASAP to prevent races. This moves it to the top of the Node adapter.

v8.3.2

Compare Source

Patch Changes

• #​11296 5848d97 Thanks @​florian-lefebvre! - Fixes astro:env getSecret compatibility

v8.3.1

Compare Source

Patch Changes

• #​11261 f5f8ed2 Thanks @​matthewp! - Fix backwards compat with Astro <= 4.9

• #​11263 7d59750 Thanks @​wackbyte! - Refactor to use Astro's integration logger for logging

v8.3.0

Compare Source

Minor Changes

• #​11199 2bdca27 Thanks @​florian-lefebvre! - Adds support for experimental astro:env released in Astro 4.10

v8.2.6

Compare Source

Patch Changes

• #​11202 d0248bc Thanks @​dkobierski! - Fixes suppressed logs when error occurs

v8.2.5

Compare Source

Patch Changes

• #​10491 28e33a2f9c04373eae5da2e6edb0dc2981bce790 Thanks @​castarco! - Fixes a bug where the preview server wrongly appends trailing slashes to subresource URLs.

v8.2.4

Compare Source

Patch Changes

• #​10454 83f9105cd50e2756d02ca2be73ab84f9d582d3f8 Thanks @​lilnasy! - Prevents crashes caused by rejections of offshoot promises.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying enpitsulin-xyz with    Cloudflare Pages

Latest commit:	f238e2c
Status:	🚫  Deploy failed.

View logs