chore(deps): update dependency astro to v7 [security] by renovate[bot] · Pull Request #194 · zantarix/cursus

renovate · 2026-07-21T09:58:58Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
astro (source)	`6.4.6` → `7.2.8`

Astro: Reflected XSS via unescaped View Transition animation properties

CVE-2026-73422 / GHSA-4g3v-8h47-v7g6

More information

Details

Summary

Astro's server-side View Transition CSS generator interpolates animation properties into an inline <style> element without escaping them for the CSS and HTML contexts.

An attacker-controlled value passed to an animation property such as duration can contain a </style> sequence, terminate the generated style element, and inject arbitrary HTML or JavaScript.

This is similar to GHSA-8hv8-536x-4wqp, but exploits a different injection point: unescaped View Transition animation values in a server-generated <style> element rather than an unescaped slot name in a hydration template.

Like GHSA-8hv8-536x-4wqp, exploitation requires an application to pass attacker-controlled data to an Astro API. However, the value is subsequently inserted into the HTML response without context-appropriate escaping by Astro.

Details

packages/astro/src/runtime/server/transition.ts

The generated stylesheet is wrapped in a <style> element and marked as HTML-safe:

const css = sheet.toString();
result._metadata.extraHead.push(markHTMLString(`<style>${css}</style>`));

Animation properties are added to the stylesheet without escaping:

if (anim.duration) {
  addAnimationProperty(builder, 'animation-duration', toTimeValue(anim.duration));
}

For string values, toTimeValue() returns the input unchanged:

export function toTimeValue(num: number | string) {
  return typeof num === 'number' ? num + 'ms' : num;
}

As a result, a duration value containing </style> can escape from the generated style element.

Other TransitionAnimation properties, including easing, direction, delay, fillMode, and name, are serialized by the same animation builder. The following PoC only relies on the official fade() helper and its duration option.

PoC

Using:

astro@7.0.9
@astrojs/node@11.0.2

`astro.config.mjs`

import node from '@astrojs/node';
import { defineConfig } from 'astro/config';

export default defineConfig({
  output: 'server',
  adapter: node({ mode: 'standalone' }),
});

`src/pages/index.astro`

---
import { fade } from 'astro:transitions';

const duration = Astro.url.searchParams.get('duration') ?? '300ms';
---

<html lang="en">
  <head>
    <meta charset="utf-8" />
    <title>PoC</title>
  </head>
  <body>
    <div transition:animate={fade({ duration })}>
      Animated content
    </div>
  </body>
</html>

Payload:

open:

http://localhost:4321/?duration=%3C%2Fstyle%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E%3C!--

The browser interprets </style> as the end of the generated style element and executes the injected script. An alert dialog is displayed when the page is opened.

Impact

An attacker who can control a View Transition animation value can execute arbitrary JavaScript in the origin of the affected Astro application.

The query-based reflected XSS scenario affects on-demand/server-rendered routes, such as:

projects configured with output: "server";
pages using export const prerender = false;
other server-side data flows that pass attacker-controlled values into a View Transition animation definition.

Successful exploitation may allow access to sensitive page data and authenticated actions available to the victim.

Suggested Fix

Animation values should be serialized using context-appropriate CSS escaping or validation before being added to the generated stylesheet.

Additionally, content inserted into a raw <style> element must not be able to contain an HTML end-tag sequence such as </style>. The final generated CSS should be made safe for the HTML raw-text context before it is passed to markHTMLString().

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

CVE-2026-59727 / GHSA-7pw4-f3q4-r2p2

More information

Details

Summary

When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS).

Severity

Although a generic reflected XSS scores in the Medium range, exploitation here requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This mitigating precondition places the real-world severity at Low.

Details

In generateHydrateScript() (packages/astro/src/runtime/server/hydration.ts), every island property is HTML-escaped before serialization — the attrs, props, and opts assignments all pass through escapeHTML(). The transition directives, however, were copied verbatim:

transitionDirectivesToCopyOnIsland.forEach((name) => {
  if (typeof props[name] !== 'undefined') {
    island.props[name] = props[name]; // not escaped
  }
});

The <astro-island> element is serialized via renderElement('astro-island', island, false) with shouldEscape=false, and toAttributeString() returns the value unchanged in that mode. As a result there is no downstream re-escaping, and the raw directive value reaches the HTML response. This is the same output sink previously addressed for slot names in GHSA-8hv8-536x-4wqp.

The affected directives are:

data-astro-transition-scope (transition:scope)
data-astro-transition-persist (transition:persist)
data-astro-transition-persist-props (transition:persist-props)

Note that transition:persist is typed boolean | string, so passing a string value is a supported use of the API.

Proof of Concept

A component that reflects a query parameter into a transition directive:

---
const persist = Astro.url.searchParams.get('persist') ?? 'default';
---
<Island client:load transition:persist={persist} />

Request:

https://example.com/?persist="><img src=x onerror=alert(document.domain)>

Rendered output (before the fix):

<astro-island … data-astro-transition-persist=""><img src=x onerror=alert(document.domain)>></astro-island>

The " closes the attribute and the injected <img onerror=…> executes in the victim's browser.

Impact

Reflected XSS. An attacker who can induce a victim to visit a crafted URL can execute arbitrary script in the victim's session on the origin, subject to the requirement that the target application reflects untrusted input into one of the affected transition directives.

Affected Versions

astro >= 3.10.0, < 7.0.4 (introduced in 3.10.0, PR #7861).

Patched Versions

astro >= 7.0.4. Fixed in PR #17212 by HTML-escaping transition directive values before they are rendered onto the island element.

Workarounds

Do not pass untrusted or request-derived input into transition:persist, transition:scope, or transition:persist-props. If such input is required, HTML-escape or strictly validate it before passing it to the directive. Upgrading to astro@7.0.4 or later removes the need for manual mitigation.

Credits

Reported by @jlgore.

Severity

CVSS Score: 2.1 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

CVE-2026-59729 / GHSA-f48w-9m4c-m7f5

More information

Details

Summary

The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing "' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context, resulting in XSS.

Details

renderHTMLElement builds attributes directly:

for (const attr in props) {
  attrHTML += ` ${attr}="${toAttributeString(await props[attr])}"`;
}

The attribute name (attr) is interpolated raw; only the value is escaped via toAttributeString. By contrast, the hardened addAttribute in util.ts rejects invalid names:

if (INVALID_ATTR_NAME_CHAR.test(key)) { return ''; } // /[\s"'>/=]/

renderHTMLElement is reached from component.ts when the component is a native HTMLElement subclass:

if (!renderer && typeof HTMLElement === 'function' && componentIsHTMLElement(Component)) {
  const output = await renderHTMLElement(result, Component, _props, slots);
}

where _props carries spread props verbatim.

Reachability

The branch only runs when typeof HTMLElement === 'function' at SSR time. In default Node SSR HTMLElement is undefined, so the branch is dead. It becomes reachable when the SSR runtime exposes a global HTMLElement (Deno, Bun with a DOM shim, or jsdom/happy-dom in Node) and a class extending HTMLElement is used directly as an Astro component that receives untrusted-keyed spread props.

Proof of Concept

Given malicious spread props:

const maliciousProps = {
  'onmouseover=alert(document.domain) x': 'y',
  'x><script>alert(1)</script>': 'z',
};

addAttribute (post-fix) → <my-el></my-el> (key stripped — safe)
renderHTMLElement → <my-el onmouseover=alert(document.domain) x="y" x><script>alert(1)</script>="z"></my-el> (handler + <script> injected — XSS)

Equivalent Astro template, served by an SSR runtime that defines a global HTMLElement:

---
import MyElement from '../MyElement.js'; // class MyElement extends HTMLElement {}
const userInput = Astro.url.searchParams;  // untrusted keys
---
<MyElement {...Object.fromEntries(userInput)} />

Impact

Cross-site scripting (CWE-79) via attribute-name breakout — the same vulnerability class as CVE-2026-54298, in a code path its fix did not cover. An attacker who controls the keys of an object spread onto a native-HTMLElement-subclass component can inject arbitrary event-handler attributes or sibling elements (including <script>) into the SSR output. Reachability is constrained by the runtime and component preconditions described above.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Astro: Remote code execution through AVIF image optimization

GHSA-26w7-cxv4-gfx2

More information

Details

A vulnerability in libheif, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized.

Projects are affected when an attacker can cause Astro to process an untrusted AVIF image.

The fix was released in Astro 7.2.8, which requires Sharp 0.35.4.

Severity

CVSS Score: 9.8 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

CVE-2026-84376 / GHSA-376h-93r7-7g6f

More information

Details

Summary

Astro stripped a configured base path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With base: "/app", a request to /appX/admin was treated as being under the base and resolved internally to the /admin route, while middleware still observed the public pathname /appX/admin. Middleware that authorizes routes by inspecting context.url.pathname could therefore be bypassed.

Impact

An unauthenticated remote attacker can bypass pathname-based middleware authorization in applications that:

Configure a non-root base.
Protect base-prefixed routes in middleware using context.url.pathname.

Because routing and middleware resolved different effective pathnames, a request such as /appX/admin (or other single-character extensions like /app2/admin or /app-/admin) reached the protected /admin route without passing the middleware check that guards /app/admin. Astro's authentication guide demonstrates protecting routes in middleware via context.url.pathname, so this is a reasonable and expected pattern.

Affected versions

astro <= 7.2.3.

Patches

Fixed in astro 7.2.4. Base stripping now requires the pathname to equal the base without its trailing slash, or to be followed by a /, so a prefix that does not end on a path-segment boundary is no longer treated as being under the base. Routing and context.url.pathname now resolve the same pathname.

Workarounds

Upgrade to astro 7.2.4 or later. As a mitigation before upgrading, avoid relying solely on prefix checks of context.url.pathname for authorization, or reject requests whose pathname does not begin with the configured base followed by a path-segment boundary.

Credits

Reported by @Ryoga-exe.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

withastro/astro (astro)

`v7.2.8`

Compare Source

Patch Changes

#17837 ecb4082 Thanks @matthewp! - Updates the minimum supported version of Sharp to 0.35.4
#17786 db7c53b Thanks @gameroman! - Replaces the internal find-process dependency with a smaller, lighter alternative

`v7.2.7`

Compare Source

Patch Changes

#17415 55d38c8 Thanks @iseraph-dev! - Deserializes each route once when loading the SSR manifest
#17772 023b48b Thanks @matthewp! - Fixes route selection for normalized request paths in adapter and development request handling
#17819 633855b Thanks @matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0
#17813 ae26d18 Thanks @matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies
#17816 a0d2fe3 Thanks @astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

`v7.2.6`

Compare Source

Patch Changes

#17812 29af6da Thanks @matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

`v7.2.5`

Compare Source

Patch Changes

#17758 5f419e2 Thanks @astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter
#17416 493796b Thanks @iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs
#17712 bd374b7 Thanks @fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8
#17719 dac1768 Thanks @astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys
#17770 84eb7e7 Thanks @astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background
#17713 d035290 Thanks @wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.
#17743 adc750f Thanks @contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.
#17757 660991c Thanks @astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error
#17783 60b14ff Thanks @matthewp! - Fixes a type error when passing an image from a content collection image() schema to a component or <Image />. The schema returned by image() was missing the apng format, so it no longer matched the type of an imported image.
#17664 d483125 Thanks @astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases "unsafe-inline" resource. Now when "unsafe-inline", Astro won't emit hashes for the directive specified.
#17810 0fc5f65 Thanks @florian-lefebvre! - Fixes a regression in the content collections that could cause images to not be resolved
#17781 aa33b44 Thanks @matthewp! - Fixes memoryCache() storing responses that set cookies through Astro.cookies or Astro.session
#17787 6661fbe Thanks @astro-factory! - Fixes server:defer crashing the dev server with "undefined is not a function" when a deferred component imports from astro:i18n
#17750 dd0e3ac Thanks @dobrodob! - Fixes a regression where transition:persist stopped working for <audio> and <video> elements.
#17774 fe1d16d Thanks @astro-factory! - Adds support for importing .apng files as image metadata for use with standard <img> elements. Astro's image components reject APNG files to avoid removing their animation
#17799 8797754 Thanks @astro-factory! - Fixes i18n fallbackType: "rewrite" returning 500 instead of 404 when the fallback locale also has no matching static path for a prerendered dynamic route
#17741 99d3d3d Thanks @ericswpark! - Bumps the Astro compiler to the latest version. Changelog.
#17782 3578d45 Thanks @Princesseuh! - Improves the performance of the Astro CLI in local by enabling Node's module compilation cache.
#17705 2043e4f Thanks @astrobot-houston! - Fixes incremental builds serving cached HTML that references stale CSS filenames after a stylesheet-only edit
#17754 3d50dfd Thanks @astro-factory! - Fixes the dev server refusing to start in Docker containers after a restart due to PID reuse in the lock file check
#17769 bbda94d Thanks @astro-factory! - Fixes a build failure when defining vite.environments.ssr in the Astro config. User-provided environment config for ssr, prerender, or client is now properly deep-merged with Astro's internal environment settings instead of silently breaking the server entry naming.
#17776 0874da8 Thanks @astro-factory! - Fixes the glob() content loader failing to load files with colons in their names (e.g., Guide: Architecture.md)
Updated dependencies [0762a83, 0c99615]:
- @astrojs/markdown-satteri@0.3.8

`v7.2.4`

Compare Source

Patch Changes

#17747 a90ff66 Thanks @Princesseuh! - Fixes builds hanging when an image file is malformed
#17701 05763a0 Thanks @matthewp! - Fixes base path stripping to respect path-segment boundaries. With a configured base such as /docs, a request like /docs-archive/page is no longer treated as being under the base, so routing and context.url.pathname now agree on the same pathname.
#17742 70b449d Thanks @Kjubikstronk! - Fixes astro build throwing TypeError: Missing parameter for dynamic routes when build.format: 'preserve' and trailingSlash: 'always' are used together. Stripping the framework-injected .html suffix dropped the trailing slash that the compiled route pattern requires, so the route no longer matched itself and its params resolved as empty.
#17703 771b0a9 Thanks @astrobot-houston! - Fixes Astro.site always being undefined when rendering components via the Container API, even when site is set in astroConfig
Updated dependencies [05763a0, bc171af]:
- @astrojs/internal-helpers@0.10.4
- @astrojs/markdown-satteri@0.3.7
- @astrojs/markdown-remark@7.2.4

`v7.2.3`

Compare Source

Patch Changes

#17724 97140b2 Thanks @ematipico! - Fixes an issue where Astro could run out of memory when experimental.collectionStorage is set to chunked and there are multiple concurrent updates to the same collection.
#17636 51723b1 Thanks @matthewp! - Fixes the dev server sometimes matching against stale routes after pages were added, removed, or renamed, requiring a dev server restart to pick up the change
#17636 51723b1 Thanks @matthewp! - Fixes the composable request helpers (astro/fetch) throwing an error when used on a request that had been rewritten with Astro.rewrite() or next()
#17636 51723b1 Thanks @matthewp! - Refactors Astro's internal server-side request handling. This is an internal change: all documented public APIs, including App and NodeApp, keep their existing signatures and behavior.

The undocumented internal app.pipeline property and the AppPipeline export from astro/app have been removed. Adapters that used app.pipeline.getLogger() to wait for the configured log destination can call the new app.getLogger() instead.

As a result of this refactor, new FetchState(request) from astro/fetch now works anywhere inside a built Astro server — including custom src/fetch.ts entrypoints — without the request needing to first pass through app.render(). Previously this threw an error, breaking patterns like the Cloudflare adapter's advanced custom-worker setup.
#17723 c3b9aed Thanks @florian-lefebvre! - Fixes a link in font providers JSDoc annotations
#17699 e28d227 Thanks @ArmandPhilippot! - Fixes several documentation issues related to the JSDoc for configuration options.
- When hovering over the server and fonts options, the JSDoc for the nested options was displayed instead of the JSDoc for the top-level property.
- Two i18n configuration options were being used incorrectly in the examples.
- The indentation of some code blocks was broken on hover.
#17572 2066f39 Thanks @matthewp! - Fixes a crash when a request arrives with a malformed port in the Host header (for example example.com:65536 or example.com:8080:8080). Such a host made the constructed request URL invalid, and the fallback that was meant to recover reused the same invalid host and threw again. The request URL now degrades to a host the server controls when the incoming host cannot be parsed, so the request is handled instead of erroring.
#17685 9f15609 Thanks @astrobot-houston! - Fixes a dev server error where an SSR full reload triggered by a third-party Vite plugin (such as @tailwindcss/vite) could fail with Failed to load url astro:server-app.js
#17636 51723b1 Thanks @matthewp! - Improves error handling for custom log destinations. When the configured logger fails to load, Astro now reports the error and continues with the default console logger instead of failing the first request.
#17631 cf29bec Thanks @matthewp! - Fixes getCollection() and getEntry() throwing DataCloneError when a collection schema transform returns a Temporal.PlainDate or other class instance.
Updated dependencies [8c193f6]:
- @astrojs/internal-helpers@0.10.3
- @astrojs/markdown-remark@7.2.3
- @astrojs/markdown-satteri@0.3.6

`v7.2.2`

Compare Source

Patch Changes

#17611 9bc3207 Thanks @thelazylamaGit! - Fixes component styles rendered from content entries remaining stale until a second save when an adapter uses Astro's fallback development environment
#17634 2267eee Thanks @astrobot-houston! - Fixes incremental builds dropping optimized images for cached pages when using a collectStaticImages prerenderer (e.g. @astrojs/cloudflare with compile-time image optimization)
#17650 4cdf128 Thanks @astrobot-houston! - Fixes intermittent ImageNotFound errors during build on projects with many images. The build now limits concurrent image file reads to avoid exhausting OS file descriptors (EMFILE) and retries transient I/O errors with backoff. Non-transient errors are no longer silently swallowed.
#17683 2378221 Thanks @astrobot-houston! - Fixes prerenderConflictBehavior not applying to content collection duplicate ID warnings in the glob() and file() loaders. Setting it to 'error' now throws during content sync, and 'ignore' suppresses the warning.
#17659 90c6ea4 Thanks @astrobot-houston! - Fixes the Fonts API breaking experimental.incrementalBuild caching by embedding a build-local, randomly-assigned server port in generated code used for the dependency hash
#17630 fd1d9ee Thanks @ericclemmons! - Fixes incremental builds becoming prohibitively slow for sites with many pages or content entries that share a large dependency graph.
#17690 93beecc Thanks @NgoQuocViet2001! - Prevents files in directories whose names start with pages from being treated as page routes
#17671 09f0dc7 Thanks @tarikermis! - Fixes astro dev refusing to start after a Docker container restart when an unrelated process reuses the PID from a persisted lock file. Astro now checks the process command across platforms, so stale lock files are cleaned up and --force does not signal the unrelated process.

`v7.2.1`

Compare Source

Patch Changes

#17612 7133730 Thanks @thelazylamaGit! - Fixes CSS hot module replacement after navigating between pages with ClientRouter
#17628 4ada248 Thanks @astrobot-houston! - Fixes a CSP violation when using both security.csp and experimental.clientPrerender with data-astro-prefetch links. The dynamically injected <script type="speculationrules"> now uses a static "source": "document" approach with a CSS selector, producing a deterministic payload that is hashed and included in the CSP script-src directive at build time.
#17605 89e4647 Thanks @ashleigh-yeoman! - Fixes middleware HMR not responding to changes in imported modules. Previously, only direct edits to the middleware file would trigger a reload.
#17582 bd2c1a5 Thanks @astrobot-houston! - Fixes a regression where content collection reference() fields silently accepted entry IDs that don't exist, such as an ID that doesn't match a loader's slugified version of it. Astro now logs an error for references that point to a missing entry after all loaders finish syncing.
#17661 97b0cc7 Thanks @ArmandPhilippot! - Improves Markdown options documentation with links to the Markdown guide and official processors.
#17349 4328c73 Thanks @astrobot-houston! - Fixes an issue where requests handled by the dev prerender environment (e.g. /_image with @astrojs/cloudflare's prerenderEnvironment: 'node') returned a 500 when a prerendered catch-all route existed, because non-prerendered route modules were imported in an environment where their runtime-specific APIs are unavailable
#17603 722eed6 Thanks @astrobot-houston! - Fixes <video> and <audio> elements being non-functional after navigating via view transitions (<ClientRouter />)
#17616 3a890d2 Thanks @lazerg! - Fixes experimental.incrementalBuild re-rendering unchanged routes that import more than one asset. The route's dependency hash depended on the order the assets finished building, so two builds of identical sources could produce different hashes. The hash is now based on the file name each asset resolves to.
#17547 fba468c Thanks @dmgawel! - Improves getCollection() and getEntry() performance for entries without local image references
#17602 16e0d9d Thanks @astrobot-houston! - Fixes a build error caused by hash collisions in generated content collection image import identifiers

`v7.2.0`

Compare Source

Minor Changes

#17174 0224a3a Thanks @matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.
```
astro preview --background
```
When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:
```
astro preview status
astro preview logs
astro preview logs --follow
astro preview stop
```
If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.
#17532 7f94895 Thanks @florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:
```
// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  logger: {
-    entrypoint: new URL('./src/logger.js', import.meta.url),
+    entrypoint: './src/logger.js',
  },
});
```
Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.
#17084 961bbe5 Thanks @matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.
```
import type { AstroPrerenderer, PrerenderResult } from 'astro';

const prerenderer: AstroPrerenderer = {
  name: 'my-adapter:prerenderer',
  getStaticPaths,
  async render(request, { routeData }): Promise<PrerenderResult> {
    const { response, metadata } = await renderInRuntime(request, routeData);
    return { response, metadata };
  },
};
```
This is a non-breaking widening: prerenderers that return a bare Response continue to work unchanged, and in-process prerenderers can keep returning a Response since the build collects their metadata directly.
#16871 90c98ae Thanks @adamchal! - Adds session: false in astro.config to opt out of session support. Projects that do not set session: false see no behavior change.
```
import { defineConfig } from 'astro/config';

export default defineConfig({
  session: false,
});
```
The session runtime and dependencies (unstorage) are now tree-shaken out of the SSR bundle for any project where no session driver is wired via:
- session: false
- no session config at all
- a session config without a driver
Useful for serverless/edge runtimes where cold-start parse time is sensitive.
#17084 961bbe5 Thanks @matthewp! - Adds experimental support for incremental static builds with experimental.incrementalBuild.

When enabled, Astro can skip regenerating static pages from dynamic routes when both the page's module dependencies and its data cache key are unchanged from the previous build. This currently applies to pages returned from getStaticPaths() that include a cacheKey.
```
// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  experimental: {
    incrementalBuild: true,
  },
});
```
Return a cacheKey for each generated page from getStaticPaths():
```
---
export async function getStaticPaths() {
  const posts = await fetchPosts();

  return posts.map((post) => ({
    params: { slug: post.slug },
    props: { post },
    cacheKey: post.digest,
  }));
}
---
```
For incremental builds to skip rendering in CI, Astro's cache directory must be preserved between builds. Astro empties the output directory on each build and restores skipped pages from the cache directory, so only that directory needs to persist. For the default config, cache and restore node_modules/.astro/ before running astro build.

See the experimental incremental static builds documentation for more information.
#17084 961bbe5 Thanks @matthewp! - Adds the

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Australia/Melbourne)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-07-21T09:59:00Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: docs/site/package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: @astrojs/mdx@5.0.6
npm warn Found: astro@7.2.8
npm warn node_modules/astro
npm warn   dev astro@"7.2.8" from the root project
npm warn
npm warn Could not resolve dependency:
npm warn peer astro@"^6.0.0" from @astrojs/mdx@5.0.6
npm warn node_modules/@astrojs/mdx
npm warn   @astrojs/mdx@"^5.0.4" from @astrojs/starlight@0.39.3
npm warn   node_modules/@astrojs/starlight
npm warn
npm warn Conflicting peer dependency: astro@6.4.8
npm warn node_modules/astro
npm warn   peer astro@"^6.0.0" from @astrojs/mdx@5.0.6
npm warn   node_modules/@astrojs/mdx
npm warn     @astrojs/mdx@"^5.0.4" from @astrojs/starlight@0.39.3
npm warn     node_modules/@astrojs/starlight
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @astrojs/starlight@0.39.3
npm error Found: astro@7.2.8
npm error node_modules/astro
npm error   dev astro@"7.2.8" from the root project
npm error
npm error Could not resolve dependency:
npm error peer astro@"^6.0.0" from @astrojs/starlight@0.39.3
npm error node_modules/@astrojs/starlight
npm error   dev @astrojs/starlight@"0.39.3" from the root project
npm error
npm error Conflicting peer dependency: astro@6.4.8
npm error node_modules/astro
npm error   peer astro@"^6.0.0" from @astrojs/starlight@0.39.3
npm error   node_modules/@astrojs/starlight
npm error     dev @astrojs/starlight@"0.39.3" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-09-10T20_01_56_593Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-10T20_01_56_593Z-debug-0.log

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot added the dependencies Dependabot and Renovate automated updates label Jul 21, 2026

chore(deps): update dependency astro to v7 [security]

e69b2b3

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot force-pushed the renovate/npm-astro-vulnerability branch from 34901a8 to e69b2b3 Compare September 10, 2026 00:49

Navigation Menu

Uh oh!

chore(deps): update dependency astro to v7 [security] - #194

chore(deps): update dependency astro to v7 [security]#194
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-astro-vulnerability

renovate Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Astro: Reflected XSS via unescaped View Transition animation properties

Details

Summary

Details

PoC

astro.config.mjs

src/pages/index.astro

Payload:

Impact

Suggested Fix

Severity

References

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Details

Summary

Severity

Details

Proof of Concept

Impact

Affected Versions

Patched Versions

Workarounds

Credits

Severity

References

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

Details

Summary

Details

Reachability

Proof of Concept

Impact

Severity

References

Astro: Remote code execution through AVIF image optimization

Details

Severity

References

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

Details

Summary

Impact

Affected versions

Patches

Workarounds

Credits

Severity

References

Release Notes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Configuration

Uh oh!

renovate Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: docs/site/package-lock.json

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 21, 2026 •

edited

Loading

`astro.config.mjs`

`src/pages/index.astro`

renovate Bot commented Jul 21, 2026 •

edited

Loading