[ifiokjr]

Every astro release up to and including 7.3.1 is affected by the current advisory set. The only patched release is 7.4.7, so this is a major migration rather than a patch bump.

What was vulnerable

11 advisories, aggregated by npm audit as one critical finding:

• Remote code execution through AVIF image optimization (CVSS 9.8)
• XSS in define:vars via incomplete </script> sanitization
• XSS via unescaped attribute names in spread props, and an incomplete fix for CVE-2026-54298
• XSS via unescaped transition:* directive values on hydrated islands
• Reflected XSS via unescaped View Transition animation properties
• Reflected XSS via unescaped slot name
• Reflected/stored XSS via unescaped <script>/<style> content in JSX/MDX rendering
• Host header SSRF in prerendered error page fetch
• Server island encrypted-parameter cross-component replay
• Authorization bypass from a missing path-segment boundary check when stripping the configured base

Version moves

package	before	after
astro	5.16.9	7.4.7
@astrojs/starlight	0.34.4	0.42.9
starlight-blog	0.25.3	0.30.2
starlight-llms-txt	0.7.0	0.12.0
sharp	0.34.5	0.35.5
@astrojs/check	0.9.9	0.9.12

sharp picks up libvips, libheif and librsvg CVEs of its own.

The transitive chain the old tree carried disappears with the upgrade — js-yaml, defu, devalue, fast-uri, h3, nanoid, picomatch, postcss, source-map-js, svgo and zod are all at patched versions now.

Source changes

1. Starlight removed the top-level tagline option. It is now description. The string is unchanged, so nothing visible moves.
2. Starlight 0.42 resolves virtual:starlight/user-config at build time but no longer ships a type declaration for it. astro check failed on src/overrides/SocialIcons.astro, which reads config.social. docs/src/env.d.ts declares the module against Starlight's own exported StarlightConfig type, so the shape still comes from the package rather than being restated here.

Dependency resolution

docs/ is a member of the pnpm workspace, so the security bump has to land in pnpm-lock.yaml, not just docs/package.json — CI installs with --frozen-lockfile.

Regenerating it surfaced a real trap: pnpm resolved @napi-rs/wasm-runtime's peers to @emnapi/core@1.11.3 but @emnapi/runtime@2.0.0-beta.2. That skew makes the wasm bridge throw this.bridge.setLastError is not a function on import, which astro surfaces as "@astrojs/check is not installed" and then tries to install interactively. Both are pinned to 1.11.3 — the versions main already uses — via pnpm.overrides.

Only the six docs specifiers change. Three shared packages move major — @astrojs/markdown-remark, @astrojs/mdx, @astrojs/prism — because astro 7 requires them. Everything else stays inside its declared range.

Verification

• pnpm install --frozen-lockfile passes (the step both failed jobs died on).
• npm audit in docs/: 0 vulnerabilities (was 1 critical + 14 high + 7 moderate).
• pnpm run build passes end to end through pnpm — provider-credential and terminal-copy tests, astro check, 100 pages, pagefind index, sitemap.

---

Created on behalf of Ifiok Jr. (@ifiokjr) — generated by DeepSeek V4.1 Flash at high thinking.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.45%. Comparing base (74a7e18) to head (e01cc53).

❌ Your project status has failed because the head coverage (27.74%) is below the target coverage (95.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #114   +/-   ##
=======================================
  Coverage   87.45%   87.45%           
=======================================
  Files         127      127           
  Lines       73904    73904           
  Branches       49       48    -1     
=======================================
+ Hits        64633    64636    +3     
+ Misses       9262     9259    -3     
  Partials        9        9           

Flag	Coverage Δ
crate-monosecret	87.54% <ø> (+<0.01%)	⬆️
crate-monosecret-derive	87.54% <ø> (+<0.01%)	⬆️
dart	94.50% <ø> (ø)
dart-monosecret	89.33% <ø> (ø)
dart-monosecret-builder	100.00% <ø> (ø)
npm	27.74% <ø> (ø)
npm-monosecret-client	27.74% <ø> (ø)
rust	87.54% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 3 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.