Repository navigation
fix(docs): migrate to astro 7 to clear 11 published advisories - #114
Merged
Merged
Conversation
Every astro release up to and including 7.3.1 is affected by the current advisory set - 8 XSS issues, an SSRF, a cross-component server-island replay, an authorization bypass in base stripping, and the AVIF image optimization RCE (CVSS 9.8). The only patched release is 7.4.7, so this is a major migration rather than a patch. - astro 5.16.9 -> 7.4.7 - @astrojs/starlight 0.34.4 -> 0.42.9 - starlight-blog 0.25.3 -> 0.30.2 - starlight-llms-txt 0.7.0 -> 0.12.0 - sharp 0.34.5 -> 0.35.5 (libvips, libheif and librsvg CVEs) The transitive chain the old tree carried is gone with it: js-yaml, defu, devalue, fast-uri, h3, nanoid, picomatch, postcss, source-map-js, svgo and zod are all at patched versions now. Two source changes were needed for the new majors: - Starlight removed the top-level option; it is now . The tagline string is unchanged. - Starlight 0.42 resolves virtual:starlight/user-config at build time but no longer ships a type declaration for it, so astro check failed on the SocialIcons override. docs/src/env.d.ts declares it against Starlight's own exported StarlightConfig type rather than restating the shape. npm audit in docs/ now reports zero vulnerabilities. npm run build succeeds: 100 pages, pagefind index and sitemap all generated.
CI installs with pnpm --frozen-lockfile, and docs/ is a member of the workspace, so bumping docs/package.json without regenerating pnpm-lock.yaml failed the check and build jobs at install. Two things surfaced while regenerating: - pnpm re-resolved @napi-rs/wasm-runtime's peers to @emnapi/core 1.11.3 but @emnapi/runtime 2.0.0-beta.2. That skew makes the wasm bridge throw 'this.bridge.setLastError is not a function' on import, which astro reports as '@astrojs/check is not installed' and then tries to install. Both are pinned to 1.11.3, the versions main already uses. - @astrojs/check 0.9.9 predates astro 7, so it moves to 0.9.12 (still inside its typescript ^6 peer range). Only the six docs specifiers changed. Three shared packages move major - @astrojs/markdown-remark, @astrojs/mdx and @astrojs/prism - because astro 7 requires them. Everything else stays inside its declared range. Verified with the CI path: pnpm install --frozen-lockfile, then the docs build (100 pages, pagefind, sitemap).
dprint's oxc plugin wants double quotes; the declaration used single quotes, which failed the lint job on the previous push.
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project status has failed because the head coverage (27.74%) is below the target coverage (95.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #114 +/- ##
=======================================
Coverage 87.45% 87.45%
=======================================
Files 127 127
Lines 73904 73904
Branches 49 48 -1
=======================================
+ Hits 64633 64636 +3
+ Misses 9262 9259 -3
Partials 9 9
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every astro release up to and including 7.3.1 is affected by the current advisory set. The only patched release is 7.4.7, so this is a major migration rather than a patch bump.
What was vulnerable
11 advisories, aggregated by
npm auditas one critical finding:define:varsvia incomplete</script>sanitizationtransition:*directive values on hydrated islands<script>/<style>content in JSX/MDX renderingVersion moves
astro@astrojs/starlightstarlight-blogstarlight-llms-txtsharp@astrojs/checksharppicks up libvips, libheif and librsvg CVEs of its own.The transitive chain the old tree carried disappears with the upgrade —
js-yaml,defu,devalue,fast-uri,h3,nanoid,picomatch,postcss,source-map-js,svgoandzodare all at patched versions now.Source changes
taglineoption. It is nowdescription. The string is unchanged, so nothing visible moves.virtual:starlight/user-configat build time but no longer ships a type declaration for it.astro checkfailed onsrc/overrides/SocialIcons.astro, which readsconfig.social.docs/src/env.d.tsdeclares the module against Starlight's own exportedStarlightConfigtype, so the shape still comes from the package rather than being restated here.Dependency resolution
docs/is a member of the pnpm workspace, so the security bump has to land inpnpm-lock.yaml, not justdocs/package.json— CI installs with--frozen-lockfile.Regenerating it surfaced a real trap: pnpm resolved
@napi-rs/wasm-runtime's peers to@emnapi/core@1.11.3but@emnapi/runtime@2.0.0-beta.2. That skew makes the wasm bridge throwthis.bridge.setLastError is not a functionon import, which astro surfaces as "@astrojs/checkis not installed" and then tries to install interactively. Both are pinned to1.11.3— the versionsmainalready uses — viapnpm.overrides.Only the six docs specifiers change. Three shared packages move major —
@astrojs/markdown-remark,@astrojs/mdx,@astrojs/prism— because astro 7 requires them. Everything else stays inside its declared range.Verification
pnpm install --frozen-lockfilepasses (the step both failed jobs died on).npm auditindocs/: 0 vulnerabilities (was 1 critical + 14 high + 7 moderate).pnpm run buildpasses end to end through pnpm — provider-credential and terminal-copy tests,astro check, 100 pages, pagefind index, sitemap.Created on behalf of Ifiok Jr. (@ifiokjr) — generated by DeepSeek V4.1 Flash at high thinking.