fix(deps): update dependency @astrojs/netlify to ~8.1.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/netlify (source)	~8.0.0 → ~8.1.0

---

@​astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

GHSA-hp3v-mfqw-h74c

More information

Details

Summary

The @astrojs/netlify adapter converts each image.remotePatterns entry into a regular expression that is written to .netlify/v1/config.json under images.remote_images. Netlify's Image CDN uses these regexes as the allowlist that decides which remote image URLs it will optimize. remotePatternToRegex() escapes . in the hostname but interpolates the literal pathname into the regex without escaping regex metacharacters. As a result, the generated allowlist is broader than the pattern the developer declared, and broader than Astro's canonical matchPattern() helper (which compares non-wildcard pathnames by exact string equality).

This is a residual of the same bug class addressed in CVE-2026-54300 (PR #​17018, commit 1310277d). That fix corrected wildcard semantics and added a $ anchor but did not add metacharacter escaping for literal pathnames.

Details

In packages/integrations/netlify/src/index.ts, remotePatternToRegex() escapes dots in the hostname:

regexStr += hostname.replace(/\./g, '\\.');

but interpolates the pathname unescaped in all three branches, e.g. the exact-match branch:

regexStr += `(\\${pathname})`;

Any regex metacharacter in the literal path (., +, ?, (, [, ...) is therefore passed through raw. Because . matches any character (including /), a restrictive pattern is silently widened.

The security boundary on Netlify is the generated regex itself — Netlify's Image CDN enforces it directly and Astro's runtime matchPattern() is not in the loop for this path, so there is no compensating layer that re-validates the request.

Proof of Concept

Configure an SSR site with a literal pathname containing a .:

// astro.config.mjs
image: {
  remotePatterns: [{
    protocol: 'https',
    hostname: 'cdn.example.com',
    pathname: '/img/v1.0/file',
  }],
}

Run astro build and inspect .netlify/v1/config.json images.remote_images[0]:

https://cdn\.example\.com(:[0-9]+)?(\/img/v1.0/file)([?][^#]*)?$

Testing the generated regex:

• https://cdn.example.com/img/v1.0/file -> MATCH (intended)
• https://cdn.example.com/img/v1X0/file -> MATCH (bypass; the unescaped . matches any character)
• https://cdn.example.com/img/v1/0/file -> MATCH (bypass; . also matches /, crossing a path segment)

Astro's canonical matchPattern() (exact string equality on the pathname) rejects both bypass URLs.

Impact

Netlify's Image CDN accepts optimization requests for URLs on the allowed host that the developer's remotePatterns entry was intended to exclude. The hostname remains correctly anchored, so the broadening is confined to the pathname dimension on an already-allowed host. Realistic impact depends on whether other images the developer meant to keep out of their CDN exist at metacharacter-adjacent paths on that host. This affects reasonable, non-permissive configurations, since any pathname containing a . (file extensions, version segments) is affected.

Patches

A fix will escape all regex metacharacters in the literal portions of each remotePatterns component before interpolation, applying only Astro's documented wildcard semantics explicitly. A regression corpus validates the generated Netlify regexes against @astrojs/internal-helpers' matchPattern().

Workarounds

Avoid regex metacharacters (notably .) in image.remotePatterns[].pathname values, or scope the allowed host so that unintended paths are not reachable.

Credit

Reported by @​sec-reex as part of an incomplete-patch measurement study (responsible disclosure).

Severity

• CVSS Score: 3.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/withastro/astro/security/advisories/GHSA-hp3v-mfqw-h74c
• https://github.com/withastro/astro/pull/17018
• https://github.com/advisories/GHSA-529g-xq4f-cw38
• https://github.com/advisories/GHSA-hp3v-mfqw-h74c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

withastro/astro (@​astrojs/netlify)

v8.1.2

Compare Source

Patch Changes

• #​17368 ee74c28 Thanks @​matthewp! - Fixes the generated Netlify Image CDN remote_images patterns so that regex metacharacters (such as .) in image.remotePatterns (hostname, pathname) and image.domains are matched literally instead of behaving like wildcards. This makes the generated patterns consistent with how Astro matches these values elsewhere.

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.3

v8.1.1

Compare Source

Patch Changes

• Updated dependencies [eb6f97e]:
  • @​astrojs/internal-helpers@​0.10.1
  • @​astrojs/underscore-redirects@​1.0.3

v8.1.0

Compare Source

Minor Changes

• #​17245 f56d9e7 Thanks @​astrobot-houston! - Adds edgeFunctions to the devFeatures adapter option, allowing users to disable Netlify Edge Function emulation during astro dev

  Some npm packages that access the filesystem at initialization (e.g. node-html-parser) fail inside the edge function sandbox with "Reading or writing files with Edge Functions is not supported yet." You can now disable edge function emulation to avoid this error:

  import netlify from '@​astrojs/netlify';
  import { defineConfig } from 'astro/config';
  
  export default defineConfig({
    adapter: netlify({
      devFeatures: {
        edgeFunctions: false,
      },
    }),
  });

  Edge functions will still work in production builds and via netlify dev.

Patch Changes

• #​17249 02b73b0 Thanks @​ematipico! - Fixes an issue where the peerDependencies field used incorrect dependencies.

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.3

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
endless-chat	Error		Jul 25, 2026 1:25am
free-chat	Error		Jul 25, 2026 1:25am

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

? Verifying lockfile against supply-chain policies (1522 entries)...
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 42, reused 0, downloaded 0, added 0
Progress: resolved 49, reused 0, downloaded 0, added 0
Progress: resolved 51, reused 0, downloaded 0, added 0
Progress: resolved 52, reused 0, downloaded 0, added 0
Progress: resolved 53, reused 0, downloaded 0, added 0
Progress: resolved 54, reused 0, downloaded 0, added 0
Progress: resolved 56, reused 0, downloaded 0, added 0
Progress: resolved 57, reused 0, downloaded 0, added 0
Progress: resolved 248, reused 0, downloaded 0, added 0
Progress: resolved 427, reused 0, downloaded 0, added 0
Progress: resolved 679, reused 0, downloaded 0, added 0
Progress: resolved 888, reused 0, downloaded 0, added 0
✗ Lockfile failed supply-chain policy check (1522 entries in 13.5s)
[ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION] 1 lockfile entries failed verification:
  svelte@5.56.8 was published at 2026-07-24T22:09:08.000Z, within the minimumReleaseAge cutoff (2026-07-24T01:25:06.397Z)

The lockfile contains entries that the active policies reject. This can mean the lockfile is stale, or that someone committed a lockfile that bypassed the policy locally — inspect recent changes to pnpm-lock.yaml before trusting it. If the changes look expected, run "pnpm clean --lockfile" and then "pnpm install" to rebuild from a fresh resolution. Alternatively, relax the policy that flagged them.