fix(deps): update dependency astro to ~7.1.0 [security] by renovate[bot] · Pull Request #1310 · CNSeniorious000/free-chat

renovate · 2026-07-21T01:23:02Z

This PR contains the following updates:

Package	Change	Age	Confidence
astro (source)	`~7.0.9` → `~7.1.0`

Astro: Reflected XSS via unescaped View Transition animation properties

GHSA-4g3v-8h47-v7g6

More information

Details

Summary

Astro's server-side View Transition CSS generator interpolates animation properties into an inline <style> element without escaping them for the CSS and HTML contexts.

An attacker-controlled value passed to an animation property such as duration can contain a </style> sequence, terminate the generated style element, and inject arbitrary HTML or JavaScript.

This is similar to GHSA-8hv8-536x-4wqp, but exploits a different injection point: unescaped View Transition animation values in a server-generated <style> element rather than an unescaped slot name in a hydration template.

Like GHSA-8hv8-536x-4wqp, exploitation requires an application to pass attacker-controlled data to an Astro API. However, the value is subsequently inserted into the HTML response without context-appropriate escaping by Astro.

Details

packages/astro/src/runtime/server/transition.ts

The generated stylesheet is wrapped in a <style> element and marked as HTML-safe:

const css = sheet.toString();
result._metadata.extraHead.push(markHTMLString(`<style>${css}</style>`));

Animation properties are added to the stylesheet without escaping:

if (anim.duration) {
  addAnimationProperty(builder, 'animation-duration', toTimeValue(anim.duration));
}

For string values, toTimeValue() returns the input unchanged:

export function toTimeValue(num: number | string) {
  return typeof num === 'number' ? num + 'ms' : num;
}

As a result, a duration value containing </style> can escape from the generated style element.

Other TransitionAnimation properties, including easing, direction, delay, fillMode, and name, are serialized by the same animation builder. The following PoC only relies on the official fade() helper and its duration option.

PoC

Using:

astro@7.0.9
@astrojs/node@11.0.2

`astro.config.mjs`

import node from '@&#8203;astrojs/node';
import { defineConfig } from 'astro/config';

export default defineConfig({
  output: 'server',
  adapter: node({ mode: 'standalone' }),
});

`src/pages/index.astro`

---
import { fade } from 'astro:transitions';

const duration = Astro.url.searchParams.get('duration') ?? '300ms';
---

<html lang="en">
  <head>
    <meta charset="utf-8" />
    <title>PoC</title>
  </head>
  <body>
    <div transition:animate={fade({ duration })}>
      Animated content
    </div>
  </body>
</html>

Payload:

open:

http://localhost:4321/?duration=%3C%2Fstyle%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E%3C!--

The browser interprets </style> as the end of the generated style element and executes the injected script. An alert dialog is displayed when the page is opened.

Impact

An attacker who can control a View Transition animation value can execute arbitrary JavaScript in the origin of the affected Astro application.

The query-based reflected XSS scenario affects on-demand/server-rendered routes, such as:

projects configured with output: "server";
pages using export const prerender = false;
other server-side data flows that pass attacker-controlled values into a View Transition animation definition.

Successful exploitation may allow access to sensitive page data and authenticated actions available to the victim.

Suggested Fix

Animation values should be serialized using context-appropriate CSS escaping or validation before being added to the generated stylesheet.

Additionally, content inserted into a raw <style> element must not be able to contain an HTML end-tag sequence such as </style>. The final generated CSS should be made safe for the HTML raw-text context before it is passed to markHTMLString().

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

withastro/astro (astro)

`v7.1.0`

Compare Source

Minor Changes

#17302 5f4dc03 Thanks @astrobot-houston! - Adds a new deferRender option to the glob() content loader

When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
```
// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';

const docs = defineCollection({
  loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
```
By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
#17296 30698a2 Thanks @ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
```
// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  experimental: {
    collectionStorage: 'chunked',
  },
});
```
Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.
#17214 44c4989 Thanks @ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

Scoping sources and hashes in your config

Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.

// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  security: {
    csp: {
      scriptDirective: {
        resources: [{ resource: 'https://cdn.example.com', kind: 'element' }],
      },
      styleDirective: {
        resources: [{ resource: "'unsafe-inline'", kind: 'attribute' }],
      },
    },
  },
});

Scoping at runtime

The same kind option is available on the runtime CSP API, where the existing methods now also accept an object:

ctx.csp.insertScriptResource({ resource: 'https://cdn.example.com', kind: 'element' });
ctx.csp.insertStyleResource({ resource: "'unsafe-inline'", kind: 'attribute' });

#17258 84814d4 Thanks @astrobot-houston! - Adds a new format() option to the paginate utility. The format() option is a function that accepts the current URL of the page, and returns a new URL.

For example, when your host only supports URLs using the .html extension, you can use format() to add it to the generated URLs:

---
export async function getStaticPaths({ paginate }) {
  // Load your data with fetch(), getCollection(), etc.
  const response = await fetch(`https://pokeapi.co/api/v2/pokemon?limit=150`);
  const result = await response.json();
  const allPokemon = result.results;

  // Return a paginated collection of paths for all items
  return paginate(allPokemon, {
    pageSize: 10,
    format: (url) => `${url}.html`,
  });
}

const { page } = Astro.props;
---

#17331 7db6420 Thanks @matthewp! - Adds a --ignore-lock flag to astro dev for starting a dev server without checking or writing the lock file, so it can run alongside an already-running dev server for the same project.

The new instance is not tracked by astro dev stop, astro dev status, or astro dev logs. --ignore-lock cannot be combined with --background (or an auto-detected AI agent environment, which runs dev servers in the background automatically) or --force, since those rely on the lock file.
```
astro dev --ignore-lock
```
#17389 16de021 Thanks @florian-lefebvre! - Allows passing URL entrypoints when configuring the logger

Matching other APIs like session drivers or font providers, the logger entrypoint can now be a URL:
```
import { defineConfig } from 'astro/config';

export default defineConfig({
  logger: {
    entrypoint: new URL('./logger.js', import.meta.url),
  },
});
```

Patch Changes

#17332 4407483 Thanks @astrobot-houston! - Fixes the JSON logger crashing with process is not defined in non-Node runtimes like Cloudflare's workerd. The JSON logger now uses console.log/console.error instead of process.stdout/process.stderr, matching the pattern already used by the console logger.
#17391 186a1e7 Thanks @florian-lefebvre! - Fixes a case where an integration could not update the logger with updateConfig()
#17394 d9f99e1 Thanks @matthewp! - Fixes element-specific CSP directives to preserve the existing behavior of configured script and style resources
#17374 b2d1b3e Thanks @astrobot-houston! - Fixes dev server returning 404 for ?url imported assets when accessed via browser navigation
#17390 ed71eaf Thanks @florian-lefebvre! - Removes an unused and undocumented generic from the AstroLoggerDestination type
#17393 092da56 Thanks @matthewp! - Hardens generated transition styles, development metadata, and server island URLs when embedding dynamic values

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2026-07-21T01:23:06Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
endless-chat	Error		Jul 25, 2026 1:25am
free-chat	Error		Jul 25, 2026 1:25am

renovate · 2026-07-25T01:25:44Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

? Verifying lockfile against supply-chain policies (1522 entries)...
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 58, reused 0, downloaded 0, added 0
Progress: resolved 274, reused 0, downloaded 0, added 0
Progress: resolved 493, reused 0, downloaded 0, added 0
Progress: resolved 629, reused 0, downloaded 0, added 0
Progress: resolved 897, reused 0, downloaded 0, added 0
✗ Lockfile failed supply-chain policy check (1522 entries in 6.4s)
[ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION] 1 lockfile entries failed verification:
  svelte@5.56.8 was published at 2026-07-24T22:09:08.000Z, within the minimumReleaseAge cutoff (2026-07-24T01:25:31.914Z)

The lockfile contains entries that the active policies reject. This can mean the lockfile is stale, or that someone committed a lockfile that bypassed the policy locally — inspect recent changes to pnpm-lock.yaml before trusting it. If the changes look expected, run "pnpm clean --lockfile" and then "pnpm install" to rebuild from a fresh resolution. Alternatively, relax the policy that flagged them.
Progress: resolved 1032, reused 0, downloaded 0, added 0

vercel Bot had a problem deploying to Preview – free-chat-personal July 21, 2026 01:23 Failure

vercel Bot had a problem deploying to Preview – free-chat July 21, 2026 01:23 Failure

vercel Bot had a problem deploying to Preview – endless-chat July 21, 2026 01:23 Failure

renovate Bot force-pushed the renovate/npm-astro-vulnerability branch from 776311a to 5a2eec1 Compare July 24, 2026 16:08

vercel Bot deployed to Preview – free-chat-personal July 24, 2026 16:10 View deployment

vercel Bot deployed to Preview – free-chat July 24, 2026 16:11 View deployment

vercel Bot deployed to Preview – endless-chat July 24, 2026 16:11 View deployment

fix(deps): update dependency astro to ~7.1.0 [security]

d25382a

renovate Bot force-pushed the renovate/npm-astro-vulnerability branch from 5a2eec1 to d25382a Compare July 25, 2026 01:25

vercel Bot had a problem deploying to Preview – free-chat-personal July 25, 2026 01:25 Failure

vercel Bot had a problem deploying to Preview – endless-chat July 25, 2026 01:25 Failure

vercel Bot had a problem deploying to Preview – free-chat July 25, 2026 01:25 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency astro to ~7.1.0 [security]#1310

fix(deps): update dependency astro to ~7.1.0 [security]#1310
renovate[bot] wants to merge 1 commit into
promplate-demofrom
renovate/npm-astro-vulnerability

renovate Bot commented Jul 21, 2026

Uh oh!

vercel Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Jul 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Jul 21, 2026

Astro: Reflected XSS via unescaped View Transition animation properties

Details

Summary

Details

PoC

astro.config.mjs

src/pages/index.astro

Payload:

Impact

Suggested Fix

Severity

References

Release Notes

v7.1.0

Minor Changes

Scoping sources and hashes in your config

Scoping at runtime

Patch Changes

Configuration

Uh oh!

vercel Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

renovate Bot commented Jul 25, 2026

⚠️ Artifact update problem

File name: pnpm-lock.yaml

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`astro.config.mjs`

`src/pages/index.astro`

`v7.1.0`

vercel Bot commented Jul 21, 2026 •

edited

Loading