An open index of dependabot pull requests across open source projects.

astro

Ecosystem:
npm
Package URL:
pkg:npm/astro
Total PRs:
36,937 Dependabot PRs
Latest PR:
about 5 hours ago
Unique Repositories:
9,313 repositories
Unique Repos (30 days):
382 repositories
Security Advisories
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
GHSA-8mv7-9c27-98vc CVE-2026-73423 MODERATE published 3 months ago • updated about 15 hours ago
## Summary In the composable `astro/hono` pipeline, the `security.checkOrigin` protection is only installed by the `middleware()` primitive. The `...
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
GHSA-376h-93r7-7g6f CVE-2026-84376 MODERATE published about 1 month ago • updated about 18 hours ago
## Summary Astro stripped a configured `base` path from request pathnames using a string-prefix check that did not verify a path-segment boundary....
Astro development server error page is vulnerable to reflected Cross-site Scripting
GHSA-w2vj-39qv-7vh7 CVE-2025-64745 LOW published 11 months ago • updated about 1 hour ago
## Summary A Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the `trailingSlash` configur...
DOM Clobbering Gadget found in astro's client-side router that leads to XSS
GHSA-m85w-3h95-hcf9 CVE-2024-47885 MODERATE published almost 2 years ago • updated about 16 hours ago
### Summary A DOM Clobbering gadget has been discoverd in Astro's client-side router. It can lead to cross-site scripting (XSS) in websites enable...
Atro CSRF Middleware Bypass (security.checkOrigin)
GHSA-c4pw-33h3-35xw CVE-2024-56140 MODERATE published almost 2 years ago • updated about 16 hours ago
### Summary A bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. ### Details When the `security.checkOrigin` confi...
Recent PRs
Bump sharp, @astrojs/mdx and astro

NOUIY/bootstrap #495

5.18.2 → 7.3.8 Major PR
Open about 15 hours ago 1 comment
NOUIY
Package Details
Name: astro
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/astro
JSON API: View JSON
Security Advisories

27

Active advisories
CRITICAL 1
HIGH 6
MODERATE 15
LOW 5
View All npm Advisories
Package Information
Description:

Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Repository: https://github.com/withastro/astro
Homepage: https://astro.build
Latest Release: 4.16.16
almost 2 years ago
Dependent Repos: 18,705
Dependent Packages: 915
Downloads: 1,349,386
Ranking: Top 0.1941% by dependent repos Top 0.2899% by downloads Top 0.0943% by dependent pkgs
PR Status
Open 16,845 (45.6%)
Merged 3,432 (9.3%)
Closed 14,305 (38.7%)
PR Types
Major 3,212 (8.7%)
Minor 19,475 (52.7%)
Patch 11,878 (32.2%)