An open index of dependabot pull requests across open source projects.

astro

Ecosystem:
npm
Package URL:
pkg:npm/astro
Total PRs:
32,333 Dependabot PRs
Latest PR:
about 9 hours ago
Unique Repositories:
6,632 repositories
Unique Repos (30 days):
457 repositories
Security Advisories
Astro Development Server has Arbitrary Local File Read
GHSA-x3h8-62x9-952g CVE-2025-64757 LOW published 4 months ago • updated about 1 month ago
### Summary A vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through th...
DOM Clobbering Gadget found in astro's client-side router that leads to XSS
GHSA-m85w-3h95-hcf9 CVE-2024-47885 MODERATE published over 1 year ago • updated 17 days ago
### Summary A DOM Clobbering gadget has been discoverd in Astro's client-side router. It can lead to cross-site scripting (XSS) in websites enable...
Astro's bypass of image proxy domain validation leads to SSRF and potential XSS
GHSA-qcpr-679q-rhm2 CVE-2025-59837 HIGH published 5 months ago • updated 24 days ago
### Summary This is a patch bypass of CVE-2025-58179 in commit [9ecf359](https://github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047e...
Atro CSRF Middleware Bypass (security.checkOrigin)
GHSA-c4pw-33h3-35xw CVE-2024-56140 MODERATE published over 1 year ago • updated 21 days ago
### Summary A bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. ### Details When the `security.checkOrigin` confi...
Astro's server source code is exposed to the public if sourcemaps are enabled
GHSA-49w6-73cw-chjr CVE-2024-56159 HIGH published over 1 year ago • updated 16 days ago
### Summary A bug in the build process allows any unauthenticated user to read parts of the server source code. ### Details During build, along wi...
Recent PRs
chore(deps): bump astro from 5.17.3 to 6.0.8

EVLBOX/docs #16

5.17.3 → 6.0.8 Major PR
Open about 11 hours ago 1 comment
EVLBOX
Bump astro from 5.18.1 to 6.0.8

groupsmix/srcgroupsmi #40

5.18.1 → 6.0.8 Major PR
Open about 21 hours ago 2 comments
groupsmix
Package Details
Name: astro
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/astro
JSON API: View JSON
Security Advisories

14

Active advisories
HIGH 3
MODERATE 9
LOW 2
View All npm Advisories
Package Information
Description:

Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Repository: https://github.com/withastro/astro
Homepage: https://astro.build
Latest Release: 4.16.16
over 1 year ago
Dependent Repos: 18,705
Dependent Packages: 915
Downloads: 1,349,386
Ranking: Top 0.1941% by dependent repos Top 0.2899% by downloads Top 0.0943% by dependent pkgs
PR Status
Open 14,860 (46.0%)
Merged 3,432 (10.6%)
Closed 11,686 (36.1%)
PR Types
Minor 17,774 (55.0%)
Major 1,589 (4.9%)
Patch 10,599 (32.8%)