An open index of dependabot pull requests across open source projects.

astro

Ecosystem:
npm
Package URL:
pkg:npm/astro
Total PRs:
34,957 Dependabot PRs
Latest PR:
about 7 hours ago
Unique Repositories:
7,934 repositories
Unique Repos (30 days):
121 repositories
Security Advisories
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
GHSA-vj59-8hwv-xxmv CVE-2026-59731 HIGH published about 10 hours ago • updated about 9 hours ago
# Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch ## Summary Astro 6.4.7 appears to reintr...
Astro: Reflected XSS via unescaped View Transition animation properties
GHSA-4g3v-8h47-v7g6 MODERATE published about 11 hours ago • updated about 9 hours ago
## Summary Astro's server-side View Transition CSS generator interpolates animation properties into an inline `<style>` element without escaping t...
Astro allows unauthorized third-party images in _image endpoint
GHSA-xf8x-j4p2-f749 CVE-2025-55303 MODERATE published 11 months ago • updated about 5 hours ago
### Summary In affected versions of `astro`, the image optimization endpoint in projects deployed with on-demand rendering allows images from unau...
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
GHSA-8mv7-9c27-98vc MODERATE published about 8 hours ago • updated about 7 hours ago
## Summary In the composable `astro/hono` pipeline, the `security.checkOrigin` protection is only installed by the `middleware()` primitive. The `...
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
GHSA-f48w-9m4c-m7f5 CVE-2026-59729 MODERATE published about 8 hours ago • updated about 7 hours ago
## Summary The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an `INVALID_ATTR_NAME_CHAR` guard to `addAttribute()` so that spread-prop attrib...
Recent PRs (filtered by: Patch PRs )
Bump astro from 6.4.2 to 6.4.8

PlayForm/Starter #733

6.4.2 → 6.4.8 Patch PR
Open 29 days ago 2 comments
PlayForm
Bump astro from 6.4.2 to 6.4.8

reupen/reupen.uk #328

6.4.2 → 6.4.8 Patch PR
Closed about 1 month ago 3 comments
reupen
Bump astro from 6.4.6 to 6.4.8

Nikos-Stuff/hosting #85

6.4.6 → 6.4.8 Patch PR
Closed about 1 month ago 3 comments
Nikos-Stuff
Package Details
Name: astro
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/astro
JSON API: View JSON
Security Advisories

25

Active advisories
HIGH 6
MODERATE 14
LOW 5
View All npm Advisories
Package Information
Description:

Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Repository: https://github.com/withastro/astro
Homepage: https://astro.build
Latest Release: 4.16.16
over 1 year ago
Dependent Repos: 18,705
Dependent Packages: 915
Downloads: 1,349,386
Ranking: Top 0.1941% by dependent repos Top 0.2899% by downloads Top 0.0943% by dependent pkgs
PR Status
Open 16,149 (46.2%)
Merged 3,432 (9.8%)
Closed 13,019 (37.2%)
PR Types
Major 2,587 (7.4%)
Minor 18,678 (53.4%)
Patch 11,318 (32.4%)