Repository navigation
fix(security): clear the critical and high advisories - #47
Merged
Merged
Conversation
Propagated from shipkit. Five packages, all with published patches.
packages/web
sharp 0.32.5 -> ^0.35.4 The critical here is an RCE
through AVIF decoding in libheif,
which astro reaches via its
default sharp image service. The
advisory is filed against astro
with a fix of 7.2.8, but the
vulnerable code is sharp's, so
patching sharp closes it without
a two-major astro migration.
astro 5.7.13 -> ^5.15.8 Reflected XSS via server islands.
@astrojs/cloudflare 12.6.3 -> ^12.6.6
packages/opencode
minimatch 10.0.3 -> ^10.2.3
packages/console/core
mysql2 3.14.4 -> ^3.22.0 Dev scope.
root overrides
wrangler -> ^4.59.1 Transitive and dev scope.
Still open after this: two astro highs that need 6.3.3 and 6.4.6, and the
astro alert for the libheif critical, which will keep showing until astro
itself moves to 7.2.8 even though the underlying flaw is now patched. Both
need a real major migration of packages/web and belong in their own change.
`bun turbo typecheck` passes, 8 of 8 tasks.
Astro 5.7.13 carried four advisories. sharp 0.35.4 in the previous commit
already closed the critical, because that one is an RCE through AVIF decoding
in libheif which astro only reaches via its default sharp image service. This
moves the framework itself so the other three close too.
astro ^5.15.8 -> ^6.4.8 reflected XSS via server islands
(5.15.8), reflected XSS via
unescaped slot name (6.3.3), host
header SSRF in the prerendered
error page fetch (6.4.6)
@astrojs/cloudflare ^12.6.6 -> ^13.7.0 peers astro ^6.3.0
@astrojs/starlight 0.34.3 -> ^0.40.0 0.40 is the last line that peers
astro ^6; 0.41 requires astro 7
@astrojs/solid-js 5.1.0 -> ^6.0.1
@astrojs/markdown-remark 6.3.1 -> ^6.3.11
Two things had to change for the build to work at all.
The catalog pinned vite at 7.1.4 while astro 6 needs ^7.3.2, so astro and the
cloudflare adapter resolved a nested vite while starlight and vite-plugin-solid
resolved the hoisted one. Virtual modules are registered per vite instance, so
the split meant `astro:assets`, `astro:static-paths` and `virtual:astro:app`
could not resolve and the build died in rolldown. The catalog now pins 7.3.6
and every package in the plugin chain resolves the same vite.
packages/web/wrangler.jsonc is new. @astrojs/cloudflare starts a miniflare
worker to prerender routes during the build, and without nodejs_compat that
worker cannot resolve the node builtins postcss and expressive-code import, so
prerendering failed with `No such module "chunks/path"`. Deployment is still
configured by SST in infra/app.ts; this file only affects the build.
Astro 7 was tried first and abandoned. It replaces remark/rehype with satteri,
whose worker build needs @bruits/satteri-wasm32-wasi, which bun will not
install because the package declares cpu: ["wasm32"]. Installing it by hand
gets the bundle to build and then fails prerendering with "The WASI method is
not implemented". That is an upstream problem, and astro 6 closes every
advisory anyway.
`bun turbo typecheck` passes 8 of 8. `astro build` completes, including the
pagefind index and sitemap.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Propagated from shipkit anomalyco#332 and anomalyco#335, plus the Astro migration.
Security fixes
astropackages/websharppackages/web@astrojs/cloudflarepackages/web@astrojs/starlightpackages/web@astrojs/solid-jspackages/webminimatchpackages/opencodemysql2packages/console/corewranglerAll eleven critical and high advisories are closed.
The astro critical is an RCE through AVIF decoding in
libheif, which astro only reaches via its default sharp image service. Bumping sharp closes the actual flaw; moving astro to 6.4.8 closes the remaining three (server-islands XSS, unescaped slot-name XSS, and host-header SSRF in the prerendered error page fetch).Two things the build needed
The catalog pinned vite at 7.1.4 while astro 6 needs
^7.3.2. Astro and the Cloudflare adapter resolved a nested vite while starlight andvite-plugin-solidresolved the hoisted one. Virtual modules are registered per vite instance, so the split meantastro:assets,astro:static-pathsandvirtual:astro:appcould not resolve and the build died in rolldown. The catalog now pins 7.3.6 and the whole plugin chain resolves one vite. This was the real cause, and it is worth knowing about for any future astro bump.packages/web/wrangler.jsoncis new.@astrojs/cloudflarestarts a miniflare worker to prerender routes during the build, and withoutnodejs_compatthat worker cannot resolve the node builtins that postcss and expressive-code import, so prerendering failed withNo such module "chunks/path". Deployment is still configured by SST ininfra/app.ts; this file only affects the build.Why Astro 6 and not 7
Astro 7 was tried first. It replaces remark/rehype with satteri, whose worker build needs
@bruits/satteri-wasm32-wasi, and bun will not install that package because it declarescpu: ["wasm32"]. Installing it and its napi runtime by hand gets the bundle to build, then prerendering fails with "The WASI method is not implemented". That is an upstream problem in the astro/cloudflare/satteri chain.Astro 6 closes every advisory, so there is no security reason to push to 7. Worth revisiting once satteri's worker story settles.
@astrojs/starlight0.41+ requires astro 7, so that bump comes with it.Verification
bun turbo typecheck: 8 of 8 tasks passastro build: completes, including the pagefind search index and sitemapInstall needs
--ignore-scriptson node 26 in this repo's siblings, though not here.Still open, deliberately
toolbeam-docs-themepeers@astrojs/starlight^0.34.3 and warns that its<Head>and<Header>overrides are already defined in the Starlight config. It builds and renders, but the theme is unmaintained at 0.4.8 and will block the eventual astro 7 move. Worth deciding separately whether to fork it or drop it.