Repository navigation
fix(deps): Bump astro to 7.3.5, clearing five Dependabot alerts - #907
Open
stefanko-ch wants to merge 1 commit into
Open
stefanko-ch wants to merge 1 commit into
stefanko-ch wants to merge 1 commit into
Conversation
All five open alerts sit in control-plane/package-lock.json and all five are transitive under the one direct dependency, `astro`. Raising it resolves every one: astro 7.2.7 -> 7.3.5 GHSA-26w7-cxv4-gfx2 critical js-yaml 4.3.1 -> 4.3.2 CVE-2026-84375 high svgo 4.0.2 -> 4.1.0 CVE-2026-84370 high CVE-2026-84369 medium devalue 5.8.1 -> 5.9.4 CVE-2026-81176 medium sharp 0.35.4 unchanged `npm audit` afterwards: found 0 vulnerabilities. None of the five was reachable in this deployment, and that is worth recording rather than leaving for the next person to re-derive. The Control Plane is `output: 'static'` — prerendered in CI and served as files by Cloudflare Pages. The API is separate plain-JS Pages Functions plus a Worker, and none of them imports any of these packages, so none of this code runs in production at all; it runs in the build step, on repository-controlled input. Per alert: astro/Sharp AVIF RCE needs Astro to optimize an untrusted AVIF. There is no `astro:assets`, no <Image>, no getImage anywhere in src/; the only image is a PNG in public/ that Astro copies verbatim, and there is no AVIF in the repository. `sharp` was already at 0.35.4, the version the advisory names as the fix. js-yaml CPU DoS build-time only, under astro and @astrojs/internal-helpers; the only YAML the build reads is our own. svgo removeScripts an opt-in plugin that matters only when sanitizing untrusted SVG. This project contains no SVG. devalue parse DoS astro serializes its own props with it at build time. devalue was stale in the lockfile rather than blocked: astro already allowed ^5.8.1, so 5.9.4 was installable all along and a plain lockfile refresh would have closed that one. Verified in node:22-bookworm, the same image the workflows use, before and after: 9 pages, and the build output is BYTE-IDENTICAL — 15 files, matching SHA-256 for every one, none added or removed. The bump changes nothing about what gets deployed.
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis dependency-only PR raises Astro to 7.3.5 and refreshes its transitive lockfile dependencies, clearing all five Dependabot alerts while preserving the existing static build output. Verification includes a clean npm audit, matching Node 22 builds with byte-identical artifacts, and a reachability review showing the vulnerable code paths are not used in production. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: stefanko-ch/Nexus-Stack/.coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe control-plane package manifest updates the Astro dependency range from ChangesAstro dependency update
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~3 minutes Change: Other Merge Risk: ⚪ Minimal · up to The Astro update is reflected consistently in the lockfile, with no identified merge-blocking issue. Architecture SummaryArchitecture risk: 🔵 Low · up to The change affects 1 system. Changed systems: Architecture concerns Review detailsSystems and components
Before / after behavior
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All five open Dependabot alerts sit in
control-plane/package-lock.json, and all five are transitive under the one direct dependency,astro. Raising it resolves every one.npm auditafterwards: found 0 vulnerabilities.None of the five was reachable here
Recorded so the next person does not have to re-derive it.
The Control Plane is
output: 'static'— prerendered in CI and served as files by Cloudflare Pages. The API is separate plain-JS Pages Functions plus a Worker, and none of them imports any of these packages. So none of this code runs in production at all; it runs in the build step, on repository-controlled input.astro:assets, no<Image>and nogetImageanywhere insrc/; the only image is a PNG inpublic/that Astro copies verbatim; there is no AVIF in the repository; and no Astro server runs in production.sharpwas already at 0.35.4 — the version the advisory names as the fixastroand@astrojs/internal-helpers. The only YAML the build reads is oursremoveScriptsbypassesdevalue.parseOne detail that explains why this is so cheap:
devaluewas stale in the lockfile rather than blocked. Astro already allowed^5.8.1, so 5.9.4 was installable all along, and a plain lockfile refresh would have closed that alert on its own.Verification
Built in
node:22-bookworm— the image the workflows use — before and after the bump. Nine pages both times, and the build output is byte-identical: 15 files, matching SHA-256 for every one, none added and none removed. The bump changes nothing about what gets deployed.Local CodeRabbit round
Reviewed
a035529aagainstmain— 0 findings.Summary by Sourcery
Upgrade the Control Plane’s Astro dependency to resolve all outstanding security alerts without changing deployed output.
Bug Fixes:
Enhancements:
Tests:
Summary by CodeRabbit