Skip to content

fix(deps): update dependency @astrojs/netlify to v7 [security]#113

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-astrojs-netlify-vulnerability
Open

fix(deps): update dependency @astrojs/netlify to v7 [security]#113
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-astrojs-netlify-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@astrojs/netlify (source) ^5.5.3 → ^7.0.0 age confidence

@​astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config

CVE-2026-54300 / GHSA-529g-xq4f-cw38

More information

Details

Summary

@astrojs/netlify converts Astro image.remotePatterns into Netlify Image CDN images.remote_images regular expressions with broader semantics than Astro's canonical matcher. A single wildcard hostname such as *.example.com is converted to an optional subdomain regex, so the apex host matches. A single wildcard pathname such as /ok/* is converted without end anchoring, so deeper paths match by prefix.

Technical details

The Netlify adapter generates regex strings for Netlify Image CDN from image.remotePatterns. For *.example.com, it emits ([a-z0-9-]+\\.)?example\\.com, which makes the subdomain optional. Astro's canonical helper requires exactly one subdomain and rejects the apex host.

For /ok/*, the adapter emits a segment regex but does not anchor the end of the URL. Netlify's Image CDN implementation treats images.remote_images entries as JavaScript regular expressions and calls .test(sourceImageUrl.href), so a URL such as /ok/a/b.svg matches the /ok/a prefix even though Astro's helper rejects it.

The latest npm package @astrojs/netlify@7.0.10 contains this conversion logic, and a minimal Astro build writes the broadened patterns into .netlify/v1/config.json.

Reproduction
  1. Create an Astro app using astro@6.3.8 and @astrojs/netlify@7.0.10.
  2. Configure Netlify output and a restrictive image pattern, for example remotePatterns: [{ protocol: 'http', hostname: '*.localhost', pathname: '/ok/*' }].
  3. Build the app and observe that .netlify/v1/config.json contains http://([a-z0-9-]+\\.)?localhost(:[0-9]+)?(\\/ok/[^/?#]+)/?([?][^#]*)?.
  4. Serve a canary SVG on 127.0.0.1:9001.
  5. Request /.netlify/images?url=http%3A%2F%2Flocalhost%3A9001%2Fok%2Fa.svg&w=100. Astro's helper rejects the apex localhost for *.localhost, but Netlify Image CDN accepts it and fetches the canary.
  6. As a negative control, request /.netlify/images?url=http%3A%2F%2Flocalhost%3A9001%2Fnope%2Fa.svg&w=100. This returns 403 Forbidden: Remote image URL not allowed and does not hit the canary.
  7. Request /.netlify/images?url=http%3A%2F%2Flocalhost%3A9001%2Fok%2Fa%2Fb.svg&w=100. Astro's /ok/* helper rejects this deeper path, but Netlify Image CDN accepts it and fetches the canary.
Impact

Any Astro app deployed with @astrojs/netlify and a restrictive image.remotePatterns config can expose a wider image-fetch boundary than intended. Public requests to the Netlify Image CDN endpoint can fetch URLs that Astro's own matcher would reject, including apex hosts for *.host patterns and deeper paths for /path/* patterns. The practical impact depends on what the application intended to isolate behind the remote image allowlist, but it can disclose image-like resources from unintended hosts or paths behind the same configured remote origin family.

Remediation

Generate regexes that exactly match Astro's canonical matchHostname and matchPathname semantics, and anchor the full URL match before writing images.remote_images. In particular, *.example.com should require exactly one subdomain and should not match example.com, and /ok/* should match exactly one additional path segment and should not match /ok/a/b.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

withastro/astro (@​astrojs/netlify)

v7.0.13

Compare Source

Patch Changes

v7.0.12

Compare Source

Patch Changes

v7.0.11

Compare Source

Patch Changes

v7.0.10

Compare Source

Patch Changes

v7.0.9

Compare Source

Patch Changes

v7.0.8

Compare Source

Patch Changes

v7.0.7

Compare Source

Patch Changes

v7.0.6

Compare Source

Patch Changes

v7.0.5

Compare Source

Patch Changes

v7.0.4

Compare Source

Patch Changes

v7.0.3

Compare Source

Patch Changes

v7.0.2

Patch Changes

v7.0.1

Patch Changes

v7.0.0

Compare Source

Major Changes
Minor Changes

  • #​15258 d339a18 Thanks @​ematipico! - Stabilizes the adapter feature experimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:

    export default defineConfig({
  adapter: netlify({
-    experimentalStaticHeaders: true
+    staticHeaders: true
  })
})

  • #​15809 94b4a46 Thanks @​Princesseuh! - Adds support for the fit option to the image service

  • #​15495 5b99e90 Thanks @​leekeh! - Adds new middlewareMode adapter feature and deprecates edgeMiddleware option

    The edgeMiddleware option is now deprecated and will be removed in a future major release, so users should transition to using the new middlewareMode feature as soon as possible.

    export default defineConfig({
  adapter: netlify({
-    edgeMiddleware: true
+    middlewareMode: 'edge'
  })
})

  • #​15006 f361730 Thanks @​florian-lefebvre! - Adds new session driver object shape

    For greater flexibility and improved consistency with other Astro code, session drivers are now specified as an object:

    -import { defineConfig } from 'astro/config'
+import { defineConfig, sessionDrivers } from 'astro/config'

export default defineConfig({
  session: {
-    driver: 'redis',
-    options: {
-      url: process.env.REDIS_URL
-    },
+    driver: sessionDrivers.redis({
+      url: process.env.REDIS_URL
+    }),
  }
})

    Specifying the session driver as a string has been deprecated, but will continue to work until this feature is removed completely in a future major version. The object shape is the current recommended and documented way to configure a session driver.

  • #​15413 736216b Thanks @​florian-lefebvre! - Updates the implementation to use the new Adapter API

  • #​14946 95c40f7 Thanks @​ematipico! - Removes the experimental.csp flag and replaces it with a new configuration option security.csp - (v6 upgrade guidance)

Patch Changes

  • #​15187 bbb5811 Thanks @​matthewp! - Update to Astro 6 beta

  • #​15781 2de969d Thanks @​ematipico! - Adds a new clientAddress option to the createContext() function

    Providing this value gives adapter and middleware authors explicit control over the client IP address. When not provided, accessing clientAddress throws an error consistent with other contexts where it is not set by the adapter.

    Additionally, both of the official Netlify and Vercel adapters have been updated to provide this information in their edge middleware.

    import { createContext } from 'astro/middleware';

createContext({
  clientAddress: context.headers.get('x-real-ip'),
});

  • #​15665 52a7efd Thanks @​matthewp! - Fixes builds that were failing with "Entry module cannot be external" error when using the Netlify adapter

    This error was preventing sites from building after recent internal changes. Your builds should now work as expected without any changes to your code.

  • #​15679 19ba822 Thanks @​matthewp! - Fixes server-rendered routes returning 404 errors

    A configuration error in the build output prevented Netlify from correctly routing requests to server-rendered pages, causing them to return 404 errors. This fix ensures that all server routes are properly handled by the Netlify SSR function.

  • #​15809 94b4a46 Thanks @​Princesseuh! - Fixes the image CDN being used in development despite being disabled in certain cases

  • #​15460 ee7e53f Thanks @​florian-lefebvre! - Updates to use the new Adapter API

  • #​15450 50c9129 Thanks @​florian-lefebvre! - Fixes a case where build.serverEntry would not be respected when using the new Adapter API

  • #​15461 9f21b24 Thanks @​florian-lefebvre! - Updates to new Adapter API introduced in v6

  • Updated dependencies [4ebc1e3, 4e7f3e8, a164c77, cf6ea6b, a18d727, 240c317, 745e632]:

v6.6.5

Compare Source

Patch Changes

v6.6.4

Compare Source

Patch Changes

v6.6.3

Compare Source

Patch Changes

v6.6.2

Compare Source

Patch Changes

v6.6.1

Compare Source

Patch Changes

v6.6.0

Compare Source

Minor Changes

  • #​14543 9b3241d Thanks @​matthewp! - Enables Netlify's skew protection feature for Astro sites deployed on Netlify. Skew protection ensures that your site's client and server versions stay synchronized during deployments, preventing issues where users might load assets from a newer deployment while the server is still running the older version.

    When you deploy to Netlify, the deployment ID is now automatically included in both asset requests and API calls, allowing Netlify to serve the correct version to every user. These are set for built-in features (Actions, View Transitions, Server Islands, Prefetch). If you are making your own fetch requests to your site, you can include the header manually using the DEPLOY_ID environment variable:

    const response = await fetch('/api/endpoint', {
  headers: {
    'X-Netlify-Deploy-ID': import.meta.env.DEPLOY_ID,
  },
});
Patch Changes

v6.5.13

Compare Source

Patch Changes

v6.5.12

Compare Source

Patch Changes

v6.5.11

Compare Source

Patch Changes

v6.5.10

Compare Source

Patch Changes

v6.5.9

Compare Source

Patch Changes

v6.5.8

Compare Source

Patch Changes

v6.5.7

Compare Source

Patch Changes

v6.5.6

Compare Source

Patch Changes
  • #​14175 1e1cef0 Thanks @​ematipico! - Fixes a bug where the adapter would cause a runtime error when calling astro build in CI environments.

v6.5.5

Compare Source

Patch Changes

v6.5.4

Compare Source

Patch Changes

v6.5.3

Compare Source

Patch Changes

v6.5.2

Compare Source

Patch Changes

v6.5.1

Compare Source

Patch Changes

v6.5.0

Compare Source

Minor Changes

This is an implementation update that does not require any change to your project code, but means that astro dev will run with an environment closer to a production deploy on Netlify. This brings several benefits you'll now notice working in dev mode!

For example, your project running in development mode will now use local versions of the Netlify Image CDN for images, and a local Blobs server for sessions. It will also populate your environment with the variables from your linked Netlify site.

While not required for fully static, prerendered web sites, you may still wish to add this for the additional benefits of now working in a dev environment closer to your Netlify production deploy, as well as to take advantage of Netlify-exclusive features such as the Netlify Image CDN.

Patch Changes

v6.4.1

Compare Source

Patch Changes

v6.4.0

Compare Source

Minor Changes

  • #​13952 de82ef2 Thanks @​ematipico! - Adds support for the experimental static headers Astro feature.

    When the feature is enabled via option experimentalStaticHeaders, and experimental Content Security Policy is enabled, the adapter will generate Response headers for static pages, which allows support for CSP directives that are not supported inside a <meta> tag (e.g. frame-ancestors).

    import { defineConfig } from 'astro/config';
import netlify from '@&#8203;astrojs/netlify';

export default defineConfig({
  adapter: netlify({
    experimentalStaticHeaders: true,
  }),
  experimental: {
    cps: true,
  },
});
Patch Changes

v6.3.4

Compare Source

Patch Changes

v6.3.3

Compare Source

Patch Changes

v6.3.2

Compare Source

Patch Changes

v6.3.1

Compare Source

Patch Changes

v6.3.0

Compare Source

Minor Changes

  • #​13527 2fd6a6b Thanks @​ascorbic! - The experimental session API introduced in Astro 5.1 is now stable and ready for production use.

    Sessions are used to store user state between requests for on-demand rendered pages. You can use them to store user data, such as authentication tokens, shopping cart contents, or any other data that needs to persist across requests:

v6.2.6

Compare Source

Patch Changes

v6.2.5

Compare Source

Patch Changes

v6.2.4

Compare Source

Patch Changes

v6.2.3

Compare Source

Patch Changes

v6.2.2

Compare Source

Patch Changes

v6.2.1

Compare Source

Patch Changes

v6.2.0

Minor Changes

  • #​13194 1b5037b Thanks @​dfdez! - Adds includedFiles and excludedFiles configuration options to customize SSR function bundle contents.

    The includeFiles property allows you to explicitly specify additional files that should be bundled with your function. This is useful for files that aren't automatically detected as dependencies, such as:

    • Data files loaded using fs operations
    • Configuration files
    • Template files

    Similarly, you can use the excludeFiles property to prevent specific files from being bundled that would otherwise be included. This is helpful for:

    • Reducing bundle size
    • Excluding large binaries
    • Preventing unwanted files from being deployed
    import { defineConfig } from 'astro/config';
import netlify from '@&#8203;astrojs/netlify';

export default defineConfig({
  // ...
  output: 'server',
  adapter: netlify({
    includeFiles: ['./my-data.json'],
    excludeFiles: ['./node_modules/package/**/*', './src/**/*.test.js'],
  }),
});

    See the Netlify adapter documentation for detailed usage instructions and examples.

  • #​13145 8d4e566 Thanks @​ascorbic! - Automatically configures Netlify Blobs storage when experimental session enabled

    If the experimental.session flag is enabled when using the Netlify adapter, Astro will automatically configure the session storage using the Netlify Blobs driver. You can still manually configure the session storage if you need to use a different driver or want to customize the session storage configuration.

    See the experimental session docs for more information on configuring session storage.

Patch Changes

v6.1.0

Minor Changes
Patch Changes

v6.0.1

Patch Changes

v6.0.0

Major Changes

  • #​367 e02b54a Thanks @​alexanderniebuhr! - Removed support for the Squoosh image service. As the underlying library libsquoosh is no longer maintained, and the image service sees very little usage we have decided to remove it from Astro.

    Our recommendation is to use the base Sharp image service, which is more powerful, faster, and more actively maintained.

    - import { squooshImageService } from "astro/config";
import { defineConfig } from "astro/config";

export default defineConfig({
-  image: {
-    service: squooshImageService()
-  }
});

    If you are using this service, and cannot migrate to the base Sharp image service, a third-party extraction of the previous service is available here: https://github.com/Princesseuh/astro-image-service-squoosh

  • #​367 e02b54a Thanks @​alexanderniebuhr! - Deprecates the functionPerRoute option

    This option is now deprecated, and will be removed entirely in Astro v5.0. We suggest removing this option from your configuration as soon as you are able to:

    import { defineConfig } from 'astro/config';
import vercel from '@&#8203;astrojs/vercel/serverless';

export default defineConfig({
  // ...
  output: 'server',
  adapter: vercel({
-     functionPerRoute: true,
  }),
});

  • #​375 e7881f7 Thanks @​Princesseuh! - Updates internal code to works with Astro 5 changes to hybrid rendering. No changes are necessary to your project, apart from using Astro 5

  • #​397 776a266 Thanks @​Princesseuh! - Welcome to the Astro 5 beta! This release has no changes from the latest alpha of this package, but it does bring us one step closer to the final, stable release.

    Starting from this release, no breaking changes will be introduced unless absolutely necessary.

    To learn how to upgrade, check out the Astro v5.0 upgrade guide in our beta docs site.

  • #​451 f248546 Thanks @​ematipico! - Updates esbuild dependency to v0.24.0

  • #​392 3a49eb7 Thanks @​Princesseuh! - Updates internal code for Astro 5 changes. No changes is required to your project, apart from using Astro 5

Minor Changes

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies javascript

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants