astro@5.18.2
Review before merging.
10 known advisories (worst: critical), no fixed version found on this major.
Why this verdict
- 10 known advisories (worst: critical), no fixed version found on this major.Evidence
Confidence 100% · algorithm v1 · computed 2026-10-19. How verdicts work
Supply chain and security
- Malware reports
- None known (OSV)
- Known advisories
- 10 known
- License
- MIT
- Install scripts
- None
- Build provenance
- Signed provenance
- Weekly downloads
- 488,656
- GHSA-26w7-cxv4-gfx2Astro: Remote code execution through AVIF image optimization
- GHSA-2pvr-wf23-7pc7Astro: Host header SSRF in prerendered error page fetch
- GHSA-376h-93r7-7g6fAstro: Authorization bypass from missing path-segment boundary check when stripping the configured base
- GHSA-4g3v-8h47-v7g6Astro: Reflected XSS via unescaped View Transition animation properties
- GHSA-7pw4-f3q4-r2p2Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
- GHSA-8hv8-536x-4wqpAstro: Reflected XSS via unescaped slot name
- GHSA-f48w-9m4c-m7f5Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
- GHSA-j687-52p2-xcffAstro: XSS in define:vars via incomplete </script> tag sanitization
- GHSA-jrpj-wcv7-9fh9Astro: XSS via Unescaped Attribute Names in Spread Props
- GHSA-xr5h-phrj-8vxvAstro: Server island encrypted parameters vulnerable to cross-component replay
Compatibility
No compatibility boundary is crossed: this is a patch or minor release on a stable major.
Check the official release notes below for behaviour changes before merging.
Release notes
Read the Astro changelog on Changes.Watch or the package page on npm for this version’s features and fixes.
Deprecations and deadlines
The maintainer has not deprecated this version on npm.