socket-security[bot]
commented
2 months ago 🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎
To accept the risk, merge this PR and you will not be notified again.
| Alert | Package | Note | Source |
|---|---|---|---|
| Install scripts | npm/sharp@0.33.4 |
|
Next steps
What is an install script?
Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.
Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.
Take a deeper look at the dependency
Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.
Remove the package
If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.
Mark a package as acceptable risk
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all
@SocketSecurity ignore npm/sharp@0.33.4
cloudflare-pages[bot]
codecov[bot]
felix-berlin
This PR contains the following updates:
4.8.6->4.9.2Release Notes
withastro/astro (astro)
### [`v4.9.2`](https://togithub.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#492) [Compare Source](https://togithub.com/withastro/astro/compare/astro@4.9.1...astro@4.9.2) ##### Patch Changes - [#11138](https://togithub.com/withastro/astro/pull/11138) [`98e0372`](https://togithub.com/withastro/astro/commit/98e0372cfd47a3e025be2ac68d1e9ebf06cf548b) Thanks [@ematipico](https://togithub.com/ematipico)! - You can now pass `props` when rendering a component using the Container APIs: ```js import { experimental_AstroContainer as AstroContainer } from 'astro/contaienr'; import Card from '../src/components/Card.astro'; const container = await AstroContainer.create(); const result = await container.renderToString(Card, { props: { someState: true, }, }); ``` ### [`v4.9.1`](https://togithub.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#491) [Compare Source](https://togithub.com/withastro/astro/compare/astro@4.9.0...astro@4.9.1) ##### Patch Changes - [#11129](https://togithub.com/withastro/astro/pull/11129) [`4bb9269`](https://togithub.com/withastro/astro/commit/4bb926908d9a7ee134701c3e5a1b5e6ea688f843) Thanks [@matthewp](https://togithub.com/matthewp)! - Prevent errors from adapters when i18n domains is not used ### [`v4.9.0`](https://togithub.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#490) [Compare Source](https://togithub.com/withastro/astro/compare/astro@4.8.7...astro@4.9.0) ##### Minor Changes - [#11051](https://togithub.com/withastro/astro/pull/11051) [`12a1bcc`](https://togithub.com/withastro/astro/commit/12a1bccc818af292cdd2a8ed0f3e3c042b9819b4) Thanks [@ematipico](https://togithub.com/ematipico)! - Introduces an experimental Container API to render `.astro` components in isolation. This API introduces three new functions to allow you to create a new container and render an Astro component returning either a string or a Response: - `create()`: creates a new instance of the container. - `renderToString()`: renders a component and return a string. - `renderToResponse()`: renders a component and returns the `Response` emitted by the rendering phase. The first supported use of this new API is to enable unit testing. For example, with `vitest`, you can create a container to render your component with test data and check the result: ```js import { experimental_AstroContainer as AstroContainer } from 'astro/container'; import { expect, test } from 'vitest'; import Card from '../src/components/Card.astro'; test('Card with slots', async () => { const container = await AstroContainer.create(); const result = await container.renderToString(Card, { slots: { default: 'Card content', }, }); expect(result).toContain('This is a card'); expect(result).toContain('Card content'); }); ``` For a complete reference, see the [Container API docs](/en/reference/container-reference/). For a feature overview, and to give feedback on this experimental API, see the [Container API roadmap discussion](https://togithub.com/withastro/roadmap/pull/916). - [#11021](https://togithub.com/withastro/astro/pull/11021) [`2d4c8fa`](https://togithub.com/withastro/astro/commit/2d4c8faa56a64d963fe7847b5be2d7a59e12ed5b) Thanks [@ematipico](https://togithub.com/ematipico)! - The CSRF protection feature that was introduced behind a flag in [v4.6.0](https://togithub.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md#460) is no longer experimental and is available for general use. To enable the stable version, add the new top-level `security` option in `astro.config.mjs`. If you were previously using the experimental version of this feature, also delete the experimental flag: ```diff export default defineConfig({ - experimental: { - security: { - csrfProtection: { - origin: true - } - } - }, + security: { + checkOrigin: true + } }) ``` Enabling this setting performs a check that the `"origin"` header, automatically passed by all modern browsers, matches the URL sent by each Request. This check is executed only for pages rendered on demand, and only for the requests `POST`, `PATCH`, `DELETE` and `PUT` with one of the following `"content-type"` headers: `'application/x-www-form-urlencoded'`, `'multipart/form-data'`, `'text/plain'`. If the `"origin"` header doesn't match the pathname of the request, Astro will return a 403 status code and won't render the page. For more information, see the [`security` configuration docs](https://docs.astro.build/en/reference/configuration-reference/#security). - [#11022](https://togithub.com/withastro/astro/pull/11022) [`be68ab4`](https://togithub.com/withastro/astro/commit/be68ab47e236476ba980cbf74daf85f27cd866f4) Thanks [@ematipico](https://togithub.com/ematipico)! - The `i18nDomains` routing feature introduced behind a flag in [v3.4.0](https://togithub.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md#430) is no longer experimental and is available for general use. This routing option allows you to configure different domains for individual locales in entirely server-rendered projects using the [@astrojs/node](https://docs.astro.build/en/guides/integrations-guide/node/) or [@astrojs/vercel](https://docs.astro.build/en/guides/integrations-guide/vercel/) adapter with a `site` configured. If you were using this feature, please remove the experimental flag from your Astro config: ```diff import { defineConfig } from 'astro' export default defineConfig({ - experimental: { - i18nDomains: true, - } }) ``` If you have been waiting for stabilization before using this routing option, you can now do so. Please see [the internationalization docs](https://docs.astro.build/en/guides/internationalization/#domains) for more about this feature. - [#11071](https://togithub.com/withastro/astro/pull/11071) [`8ca7c73`](https://togithub.com/withastro/astro/commit/8ca7c731dea894e77f84b314ebe3a141d5daa918) Thanks [@bholmesdev](https://togithub.com/bholmesdev)! - Adds two new functions `experimental_getActionState()` and `experimental_withState()` to support [the React 19 `useActionState()` hook](https://react.dev/reference/react/useActionState) when using Astro Actions. This introduces progressive enhancement when calling an Action with the `withState()` utility. This example calls a `like` action that accepts a `postId` and returns the number of likes. Pass this action to the `experimental_withState()` function to apply progressive enhancement info, and apply to `useActionState()` to track the result: ```tsx import { actions } from 'astro:actions'; import { experimental_withState } from '@astrojs/react/actions'; export function Like({ postId }: { postId: string }) { const [state, action, pending] = useActionState( experimental_withState(actions.like), 0 // initial likes ); return ( ); } ``` You can also access the state stored by `useActionState()` from your action `handler`. Call `experimental_getActionState()` with the API context, and optionally apply a type to the result: ```ts import { defineAction, z } from 'astro:actions'; import { experimental_getActionState } from '@astrojs/react/actions'; export const server = { like: defineAction({ input: z.object({ postId: z.string(), }), handler: async ({ postId }, ctx) => { const currentLikes = experimental_getActionStateConfiguration
📅 Schedule: Branch creation - "on friday and saturday" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.