Skip to content

Bump astro from 5.18.1 to 6.1.1 - #10

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/astro-6.1.1
Closed

Bump astro from 5.18.1 to 6.1.1#10
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/astro-6.1.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 30, 2026

Copy link
Copy Markdown

Bumps astro from 5.18.1 to 6.1.1.

Release notes

Sourced from astro's releases.

astro@6.1.1

Patch Changes

astro@6.1.0

Minor Changes

  • #15804 a5e7232 Thanks @​merlinnot! - Allows setting codec-specific defaults for Astro's built-in Sharp image service via image.service.config.

    You can now configure encoder-level options such as jpeg.mozjpeg, webp.effort, webp.alphaQuality, avif.effort, avif.chromaSubsampling, and png.compressionLevel when using astro/assets/services/sharp for compile-time image generation.

    These settings apply as defaults for the built-in Sharp pipeline, while per-image quality still takes precedence when set on <Image />, <Picture />, or getImage().

  • #15455 babf57f Thanks @​AhmadYasser1! - Adds fallbackRoutes to the IntegrationResolvedRoute type, exposing i18n fallback routes to integrations via the astro:routes:resolved hook for projects using fallbackType: 'rewrite'.

    This allows integrations such as the sitemap integration to properly include generated fallback routes in their output.

    {
      'astro:routes:resolved': ({ routes }) => {
        for (const route of routes) {
          for (const fallback of route.fallbackRoutes) {
            console.log(fallback.pathname) // e.g. /fr/about/
          }
        }
      }
    }
  • #15340 10a1a5a Thanks @​trueberryless! - Adds support for advanced configuration of SmartyPants in Markdown.

    You can now pass an options object to markdown.smartypants in your Astro configuration to fine-tune how punctuation, dashes, and quotes are transformed.

    This is helpful for projects that require specific typographic standards, such as "oldschool" dash handling or localized quotation marks.

    // astro.config.mjs
    export default defineConfig({
      markdown: {
        smartypants: {
          backticks: 'all',
          dashes: 'oldschool',
          ellipses: 'unspaced',
          openingQuotes: { double: '«', single: '‹' },
          closingQuotes: { double: '»', single: '›' },
          quotes: false,
        },

... (truncated)

Changelog

Sourced from astro's changelog.

6.1.1

Patch Changes

6.1.0

Minor Changes

  • #15804 a5e7232 Thanks @​merlinnot! - Allows setting codec-specific defaults for Astro's built-in Sharp image service via image.service.config.

    You can now configure encoder-level options such as jpeg.mozjpeg, webp.effort, webp.alphaQuality, avif.effort, avif.chromaSubsampling, and png.compressionLevel when using astro/assets/services/sharp for compile-time image generation.

    These settings apply as defaults for the built-in Sharp pipeline, while per-image quality still takes precedence when set on <Image />, <Picture />, or getImage().

  • #15455 babf57f Thanks @​AhmadYasser1! - Adds fallbackRoutes to the IntegrationResolvedRoute type, exposing i18n fallback routes to integrations via the astro:routes:resolved hook for projects using fallbackType: 'rewrite'.

    This allows integrations such as the sitemap integration to properly include generated fallback routes in their output.

    {
      'astro:routes:resolved': ({ routes }) => {
        for (const route of routes) {
          for (const fallback of route.fallbackRoutes) {
            console.log(fallback.pathname) // e.g. /fr/about/
          }
        }
      }
    }
  • #15340 10a1a5a Thanks @​trueberryless! - Adds support for advanced configuration of SmartyPants in Markdown.

    You can now pass an options object to markdown.smartypants in your Astro configuration to fine-tune how punctuation, dashes, and quotes are transformed.

    This is helpful for projects that require specific typographic standards, such as "oldschool" dash handling or localized quotation marks.

    // astro.config.mjs
    export default defineConfig({
      markdown: {
        smartypants: {
          backticks: 'all',
          dashes: 'oldschool',
          ellipses: 'unspaced',
          openingQuotes: { double: '«', single: '‹' },
          closingQuotes: { double: '»', single: '›' },

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 30, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/astro-6.1.1 branch from 35200ce to bc118f9 Compare March 30, 2026 20:05
Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 5.18.1 to 6.1.1.
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@6.1.1/packages/astro)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 6.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/astro-6.1.1 branch from bc118f9 to 15cddbf Compare April 10, 2026 02:04
@dependabot @github

dependabot Bot commented on behalf of github Apr 13, 2026

Copy link
Copy Markdown
Author

Superseded by #15.

@dependabot dependabot Bot closed this Apr 13, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/astro-6.1.1 branch April 13, 2026 00:48
charlieseay pushed a commit that referenced this pull request Jun 17, 2026
ISSUE #9: Skin seeding Drizzle ORM error
- Fix: Import eq() from drizzle-orm, use eq(skins.isBuiltIn, true)
- Old: .where((t) => t.isBuiltIn.eq(true)) - invalid syntax
- File: src/lib/setup/seed-skins.ts

ISSUE #10: Monitor creation SQL INSERT failures
- Fix: Match actual monitors table schema (intervalSeconds, target, paused, etc.)
- Old: Used non-existent columns (enabled, check_interval_seconds, thresholds)
- Added type mapping: health/cpu/memory/restart → docker
- File: src/lib/setup/monitors.ts

ISSUE #11: Skin preference save API failures
- Fix: Import eq() from drizzle-orm, use eq(userSkinPreferences.userId, session.id)
- Old: .where((t) => t.userId.eq(session.id)) - invalid syntax
- File: src/pages/app/api/skins/set-active.ts

All three issues were caused by incorrect Drizzle ORM syntax.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
charlieseay pushed a commit that referenced this pull request Aug 16, 2026
CRITICAL BUG FOUND & FIXED:
- incidents table schema missing 8 fields added by migrations
- API code referenced incident.userId but schema had no userId field
- Caused "Incident not found" error in AI diagnosis

ROOT CAUSE:
- Migration 0025 added user_id column
- Migrations 0026-0029 added more incident fields
- TypeScript schema (monitoring-schema.ts) never updated
- Schema drift caused type mismatches

FIELDS ADDED TO SCHEMA:
- fingerprint (for deduplication)
- duplicateOf (incident merging)
- occurrenceCount (duplicate tracking)
- costImpact (cost attribution)
- attachments (file uploads)
- aiCostUsd (AI usage tracking)
- aiTokensUsed (token consumption)
- aiProvider (which AI was used)
- userId (multi-user support)

IMPACT:
- AI diagnosis will now work (userId check valid)
- TypeScript types now match actual database
- Prevents runtime errors from missing fields

This is Bug #10, discovered while investigating Bug #9

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
charlieseay pushed a commit that referenced this pull request Aug 16, 2026
FINAL SUMMARY:
- 10 bugs found (5 critical, 2 high, 2 medium, 1 low)
- 5 bugs fixed (3 critical in Cycle 4, 2 in Cycle 2)
- 5 bugs remain (2 high, 2 medium, 1 low)

CYCLE 4 ACHIEVEMENTS:
- Found 7 new bugs (#4-#10)
- Fixed 3 critical bugs (#5, #8, #10)
- Validated CSRF fix works
- Discovered schema drift issue

CRITICAL FIXES:
✅ Bug #5: doc_type → type column mismatch
✅ Bug #8: CSRF token <parameter> → <meta>
✅ Bug #10: Schema drift (9 missing fields)

REMAINING ISSUES:
⚠️ Bug #4: XSS in title (needs verification)
⚠️ Bug #7: Markdown not rendered (UX)
⚠️ Bug #9: AI diagnosis (should work now, needs retest)
ℹ️ Bug #6: Route confusion (minor)

TESTING COVERAGE:
- 31/63 features tested (49%)
- 29/63 features working (46%)
- Performance: 6.7x faster than advertised
- Security: 9/10 (strong)

TIME INVESTMENT:
- 199 minutes total (3h 19min)
- Efficiency: 117% (under 6hr allocation)

FINAL SCORE: 8.0/10 - STRONG BUY
VERDICT: Production-ready with documented issues

Documentation: COMPREHENSIVE-TEST-RESULTS.md

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
charlieseay pushed a commit that referenced this pull request Aug 17, 2026
CRITICAL SECURITY FIXES (Production Blockers):
- Remove hardcoded password bypass in auth.ts (CVE-pending)
- Enable account lockout after 5 failed attempts (brute-force protection)
- Fix API token enumeration (users could see all tokens)
- Fix monitor data exposure (users could see all monitors)
- Reduce session duration from 30 days to 7 days

ALL 11 UX BUGS FIXED:
✅ Bug #1: Documentation contradictions
✅ Bug #2: Missing customer compose file
✅ Bug #3: Docker image SQL errors
✅ Bug #4: XSS in page title (HTML entity escaping)
✅ Bug #5: Similar incidents API (doc_type → type)
✅ Bug #6: Route alias /app/knowledge → /app/kb
✅ Bug #7: Markdown rendering in incident descriptions
✅ Bug #8: CSRF token validation (meta tag fix)
✅ Bug #9: AI diagnosis (resolved by Bug #11 fix)
✅ Bug #10: Schema drift (9 missing fields)
✅ Bug #11: Missing userId (raw SQL bypass of Drizzle ORM bug)

SCORE UPDATE:
- Before: 5.0/10 (critical security issues)
- After: 8.5/10 (production ready with known issues)

DEPLOYMENT:
- Image: stdout:security-fixes-v1
- Platform: linux/amd64
- Status: Deployed and validated on ThinkPad

REMAINING ISSUES (deferred to v1.1):
- 4 HIGH: CSRF origin validation, token logging, race conditions, SSRF
- 7 MEDIUM: Input validation, file upload, audit logging
- 8 LOW: Code quality improvements

Documentation:
- SECURITY-FIXES-VALIDATED.md - Complete security audit report
- ALL-BUGS-FIXED-VALIDATED.md - UX bug validation
- FINAL-VALIDATION-REPORT.md - Comprehensive testing summary

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants