From 9f5bbed8b8376c81433e180430af83e0955d250d Mon Sep 17 00:00:00 2001 From: Paul Bakaus Date: Wed, 22 Jul 2026 09:46:17 -0700 Subject: [PATCH] Bump astro test fixture to ^7.1.0 to clear dependabot XSS alerts The astro-vite7 live-e2e fixture pinned astro ^6.0.0, which resolves into the vulnerable range of three dependabot advisories: GHSA-4g3v-8h47-v7g6 (reflected XSS via View Transition animation properties, medium), GHSA-f48w-9m4c-m7f5 (XSS via spread attribute names in renderHTMLElement, medium), and GHSA-7pw4-f3q4-r2p2 (XSS via transition:* directive values, low). All three are patched by 7.1.0. Dev-only test fixture; the vulnerable code paths (View Transitions, transition directives, spread attributes) are not exercised by this static, non-hydrated page, so real exposure is nil. Bumped anyway as the cheap, correct fix. Also corrected the now-stale fixture label to "Astro 7 + Vite 7". Co-Authored-By: Claude Fable 5 --- tests/framework-fixtures/astro-vite7/files/package.json | 2 +- tests/framework-fixtures/astro-vite7/fixture.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/framework-fixtures/astro-vite7/files/package.json b/tests/framework-fixtures/astro-vite7/files/package.json index 33ba1a69d..bd826d09a 100644 --- a/tests/framework-fixtures/astro-vite7/files/package.json +++ b/tests/framework-fixtures/astro-vite7/files/package.json @@ -9,6 +9,6 @@ "preview": "astro preview" }, "devDependencies": { - "astro": "^6.0.0" + "astro": "^7.1.0" } } diff --git a/tests/framework-fixtures/astro-vite7/fixture.json b/tests/framework-fixtures/astro-vite7/fixture.json index 53ad21b50..92b409a44 100644 --- a/tests/framework-fixtures/astro-vite7/fixture.json +++ b/tests/framework-fixtures/astro-vite7/fixture.json @@ -1,5 +1,5 @@ { - "name": "Astro 6 + Vite 7", + "name": "Astro 7 + Vite 7", "config": { "files": ["src/layouts/Layout.astro"], "insertBefore": "",