chore(deps): update dependency astro to v6.1.10 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
astro (source)	6.1.9 → 6.1.10

---

Astro: Server island encrypted parameters vulnerable to cross-component replay

CVE-2026-45028 / GHSA-xr5h-phrj-8vxv

More information

Details

Impact

Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker could replay one component's encrypted props (p) value as another component's slots (s) value, or vice versa.

Since slots contain raw unescaped HTML while props may contain user-controlled values, this could lead to XSS in applications that meet all of the following conditions:

• The application uses server islands
• Two different server island components share the same key name for a prop and a slot
• An attacker has full control over the value of the overlapping prop (requires a dynamically rendered page)

These conditions are very unlikely to occur in real-world production applications.

Patches

This has been patched in astro@6.1.10.

The fix binds each encrypted parameter to its target component and purpose using AES-GCM authenticated additional data (AAD). Each ciphertext now includes context like props:IslandName or slots:IslandName, so encrypted data for one component cannot be replayed against a different component, and encrypted props cannot be reused as slots.

References

• Fix PR: https://github.com/withastro/astro/pull/16457
• Example demonstrating the vulnerability: https://github.com/CyberSecurityAustria/ACSC2026-web-astronomical

Severity

• CVSS Score: 2.9 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

References

• https://github.com/withastro/astro/security/advisories/GHSA-xr5h-phrj-8vxv
• https://github.com/withastro/astro/pull/16457
• https://github.com/withastro/astro/commit/3d82220a1549e699e34ed433f3846a919f4c02bd
• https://nvd.nist.gov/vuln/detail/CVE-2026-45028
• https://github.com/advisories/GHSA-xr5h-phrj-8vxv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

withastro/astro (astro)

v6.1.10

Compare Source

Patch Changes

• #​16479 1058428 Thanks @​matthewp! - Fixes a spurious [WARN] [content] Content config not loaded warning during astro dev for projects that don't use content collections

• #​16457 3d82220 Thanks @​matthewp! - Hardens server island encryption to prevent encrypted data from one island component being replayed against a different one

• #​16481 152700e Thanks @​matthewp! - Fixes a spurious 404 request for a dev toolbar sourcemap during astro dev caused by the browser mis-resolving a relative sourceMappingURL from the /@​id/ URL prefix

• #​16480 1bcb43b Thanks @​matthewp! - Fixes an unnecessary full page reload on first navigation during dev

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for brilliant-pasca-3e80ec canceled.

Name	Link
🔨 Latest commit	3ae0c29
🔍 Latest deploy log	https://app.netlify.com/projects/brilliant-pasca-3e80ec/deploys/6a25cd24d709320008830e5f

[github-actions]

🚀 Performance Test Results

Test Configuration:

• VUs: 4
• Duration: 1m0s

Test Metrics:

• Requests/s: 44.18
• Iterations/s: 14.73
• Failed Requests: 0.00% (0 of 2657)

📜 Logs

> performance@1.0.0 run-tests:testenv /home/runner/work/rafiki/rafiki/test/performance
> ./scripts/run-tests.sh -e test -k -q --vus 4 --duration 1m

Cloud Nine GraphQL API is up: http://localhost:3101/graphql
Cloud Nine Wallet Address is up: http://localhost:3100/
Happy Life Bank Address is up: http://localhost:4100/
cloud-nine-wallet-test-backend already set
cloud-nine-wallet-test-auth already set
happy-life-bank-test-backend already set
happy-life-bank-test-auth already set
     data_received..................: 959 kB 16 kB/s
     data_sent......................: 2.0 MB 34 kB/s
     http_req_blocked...............: avg=7.12µs   min=2.42µs   med=5.21µs   max=1.67ms   p(90)=6.39µs   p(95)=7.1µs   
     http_req_connecting............: avg=301ns    min=0s       med=0s       max=238.89µs p(90)=0s       p(95)=0s      
     http_req_duration..............: avg=89.87ms  min=6.33ms   med=72.19ms  max=432.96ms p(90)=157.81ms p(95)=180.95ms
       { expected_response:true }...: avg=89.87ms  min=6.33ms   med=72.19ms  max=432.96ms p(90)=157.81ms p(95)=180.95ms
     http_req_failed................: 0.00%  ✓ 0         ✗ 2657
     http_req_receiving.............: avg=97.48µs  min=25.54µs  med=81.04µs  max=2.37ms   p(90)=129.33µs p(95)=177.32µs
     http_req_sending...............: avg=39.76µs  min=9.55µs   med=24.69µs  max=2ms      p(90)=48.05µs  p(95)=72.24µs 
     http_req_tls_handshaking.......: avg=0s       min=0s       med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting...............: avg=89.73ms  min=6.2ms    med=72.11ms  max=432.86ms p(90)=157.71ms p(95)=180.87ms
     http_reqs......................: 2657   44.183689/s
     iteration_duration.............: avg=271.31ms min=167.76ms med=258.45ms max=898.85ms p(90)=340.03ms p(95)=374.69ms
     iterations.....................: 886    14.733439/s
     vus............................: 4      min=4       max=4 
     vus_max........................: 4      min=4       max=4