fix(templates): migrate Astro starter to v6.4.8 + Tailwind 4 (clears SSRF/XSS advisories)#113
Merged
PAMulligan merged 1 commit intoJul 1, 2026
Conversation
… SSRF/XSS advisories Resolves five open Dependabot advisories on templates/astro (two HIGH): CVE-2026-54299 (host-header SSRF), CVE-2026-50146 (reflected XSS), CVE-2026-54298, CVE-2026-41067, and CVE-2026-45028. All are patched only in Astro >= 6.x with no 5.x backport, so clearing them requires a major bump. Migration: - astro ^5.18.2 -> ^6.4.8; @astrojs/react ^4 -> ^6 (React 19 supported) - Drop @astrojs/tailwind (supports Astro <=5 only); adopt Tailwind 4 via @tailwindcss/vite. Styles load from src/styles/global.css, which imports Tailwind and bridges tailwind.config.mjs via @config so the token-lock / converter injection point is preserved - tailwindcss ^3 -> ^4 - Pin vite ^7.3.2 to match Astro's own dep; pnpm auto-install-peers otherwise pulled Vite 8 for @tailwindcss/vite while Astro ran Vite 7, crashing the build on the rolldown resolve binding - Add templates/astro/pnpm-lock.yaml so Dependabot can track the template Also gitignore Astro's generated .astro/ dir, refresh the multi-framework and templates docs, and bump the astro-hybrid test fixture to 6.4.8. Verified locally: pnpm install clean, astro build produces static output, and the vitest + Container-API harness initialises under Astro 6. The Stryker gate is unaffected (packages/pipeline only; never runs on PRs). Closes #107 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #107. Migrates the
templates/astrostarter off the vulnerable Astro 5 line to Astro 6.4.8, clearing all five open Dependabot advisories on the template (two HIGH). Every fix lands only in Astro ≥ 6.x — there is no 5.x backport — so this is necessarily a major bump.define:varsWhat changed
astro^5.18.2→^6.4.8(latest 6.x; chosen over the 0-day-old 7.0.5 for a smaller, more battle-tested surface).@astrojs/react^4→^6(React 19 supported).@astrojs/tailwind— its latest release only supports Astro ≤ 5. Replaced with Tailwind 4 via@tailwindcss/vite. Styles now load from a newsrc/styles/global.css(imported once inindex.astro) that pulls in Tailwind and bridges the existingtailwind.config.mjsthrough@config, so the token-lock / converter injection point is preserved.tailwindcss^3→^4.vite^7.3.2to match Astro's own dependency. Without it, pnpm'sauto-install-peerspulled Vite 8 for@tailwindcss/vitewhile Astro ran Vite 7, crashing the build on Vite 8's rolldown resolve binding.templates/astro/pnpm-lock.yamlso the template's dependency tree is lockable and trackable (issue task Pixel-perfect Figma alignment for Score and Setup pages #1)..astro/dir; refreshed the multi-framework + templates docs; bumped theastro-hybridtest fixture to6.4.8.Verification
pnpm installresolves cleanly (single Vite 7.3.6, no Vite 8).astro build→ static output generated; Tailwind 4 +@configprocess without error.renderer-registrytest (the only CI test touching the changed fixture): 12/12 pass.lint(eslint + prettier) ignorestemplates/,docs/,.claude/, so no formatting risk. Stryker is unaffected — it targetspackages/pipelineonly and never runs on PRs.Notes / follow-ups
.github/dependabot.ymlis the real enabler — recommended as a small follow-up.🤖 Generated with Claude Code