[Aikido] Fix 8 security issues in devalue, astro, sharp

[aikido-autofix]

Upgrade devalue, Astro, and sharp to fix memory exhaustion DoS, SSR host header injection, image processing RCE, XSS via slot names, and script tag injection vulnerabilities. This update includes breaking changes that require manual migration.

⚠️ Code affected by breaking changes.

⚠️ The upgrade has breaking changes that affect this codebase:

1. Node.js version requirement (Astro 6.0.0)

• Where your code is affected: .github/workflows/deploy.yml:22 specifies node-version: 22

• Impact: Astro 6.0.0 requires Node.js >= 22.12.0, but the workflow specifies node-version: 22 which may resolve to an earlier 22.x version (e.g., 22.0.0) that doesn't meet the minimum requirement. This will cause the build to fail.

• Remediation: Update the workflow to specify node-version: 22.12.0 or higher (e.g., node-version: '22.12' or node-version: 'lts/*').

2. TypeScript configuration changes (Astro 6.0.0)

• Where your code is affected: tsconfig.json:2 extends astro/tsconfigs/strict

• Impact: Astro 6.0.0 changes the TypeScript configuration, which may affect how the extended strict config behaves. This could lead to new type errors or different compilation behavior.

• Remediation: Review and test the TypeScript compilation after upgrade, and adjust type definitions if necessary based on the new Astro 6.0 TypeScript configuration.

3. Vite 7.0 upgrade (Astro 6.0.0)

• Where your code is affected: astro.config.mjs:7-9 uses Vite plugins configuration

• Impact: Astro 6.0.0 upgrades to Vite 7.0, which may introduce breaking changes in how Vite plugins are configured or behave, potentially affecting the @tailwindcss/vite plugin.

• Remediation: Verify that @tailwindcss/vite is compatible with Vite 7.0 and update it if necessary.

All breaking changes by upgrading astro from version 5.18.1 to 6.4.8 (CHANGELOG)

Version	Description
6.0.0	Removes entryPoints on astro:build:ssr hook (Integration API)
6.0.0	Deprecates loadManifest() and loadApp() from astro/app/node (Adapter API)
6.0.0	Removes session test driver
6.0.0	Renames entryType to entrypointResolution in Adapter API and updates possible values: legacy-dynamic becomes explicit, self becomes auto
6.0.0	Removes the deprecated emitESMImage() function
6.0.0	Deprecates session driver string signature
6.0.0	Adds support for converting SVGs to raster images (PNGs, WebP, etc) to the default Sharp image service
6.0.0	Removes routes on astro:build:done hook (Integration API)
6.0.0	Throws an error when getImage() from astro:assets is called on the client
6.0.0	Removes the old app.render() signature (Adapter API)
6.0.0	Upgrades to Zod v4 for schema validation
6.0.0	Updates how schema types are inferred for content loaders with schemas (Loader API)
6.0.0	Removes support for CommonJS config files
6.0.0	Removes prefetch() with option
6.0.0	Removes support for routes with percent-encoded percent signs (e.g. %25)
6.0.0	Deprecates Astro in getStaticPaths()
6.0.0	Removes the option to define dynamic schemas in content loaders as functions and adds a new equivalent createSchema() property (Loader API)
6.0.0	Updates trailing slash behavior of endpoint URLs
6.0.0	Updates Markdown heading ID generation
6.0.0	Deprecates import.meta.env.ASSETS_PREFIX
6.0.0	Changes the values allowed in params returned by getStaticPaths()
6.0.0	Changes TypeScript configuration
6.0.0	Removes the previously deprecated Astro.glob()
6.0.0	Removes the ability to render Astro components in Vitest client environments
6.0.0	Deprecates createExports() and start() (Adapter API)
6.0.0	Deprecates NodeApp from astro/app/node (Adapter API)
6.0.0	Removes the handleForms prop for the <ClientRouter /> component
6.0.0	Increases minimum Node.js version to 22.12.0
6.0.0	Adds frontmatter parsing support to renderMarkdown in content loaders - frontmatter is now extracted and excluded from HTML output
6.0.0	Removes the deprecated <ViewTransitions /> component
6.0.0	Removes RouteData.generate from the Integration API
6.0.0	Changes the default routing configuration value of i18n.routing.redirectToDefaultLocale from true to false
6.0.0	Deprecates exposed astro:transitions internals
6.0.0	Updates dependency shiki to v4
6.0.0	Removes the setManifestData method from App and NodeApp (Adapter API)
6.0.0	Removes rewrite() from Actions context
6.0.0	Removes the experimental.failOnPrerenderConflict flag and replaces it with a new configuration option prerenderConflictBehavior
6.0.0	Deprecates astro:schema and z from astro:content in favor of astro/zod
6.0.0	Removes exposed astro:actions internals
6.0.0	Changes the shape of SSRManifest properties and adds several new required properties in the Adapter API
6.0.0	Allows Astro.csp and context.csp to be undefined instead of throwing errors when csp: true is not configured - methods must now be accessed conditionally
6.0.0	Upgrades to Vite v7.0 as the development server and production bundler
6.0.0	Changes how styles of responsive images are emitted
6.0.0	Changes integration hooks and HMR access patterns in the Integration API
6.0.0	Removes the unused astro:ssr-manifest virtual module
6.0.0	Updates import.meta.env values to always be inlined
6.0.0	Updates <script> and <style> tags to render in the order they are defined
6.0.0	Removes legacy content collection support
6.0.0	Removes the experimental.fonts flag and replaces it with a new configuration option fonts
6.0.0	Removes the experimental.csp flag and replaces it with a new configuration option security.csp

All breaking changes by upgrading sharp from version 0.34.5 to 0.35.0 (CHANGELOG)

Version	Description
0.35.0	Drop support for Node.js 18, now requires Node.js >= 20.9.0.
0.35.0	Remove install script from package.json file. Compiling from source is now opt-in via the build script.
0.35.0	Lossy AVIF output is now tuned using SSIMULACRA2-based iq quality metrics.
0.35.0	Add limitInputChannels with a default value of 5.
0.35.0	Remove deprecated failOnError constructor property.
0.35.0	Remove deprecated paletteBitDepth from metadata response.
0.35.0	Remove deprecated properties from sharpen operation.
0.35.0	Rename format.jp2k as format.jp2 for API consistency.

✅ 8 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-42570	HIGH	[devalue] Deserialization of sparse arrays causes excessive memory allocation due to JavaScript engine quirks, leading to denial of service through memory exhaustion.
CVE-2026-54299	HIGH	[astro] SSR apps with prerendered error pages fetch them via HTTP using an unvalidated Host header, allowing attackers to redirect requests to arbitrary hosts and read responses, enabling information disclosure.
AIKIDO-2026-10849	MEDIUM	[astro] Unescaped slot names in server-rendered hydrated components allow attackers to inject HTML/JavaScript into SSR responses, enabling reflected XSS attacks when user-controlled input is used as slot names.
CVE-2026-41067	MEDIUM	[astro] A case-sensitive regex in the defineScriptVars function fails to sanitize script tag closures, allowing attackers to bypass sanitization using case variations or whitespace (e.g., </Script>, </script >) to inject arbitrary HTML/JavaScript via the define:vars directive.
CVE-2026-45028	MEDIUM	[astro] Encryption replay vulnerability in server island props and slots allows attackers to swap encrypted values between components, potentially leading to XSS when slots containing unescaped HTML are substituted with user-controlled props.
CVE-2026-50146	MEDIUM	[astro] Unescaped slot names in client directives allow attackers to break out of data attributes and inject arbitrary HTML, enabling reflected XSS attacks during server-side rendering.
CVE-2026-54298	MEDIUM	[astro] A server-side rendering vulnerability in the spreadAttributes function fails to escape object keys when spreading props onto HTML elements, allowing attackers to inject arbitrary HTML attributes and event handlers when keys come from untrusted sources like APIs or URL parameters.
GHSA-f88m-g3jw-g9cj	HIGH	[sharp] Multiple high-severity vulnerabilities in upstream libvips dependency allow remote code execution when processing untrusted image input (GIF, TIFF, VIPS formats).

🤖 Remediation details

Fix security vulnerabilities in astro, devalue, and sharp

Short summary

This PR remediates security vulnerabilities in three npm packages — astro, devalue, and sharp — by updating the root package.json and refreshing package-lock.json. The astro direct dependency was bumped across a major version boundary (5→6), which also resolved the devalue transitive vulnerability via the new parent's updated range. A companion bump of @astrojs/react (4→5) was required for astro@6.x peer-compatibility. A targeted overrides entry was added for sharp because no astro@6.x release widens its sharp range to include 0.35.0.

astro

astro is a direct dependency declared in the root package.json. Its spec was raised from ^5.7.10 to ^6.4.6, resolving to 6.4.8 in the lockfile. This major bump was necessary because all patched versions for the multiple astro advisories (covering path traversal, header injection, and related issues) require astro ≥ 6.1.6 through ≥ 6.4.6, none of which are reachable from the ^5.x range. Because @astrojs/react@4.x targets astro@5.x as a peer, its spec was simultaneously raised to ^5.0.0 (resolving to 5.0.7) to maintain a compatible integration layer; without this change npm would report an unresolved peer conflict.

devalue

devalue is a transitive dependency pulled in by astro. Under astro@5.18.1 it was declared as ^5.6.2 and resolved to 5.7.1, which is below the patched floor of 5.8.1. Bumping astro to 6.4.8 (see above) brought in a new devalue declaration of ^5.8.1, which npm resolved to 5.8.2, satisfying the patched version requirement without any additional manifest change or override.

sharp

sharp is an optional transitive dependency of astro. Under astro@6.x it is declared as ^0.34.0, which excludes the patched 0.35.0 release; the first astro version that widens this range to ^0.34.0 || ^0.35.0 is 7.0.4, well beyond the 6.4.6 target. Because a further major bump of astro was outside the scope of this task, a selector-pattern override "sharp@<0.35.0": "0.35.0" was added to the root package.json to pin only vulnerable instances to 0.35.0, leaving any future 0.35.x-or-higher resolutions unaffected.

Version changes

Package	From	To	Why updated
astro	^5.7.10 → 5.18.1	^6.4.6 → 6.4.8	Direct CVE fix (multiple advisories); major bump required
@astrojs/react	^4.2.1 → 4.2.1	^5.0.0 → 5.0.7	Peer-compatibility with astro@6.x
devalue	5.7.1	5.8.2	Transitive fix after parent bump (astro)
sharp	0.34.5	0.35.0	Override (sharp@<0.35.0); astro@6.x pins ^0.34.0

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #12