Repository navigation
Update the website to Astro 7 to clear its security advisories - #273
Merged
Merged
Conversation
…ories Astro 6.4.8 carried three cross-site scripting advisories and pulled in a vulnerable sharp; @astrojs/rss, js-yaml, postcss and svgo each had their own. Moving to Astro 7.1.3, @astrojs/mdx 7.0.3 and sharp 0.35.3 clears all of them, and the remaining four resolve transitively once the ranges refresh. The esbuild override is gone: Astro 7 depends on a safe esbuild directly, so nothing needs to be forced any more. Two config changes come with the major bump. Astro 7 replaced remark and rehype with a new default Markdown engine and made the old pipeline a peer dependency, so @astrojs/markdown-remark is now an explicit dependency; the unified() processor and its plugins are otherwise untouched. Tailwind moves from its PostCSS plugin to its Vite plugin because Vite 8 resolves the bare `@import "tailwindcss"` in global.css as a file path and fails the build before Tailwind runs. Vite 8 minifies CSS against a newer browser target than Tailwind compiles for, which silently dropped the vendor prefixes the sticky header's blur needs on Safari before 18. Setting cssTarget to Tailwind's own floor keeps them in the shipped stylesheet.
The web UI build writes crates/dux-web/web/dist on every run, so it shows up as a wall of untracked assets in git status.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The website was carrying seven open advisories.
astro6.4.8 accounted for three cross-site scripting issues and pulled in a vulnerablesharp, while@astrojs/rss,js-yaml,postcssandsvgoeach had one of their own. This moves the site toastro7.1.3,@astrojs/mdx7.0.3 andsharp0.35.3, which clears the direct ones; the remaining four are transitive and resolve on their own once the ranges refresh. Theesbuildoverride is no longer needed either, since Astro 7 depends on a safe version directly.npm auditnow reports no vulnerabilities.Two configuration changes come with the major version bump, and neither is optional. Astro 7 replaced remark and rehype with a new default Markdown engine and made the old pipeline a peer dependency, so
@astrojs/markdown-remarkis now an explicit dependency — theunified()processor and its plugins (emoji shortcodes, heading slugs, autolink anchors, prose images) are otherwise untouched. Tailwind also moves from its PostCSS plugin to its Vite plugin, andpostcss.config.mjsis deleted: Astro 7 ships Vite 8, whose CSS pipeline treats the bare@import "tailwindcss"inglobal.cssas a file path and fails the build before Tailwind ever runs. The Vite plugin is what Astro and Tailwind both document for Tailwind 4.The built site was compared page by page against a build from before the upgrade, rather than relying on the build simply succeeding. The HTML is equivalent throughout and
rss.xmland the sitemaps are byte-identical, but the comparison did surface one silent regression worth calling out: Vite 8 minifies CSS against a newer browser target than Tailwind compiles for, and was stripping out the-webkit-prefixes that the sticky header's blur relies on in Safari before 18. Nothing would have failed loudly; the blur would just have stopped working on older iPhones. PinningcssTargetto Tailwind's own floor keeps those prefixes in the shipped stylesheet, and prefix coverage now slightly exceeds what the site had before.