Skip to content

Bump @astrojs/node from 9.5.5 to 10.0.4 - #11

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/astrojs/node-10.0.4
Closed

Bump @astrojs/node from 9.5.5 to 10.0.4#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/astrojs/node-10.0.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 30, 2026

Copy link
Copy Markdown

Bumps @astrojs/node from 9.5.5 to 10.0.4.

Release notes

Sourced from @​astrojs/node's releases.

@​astrojs/node@​10.0.4

Patch Changes

  • #16002 846f27f Thanks @​buley! - Fixes file descriptor leaks from read streams that were not destroyed on client disconnect or read errors

  • #15941 f41584a Thanks @​ematipico! - Fixes an infinite loop in resolveClientDir() when the server entry point is bundled with esbuild or similar tools. The function now throws a descriptive error instead of hanging indefinitely when the expected server directory segment is not found in the file path.

@​astrojs/node@​10.0.3

Patch Changes

  • #15735 9685e2d Thanks @​fa-sharp! - Fixes an EventEmitter memory leak when serving static pages from Node.js middleware.

    When using the middleware handler, requests that were being passed on to Express / Fastify (e.g. static files / pre-rendered pages / etc.) weren't cleaning up socket listeners before calling next(), causing a memory leak warning. This fix makes sure to run the cleanup before calling next().

@​astrojs/node@​10.0.2

Patch Changes

@​astrojs/node@​10.0.1

Patch Changes

@​astrojs/node@​10.0.0

Major Changes

  • #15654 a32aee6 Thanks @​florian-lefebvre! - Removes the experimentalErrorPageHost option

    This option allowed fetching a prerendered error page from a different host than the server is currently running on.

    However, there can be security implications with prefetching from other hosts, and often more customization was required to do this safely. This has now been removed as a built-in option so that you can implement your own secure solution as needed and appropriate for your project via middleware.

    What should I do?

    If you were previously using this feature, you must remove the option from your adapter configuration as it no longer exists:

    // astro.config.mjs
    import { defineConfig } from 'astro/config'
    import node from '@astrojs/node'
    export default defineConfig({
    adapter: node({
    mode: 'standalone',
    
    experimentalErrorPageHost: 'http://localhost:4321'
    })
    })

... (truncated)

Changelog

Sourced from @​astrojs/node's changelog.

10.0.4

Patch Changes

  • #16002 846f27f Thanks @​buley! - Fixes file descriptor leaks from read streams that were not destroyed on client disconnect or read errors

  • #15941 f41584a Thanks @​ematipico! - Fixes an infinite loop in resolveClientDir() when the server entry point is bundled with esbuild or similar tools. The function now throws a descriptive error instead of hanging indefinitely when the expected server directory segment is not found in the file path.

10.0.3

Patch Changes

  • #15735 9685e2d Thanks @​fa-sharp! - Fixes an EventEmitter memory leak when serving static pages from Node.js middleware.

    When using the middleware handler, requests that were being passed on to Express / Fastify (e.g. static files / pre-rendered pages / etc.) weren't cleaning up socket listeners before calling next(), causing a memory leak warning. This fix makes sure to run the cleanup before calling next().

10.0.2

Patch Changes

10.0.1

Patch Changes

10.0.0

Major Changes

  • #15654 a32aee6 Thanks @​florian-lefebvre! - Removes the experimentalErrorPageHost option

    This option allowed fetching a prerendered error page from a different host than the server is currently running on.

    However, there can be security implications with prefetching from other hosts, and often more customization was required to do this safely. This has now been removed as a built-in option so that you can implement your own secure solution as needed and appropriate for your project via middleware.

    What should I do?

    If you were previously using this feature, you must remove the option from your adapter configuration as it no longer exists:

    // astro.config.mjs
    import { defineConfig } from 'astro/config'
    import node from '@astrojs/node'
    export default defineConfig({
    adapter: node({
    mode: 'standalone',

... (truncated)

Commits

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [@astrojs/node](https://github.com/withastro/astro/tree/HEAD/packages/integrations/node) from 9.5.5 to 10.0.4.
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/node/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/node@10.0.4/packages/integrations/node)

---
updated-dependencies:
- dependency-name: "@astrojs/node"
  dependency-version: 10.0.4
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 30, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 8, 2026

Copy link
Copy Markdown
Author

Superseded by #29.

@dependabot dependabot Bot closed this Jun 8, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/astrojs/node-10.0.4 branch June 8, 2026 22:39
charlieseay pushed a commit that referenced this pull request Jun 17, 2026
ISSUE #9: Skin seeding Drizzle ORM error
- Fix: Import eq() from drizzle-orm, use eq(skins.isBuiltIn, true)
- Old: .where((t) => t.isBuiltIn.eq(true)) - invalid syntax
- File: src/lib/setup/seed-skins.ts

ISSUE #10: Monitor creation SQL INSERT failures
- Fix: Match actual monitors table schema (intervalSeconds, target, paused, etc.)
- Old: Used non-existent columns (enabled, check_interval_seconds, thresholds)
- Added type mapping: health/cpu/memory/restart → docker
- File: src/lib/setup/monitors.ts

ISSUE #11: Skin preference save API failures
- Fix: Import eq() from drizzle-orm, use eq(userSkinPreferences.userId, session.id)
- Old: .where((t) => t.userId.eq(session.id)) - invalid syntax
- File: src/pages/app/api/skins/set-active.ts

All three issues were caused by incorrect Drizzle ORM syntax.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
charlieseay pushed a commit that referenced this pull request Aug 17, 2026
CRITICAL SECURITY FIXES (Production Blockers):
- Remove hardcoded password bypass in auth.ts (CVE-pending)
- Enable account lockout after 5 failed attempts (brute-force protection)
- Fix API token enumeration (users could see all tokens)
- Fix monitor data exposure (users could see all monitors)
- Reduce session duration from 30 days to 7 days

ALL 11 UX BUGS FIXED:
✅ Bug #1: Documentation contradictions
✅ Bug #2: Missing customer compose file
✅ Bug #3: Docker image SQL errors
✅ Bug #4: XSS in page title (HTML entity escaping)
✅ Bug #5: Similar incidents API (doc_type → type)
✅ Bug #6: Route alias /app/knowledge → /app/kb
✅ Bug #7: Markdown rendering in incident descriptions
✅ Bug #8: CSRF token validation (meta tag fix)
✅ Bug #9: AI diagnosis (resolved by Bug #11 fix)
✅ Bug #10: Schema drift (9 missing fields)
✅ Bug #11: Missing userId (raw SQL bypass of Drizzle ORM bug)

SCORE UPDATE:
- Before: 5.0/10 (critical security issues)
- After: 8.5/10 (production ready with known issues)

DEPLOYMENT:
- Image: stdout:security-fixes-v1
- Platform: linux/amd64
- Status: Deployed and validated on ThinkPad

REMAINING ISSUES (deferred to v1.1):
- 4 HIGH: CSRF origin validation, token logging, race conditions, SSRF
- 7 MEDIUM: Input validation, file upload, audit logging
- 8 LOW: Code quality improvements

Documentation:
- SECURITY-FIXES-VALIDATED.md - Complete security audit report
- ALL-BUGS-FIXED-VALIDATED.md - UX bug validation
- FINAL-VALIDATION-REPORT.md - Comprehensive testing summary

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants