Skip to content

Bump @astrojs/node from 9.5.5 to 10.0.3 - #3

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/astrojs/node-10.0.3
Closed

Bump @astrojs/node from 9.5.5 to 10.0.3#3
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/astrojs/node-10.0.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 23, 2026

Copy link
Copy Markdown

Bumps @astrojs/node from 9.5.5 to 10.0.3.

Release notes

Sourced from @​astrojs/node's releases.

@​astrojs/node@​10.0.3

Patch Changes

  • #15735 9685e2d Thanks @​fa-sharp! - Fixes an EventEmitter memory leak when serving static pages from Node.js middleware.

    When using the middleware handler, requests that were being passed on to Express / Fastify (e.g. static files / pre-rendered pages / etc.) weren't cleaning up socket listeners before calling next(), causing a memory leak warning. This fix makes sure to run the cleanup before calling next().

@​astrojs/node@​10.0.2

Patch Changes

@​astrojs/node@​10.0.1

Patch Changes

@​astrojs/node@​10.0.0

Major Changes

  • #15654 a32aee6 Thanks @​florian-lefebvre! - Removes the experimentalErrorPageHost option

    This option allowed fetching a prerendered error page from a different host than the server is currently running on.

    However, there can be security implications with prefetching from other hosts, and often more customization was required to do this safely. This has now been removed as a built-in option so that you can implement your own secure solution as needed and appropriate for your project via middleware.

    What should I do?

    If you were previously using this feature, you must remove the option from your adapter configuration as it no longer exists:

    // astro.config.mjs
    import { defineConfig } from 'astro/config'
    import node from '@astrojs/node'
    export default defineConfig({
    adapter: node({
    mode: 'standalone',
    
    experimentalErrorPageHost: 'http://localhost:4321'
    })
    })

You can replicate the previous behavior by checking the response status in a middleware and fetching the prerendered page yourself:

// src/middleware.ts
import { defineMiddleware } from 'astro:middleware';
export const onRequest = defineMiddleware(async (ctx, next) => {

... (truncated)

Changelog

Sourced from @​astrojs/node's changelog.

10.0.3

Patch Changes

  • #15735 9685e2d Thanks @​fa-sharp! - Fixes an EventEmitter memory leak when serving static pages from Node.js middleware.

    When using the middleware handler, requests that were being passed on to Express / Fastify (e.g. static files / pre-rendered pages / etc.) weren't cleaning up socket listeners before calling next(), causing a memory leak warning. This fix makes sure to run the cleanup before calling next().

10.0.2

Patch Changes

10.0.1

Patch Changes

10.0.0

Major Changes

  • #15654 a32aee6 Thanks @​florian-lefebvre! - Removes the experimentalErrorPageHost option

    This option allowed fetching a prerendered error page from a different host than the server is currently running on.

    However, there can be security implications with prefetching from other hosts, and often more customization was required to do this safely. This has now been removed as a built-in option so that you can implement your own secure solution as needed and appropriate for your project via middleware.

    What should I do?

    If you were previously using this feature, you must remove the option from your adapter configuration as it no longer exists:

    // astro.config.mjs
    import { defineConfig } from 'astro/config'
    import node from '@astrojs/node'
    export default defineConfig({
    adapter: node({
    mode: 'standalone',
    
    experimentalErrorPageHost: 'http://localhost:4321'
    })
    })

You can replicate the previous behavior by checking the response status in a middleware and fetching the prerendered page yourself:

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 23, 2026
Bumps [@astrojs/node](https://github.com/withastro/astro/tree/HEAD/packages/integrations/node) from 9.5.5 to 10.0.3.
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/node/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/node@10.0.3/packages/integrations/node)

---
updated-dependencies:
- dependency-name: "@astrojs/node"
  dependency-version: 10.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/astrojs/node-10.0.3 branch from 4284c5a to 1cf0d82 Compare March 28, 2026 03:52
@dependabot @github

dependabot Bot commented on behalf of github Mar 30, 2026

Copy link
Copy Markdown
Author

Superseded by #11.

@dependabot dependabot Bot closed this Mar 30, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/astrojs/node-10.0.3 branch March 30, 2026 00:49
charlieseay pushed a commit that referenced this pull request Jun 16, 2026
Schema defined these columns in tenant-schema.ts but apply-schema.js
CREATE TABLE statement was missing them, causing fresh installations
to fail when creating output-freshness monitors.

Root cause: Issue #3 from E2E testing revealed the manual ALTER TABLE
fix was only a band-aid. Fresh installs need these columns in the DDL.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
charlieseay pushed a commit that referenced this pull request Jun 17, 2026
- ISSUE #1 (P0): Setup redirect loop - FIXED & VERIFIED
- ISSUE #3 (P1): Data Source Discovery getDb error - FIXED & VERIFIED
- ISSUE #4 (P1): Monitor Configuration getDb error - FIXED (reveals new issue)
- ISSUE #5 (P2): Monitor Configuration schema error - NEW (no such column: type)

Dashboard now loads successfully at /app after setup completes.
Ready for full E2E test suite execution.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
charlieseay pushed a commit that referenced this pull request Aug 17, 2026
CRITICAL SECURITY FIXES (Production Blockers):
- Remove hardcoded password bypass in auth.ts (CVE-pending)
- Enable account lockout after 5 failed attempts (brute-force protection)
- Fix API token enumeration (users could see all tokens)
- Fix monitor data exposure (users could see all monitors)
- Reduce session duration from 30 days to 7 days

ALL 11 UX BUGS FIXED:
✅ Bug #1: Documentation contradictions
✅ Bug #2: Missing customer compose file
✅ Bug #3: Docker image SQL errors
✅ Bug #4: XSS in page title (HTML entity escaping)
✅ Bug #5: Similar incidents API (doc_type → type)
✅ Bug #6: Route alias /app/knowledge → /app/kb
✅ Bug #7: Markdown rendering in incident descriptions
✅ Bug #8: CSRF token validation (meta tag fix)
✅ Bug #9: AI diagnosis (resolved by Bug #11 fix)
✅ Bug #10: Schema drift (9 missing fields)
✅ Bug #11: Missing userId (raw SQL bypass of Drizzle ORM bug)

SCORE UPDATE:
- Before: 5.0/10 (critical security issues)
- After: 8.5/10 (production ready with known issues)

DEPLOYMENT:
- Image: stdout:security-fixes-v1
- Platform: linux/amd64
- Status: Deployed and validated on ThinkPad

REMAINING ISSUES (deferred to v1.1):
- 4 HIGH: CSRF origin validation, token logging, race conditions, SSRF
- 7 MEDIUM: Input validation, file upload, audit logging
- 8 LOW: Code quality improvements

Documentation:
- SECURITY-FIXES-VALIDATED.md - Complete security audit report
- ALL-BUGS-FIXED-VALIDATED.md - UX bug validation
- FINAL-VALIDATION-REPORT.md - Comprehensive testing summary

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants