Skip to content

🚨 [security] Update @astrojs/cloudflare 12.6.7 → 13.5.0 (major)#2

Open
depfu[bot] wants to merge 1 commit into
mainfrom
depfu/update/npm/@astrojs/cloudflare-13.5.0
Open

🚨 [security] Update @astrojs/cloudflare 12.6.7 → 13.5.0 (major)#2
depfu[bot] wants to merge 1 commit into
mainfrom
depfu/update/npm/@astrojs/cloudflare-13.5.0

Conversation

@depfu
Copy link
Copy Markdown

@depfu depfu Bot commented May 10, 2026

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ @​astrojs/cloudflare (12.6.7 → 13.5.0) · Repo · Changelog

Security Advisories 🚨

🚨 Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)

Summary

The fetch() call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts (line 28) uses the default redirect: 'follow' behavior. This allows the Cloudflare Worker to follow HTTP redirects to arbitrary URLs, bypassing the isRemoteAllowed() domain allowlist check which only validates the initial URL.

All three other image fetch paths in the codebase correctly use { redirect: 'manual' }. This is an incomplete fix for GHSA-qpr4-c339-7vq8.

Confirmed on HEAD.

Root Cause

image-binding-transform.ts line 28:

const content = await (isRemotePath(href) ? fetch(imageSrc) : assets.fetch(imageSrc));

Missing { redirect: 'manual' }. The three protected paths:

// image-passthrough-endpoint.ts:23
response = await fetch(href, { redirect: 'manual' });

// assets/endpoint/shared.ts:11

const res = await fetch(src, { redirect: 'manual' });


// assets/utils/remoteProbe.ts:53

const response = await fetch(url, { redirect: 'manual' });

PoC

Demonstrated with Node.js that fetch() without redirect: 'manual' follows 302 redirects to arbitrary destinations:

# Server A (allowed domain) returns 302 → Server B (internal)
fetch('http://allowed:19741/img.jpg')                        → follows 302 → hits http://internal:19742/secret
fetch('http://allowed:19741/img.jpg', {redirect:'manual'})   → returns 302, internal server NOT hit

Attack path: attacker finds an open redirect on an allowed domain, crafts /_image?href=https://allowed-cdn.com/redirect?url=http://internal-service/, and the Worker follows the redirect to the unauthorized destination.

Impact

Bypasses the image.domains and image.remotePatterns allowlist for the default Cloudflare image service (cloudflare-binding). Enables blind SSRF to domains not in the allowlist. Same vulnerability class as GHSA-qpr4-c339-7vq8 (HIGH) which fixed the passthrough endpoint but missed this one.

Suggested Fix

const content = await (isRemotePath(href) ? fetch(imageSrc, { redirect: 'manual' }) : assets.fetch(imageSrc));

↗️ @​emnapi/runtime (indirect, 1.4.3 → 1.10.0) · Repo

Release Notes

1.10.0

What's Changed

  • fix: early update wasm memory for views (https://github.com/hardfist/emnapi-shared-memory-grow-repro)
  • fix!: napi_adjust_external_memory no longer grow wasm memory
  • fix: add missing from64 wrap
  • fix: coalesce tsfn (js version) send message
  • ci: restructure CI workflows
  • ci: prebuilt liraries using llvm 22

Thanks @hardfist

Full Changelog: v1.9.2...v1.10.0

1.9.2

What's Changed

Full Changelog: v1.9.1...v1.9.2

1.9.1

fix for emscripten 5.0.3
emscripten-core/emscripten@3051725

Full Changelog: v1.9.0...v1.9.1

1.9.0

What's Changed

  • fix data race and use-after-free in napi_threadsafe_function by @toyobayashi in #199
    • fix tsfn not work in JS based async_work workers
    • fix pthread_create not work in JS based async_work workers
    • emnapi_basic[-mt].a includes libuv symbols now
  • refactor: dispatch async work queue in shared memory by @toyobayashi in #200
    • Avoids deadlock when main thread block on waiting queued async work starting. Completed work can not be dispatched to main thread that cause no new worker available, then queued work never start.
    • wasm32-wasip1-threads target spawn async worker in JS will use pthread_create, no longer maintain a separate worker pool.
  • rename node_api_create_object_with_properties by @toyobayashi in #193
  • fix: execute tsfn finalizer after queue drains when aborted
  • feat: add required config hint in package entry 
    const { requiredConfig } = require('emnapi')
console.log(requiredConfig.clang.wasmld)
    [
  '--import-memory',
  '--shared-memory',
  '--export-table',
  '--export=malloc',
  '--export=free',
  '--export=napi_register_wasm_v1',
  '--export-if-defined=node_api_module_get_api_version_v1',
  '--export=emnapi_thread_crashed',
  '--export-if-defined=emnapi_async_worker_create',
  '--export-if-defined=emnapi_async_worker_init'
]

Full Changelog: v1.8.1...v1.9.0

1.8.1

What's Changed

Full Changelog: v1.8.0...v1.8.1

1.8.0

What's Changed

Full Changelog: v1.7.1...v1.8.0

1.7.1

What's Changed

Full Changelog: v1.7.0...v1.7.1

1.7.0

What's Changed

Full Changelog: v1.6.0...v1.7.0

1.6.0

What's Changed

Full Changelog: v1.5.0...v1.6.0

1.5.0

What's Changed

Prebuilt libraries are built by LLVM clang 20.

  • fix: env undefined after emitting beforeExit event by @toyobayashi in #162
  • fix(wasi): avoid deadlock caused by child thread abort when the main thread is in Atomics.wait and allow blocking calls on browser main thread (requires wasi-sdk 26+ and --export=emnapi_thread_crashed) by @toyobayashi in #163
  • build: backport emscripten parse tools changes to v1 by @toyobayashi in #165

Full Changelog: v1.4.5...v1.5.0

1.4.5

What's Changed

  • fix(wasm32-wasip1-threads): process never exit if trap in threads (#156)

Full Changelog: v1.4.4...v1.4.5

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 47 commits:

↗️ detect-libc (indirect, 2.0.4 → 2.1.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 11 commits:

↗️ semver (indirect, 7.7.2 → 7.8.0) · Repo · Changelog

Release Notes

7.8.0

7.8.0 (2026-05-08)

Features

Bug Fixes

Documentation

Chores

7.7.4

7.7.4 (2026-01-16)

Bug Fixes

Documentation

Dependencies

Chores

7.7.3

7.7.3 (2025-10-06)

Bug Fixes

Chores

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 24 commits:

↗️ tinyglobby (indirect, 0.2.14 → 0.2.16) · Repo · Changelog

Release Notes

0.2.16

Fixed

Changed

  • Overhauled and optimized most internals by @Torathion
  • Ignore patterns are no longer compiled twice by @webpro

Consider sponsoring if you'd like to support the development of this project and the goal of reaching a lighter and faster ecosystem

0.2.15

Added

  • Documentation page at https://superchupu.dev/tinyglobby, which also contains a library comparison page and migration guide.

    It's been a huge effort that took two months to make.

    Big thanks to @outslept, @43081j and @benmccann for helping out! ❤️

  • JSDoc to all functions and options based on the online documentation page

  • Benchmarks with help from @43081j and @benmccann

  • braceExpansion option

  • extglob option

  • fs option

  • globstar option by @benmccann

  • signal option

  • package.json export as tinyglobby/package.json

  • Ability to pass readonly types by @TomerAberbach

  • Support for URLs in cwd option

Changed

  • Rewritten path processing algorithm leading to a huge performance increase in many cases with help from @43081j and @benmccann

  • Deprecated using patterns inside the options object

  • Enabled trusted publishing using npm's OIDC support

Fixed

  • Negated bracket expressions i.e. [!abc]
  • Some patterns like +++ breaking the partial matcher

Consider sponsoring if you'd like to support the development of this project and the goal of reaching a lighter and faster ecosystem

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 66 commits:

↗️ undici (indirect, 7.12.0 → 7.24.8) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 @​cloudflare/vite-plugin (added, 1.36.3)

🆕 @​esbuild/openharmony-arm64 (added, 0.27.7)

🆕 @​img/colour (added, 1.1.0)

🆕 @​img/sharp-libvips-linux-ppc64 (added, 1.2.4)

🆕 @​img/sharp-libvips-linux-riscv64 (added, 1.2.4)

🆕 @​img/sharp-linux-ppc64 (added, 0.34.5)

🆕 @​img/sharp-linux-riscv64 (added, 0.34.5)

🆕 @​img/sharp-win32-arm64 (added, 0.34.5)

🆕 fdir (added, 6.5.0)

🆕 piccolore (added, 0.1.3)

🗑️ @​fastify/busboy (removed)

🗑️ as-table (removed)

🗑️ data-uri-to-buffer (removed)

🗑️ get-source (removed)

🗑️ mustache (removed)

🗑️ prettier (removed)

🗑️ printable-characters (removed)

🗑️ stacktracey (removed)

🗑️ typescript (removed)

👉 No CI detected

You don't seem to have any Continuous Integration service set up!

Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.

This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:

* [Circle CI](https://circleci.com), [Semaphore ](https://semaphoreci.com) and [Github Actions](https://docs.github.com/actions) are all excellent options. * If you use something like Jenkins, make sure that you're using the Github integration correctly so that it reports status data back to Github. * If you have already set up a CI for this repository, you might need to check your configuration. Make sure it will run on all new branches. If you don’t want it to run on every branch, you can whitelist branches starting with `depfu/`.

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu Bot added the depfu label May 10, 2026
llamapreview[bot]
llamapreview Bot reviewed May 10, 2026
View reviewed changes
Copy link
Copy Markdown

@llamapreview llamapreview Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI Code Review by LlamaPReview

🎯 TL;DR & Recommendation

Recommendation: Approve with suggestions

This PR updates @astrojs/cloudflare from 12.6.7 to 13.5.0 to address security vulnerabilities. However, as a major version bump, it introduces a risk of breaking type definitions and the integration API. Additionally, no CI is configured, so any breaking changes could go undetected without manual verification.

💡 Suggestions (P2)

  • package.json: Major version bump may silently break TypeScript compilation if the Runtime type signature or cloudflare() integration API changed. Run npm run build and check for type errors before merging.
  • package.json: No CI detected – breaking changes may go undetected. Consider enabling CI or manually running the full test suite and build commands.

💡 Have feedback? We'd love to hear it in our GitHub Discussions.
✨ This review was generated by LlamaPReview Advanced, which is free for all open-source projects. Learn more.

Comment thread package.json
Comment on lines 16 to +18
},
"dependencies": {
"@astrojs/cloudflare": "12.6.7",
"@astrojs/cloudflare": "13.5.0",
Copy link
Copy Markdown

@llamapreview llamapreview Bot May 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 | Confidence: High

Breaking Change Risk: The major version bump from 12.6.7 to 13.5.0 introduces a risk of breaking type definitions and integration API. The project directly imports Runtime<Env> from @astrojs/cloudflare (anchor path:src/env.d.ts) and calls the cloudflare() integration in astro.config.mjs (anchor path:astro.config.mjs). If the Runtime type was renamed, its generic signature changed, or the integration constructor now requires configuration (e.g., cloudflare({/*...*/})), the TypeScript compilation and Astro build will fail. Since the PR description notes "No CI detected", there is no automated verification. It is strongly recommended to run npm run build locally and check for type errors before merging.

No CI Detected: The PR description explicitly states "No CI detected". Without a CI pipeline, any breaking changes introduced by this major dependency update (e.g., build errors, runtime failures) will not be caught automatically. This is a process risk that should be addressed either by enabling CI or by manually running the full test suite (if any) and the build commands (npm run build, npm run build:embed) before merging.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@llamapreview llamapreview[bot] llamapreview[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants