GitHub Actions Deprecation
NONE — repo has no .github/workflows/ directory; no CI pipeline exists to evaluate for Node20/Node24.
npm Dependencies
astro@^5.17.2 (locked at 5.17.2) — 2 major versions behind latest (7.1.3). Vulnerable to CVE-2026-41067 (GHSA-j687-52p2-xcff, XSS via incomplete </script> tag sanitization in define:vars) — affects all versions <6.1.6 with no backport on the 5.x line; the only fix is upgrading to Astro ≥6.1.6. Current src/ doesn't use define:vars or any client:* directives, so exploitability today is low, but the dependency itself remains unpatched. Not affected by CVE-2026-25545 (SSRF, fixed exactly at 5.17.2) or the Vercel-adapter/@astrojs/node-specific CVEs, since this site builds output: 'static' with no adapter.
@astrojs/sitemap@^3.7.0 (locked 3.7.0) — one patch behind latest (3.7.3), not a CVE. Low priority; verify before bumping straight to 3.7.3 given a reported build regression in 3.7.1.
Recommend upgrading astro to ≥6.1.6 (evaluate the 7.x line separately given breaking changes) to close CVE-2026-41067.
Go Module CVEs
NONE — no go.mod in this repo.
Terraform Providers
NONE — no *.tf files in this repo.
Note: this is the same astro finding raised in #37 (2026-07-06); the lockfile still resolves to the vulnerable version three weeks later.
GitHub Actions Deprecation
NONE — repo has no
.github/workflows/directory; no CI pipeline exists to evaluate for Node20/Node24.npm Dependencies
astro@^5.17.2(locked at 5.17.2) — 2 major versions behind latest (7.1.3). Vulnerable to CVE-2026-41067 (GHSA-j687-52p2-xcff, XSS via incomplete</script>tag sanitization indefine:vars) — affects all versions <6.1.6 with no backport on the 5.x line; the only fix is upgrading to Astro ≥6.1.6. Currentsrc/doesn't usedefine:varsor anyclient:*directives, so exploitability today is low, but the dependency itself remains unpatched. Not affected by CVE-2026-25545 (SSRF, fixed exactly at 5.17.2) or the Vercel-adapter/@astrojs/node-specific CVEs, since this site buildsoutput: 'static'with no adapter.@astrojs/sitemap@^3.7.0(locked 3.7.0) — one patch behind latest (3.7.3), not a CVE. Low priority; verify before bumping straight to 3.7.3 given a reported build regression in 3.7.1.Recommend upgrading
astroto ≥6.1.6 (evaluate the 7.x line separately given breaking changes) to close CVE-2026-41067.Go Module CVEs
NONE — no
go.modin this repo.Terraform Providers
NONE — no
*.tffiles in this repo.Note: this is the same
astrofinding raised in #37 (2026-07-06); the lockfile still resolves to the vulnerable version three weeks later.