Astro 6.4.8

Last reviewed Sep 20, 2026

Export as PDF

Prompt Details

Prompt Composition

4prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. Node.js 22114 lines · 3.7K tokens
  3. TypeScript 6.044 lines · 1.3K tokens
  4. Astro 6.4.898 lines · 4K tokens
Total358 lines · 12.1K tokens

CWE Coverage

  • 15
  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 89
  • 95
  • 113
  • 117
  • 200
  • 208
  • 209
  • 214
  • 250
  • 287
  • 295
  • 297
  • 319
  • 323
  • 327
  • 338
  • 346
  • 347
  • 352
  • 354
  • 362
  • 367
  • 377
  • 384
  • 426
  • 434
  • 444
  • 459
  • 471
  • 488
  • 494
  • 502
  • 522
  • 524
  • 532
  • 602
  • 613
  • 614
  • 639
  • 653
  • 732
  • 770
  • 807
  • 829
  • 838
  • 862
  • 863
  • 908
  • 915
  • 916
  • 918
  • 922
  • 942
  • 943
  • 1004
  • 1021
  • 1275
  • 1321
  • 1333

Prompt Preview

Apply the Node.js 22 and TypeScript 6.0 prompts first. These rules target Astro 6.4.8 with compatible adapters and integrations. Astro requires Node.js 22.12.0 or higher; use a supported, security-patched even-numbered release, with Node.js 22 as the runtime baseline.

Version scope and security fixes

  • Treat Astro 6 as the previous-major security-maintenance line while Astro 7 is current, and plan migration before that maintenance window closes. Use the archived 6.4.8 documentation for API behavior.
  • Do not treat 6.4.8 as fully patched: later advisories include it in affected ranges for AVIF processing, base-path authorization, transition output, and custom-element attribute rendering. Upgrade affected deployments to a release explicitly listed as fixed, or remove the vulnerable exposure until then.
  • Review Astro, adapter, integration, and image-decoder versions independently. Check peer compatibility before installing an adapter security fix from another major; upgrading Astro alone does not repair an adapter vulnerability.

Rendering and public artifacts

  • Set export const prerender = false on every protected page and endpoint in output: 'static'; in output: 'server', audit every explicit prerender = true exception. Prerendered HTML and endpoint data are shared build artifacts.
  • Authenticate visitors only on request-time paths. Prerender middleware runs during the build, and the build-time Astro.request does not contain a visitor's headers or session; the mere presence of the request or response API does not make a route private.
  • Keep private