Skip to main content
PET_03 / This site

Migrating nikalexan.com
Astro 5 → 7October 2026

My roleDependency audit, Astro and Tailwind upgrade, moving content collections to the new API
TimelineOctober 2026, one evening
Delivered0 npm audit vulnerabilities, the same 6 pages after the build
crisis_alertProblem

npm audit found a critical vulnerability in Astro itself

In astro 5.16.15, AVIF image optimization allowed remote code execution (GHSA-26w7-cxv4-gfx2). The fix only shipped in 7.2.8, and Astro 6 removed the legacy content collections API that every project page relied on. A small bump was not enough: I had to jump a major version and rewrite how content loads.

16
vulnerable packages
1
critical
14
high
Stack[SYSTEM_ARCHITECTURE]

A static Astro site

Astro builds static pages in Russian and English from Markdown collections with Zod schemas. Styles use Tailwind 4, and the site deploys to Netlify. Most findings came from Astro's dependencies rather than Astro itself: sharp, vite, rollup, postcss and svgo.

  • Astro
  • TypeScript
  • Zod
  • Tailwind CSS
  • Netlify
codesite/src/content.config.ts
import { glob } from "astro/loaders";
import { z } from "astro/zod";

const projects = defineCollection({
  loader: glob({
    pattern: "**/*.{md,mdx}",
    base: "./src/content/projects"
  }),
  schema: z.object({ /* ... */ })
});
commit 7ec9744
Solutions
  • 01 / 03

    Straight to 7.x

    Upgraded astro to 7.4.1 and @astrojs/mdx to 8.1.0, plus Tailwind to 4.3.3. Version 6 alone did not fix the critical issue.

  • 02 / 03

    Content Layer API

    Moved src/content/config.ts to src/content.config.ts with a glob() loader and z from astro/zod. entry.slug became entry.id, and getEntryBySlug became a plain lookup in the collection.

  • 03 / 03

    Checking nothing broke

    After npm audit fix for the remaining transitive packages, I compared builds: the same 6 pages with the same text, and the /project/* and /en/project/* routes in place.

16 → 0

What I changed after

I skipped a major version, so the upgrade grew large. After the migration I turned on Dependabot: it now reports vulnerabilities, and updates arrive while they are still small.

Pull request on GitHubarrow_outward