Skip to content

Harden error overlay and logging sinks#16420

Merged
matthewp merged 2 commits into
mainfrom
semgrep-dom-log-hardening
Apr 21, 2026
Merged

Harden error overlay and logging sinks#16420
matthewp merged 2 commits into
mainfrom
semgrep-dom-log-hardening

Conversation

@matthewp

@matthewp matthewp commented Apr 20, 2026

Copy link
Copy Markdown
Contributor

Changes

  • Replaces HTML string insertion in the dev overlay with DOM node creation so caret rendering no longer relies on insertAdjacentHTML.
  • Uses fixed log format strings for streaming and session cleanup errors so runtime values are logged as arguments instead of being treated as format strings.

Testing

  • Installed dependencies in a fresh worktree to validate the split branch in isolation.
  • Ran Biome against the touched source files and changeset to confirm the branch stays formatted and lint-clean.

Docs

  • No docs update needed, because this only hardens existing internal error handling.

@changeset-bot

changeset-bot Bot commented Apr 20, 2026 •
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 56c3b16

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions github-actions Bot added the pkg: astro Related to the core `astro` package (scope) label Apr 20, 2026
@codspeed-hq

codspeed-hq Bot commented Apr 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Merging this PR will not alter performance

✅ 18 untouched benchmarks

Comparing semgrep-dom-log-hardening (56c3b16) with main (3852adc)1

Open in CodSpeed

Footnotes

  1. No successful run was found on main (0c0ae11) during the generation of this report, so 3852adc was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

@matthewp matthewp merged commit e21de1d into main Apr 21, 2026
27 checks passed
@matthewp matthewp deleted the semgrep-dom-log-hardening branch April 21, 2026 18:14
@astrobot-houston astrobot-houston mentioned this pull request Apr 21, 2026
Merged
dadezzz pushed a commit to dadezzz/university_notes that referenced this pull request Apr 26, 2026
@dadezzz
fix(deps): update dependency astro to v6.1.9 (#592)
6716474 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [astro](https://astro.build) ([source](https://github.com/withastro/astro/tree/HEAD/packages/astro)) | [`6.1.8` → `6.1.9`](https://renovatebot.com/diffs/npm/astro/6.1.8/6.1.9) | ![age](https://developer.mend.io/api/mc/badges/age/npm/astro/6.1.9?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/astro/6.1.8/6.1.9?slim=true) |

---

### Release Notes

<details>
<summary>withastro/astro (astro)</summary>

### [`v6.1.9`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#619)

[Compare Source](https://github.com/withastro/astro/compare/[email protected]@6.1.9)

##### Patch Changes

- [#&#8203;16448](withastro/astro#16448) [`99464ed`](withastro/astro@99464ed) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Updates vite, picomatch, and unstorage to latest patch versions

- [#&#8203;16422](withastro/astro#16422) [`a3951d7`](withastro/astro@a3951d7) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Hardens `astro-island` export resolution and hydration error handling for malformed component metadata

- [#&#8203;16420](withastro/astro#16420) [`e21de1d`](withastro/astro@e21de1d) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Hardens Astro's error overlay and server logging paths to avoid unsafe HTML insertion and format-string interpolation

- [#&#8203;16419](withastro/astro#16419) [`f3485c3`](withastro/astro@f3485c3) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Hardens nested object and package metadata lookups to ignore prototype keys in content handling and project scaffolding

- [#&#8203;16022](withastro/astro#16022) [`a002540`](withastro/astro@a002540) Thanks [@&#8203;mathieumaf](https://github.com/mathieumaf)! - Fixes an issue where i18n domains would return 404 when `trailingSlash` is set to `never`.

- Updated dependencies \[[`99464ed`](withastro/astro@99464ed), [`f3485c3`](withastro/astro@f3485c3)]:
  - [@&#8203;astrojs/internal-helpers](https://github.com/astrojs/internal-helpers)@&#8203;0.9.0
  - [@&#8203;astrojs/markdown-remark](https://github.com/astrojs/markdown-remark)@&#8203;7.1.1

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMzIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEzMi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
@github-actions github-actions Bot mentioned this pull request Apr 27, 2026
Merged
1 task
@kylifornication-code kylifornication-code mentioned this pull request May 13, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ematipico ematipico ematipico approved these changes

Assignees

No one assigned

Labels

pkg: astro Related to the core `astro` package (scope)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@matthewp @ematipico