[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
astro (source)	6.4.7 → 6.4.8

---

Release Notes

withastro/astro (astro)

v6.4.8

Compare Source

Patch Changes

• #​17109 27c80ea Thanks @​ematipico! - Harden the limits on the number of decoding on the URL.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

• No breaking changes: This is a patch release (6.4.7 → 6.4.8) with a single security hardening fix
• Security fix — URL decoding limit hardening (PR #17109): "Harden the limits on the number of decoding on the URL." — restricts the maximum number of sequential URL decode iterations to prevent potential DoS/attack vectors via excessively/recursively encoded URLs (e.g., %252F%252F...)
• No new features, no API changes, no configuration changes required

🎯 Impact Scope Investigation

Codebase URL/routing usage:

• Dynamic routes (/posts/[slug].astro, /tags/[tag].astro, /channels/[channel].astro) all generate parameters internally via getStaticPaths() — no external URL encoding involved
• Tag/Channel slugs are produced by urlize() (toLowerCase + space→hyphen) — simple ASCII, no percent-encoding
• The only explicit decodeURIComponent() call is in /embed/index.ts for a single query parameter — single-level decode, not recursive

Conclusion: No code paths in this codebase rely on multi-level URL encoding that would be affected by the new decoding limit. The change only blocks pathological/malformed URL patterns that are not present here.

Dependency impact: No transitive dependency changes observed in the lockfile beyond the astro package itself and its internal references.

💡 Recommended Actions

• No migration steps or code modifications required
• Merge this PR as-is

🔗 Reference Links

• astro v6.4.8 Release Notes
• PR #17109 — Harden URL decoding limits
• Renovate merge confidence badges

Generated by koki-develop/claude-renovate-review

---

🚫 Permission Denied Tool Executions

The following tool executions that Claude Code attempted were blocked due to insufficient permissions.
Consider adding them to allowed_tools if needed.

Run #27976294836 - 1 tool denied

Tool	Input
WebSearch	{"query":"astro 6.4.8 URL decoding harden limits security"}

Generated by koki-develop/claude-denied-tools

[github-actions]

🚀 Preview deployment ready!

✅ Preview URL: https://pr-1839---web-njpdbbjcea-an.a.run.app
📝 Commit SHA: e22ba18 (view commit)

This comment was automatically generated by the deploy-preview workflow.