You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#17209fbcfa03 Thanks @matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.
#17209fbcfa03 Thanks @matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.
The @astrojs/rss patch only hardens escaping for the source and enclosure RSS item fields; this repo does not set those fields in any of its changelog RSS routes, so output should remain identical while gaining a small hardening benefit. No manual verification is needed.
Package details
@astrojs/rss: 4.0.18 → 4.0.19
Type: security fix Dependency type: direct
What changed
Hardens RSS feed generation by escaping source and enclosure item fields as structured XML values so special characters are treated as text rather than markup.
Usage in this repo
Direct dependency called from five changelog RSS routes (src/pages/changelog/rss/index.xml.ts, src/pages/changelog/rss/index.md.xml.ts, src/pages/changelog/rss/[area].xml.ts, src/pages/changelog/rss/[product].xml.ts, src/pages/[...changelog].xml.ts) and used as the RSSFeedItem type in src/util/changelog.ts. None of the RSS items set source or enclosure fields.
Impact: 🟢 Very Low — The escaping change only affects source and enclosure fields, which this repo does not populate, so existing feeds are unaffected beyond a minor safety improvement.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filejavascriptPull requests that update Javascript codesize/s
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps @astrojs/rss from 4.0.18 to 4.0.19.
Release notes
Sourced from @astrojs/rss's releases.
Changelog
Sourced from @astrojs/rss's changelog.
Commits
5978993[ci] release (#17213)2bfb179chore: simpler package.json types (#17229)fbcfa03Escape source and enclosure fields in RSS feed generation (#17209)5a8cd09refactor: update tsconfig to use TypeScript project references (#16505)46633f5refactor(create-astro): migrate tests to typescript (#16400)747a5b3refactor: migrate astro-rss tests to typescript (#16357)88fcc98fix integrations links across docs (#16098)