Summary
@apphosting/astro-adapter@0.0.1 currently depends on @astrojs/node@^9.x, which is Astro 5 only. Astro 6 requires @astrojs/node@^10.x or ^11.x. There is no peerDependencies constraint in the adapter, but the hard dependency on @astrojs/node@^9 prevents Astro 6 from working correctly.
Security motivation
Snyk flagged SNYK-JS-ASTRO-17901336 ("Use of Non-Canonical URL Paths for Authorization Decisions", HIGH severity) against Astro v5. The fix is upgrading to Astro v6, but that is currently blocked by this adapter.
We assessed the risk for our specific app as low (auth is enforced at the page level via Firebase Admin SDK, not in Astro middleware), and have added a Snyk exception accordingly — but the upgrade is still needed.
What needs to change
Looking at the compiled adapter source (dist/index.js), the change appears minimal:
package.json — bump @astrojs/node from ^9.0.1 to ^10.0.0 || ^11.0.0 and add peerDependencies: { "astro": "^5 || ^6" }supportedAstroFeatures — verify i18nDomains and envGetSecret feature names/values are still valid in Astro v6's adapter API- Publish a new version — even a
0.0.2 would unblock the ecosystem
Environment
@apphosting/astro-adapter: 0.0.1- Current Astro:
5.18.1
- Target Astro:
6.4.8 (latest)
@astrojs/node latest: 11.0.2- Firebase App Hosting (App Hosting backend,
apphosting.yaml)
References
Summary
@apphosting/astro-adapter@0.0.1currently depends on@astrojs/node@^9.x, which is Astro 5 only. Astro 6 requires@astrojs/node@^10.xor^11.x. There is nopeerDependenciesconstraint in the adapter, but the hard dependency on@astrojs/node@^9prevents Astro 6 from working correctly.Security motivation
Snyk flagged SNYK-JS-ASTRO-17901336 ("Use of Non-Canonical URL Paths for Authorization Decisions", HIGH severity) against Astro v5. The fix is upgrading to Astro v6, but that is currently blocked by this adapter.
We assessed the risk for our specific app as low (auth is enforced at the page level via Firebase Admin SDK, not in Astro middleware), and have added a Snyk exception accordingly — but the upgrade is still needed.
What needs to change
Looking at the compiled adapter source (
dist/index.js), the change appears minimal:package.json— bump@astrojs/nodefrom^9.0.1to^10.0.0 || ^11.0.0and addpeerDependencies: { "astro": "^5 || ^6" }supportedAstroFeatures— verifyi18nDomainsandenvGetSecretfeature names/values are still valid in Astro v6's adapter API0.0.2would unblock the ecosystemEnvironment
@apphosting/astro-adapter:0.0.15.18.16.4.8(latest)@astrojs/nodelatest:11.0.2apphosting.yaml)References
@astrojs/nodechangelog: https://github.com/withastro/astro/blob/main/packages/integrations/node/CHANGELOG.md