🚨 [security] Update astro 6.4.8 → 7.1.3 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ astro (6.4.8 → 7.1.3) · Repo · Changelog

Security Advisories 🚨

🚨 Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Summary

When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS).

Severity

Although a generic reflected XSS scores in the Medium range, exploitation here requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This mitigating precondition places the real-world severity at Low.

Details

In generateHydrateScript() (packages/astro/src/runtime/server/hydration.ts), every island property is HTML-escaped before serialization — the attrs, props, and opts assignments all pass through escapeHTML(). The transition directives, however, were copied verbatim:

transitionDirectivesToCopyOnIsland.forEach((name) => {
  if (typeof props[name] !== 'undefined') {
    island.props[name] = props[name]; // not escaped
  }
});

The <astro-island> element is serialized via renderElement('astro-island', island, false) with shouldEscape=false, and toAttributeString() returns the value unchanged in that mode. As a result there is no downstream re-escaping, and the raw directive value reaches the HTML response. This is the same output sink previously addressed for slot names in GHSA-8hv8-536x-4wqp.

The affected directives are:

• data-astro-transition-scope (transition:scope)
• data-astro-transition-persist (transition:persist)
• data-astro-transition-persist-props (transition:persist-props)

Note that transition:persist is typed boolean | string, so passing a string value is a supported use of the API.

Proof of Concept

A component that reflects a query parameter into a transition directive:

---
const persist = Astro.url.searchParams.get('persist') ?? 'default';
---
<Island client:load transition:persist={persist} />

Request:

https://example.com/?persist="><img src=x onerror=alert(document.domain)>

Rendered output (before the fix):

<astro-island … data-astro-transition-persist=""><img src=x onerror=alert(document.domain)>></astro-island>

The " closes the attribute and the injected <img onerror=…> executes in the victim's browser.

Impact

Reflected XSS. An attacker who can induce a victim to visit a crafted URL can execute arbitrary script in the victim's session on the origin, subject to the requirement that the target application reflects untrusted input into one of the affected transition directives.

Affected Versions

astro >= 3.10.0, < 7.0.4 (introduced in 3.10.0, PR #7861).

Patched Versions

astro >= 7.0.4. Fixed in PR #17212 by HTML-escaping transition directive values before they are rendered onto the island element.

Workarounds

Do not pass untrusted or request-derived input into transition:persist, transition:scope, or transition:persist-props. If such input is required, HTML-escape or strictly validate it before passing it to the directive. Upgrading to astro@7.0.4 or later removes the need for manual mitigation.

Credits

Reported by @jlgore.

🚨 Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

Summary

The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing "' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context, resulting in XSS.

Details

renderHTMLElement builds attributes directly:

for (const attr in props) {
  attrHTML += ` ${attr}="${toAttributeString(await props[attr])}"`;
}

The attribute name (attr) is interpolated raw; only the value is escaped via toAttributeString. By contrast, the hardened addAttribute in util.ts rejects invalid names:

if (INVALID_ATTR_NAME_CHAR.test(key)) { return ''; } // /[\s"'>/=]/

renderHTMLElement is reached from component.ts when the component is a native HTMLElement subclass:

if (!renderer && typeof HTMLElement === 'function' && componentIsHTMLElement(Component)) {
  const output = await renderHTMLElement(result, Component, _props, slots);
}

where _props carries spread props verbatim.

Reachability

The branch only runs when typeof HTMLElement === 'function' at SSR time. In default Node SSR HTMLElement is undefined, so the branch is dead. It becomes reachable when the SSR runtime exposes a global HTMLElement (Deno, Bun with a DOM shim, or jsdom/happy-dom in Node) and a class extending HTMLElement is used directly as an Astro component that receives untrusted-keyed spread props.

Proof of Concept

Given malicious spread props:

const maliciousProps = {
  'onmouseover=alert(document.domain) x': 'y',
  'x><script>alert(1)</script>': 'z',
};

• addAttribute (post-fix) → <my-el></my-el> (key stripped — safe)
• renderHTMLElement → <my-el onmouseover=alert(document.domain) x="y" x><script>alert(1)</script>="z"></my-el> (handler + <script> injected — XSS)

Equivalent Astro template, served by an SSR runtime that defines a global HTMLElement:

---
import MyElement from '../MyElement.js'; // class MyElement extends HTMLElement {}
const userInput = Astro.url.searchParams;  // untrusted keys
---
<MyElement {...Object.fromEntries(userInput)} />

Impact

Cross-site scripting (CWE-79) via attribute-name breakout — the same vulnerability class as CVE-2026-54298, in a code path its fix did not cover. An attacker who controls the keys of an object spread onto a native-HTMLElement-subclass component can inject arbitrary event-handler attributes or sibling elements (including <script>) into the SSR output. Reachability is constrained by the runtime and component preconditions described above.

🚨 Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

Summary

In the composable astro/hono pipeline, the security.checkOrigin protection is only installed by the middleware() primitive. The actions() and pages() primitives each dispatch to user code independently, so a pipeline that mounts either primitive before (or without) middleware() will bypass the origin check for those requests.

Details

security.checkOrigin (default: true) is intended to reject cross-site POST/PUT/PATCH/DELETE form submissions. In the classic pipeline (astro() all-in-one), the check always runs because Astro injects a virtual middleware module even when the user has no src/middleware.ts. In the composable astro/hono pipeline, the user assembles primitives manually. The check is only installed inside middleware() — so:

• Mounting actions() before middleware() allows cross-origin form-encoded action requests to execute before the gate runs. The examples/advanced-routing example and the Cloudflare hono docs shipped this order.
• Omitting middleware() entirely (reasonable for apps with no custom middleware) silently drops checkOrigin protection for all on-demand endpoints and pages dispatched through pages().

The attack is a blind write-only CSRF: the attacker can trigger a state-mutating action or endpoint handler using the victim's cookies, but cannot read the cross-origin response body.

Affected versions

Astro >= 7.0.0 when using the composable astro/hono pipeline with either:

• actions() mounted before middleware(), or
• pages() used without middleware()

The default (non-composable) pipeline is not affected.

Fix

The origin check is now applied at each dispatch sink (ActionHandler.handle and PagesHandler.handleWithErrorFallback), gated on manifest.checkOrigin, using the same predicate as the middleware. The check is order-independent and a no-op when middleware() has already run.

Fix: #17250

Workaround

Ensure middleware() is mounted before both actions() and pages() in the composable pipeline, and that it is always included even when no custom middleware logic is needed:

app.use(middleware());
app.use(actions());
app.use(pages());

🚨 Astro: Reflected XSS via unescaped View Transition animation properties

Summary

Astro's server-side View Transition CSS generator interpolates animation properties into an inline <style> element without escaping them for the CSS and HTML contexts.

An attacker-controlled value passed to an animation property such as duration can contain a </style> sequence, terminate the generated style element, and inject arbitrary HTML or JavaScript.

This is similar to GHSA-8hv8-536x-4wqp, but exploits a different injection point: unescaped View Transition animation values in a server-generated <style> element rather than an unescaped slot name in a hydration template.

Like GHSA-8hv8-536x-4wqp, exploitation requires an application to pass attacker-controlled data to an Astro API. However, the value is subsequently inserted into the HTML response without context-appropriate escaping by Astro.

Details

packages/astro/src/runtime/server/transition.ts

The generated stylesheet is wrapped in a <style> element and marked as HTML-safe:

const css = sheet.toString();
result._metadata.extraHead.push(markHTMLString(`<style>${css}</style>`));

Animation properties are added to the stylesheet without escaping:

if (anim.duration) {
  addAnimationProperty(builder, 'animation-duration', toTimeValue(anim.duration));
}

For string values, toTimeValue() returns the input unchanged:

export function toTimeValue(num: number | string) {
  return typeof num === 'number' ? num + 'ms' : num;
}

As a result, a duration value containing </style> can escape from the generated style element.

Other TransitionAnimation properties, including easing, direction, delay, fillMode, and name, are serialized by the same animation builder. The following PoC only relies on the official fade() helper and its duration option.

PoC

Using:

• astro@7.0.9
• @astrojs/node@11.0.2

astro.config.mjs

import node from '@astrojs/node';
import { defineConfig } from 'astro/config';
export default defineConfig({

output: 'server',

adapter: node({ mode: 'standalone' }),

});

src/pages/index.astro

---
import { fade } from 'astro:transitions';

const duration = Astro.url.searchParams.get('duration') ?? '300ms';
---
<html lang="en">

<head>

<meta charset="utf-8" />

<title>PoC</title>

</head>

<body>

<div transition:animate={fade({ duration })}>

Animated content

</div>

</body>

</html>

Payload:

open:

http://localhost:4321/?duration=%3C%2Fstyle%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E%3C!--

The browser interprets </style> as the end of the generated style element and executes the injected script. An alert dialog is displayed when the page is opened.

Impact

An attacker who can control a View Transition animation value can execute arbitrary JavaScript in the origin of the affected Astro application.

The query-based reflected XSS scenario affects on-demand/server-rendered routes, such as:

• projects configured with output: "server";
• pages using export const prerender = false;
• other server-side data flows that pass attacker-controlled values into a View Transition animation definition.

Successful exploitation may allow access to sensitive page data and authenticated actions available to the victim.

Suggested Fix

Animation values should be serialized using context-appropriate CSS escaping or validation before being added to the generated stylesheet.

Additionally, content inserted into a raw <style> element must not be able to contain an HTML end-tag sequence such as </style>. The final generated CSS should be made safe for the HTML raw-text context before it is passed to markHTMLString().

Release Notes

Too many releases to show here. View the full release notes.

↗️ @​astrojs/telemetry (indirect, 3.3.2 → 3.3.3) · Repo · Changelog

Release Notes

3.3.3 (from changelog)

Patch Changes

• #17323 4298883 Thanks @ematipico! - Refactors internal WSL detection by removing the is-wsl dependency.

• #17323 4298883 Thanks @ematipico! - Replaced which-pm-runs dependency with package-manager-detector

Does any of this look wrong? Please let us know.

↗️ nanoid (indirect, 3.3.12 → 3.3.16) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 13 commits:

• Release 3.3.16 version
• fix(non-secure): clamp negative size to prevent infinite loop (#601)
• Update CI action
• Do not create latest release for v3
• Release 3.3.15 version
• Fix tag for v3
• Back-port new release system and fix pre-commit hook
• Release 3.3.14 version
• Another way to deal with pool damage
• Reduce ID size
• Fix pnpm 11 support
• Release 3.3.13 version
• Ignore .claude in npm

↗️ postcss (indirect, 8.5.14 → 8.5.24) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 74 commits:

• Release 8.5.24 version
• Update dependencies
• Preserve the BOM when stringifying (#2119)
• Fix types check
• Release 8.5.23 version
• Update dependencies
• Does no load source map file without opts.from
• Typo
• Update EM banner
• Update EM banner
• Release 8.5.22 version
• Fix custom property losing its semicolon before a comment (#2117)
• Release 8.5.21 version
• Update dependencies
• Fix childless at-rule losing its semicolon before a comment (#2115)
• Fix mismatched JSDoc comments on Position (#2114)
• Release 8.5.20 version
• Fix missing space when AtRule#params is set after parsing (#2113)
• Update dependencies
• Move back to latest 11 pnpm
• Update pnpm to check that CI is fixed
• Rebuild nodes from another PostCSS copy in Warning (#2112)
• Improve CI security
• Remove patch after updating dependency
• Release 8.5.19 version
• Fix CI on Windows too
• Keep explicitly set raws.before when inserting nodes into root (#2111)
• Temporary fix CI
• Release 8.5.18 version
• Update dependencies
• Limit where source map can be loaded for security reasons
• Release 8.5.17 version
• Fix Maximum call stack size exceeded error
• Fix linter
• Fix CI
• Prevent prototype hijacking in fromJSON
• Update dependencies
• Fix non-closed `<div align="center">` in README (#2110)
• Remove old sponsors
• docs: fix invalid JS in writing-a-plugin examples (#2107)
• Fix `Input#origin()` mixing null and undefined for unmapped end position (#2106)
• Release 8.5.16 version
• Update formatting
• Fix `Input#origin()` returning incorrect position (#2036)
• Fix tests
• Don't clone root-less child nodes in container constructor (#2097)
• Revert version update to fix old Node.js on CI
• Update dependencies
• Preserve node raws when rehydrating a JSON AST (#2100)
• Fix Node#rangeBy() ignoring index 0 (#2091)
• Fix Node.js 26 tests
• Move to new publish process
• Update CI
• Move to Node.js 26 on CI
• Move to public Dev Container
• fix(node): always include offset in positionBy() like rangeBy() (#2099)
• Add postcss-nth-nested to plugins list (#2098)
• Add a version of Atlas Cloud banner (#2093)
• Release 8.5.15 version
• Update CI actions
• Speed up declaration parsing by avoiding creating new array on each token
• Fix code format
• Update dependencies
• Install older pnpm action for old Node.js
• Revert pnpm action for old Node.js
• Update CI actions
• Fix linter warnings
• Merge pull request #2088 from rootvector2/add-oss-fuzz-harness
• Address review: source-map dict tokens and oxfmt formatting
• Add OSS-Fuzz fuzzing harness under test/fuzzing/
• Remove image since WIkipedia stopped to serve it to third parties
• Fix to another link
• Fix image URL
• Fix CI

🆕 @​astrojs/compiler-binding (added, 0.3.1)

🆕 @​astrojs/compiler-binding-darwin-arm64 (added, 0.3.1)

🆕 @​astrojs/compiler-binding-darwin-x64 (added, 0.3.1)

🆕 @​astrojs/compiler-binding-linux-arm64-gnu (added, 0.3.1)

🆕 @​astrojs/compiler-binding-linux-arm64-musl (added, 0.3.1)

🆕 @​astrojs/compiler-binding-linux-x64-gnu (added, 0.3.1)

🆕 @​astrojs/compiler-binding-linux-x64-musl (added, 0.3.1)

🆕 @​astrojs/compiler-binding-wasm32-wasi (added, 0.3.1)

🆕 @​astrojs/compiler-binding-win32-arm64-msvc (added, 0.3.1)

🆕 @​astrojs/compiler-binding-win32-x64-msvc (added, 0.3.1)

🆕 @​astrojs/compiler-rs (added, 0.3.1)

🆕 @​astrojs/markdown-satteri (added, 0.3.4)

🆕 @​bruits/satteri-darwin-arm64 (added, 0.9.5)

🆕 @​bruits/satteri-darwin-x64 (added, 0.9.5)

🆕 @​bruits/satteri-linux-arm64-gnu (added, 0.9.5)

🆕 @​bruits/satteri-linux-arm64-musl (added, 0.9.5)

🆕 @​bruits/satteri-linux-x64-gnu (added, 0.9.5)

🆕 @​bruits/satteri-linux-x64-musl (added, 0.9.5)

🆕 @​bruits/satteri-wasm32-wasi (added, 0.9.5)

🆕 @​emnapi/core (added, 1.11.1)

🆕 @​emnapi/core (added, 2.0.0-alpha.3)

🆕 @​emnapi/wasi-threads (added, 1.2.2)

🆕 @​emnapi/wasi-threads (added, 2.0.1)

🆕 @​bruits/satteri-win32-arm64-msvc (added, 0.9.5)

🆕 @​bruits/satteri-win32-x64-msvc (added, 0.9.5)

🆕 @​napi-rs/wasm-runtime (added, 1.2.0)

🆕 @​oxc-project/types (added, 0.139.0)

🆕 @​rolldown/binding-android-arm64 (added, 1.1.5)

🆕 @​rolldown/binding-darwin-arm64 (added, 1.1.5)

🆕 @​rolldown/binding-darwin-x64 (added, 1.1.5)

🆕 @​rolldown/binding-freebsd-x64 (added, 1.1.5)

🆕 @​rolldown/binding-linux-arm-gnueabihf (added, 1.1.5)

🆕 @​rolldown/binding-linux-arm64-gnu (added, 1.1.5)

🆕 @​rolldown/binding-linux-arm64-musl (added, 1.1.5)

🆕 @​rolldown/binding-linux-ppc64-gnu (added, 1.1.5)

🆕 @​rolldown/binding-linux-s390x-gnu (added, 1.1.5)

🆕 @​rolldown/binding-linux-x64-gnu (added, 1.1.5)

🆕 @​rolldown/binding-linux-x64-musl (added, 1.1.5)

🆕 @​rolldown/binding-openharmony-arm64 (added, 1.1.5)

🆕 @​rolldown/binding-wasm32-wasi (added, 1.1.5)

🆕 @​rolldown/binding-win32-arm64-msvc (added, 1.1.5)

🆕 @​rolldown/binding-win32-x64-msvc (added, 1.1.5)

🆕 @​rolldown/pluginutils (added, 1.0.1)

🆕 @​tybys/wasm-util (added, 0.10.3)

🆕 @​types/estree-jsx (added, 1.0.5)

🆕 am-i-vibing (added, 0.4.0)

🆕 lightningcss (added, 1.33.0)

🆕 lightningcss-android-arm64 (added, 1.33.0)

🆕 lightningcss-darwin-arm64 (added, 1.33.0)

🆕 lightningcss-darwin-x64 (added, 1.33.0)

🆕 lightningcss-freebsd-x64 (added, 1.33.0)

🆕 lightningcss-linux-arm-gnueabihf (added, 1.33.0)

🆕 lightningcss-linux-arm64-gnu (added, 1.33.0)

🆕 lightningcss-linux-arm64-musl (added, 1.33.0)

🆕 lightningcss-linux-x64-gnu (added, 1.33.0)

🆕 lightningcss-linux-x64-musl (added, 1.33.0)

🆕 lightningcss-win32-arm64-msvc (added, 1.33.0)

🆕 lightningcss-win32-x64-msvc (added, 1.33.0)

🆕 process-ancestry (added, 0.1.0)

🆕 rolldown (added, 1.1.5)

🆕 satteri (added, 0.9.5)

🆕 @​astrojs/internal-helpers (added, 0.10.1)

🆕 @​emnapi/runtime (added, 1.11.1)

🆕 @​emnapi/runtime (added, 2.0.0-alpha.3)

🆕 @​emnapi/runtime (added, 1.11.3)

🆕 picomatch (added, 4.0.5)

🆕 cookie (added, 2.0.1)

🆕 tinyglobby (added, 0.2.17)

🆕 vite (added, 8.1.5)

🗑️ @​astrojs/markdown-remark (removed)

🗑️ array-iterate (removed)

🗑️ hast-util-raw (removed)

🗑️ hast-util-to-parse5 (removed)

🗑️ mdast-util-definitions (removed)

🗑️ parse-latin (removed)

🗑️ rehype (removed)

🗑️ rehype-raw (removed)

🗑️ rehype-stringify (removed)

🗑️ remark-rehype (removed)

🗑️ remark-smartypants (removed)

🗑️ retext (removed)

🗑️ retext-latin (removed)

🗑️ retext-stringify (removed)

🗑️ unist-util-modify-children (removed)

🗑️ unist-util-remove-position (removed)

🗑️ unist-util-visit-children (removed)

🗑️ which-pm-runs (removed)

🗑️ @​astrojs/compiler (removed)

🗑️ @​esbuild/aix-ppc64 (removed)

🗑️ @​esbuild/aix-ppc64 (removed)

🗑️ @​esbuild/android-arm (removed)

🗑️ @​esbuild/android-arm (removed)

🗑️ @​esbuild/android-arm64 (removed)

🗑️ @​esbuild/android-arm64 (removed)

🗑️ @​esbuild/android-x64 (removed)

🗑️ @​esbuild/android-x64 (removed)

🗑️ @​esbuild/darwin-arm64 (removed)

🗑️ @​esbuild/darwin-arm64 (removed)

🗑️ @​esbuild/darwin-x64 (removed)

🗑️ @​esbuild/darwin-x64 (removed)

🗑️ @​esbuild/freebsd-arm64 (removed)

🗑️ @​esbuild/freebsd-arm64 (removed)

🗑️ @​esbuild/freebsd-x64 (removed)

🗑️ @​esbuild/freebsd-x64 (removed)

🗑️ @​esbuild/linux-arm (removed)

🗑️ @​esbuild/linux-arm (removed)

🗑️ @​esbuild/linux-arm64 (removed)

🗑️ @​esbuild/linux-arm64 (removed)

🗑️ @​esbuild/linux-ia32 (removed)

🗑️ @​esbuild/linux-ia32 (removed)

🗑️ @​esbuild/linux-loong64 (removed)

🗑️ @​esbuild/linux-loong64 (removed)

🗑️ @​esbuild/linux-mips64el (removed)

🗑️ @​esbuild/linux-mips64el (removed)

🗑️ @​esbuild/linux-ppc64 (removed)

🗑️ @​esbuild/linux-ppc64 (removed)

🗑️ @​esbuild/linux-riscv64 (removed)

🗑️ @​esbuild/linux-riscv64 (removed)

🗑️ @​esbuild/linux-s390x (removed)

🗑️ @​esbuild/linux-s390x (removed)

🗑️ @​esbuild/linux-x64 (removed)

🗑️ @​esbuild/linux-x64 (removed)

🗑️ @​esbuild/netbsd-arm64 (removed)

🗑️ @​esbuild/netbsd-arm64 (removed)

🗑️ @​esbuild/netbsd-x64 (removed)

🗑️ @​esbuild/netbsd-x64 (removed)

🗑️ @​esbuild/openbsd-arm64 (removed)

🗑️ @​esbuild/openbsd-arm64 (removed)

🗑️ @​esbuild/openbsd-x64 (removed)

🗑️ @​esbuild/openbsd-x64 (removed)

🗑️ @​esbuild/openharmony-arm64 (removed)

🗑️ @​esbuild/openharmony-arm64 (removed)

🗑️ @​esbuild/sunos-x64 (removed)

🗑️ @​esbuild/sunos-x64 (removed)

🗑️ @​esbuild/win32-arm64 (removed)

🗑️ @​esbuild/win32-arm64 (removed)

🗑️ @​esbuild/win32-ia32 (removed)

🗑️ @​esbuild/win32-ia32 (removed)

🗑️ @​esbuild/win32-x64 (removed)

🗑️ @​esbuild/win32-x64 (removed)

🗑️ esbuild (removed)

🗑️ esbuild (removed)

🗑️ @​emnapi/runtime (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	head-start	e88b11f	Jul 28 2026, 09:46 AM