Astro cache advisory recheck (2026-10-10)

This page rechecks the 2026-10-03 review. It is a dependency and source review, not a test against a deployed cache.

Upstream state

gh api /advisories/GHSA-ch52-4w7c-c8xp still lists http-cache-semantics <= 4.2.0 as vulnerable and gives no patched version. The advisory was last updated 2026-10-02.
Upstream fix PR #58 was closed without merging on 2026-10-04. The maintainer's comment disputes the report: data private to one user should use Cache-Control: private.
http-cache-semantics@4.3.0 was published on 2026-10-04. Comparing the published 4.2.0 and 4.3.0 index.js files shows changes only to Vary matching, inherited-property checks and a new response status() accessor. The max-stale branch in evaluateRequest() is unchanged. Because 4.3.0 falls outside the advisory's version range, npm audit would stop reporting it, but the behavior the advisory describes is unchanged.
astro@7.3.8 is current and depends on http-cache-semantics@^4.2.0. In its published dist, the library is imported only by assets/build/remote.js. That file calls only storable() and timeToLive() to compute remote-image expiry. It does not call satisfiesWithoutRevalidation() or evaluateRequest().

Decision

The repository and example lockfiles stay on astro@7.3.5 and http-cache-semantics@4.2.0. Moving to 4.3.0 would silence the audit finding without changing the reported behavior, which would be a misleading green check. Agent Native and its Astro examples never let http-cache-semantics answer requests from a shared cache. Astro, the only consumer, uses the library to compute how long remote images may be cached, not to decide whether a cached response may be reused.

This closes the Astro advisory gate for the 0.1.1 preview, with the following limits:

The core and browser package has no dependency on http-cache-semantics.
The Astro integration and examples use only build-time image expiry, which is outside the reported path.
An application that runs its own shared HTTP cache on http-cache-semantics must evaluate the max-stale behavior itself and mark per-user responses Cache-Control: private.

Recheck when the advisory changes its range, when Astro changes its use of the library, or before a provider launch guide is published.

Evidence commands:

gh api /advisories/GHSA-ch52-4w7c-c8xp
gh api repos/kornelski/http-cache-semantics/pulls/58 and its comments
npm view http-cache-semantics versions and npm view astro@7.3.8 dependencies.http-cache-semantics
npm pack of both http-cache-semantics versions, followed by a diff of index.js
npm pack astro@7.3.8, followed by grep for http-cache-semantics, satisfiesWithoutRevalidation and evaluateRequest under dist