Astro cache advisory recheck for 1.0.0 (2026-10-12)

This page rechecks the 2026-10-10 review for the 1.0.0 candidate.

• gh api advisories/GHSA-ch52-4w7c-c8xp: still severity high, vulnerable range <= 4.2.0, no patched version, not withdrawn, last updated 2026-10-02. Nothing changed since the previous review.
• npm view http-cache-semantics version: 4.3.0, published 2026-10-04, the same release the previous review compared.
• npm view astro version: 7.3.8, with http-cache-semantics@^4.2.0. In npm pack astro@7.3.8, only dist/assets/build/remote.js uses the library, through storable() and timeToLive() for build-time remote-image expiry. Nothing calls satisfiesWithoutRevalidation or evaluateRequest.
• npm audit --omit=dev on the package: zero vulnerabilities. The package has no runtime dependencies. The full tree reports only this advisory, through the astro@7.3.5 development and example dependency.

Decision: the previous decision holds for 1.0.0. Agent Native and its Astro examples never let http-cache-semantics answer requests from a shared cache. An application that runs its own shared HTTP cache on that library must evaluate max-stale itself and mark per-user responses Cache-Control: private.