# Astro cache advisory recheck (2026-10-10)

This page rechecks the [2026-10-03 review](GHSA-ch52-4w7c-c8xp-2026-10-03.md). It is a dependency and source review, not a test against a deployed cache.

## Upstream state

- `gh api /advisories/GHSA-ch52-4w7c-c8xp` still lists `http-cache-semantics <= 4.2.0` as vulnerable and gives no patched version. The advisory was last updated 2026-10-02.
- Upstream fix [PR #58](https://github.com/kornelski/http-cache-semantics/pull/58) was closed without merging on 2026-10-04. The maintainer's comment disputes the report: data private to one user should use `Cache-Control: private`.
- `http-cache-semantics@4.3.0` was published on 2026-10-04. Comparing the published 4.2.0 and 4.3.0 `index.js` files shows changes only to `Vary` matching, inherited-property checks and a new response `status()` accessor. The `max-stale` branch in `evaluateRequest()` is unchanged. Because 4.3.0 falls outside the advisory's version range, `npm audit` would stop reporting it, but the behavior the advisory describes is unchanged.
- `astro@7.3.8` is current and depends on `http-cache-semantics@^4.2.0`. In its published `dist`, the library is imported only by `assets/build/remote.js`. That file calls only `storable()` and `timeToLive()` to compute remote-image expiry. It does not call `satisfiesWithoutRevalidation()` or `evaluateRequest()`.

## Decision

The repository and example lockfiles stay on `astro@7.3.5` and `http-cache-semantics@4.2.0`. Moving to 4.3.0 would silence the audit finding without changing the reported behavior, which would be a misleading green check. Agent Native and its Astro examples never let `http-cache-semantics` answer requests from a shared cache. Astro, the only consumer, uses the library to compute how long remote images may be cached, not to decide whether a cached response may be reused.

This closes the Astro advisory gate for the `0.1.1` preview, with the following limits:

- The core and browser package has no dependency on `http-cache-semantics`.
- The Astro integration and examples use only build-time image expiry, which is outside the reported path.
- An application that runs its own shared HTTP cache on `http-cache-semantics` must evaluate the `max-stale` behavior itself and mark per-user responses `Cache-Control: private`.

Recheck when the advisory changes its range, when Astro changes its use of the library, or before a provider launch guide is published.

Evidence commands:

- `gh api /advisories/GHSA-ch52-4w7c-c8xp`
- `gh api repos/kornelski/http-cache-semantics/pulls/58` and its comments
- `npm view http-cache-semantics versions` and `npm view astro@7.3.8 dependencies.http-cache-semantics`
- `npm pack` of both `http-cache-semantics` versions, followed by a `diff` of `index.js`
- `npm pack astro@7.3.8`, followed by `grep` for `http-cache-semantics`, `satisfiesWithoutRevalidation` and `evaluateRequest` under `dist`