# Astro cache advisory recheck for 1.0.0 (2026-10-12)

This page rechecks the [2026-10-10 review](GHSA-ch52-4w7c-c8xp-2026-10-10.md) for the 1.0.0 candidate.

- `gh api advisories/GHSA-ch52-4w7c-c8xp`: still severity high, vulnerable range `<= 4.2.0`, no patched version, not withdrawn, last updated 2026-10-02. Nothing changed since the previous review.
- `npm view http-cache-semantics version`: 4.3.0, published 2026-10-04, the same release the previous review compared.
- `npm view astro version`: 7.3.8, with `http-cache-semantics@^4.2.0`. In `npm pack astro@7.3.8`, only `dist/assets/build/remote.js` uses the library, through `storable()` and `timeToLive()` for build-time remote-image expiry. Nothing calls `satisfiesWithoutRevalidation` or `evaluateRequest`.
- `npm audit --omit=dev` on the package: zero vulnerabilities. The package has no runtime dependencies. The full tree reports only this advisory, through the `astro@7.3.5` development and example dependency.

**Decision:** the previous decision holds for 1.0.0. Agent Native and its Astro examples never let `http-cache-semantics` answer requests from a shared cache. An application that runs its own shared HTTP cache on that library must evaluate `max-stale` itself and mark per-user responses `Cache-Control: private`.