8000 Respect remote image allowlists by matthewp · Pull Request #15569 · withastro/astro · GitHub
[go: up one dir, main page]

Skip to content

Respect remote image allowlists#15569

Merged
matthewp merged 2 commits into5-legacyfrom
advisory-fix-1-5-legacy
Feb 18, 2026
Merged

Respect remote image allowlists#15569
matthewp merged 2 commits into5-legacyfrom
advisory-fix-1-5-legacy

Conversation

@matthewp
Copy link
Contributor
@matthewp matthewp commented Feb 18, 2026

Changes

  • Enforce allowlists for remote inferSize and reject remote redirects in image fetch paths.
  • Add minimal tests for disallowed inferSize and redirect rejection.
  • Include a changeset.

Testing

  • New test cases added

Docs

  • N/A, bug fix

@changeset-bot
Copy link
changeset-bot bot commented Feb 18, 2026

🦋 Changeset detected

Latest commit: b055d88

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions github-actions bot added pkg: astro Related to the core `astro` package (scope) docs pr labels Feb 18, 2026
@withastro withastro deleted a comment from github-actions bot Feb 18, 2026
@withastro withastro deleted a comment from github-actions bot Feb 18, 2026
@matthewp matthewp merged commit e01e98b into 5-legacy Feb 18, 2026
64 of 66 checks passed
@matthewp matthewp deleted the advisory-fix-1-5-legacy branch February 18, 2026 19:26
@astrobot-houston astrobot-houston mentioned this pull request Feb 18, 2026
matthewp added a commit that referenced this pull request Feb 19, 2026
* Respect remote image allowlists

* Fix inferRemoteSize virtual module import
dadezzz pushed a commit to dadezzz/ice-notes that referenced this pull request Feb 22, 2026
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [astro](https://astro.build) ([source](https://github.com/withastro/astro/tree/HEAD/packages/astro)) | [`5.17.2` → `5.17.3`](https://renovatebot.com/diffs/npm/astro/5.17.2/5.17.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/astro/5.17.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/astro/5.17.2/5.17.3?slim=true) |

---

### Release Notes

<details>
<summary>withastro/astro (astro)</summary>

### [`v5.17.3`](https://github.com/withastro/astro/releases/tag/astro%405.17.3)

[Compare Source](https://github.com/withastro/astro/compare/astro@5.17.2...astro@5.17.3)

##### Patch Changes

- [#&#8203;15564](withastro/astro#15564) [`522f880`](withastro/astro@522f880) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.

- [#&#8203;15569](withastro/astro#15569) [`e01e98b`](withastro/astro@e01e98b) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Respect image allowlists when inferring remote image sizes and reject remote redirects.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNS44IiwidXBkYXRlZEluVmVyIjoiNDMuMjUuOCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: Renovate Bot <renovate@zarantonello.dev>
Co-committed-by: Renovate Bot <renovate@zarantonello.dev>
matthewp added a commit that referenced this pull request Feb 23, 2026
* Respect remote image allowlists (#15569)

* Respect remote image allowlists

* Fix inferRemoteSize virtual module import

* fix tests

* fix(tests): allow Unsplash host in layout fixture

* Update .changeset/tame-lemons-probe.md

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>

* Add back support for service override

---------

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>
@diogotcorreia
Copy link

I just updated from Astro 5.17.1 to 5.18.0 and my build started failing since some of the images I am using return a redirect. Would it be possible to have an option to restore the previous behavior?

It is also not obvious from the error message that this was the culprit, as it does not mention a redirect anywhere:

[FailedToFetchRemoteImageDimensions] Failed to get the dimensions for https://picsum.photos/id/28/1000/400.
  Hint:
    Verify your remote image URL is accurate, and that you are not using `inferSize` with a file located in your `public/` folder.
  Error reference:
    https://docs.astro.build/en/reference/errors/failed-to-fetch-remote-image-dimensions/

diogotcorreia added a commit to xperience-house/website that referenced this pull request Mar 5, 2026
This fixes a blocker to update Astro, as a regression in 5.17.3 prevents
remote images with a redirect from being used.

See withastro/astro#15569 (comment)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docs pr pkg: astro Related to the core `astro` package (scope)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

0