unstale

npm / @astrojs/rss

@astrojs/rss

What changed in @astrojs/rss 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.

3 breaking3 security1 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.1.0 on npm

@astrojs/rss 47 changes

Breaking changes 3

  • Updated to Astro 6 beta, which may affect compatibility for projects using this integration.

    4.0.16release notes

  • Validation now uses Zod v4.

    4.0.16release notes

  • Removes picocolors as a dependency in favor of the piccolore fork.

    4.0.14release notes

Security 3

  • @astrojs/rss: XML Injection via Unescaped RSS Feed Fields

    4.0.19security advisory

  • The enclosure item field is escaped and serialized as structured XML so special characters are treated as text rather than markup.

    4.0.19release notes

  • Unpinned fast-xml-parser to ^5.5.7 to resolve entity expansion CVEs.

    4.0.18release notes

Fixes and other changes 1

  • The package now uses zod as its own dependency instead of relying on astro/zod.

    4.0.16release notes