# What changed in @astrojs/rss

> 7 changes in @astrojs/rss 4 from its official release notes, upgrade guides and advisories: 3 breaking, 3 security. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/@astrojs/rss/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @astrojs/rss 4

### Breaking changes

- Updated to Astro 6 beta, which may affect compatibility for projects using this integration. (4.0.16) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/rss%404.0.16)
- Validation now uses Zod v4. (4.0.16) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/rss%404.0.16)
- Removes picocolors as a dependency in favor of the piccolore fork. (4.0.14) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/rss%404.0.14)

### Security

- @astrojs/rss: XML Injection via Unescaped RSS Feed Fields (4.0.19) — [security advisory](https://github.com/advisories/GHSA-8J5Q-MFJ2-5Q9Q)
- The enclosure item field is escaped and serialized as structured XML so special characters are treated as text rather than markup. (4.0.19) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/rss%404.0.19)
- Unpinned fast-xml-parser to ^5.5.7 to resolve entity expansion CVEs. (4.0.18) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/rss%404.0.18)

### Fixes and other changes

- The package now uses zod as its own dependency instead of relying on astro/zod. (4.0.16) — [release notes](https://github.com/withastro/astro/releases/tag/%40astrojs/rss%404.0.16)