npm / @astrojs/rss
@astrojs/rss
What changed in @astrojs/rss 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
3 breaking3 security1 fixes and other
@astrojs/rss 47 changes
Breaking changes 3
Updated to Astro 6 beta, which may affect compatibility for projects using this integration.
Validation now uses Zod v4.
Removes picocolors as a dependency in favor of the piccolore fork.
Security 3
@astrojs/rss: XML Injection via Unescaped RSS Feed Fields
The enclosure item field is escaped and serialized as structured XML so special characters are treated as text rather than markup.
Unpinned fast-xml-parser to ^5.5.7 to resolve entity expansion CVEs.
Fixes and other changes 1
The package now uses zod as its own dependency instead of relying on astro/zod.