← All reportsPublic report

gatsbyjs/gatsby

React-based framework with performance, scalability, and security built in.

56k stars JavaScript View on GitHubprofiled 11d ago
Try GitZoid
2PRs this week
2Contributors
66Deps scanned
1Issues found
01 · Repo overview

How gatsby is put together

This is the Gatsby framework monorepo (gatsbyjs/gatsby), a large JavaScript/TypeScript Lerna + Yarn workspaces repository whose published packages live under packages/* (not individually indexed here). The repo also contains deprecated-packages/* (legacy plugins such as gatsby-admin, gatsby-image), e2e-tests/* suites driven by Cypress and Playwright, an integration-tests suite, starter templates under starters/, and a Peril (automated PR review) configuration. Root-level tooling coordinates building, linting, testing (Jest with a custom transformer and environment), versioning, and npm publishing of the many packages via Lerna. A GitHub Action at .github/actions/format-stale-output formats actions/stale output into Slack blocks for triage automation.

Languages

JavaScriptTypeScript

Frameworks

ReactGatsbyJestLernaCypressPlaywrightPeril

Infrastructure

CircleCI (.circleci/config.yml)Docker (.gitpod.Dockerfile)GitHub Actions (.github/actions/format-stale-output)Netlify deploy targets referenced in e2e configs

Major components

packages/* workspace packages

The core Gatsby framework packages built, tested, versioned, and published as a Lerna-managed monorepo.

deprecated-packages/

Legacy/deprecated packages (e.g., gatsby-admin, gatsby-image, gatsby-plugin-gatsby-cloud) kept in-tree with their own build and publish metadata.

e2e-tests/

End-to-end test sites (adapters, contentful, development-runtime, mdx, path-prefix, production-runtime) exercised with Cypress and Playwright against real Gatsby builds.

integration-tests/

Separate Jest-configured integration test suite run via the test:integration script.

starters/

Official Gatsby starter templates with README generation driven by markdown-magic transforms.

peril/

Peril automation rules/tests for automated pull-request checks, with its own Jest config rooted at ../peril.

.github/actions/format-stale-output

Composite/local GitHub Action that reformats actions/stale outputs into Slack block payloads for pullreminders/slack-action.

scripts/ (root tooling)

Release and maintenance scripts including check-versions, check-repo-fields, check-publish-access, clear-package-dir, changelog generation, and release-next-major.

Activity on the Gatsby repository has been light over the past few weeks, with just a couple of small maintenance changes. The work focused on keeping dependencies compatible and cleaning up documentation, rather than adding new features. Both changes are small housekeeping fixes that keep the project running smoothly for existing users.

Week by week

2026-08-17A single compatibility fix kept the Markdown plugin working on older versions of Node.latest1 change

Fix

Markdown plugin pinned to an older helper library

The Markdown transformer plugin now uses a specific version of its HTML-sanitizing dependency so it keeps working on computers running Node.js version 21 or earlier.

2026-07-20Documentation was tidied up by removing references to a discontinued service.1 change

Docs

Removed outdated Gatsby Cloud docs

The version support page no longer mentions Gatsby Cloud, a hosted service that is no longer part of current offerings, so readers aren't confused by stale information.

03 · Security check

Dependencies and code review

66 dependencies scanned

Dependency advisories

Security Watch

1 vulnerable package (2 advisories) across 66 scanned dependencies.

warninghigh · npmfixed in 3.15.0

js-yaml 3.14.1

2 advisories. Fixed in 3.15.0.

How it can be abusedAn attacker who gets maliciously crafted YAML into anything this project or its published packages load at build time, such as test fixtures or plugin configuration, can make the YAML parser burn CPU on merge-key chains and ordered-map resolution, stalling builds or CI. Only developers running those builds are affected; there is no runtime exposure for end users of built sites.

  • highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
  • highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required