gatsbyjs/gatsby
React-based framework with performance, scalability, and security built in.
How gatsby is put together
This is the Gatsby framework monorepo (gatsbyjs/gatsby), a large JavaScript/TypeScript Lerna + Yarn workspaces repository whose published packages live under packages/* (not individually indexed here). The repo also contains deprecated-packages/* (legacy plugins such as gatsby-admin, gatsby-image), e2e-tests/* suites driven by Cypress and Playwright, an integration-tests suite, starter templates under starters/, and a Peril (automated PR review) configuration. Root-level tooling coordinates building, linting, testing (Jest with a custom transformer and environment), versioning, and npm publishing of the many packages via Lerna. A GitHub Action at .github/actions/format-stale-output formats actions/stale output into Slack blocks for triage automation.
Languages
Frameworks
Infrastructure
Major components
packages/* workspace packages
The core Gatsby framework packages built, tested, versioned, and published as a Lerna-managed monorepo.
deprecated-packages/
Legacy/deprecated packages (e.g., gatsby-admin, gatsby-image, gatsby-plugin-gatsby-cloud) kept in-tree with their own build and publish metadata.
e2e-tests/
End-to-end test sites (adapters, contentful, development-runtime, mdx, path-prefix, production-runtime) exercised with Cypress and Playwright against real Gatsby builds.
integration-tests/
Separate Jest-configured integration test suite run via the test:integration script.
starters/
Official Gatsby starter templates with README generation driven by markdown-magic transforms.
peril/
Peril automation rules/tests for automated pull-request checks, with its own Jest config rooted at ../peril.
.github/actions/format-stale-output
Composite/local GitHub Action that reformats actions/stale outputs into Slack block payloads for pullreminders/slack-action.
scripts/ (root tooling)
Release and maintenance scripts including check-versions, check-repo-fields, check-publish-access, clear-package-dir, changelog generation, and release-next-major.
A single compatibility fix kept the Markdown plugin working on older versions of Node.
Activity on the Gatsby repository has been light over the past few weeks, with just a couple of small maintenance changes. The work focused on keeping dependencies compatible and cleaning up documentation, rather than adding new features. Both changes are small housekeeping fixes that keep the project running smoothly for existing users.
Week by week
2026-08-17A single compatibility fix kept the Markdown plugin working on older versions of Node.latest1 change
Fix
Markdown plugin pinned to an older helper library
The Markdown transformer plugin now uses a specific version of its HTML-sanitizing dependency so it keeps working on computers running Node.js version 21 or earlier.
2026-07-20Documentation was tidied up by removing references to a discontinued service.1 change
Docs
Removed outdated Gatsby Cloud docs
The version support page no longer mentions Gatsby Cloud, a hosted service that is no longer part of current offerings, so readers aren't confused by stale information.
Dependencies and code review
Dependency advisories
Security Watch
1 vulnerable package (2 advisories) across 66 scanned dependencies.
js-yaml 3.14.1
2 advisories. Fixed in 3.15.0.
How it can be abusedAn attacker who gets maliciously crafted YAML into anything this project or its published packages load at build time, such as test fixtures or plugin configuration, can make the YAML parser burn CPU on merge-key chains and ordered-map resolution, stalling builds or CI. Only developers running those builds are affected; there is no runtime exposure for end users of built sites.
- highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
- highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required