fix(deps): update all non-major dependencies#228
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #228 +/- ##
=======================================
Coverage 87.28% 87.28%
=======================================
Files 18 18
Lines 401 401
Branches 88 84 -4
=======================================
Hits 350 350
Misses 51 51 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
88b21ab to
b134b81
Compare
9162ac7 to
3f18a0a
Compare
487c3ac to
d0c9a1a
Compare
d828d01 to
007f6f5
Compare
4aa3f67 to
8e58e6b
Compare
9f2afb1 to
38b5d77
Compare
23a3910 to
7818201
Compare
968c62c to
ade3203
Compare
ade3203 to
bfafdd4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
22.7.2→22.7.522.7.2→22.7.522.7.2→22.7.522.7.2→22.7.525.9.1→25.9.44.1.7→4.1.94.1.7→4.1.96.3.7→6.4.810.4.0→10.5.05.5.5→5.5.622.7.2→22.7.511.1.2→11.8.03.8.3→3.8.4^0.34.5→^0.35.08.59.4→8.61.18.0.14→8.0.165.0.1→5.0.24.1.7→4.1.9Release Notes
nrwl/nx (@nx/eslint)
v22.7.5Compare Source
22.7.5 (2026-05-27)
🩹 Fixes
❤️ Thank You
v22.7.4Compare Source
22.7.4 (2026-05-25)
🩹 Fixes
❤️ Thank You
v22.7.3Compare Source
22.7.3 (2026-05-22)
🚀 Features
🩹 Fixes
projects: 'self'independsOnentries (#35686)$escaping in file paths on windows (#35692)❤️ Thank You
vitest-dev/vitest (@vitest/coverage-v8)
v4.1.9Compare Source
🐞 Bug Fixes
importOriginalwith optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #10546 (a5180)View changes on GitHub
v4.1.8Compare Source
🐞 Bug Fixes
cdpAPI whenallowWrite/allowExec: false[backport to v4] - by @hi-ogawa and Codex in #10450 (e4067)View changes on GitHub
vitest-dev/vitest (@vitest/ui)
v4.1.9Compare Source
v4.1.8Compare Source
🐞 Bug Fixes
cdpAPI whenallowWrite/allowExec: false[backport to v4] - by @hi-ogawa and Codex in #10450 (e4067)View changes on GitHub
withastro/astro (astro)
v6.4.8Compare Source
Patch Changes
27c80eaThanks @ematipico! - Harden the limits on the number of decoding on the URL.v6.4.7Compare Source
Patch Changes
#17035
197e50eThanks @astrobot-houston! - FixesgetRelativeLocaleUrl,getAbsoluteLocaleUrl, andgetAbsoluteLocaleUrlListto strip trailing slashes whentrailingSlash: 'never'is configured#16967
3719765Thanks @astrobot-houston! - Fixes double URL-encoded paths returning 400 Bad Request on on-demand routesPreviously, any URL containing a double-encoded character (like
%255B, which is[encoded twice) was unconditionally rejected with a400 Bad Requestbefore middleware or route handlers could run. This broke embedded tools like Sanity Studio whose client-side router legitimately produces double-encoded URLs.The fix replaces the rejection approach with iterative decoding — multi-level percent-encoding is now fully resolved to its canonical form before being passed to middleware and route matching. This preserves the security fix for CVE-2025-66202 (middleware authorization bypass via double encoding) because middleware now always sees the fully decoded path, making bypass impossible. For example,
/api/%2561dminis decoded to/api/admin, which middleware can correctly block.#17066
2f4d92aThanks @matthewp! - Fixes prerendered redirect targets being incorrectly bundled into the SSR function in hybrid mode, causing massive bundle size inflation#16882
621beb7Thanks @jettwayio! - fix(render): honour compressHTML when joining head elements#16892
8d753b0Thanks @astrobot-houston! - Fixes custom elements in MDX having their children'sslotattribute stripped by the JSX runtimeWhen custom elements (tags with hyphens like
<my-element>) are used in MDX files, theslotHTML attribute on their children is now correctly preserved. Previously, the shared JSX runtime would treatslotas an Astro slot assignment and remove it from the output, breaking Shadow DOM named slot distribution for web components.#16957
544ee76Thanks @thelazylamaGit! - Fixes stale inline CSS in server-rendered HTML after CSS file edits during devWhen editing a CSS file (
.css,.scss, etc.) during development, the inline<style>tags in server-rendered HTML would retain old CSS content instead of updating. This caused a brief flash of old CSS (FOUC) on fresh page loads before Vite's client-side HMR corrected the styles.The fix ensures that Astro's per-route dev CSS virtual modules are invalidated in both the SSR module graph and the module runner's evaluation cache when a style file changes, so the next page render picks up the fresh CSS.
#17044
2220d22Thanks @astrobot-houston! - Fixes CSS fromclient:onlyislands leaking to unrelated pages when Rollup bundles non-CSS-importing modules into the same chunk as CSS-importing modules#17040
7c4763dThanks @astrobot-houston! - Fixes HMR not triggering for files inside thesrc/middleware/directory during dev#16672
52fc862Thanks @martinheidegger! - Fixes support for numeric IDs in YAML frontmatter when using content collection references#16762
9de80aeThanks @alexanderdombroski! - Adds a JSON schema to the Wrangler configuration file generated when runningastro add cloudflare#17046
ef771ecThanks @ematipico! - Improves the diagnostics emitted when Astro parses incorrect.astrofiles.v6.4.6Compare Source
Patch Changes
#16765
b10e86eThanks @fkatsuhiro! - Fixes an issue where renaming an image file while the dev server is running triggers a build error. Now Astro correctly hot-reloads the image without crashing.#17026
add3df1Thanks @matthewp! - HardensaddAttributeto drop attribute names containing characters that are invalid per the HTML spec (",',>,/,=, whitespace)#17033
ffda27bThanks @matthewp! - Validates the request origin againstallowedDomainsbefore fetching prerendered error pages. WhenallowedDomainsis configured and the Host header matches, the original origin is used. Otherwise, the fetch falls back tolocalhost.v6.4.5Compare Source
Patch Changes
#16985
4ecff32Thanks @maximslo! - Fixes theexperimental.loggerdestination not being used for the "Server listening on..." startup message. The logger is now resolved before the server starts listening, andadapterLoggerre-creates itself when the underlying logger changes so the startup message uses the correct destination.#16947
e0703a6Thanks @ematipico! - FixesAstro.request.urlnot reflecting validatedX-Forwarded-Proto/X-Forwarded-Hostheaders whensecurity.allowedDomainsis configured. Previously, onlyAstro.urlwas updated with the forwarded origin whileAstro.request.urlretained the socket-derived URL, causing the two to diverge behind TLS-terminating proxies.#16997
dc45246Thanks @matthewp! - Reverts a change toisNoderuntime detection that caused a significant build time regression for Cloudflare adapter users with large prerendered sitesv6.4.4Compare Source
Patch Changes
#16926
1b39ae8Thanks @narendraio! - PreventsApp.match()from throwing on request paths that contain an invalid percent-sequence.#16924
2c0bc94Thanks @astrobot-houston! - Fixes an issue where editing a client-side component (e.g. withclient:idle,client:load, etc.) caused an unnecessary full program reload of the backend during development.#16958
2c1d50fThanks @fkatsuhiro! - Fixes a bug where static file endpoints usinggetStaticPathswith.htmlin dynamic param values (e.g.{ path: 'file.html' }) would fail with aNoMatchingStaticPathFounderror during build. The.htmlsuffix is no longer incorrectly stripped from endpoint route pathnames.#16855
c610cdaThanks @astrobot-houston! - Fixes dynamic routes returning 500 "TypeError: Missing parameter" when using domain-based i18n routing in SSR.#16946
606c37bThanks @ematipico! - FixesAstro.routePatternto preserve original casing of dynamic parameter names from filenames. Previously, a file atsrc/pages/blog/[postId].astrowould return/blog/[postid]forAstro.routePatterndue to an internal.toLowerCase()call. It now correctly returns/blog/[postId].#16720
16d49b6Thanks @thomas-callahan-collibra! - Fix an issue where dynamic routes would return the string[object Object]instead of the expected content, in certain runtimes.#16703
17390a6Thanks @henrybrewer00-dotcom! - Fixes styles being stripped when the project root is started with a path whose case differs from the actual filesystem case (e.g. runningastro devfromd:\dev\appwhile the folder on disk isD:\dev\app).#16855
c610cdaThanks @astrobot-houston! - FixesAstro.currentLocalereturning the default locale instead of the domain's locale on dynamic routes served from a mapped domain.v6.4.3Compare Source
Patch Changes
#16900
17a0fbdThanks @ocavue! - Bumpsdevaluedependency to v5.8.1#16016
0d85e1bThanks @felmonon! - Fix a false positive in the dev toolbar accessibility audit for anchors with text inside closed<details>elements.#16911
79c6c46Thanks @astrobot-houston! - Fixes a bug whereexperimental.advancedRoutingwithastro/honohandlers threwTypeError: Cannot read properties of undefined (reading 'route')for unmatched routes instead of rendering the custom 404 page.#16899
239c469Thanks @matthewp! - Fixes a false "does not call the middleware() handler" warning when usingastro()in a customsrc/app.tsand the first request is a redirect route.#16887
493acdbThanks @astrobot-houston! - FixesredirectToDefaultLocalenot working after the Advanced Routing refactoring.#16908
ef53ab9Thanks @florian-lefebvre! - Improves optimized fallbacks generation when using the Fonts API by using better metrics for bold variantsv6.4.2Patch Changes
#16889
b94bcfdThanks @Princesseuh! - Fixes aplugins is not iterablecrash when using a pre-6.0@astrojs/mdxalongside integrations (e.g. Starlight) that setmarkdown.remarkPlugins,markdown.rehypePlugins, ormarkdown.remarkRehype.#16878
b9f6bb9Thanks @fkatsuhiro! - Fixes an issue where on-demand (SSR) dynamic routes would return 404 when a prerendered dynamic route with the same URL pattern was sorted first alphabetically. In production builds with@astrojs/nodeadapter, if[a_prebuild].astro(prerender=true) came before[b_ssr].astroalphabetically, requests to URLs not in the prerendered route's static paths would 404 instead of falling through to the SSR route. The fix adds fallthrough logic so that when a prerendered dynamic route matches but can't serve the request, Astro tries subsequent matching routes.v6.4.1Patch Changes
eeb064cThanks @Princesseuh! - Restores theastro/jsx/rehype.jsentry point so that older versions of@astrojs/mdxcontinue to work when used with Astro 6.x. This entry point will be removed in Astro 7.0.v6.4.0Compare Source
Minor Changes
#16468
4cff3a1Thanks @matthewp! - Adds a newpreserveBuildServerDiradapter featureAdapters can now set
preserveBuildServerDir: truein their adapter features to keep thedist/server/directory structure for static builds, mirroring the existingpreserveBuildClientDiroption. This is useful for adapters that require a consistentdist/client/anddist/server/layout regardless of build output type.#16848
f732f3cThanks @Princesseuh! - Adds a newmarkdown.processorconfiguration option, allowing you to choose an alternative Markdown processor.Websites with many Markdown/MDX files tend to be slow to build because the unified ecosystem (e.g., remark, rehype) is slow to process. This feature introduces the ability to replace this part of the build pipeline with another processor.
The default processor is
unified(). This means that existing configurations remain unchanged and your remark/rehype plugins continue to work.In addition to this new configuration option, Astro provides a new alternative processor based on Rust: Sätteri. You can choose to use it now by installing
@astrojs/markdown-satteri, importing thesatteri()processor, and adapting your existing configuration:This processor does not support the remark and rehype plugins. This means you may need to convert them to MDAST or HAST plugins to retain your current functionality.
The existing top-level
markdown.remarkPlugins,markdown.rehypePlugins,markdown.remarkRehype,markdown.gfm, andmarkdown.smartypantsoptions still work, but are now deprecated and will be removed in a future major update. The matchingremarkPlugins,rehypePlugins, andremarkRehypeoptions on the MDX integration are also deprecated for the same reason. To anticipate their removal, move them ontounified({...})(or your preferred plugin processor) :// astro.config.mjs import { defineConfig } from 'astro/config'; import remarkToc from 'remark-toc'; import rehypeSlug from 'rehype-slug'; + import { unified } from '@​astrojs/markdown-remark'; export default defineConfig({ markdown: { + processor: unified({ + remarkPlugins: [remarkToc], + rehypePlugins: [rehypeSlug], + remarkRehype: true, + gfm: true, + smartypants: true, + }), - remarkPlugins: [remarkToc], - rehypePlugins: [rehypeSlug], - remarkRehype: true, - gfm: true, - smartypants: true, }, });For more information on enabling and using this feature in your project, see our Markdown guide. To give feedback on this new Rust processor, see the Native Markdown / MDX parsing and processing RFC.
Patch Changes
#16468
4cff3a1Thanks @matthewp! - Skips the static preview server when an adapter provides its ownpreviewEntrypoint, allowing the adapter to handle both static and dynamic routes#16811
e0e26dbThanks @matthewp! - FixesX-Forwarded-HostandX-Forwarded-Protoheaders being ignored when set in a customsrc/app.tsfetch handler before creatingFetchState#16468
4cff3a1Thanks @matthewp! - Fixes the static preview server to respectpreserveBuildClientDir, serving files frombuild.clientinstead ofoutDirwhen the adapter requires it#16770
1e2aa11Thanks @matthewp! - Fixes a race condition where the Vite dep optimizer could lose React dependencies in dev mode when using Astro Actions#16468
4cff3a1Thanks @matthewp! - Exempts internal routes (e.g. server islands) fromgetStaticPaths()validation, fixing server island rendering on static sites#16468
4cff3a1Thanks @matthewp! - Fixes preview for static sites that contain non-prerendered routes. Previously, the preview command ignored SSR routes discovered during route scanning and always used the static preview server.Updated dependencies [
f732f3c,f732f3c]:v6.3.8Compare Source
Patch Changes
#16830
f2bf3cbThanks @matthewp! - Fixes 404s for dynamically imported JS chunks when using an adapter withassetQueryParams(e.g. Vercel skew protection)#16831
ace96baThanks @astrobot-houston! - Fixes a misleadingGetStaticPathsRequirederror when a redirect is configured from a dynamic route to a static (or less-dynamic) destination. For example,'/project/[slug]': '/'previously produced a confusing error pointing atindex.astro. Astro now detects the parameter mismatch at config validation time and throws a clearInvalidRedirectDestinationerror naming the missing parameters.#16702
b7d1758Thanks @matthewp! - Fixes scoped styles from.astrocomponents being dropped when rendered inside MDX content (<Content />fromrender(entry)) passed through a named slot using<Fragment slot="X">. The Fragment component now eagerly evaluates its slot contents to ensure propagating components register their styles before head content is flushed.#16823
3df6a45Thanks @astrobot-houston! - Fixes missing CSS for conditionally rendered Svelte components in production builds#16836
3d7adfaThanks @LongYC! - Document compressHTML: "jsx" config is only available since Astro v6.2.0#16864
334ce13Thanks @cheets! - Fixes a false-positiveInternal Warning: route cache overwrittenlogged on every SSR request for dynamic routeseslint/eslint (eslint)
v10.5.0Compare Source
Features
5ca8c52feat: correct stack tracking in max-nested-callbacks (#20973) (Pixel998)b565783feat: report no-with violations at the with keyword (#20971) (Pixel998)2ce032ffeat: report max-lines-per-function violations at function head (#20966) (Pixel998)732cb3efeat: report max-nested-callbacks violations at function head (#20967) (Pixel998)f9c138afeat: report max-depth violations on keywords (#20943) (Pixel998)bdb496cfeat: correct max-depth handling for else-if chains (#20944) (Pixel998)c296873feat: update error loc inmax-statementsto function header (#20907) (Taejin Kim)Documentation
8ae1b5bdocs: Update README (GitHub Actions Bot)ca7eb90docs: update Node.js prerequisites to include ICU support (#20962) (Francesco Trotta)f99b47adocs: Update README (GitHub Actions Bot)acf03d4docs: clarify precedence of parserOptions over languageOptions (#20926) (sethamus)Chores
b18bf58chore: update ecosystem plugins (#20959) (ESLint Bot)c2d1444refactor: replace areAllSegmentsUnreachable with !isAnySegmentReachable (#20951) (Taejin Kim)243b8c5chore: enhance config-rule to support oneOf, anyOf, and nested schemas (#20788) (kuldeep kumar)217b2a9test: add unit tests for ParserService (#20949) (Taejin Kim)72003e7test: add location information to error messages inmax-statements(#20945) (lumir)7797c26refactor: deduplicate isAnySegmentReachable across rules (#20890) (Taejin Kim)67c46fachore: update ecosystem plugins (#20938) (ESLint Bot)95d8c7achore: update dependency @eslint/json to v2 (#20934) (renovate[bot])cf9e496chore: update @arethetypeswrong/cli to 0.18.3 (#20933) (Pixel998)fb6d396test: run type tests with TypeScript 7 (#20868) (sethamus)v10.4.1Compare Source
Bug Fixes
e557467fix: update@eslint/plugin-kitversion to 0.7.2 (#20930) (Francesco Trotta)d4ce898fix: propagate failures from delegated commands (#20917) (Minh Vu)f4f3507fix: prefer-arrow-callback invalid autofix with newline afterasync(#20916) (kuldeep kumar)c5bc78bfix: false positive for reference infinallyblock (#20655) (Tanuj Kanti)27538c0fix: add missing CodePath and CodePathSegment types (#20853) (Pixel998)Documentation
61b0adddocs: remove deprecated rule from related rules ofmax-params(#20921) (Tanuj Kanti)305d5b9docs: remove deprecated rules from related rules section (#20911) (Tanuj Kanti)49b0202docs: fixdisplay: noneof ad (#20901) (Tanuj Kanti)9067f94docs: switch build to Node.js 24 (#20893) (Milos Djermanovic)c91b041docs: Update README (GitHub Actions Bot)e349265docs: clarify semver strings in rule deprecation objects (#20885) (Milos Djermanovic)Chores
b0e466btest: adddataproperty to invalid tests cases for rules (#20924) (Tanuj Kanti)f78838btest: add CodePath type coverage (#20904) (Pixel998)1daa4bdchore: updateeslint-plugin-eslint-commentstest data to latest commit (#20922) (Francesco Trotta)002942cci: declare contents:read on update-readme workflow (#20919) (Arpit Jain)64bca24chore: update ecosystem plugins (#20912) (ESLint Bot)6d7c832chore: ignore fflate updates in renovate (#20908) (Pixel998)b2c8638ci: bump pnpm/action-setup from 6.0.7 to 6.0.8 (#20889) (dependabot[bot])a9b8d7fchore: increase maxBuffer for ecosystem tests (#20881) (sethamus)b702eadchore: update ecosystem update PR settings (#20884) (Pixel998)507f60echore: update ecosystem plugins (#20882) (ESLint Bot)92f5c5btest: add unit test for message-count (#20878) (kuldeep kumar)df32108chore: add @eslint/markdown and typescript-eslint ecosystem tests (#20837) (sethamus)327f91dchore: use includeIgnoreFile internally (#20876) (Kirk Waiblinger)f0dc4bdchore: pin fflate@0.8.2 (#20877) (Milos Djermanovic)0f4bd25ci: run Discord alert for ecosystem test failures (#20873) (Copilot)prettier/eslint-plugin-prettier (eslint-plugin-prettier)
v5.5.6Compare Source
Patch Changes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.