chore(deps): update all non-major dependencies #463
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.9.4->0.9.54.3.7->4.3.124.0.12->4.0.149.38.0->9.39.124.8.1->24.10.18.46.1->8.47.05.14.6->5.16.09.38.0->9.39.11.3.1->1.5.016.4.0->16.5.010.18.3->10.23.00.34.4->0.34.53.28.0->3.30.08.46.1->8.47.0Release Notes
withastro/language-tools (@astrojs/check)
v0.9.5Patch Changes
d415d4e: When no errors or warnings are detected, display "0 errors" or "0 warnings" in a dimmed color on the console instead of red or yellow.withastro/astro (@astrojs/mdx)
v4.3.12Compare Source
Patch Changes
e1dd377Thanks @ematipico! - Removespicocolorsas dependency in favor of the forkpiccolore.v4.3.11Compare Source
Patch Changes
v4.3.10Compare Source
Patch Changes
#14715
3d55c5dThanks @ascorbic! - Adds support for client hydration ingetContainerRenderer()The
getContainerRenderer()function is exported by Astro framework integrations to simplify the process of rendering framework components when using the experimental Container API inside a Vite or Vitest environment. This update adds the client hydration entrypoint to the returned object, enabling client-side interactivity for components rendered using this function. Previously this required users to manually callcontainer.addClientRenderer()with the appropriate client renderer entrypoint.See the
container-with-vitestdemo for a usage example, and the Container API documentation for more information on using framework components with the experimental Container API.v4.3.9Patch Changes
e3175d9Thanks @GameRoMan! - Updatesviteversion to fix CVEv4.3.8Patch Changes
#14591
3e887ecThanks @matthewp! - Adds TypeScript support for thecomponentsprop on MDXContentcomponent when usingawait render(). Developers now get proper IntelliSense and type checking when passing custom components to override default MDX element rendering.#14598
7b45c65Thanks @delucis! - Reduces terminal text styling dependency size by switching fromkleurtopicocolorswithastro/astro (@astrojs/rss)
v4.0.14Compare Source
Patch Changes
e1dd377Thanks @ematipico! - Removespicocolorsas dependency in favor of the forkpiccolore.v4.0.13Compare Source
Patch Changes
7b45c65Thanks @delucis! - Reduces terminal text styling dependency size by switching fromkleurtopicocolorseslint/eslint (@eslint/js)
v9.39.1Compare Source
v9.39.0Compare Source
typescript-eslint/typescript-eslint (@typescript-eslint/parser)
v8.47.0Compare Source
This was a version bump only for parser to align it with other projects, there were no code changes.
You can read about our versioning strategy and releases on our website.
v8.46.4Compare Source
This was a version bump only for parser to align it with other projects, there were no code changes.
You can read about our versioning strategy and releases on our website.
v8.46.3Compare Source
This was a version bump only for parser to align it with other projects, there were no code changes.
You can read about our versioning strategy and releases on our website.
v8.46.2Compare Source
This was a version bump only for parser to align it with other projects, there were no code changes.
You can read about our versioning strategy and releases on our website.
withastro/astro (astro)
v5.16.0Compare Source
Minor Changes
#13880
1a2ed01Thanks @azat-io! - Adds experimental SVGO optimization support for SVG assetsAstro now supports automatic SVG optimization using SVGO during build time. This experimental feature helps reduce SVG file sizes while maintaining visual quality, improving your site's performance.
To enable SVG optimization with default settings, add the following to your
astro.config.mjs:To customize optimization, pass a SVGO configuration object:
For more information on enabling and using this feature in your project, see the experimental SVG optimization docs.
#14810
2e845feThanks @ascorbic! - Adds a hint for code agents to use the--yesflag to skip prompts when runningastro add#14698
f42ff9bThanks @mauriciabad! - Adds theActionInputSchemautility type to automatically infer the TypeScript type of an action's input based on its Zod schemaFor example, this type can be used to retrieve the input type of a form action:
#14574
4356485Thanks @jacobdalamb! - Adds new CLI shortcuts available when runningastro preview:o+enter: open the site in your browserq+enter: quit the previewh+enter: print all available shortcutsPatch Changes
#14813
e1dd377Thanks @ematipico! - Removespicocolorsas dependency in favor of the forkpiccolore.#14609
d774306Thanks @florian-lefebvre! - Improvesastro info#14796
c29a785Thanks @florian-lefebvre! - BREAKING CHANGE to the experimental Fonts API onlyUpdates the default
subsetsto["latin"]Subsets have been a common source of confusion: they caused a lot of files to be downloaded by default. You now have to manually pick extra subsets.
Review your Astro config and update subsets if you need, for example if you need greek characters:
import { defineConfig, fontProviders } from "astro/config" export default defineConfig({ experimental: { fonts: [{ name: "Roboto", cssVariable: "--font-roboto", provider: fontProviders.google(), + subsets: ["latin", "greek"] }] } })v5.15.9Compare Source
Patch Changes
#14786
758a891Thanks @mef! - Add handling of invalid encrypted props and slots in server islands.#14783
504958fThanks @florian-lefebvre! - Improves the experimental Fonts API build log to show the number of downloaded files. This can help spotting excessive downloading because of misconfiguration#14791
9e9c528Thanks @Princesseuh! - Changes the remote protocol checks for images to require explicit authorization in order to use data URIs.In order to allow data URIs for remote images, you will need to update your
astro.config.mjsfile to include the following configuration:#14787
0f75f6bThanks @matthewp! - Fixes wildcard hostname pattern matching to correctly reject hostnames without dotsPreviously, hostnames like
localhostor other single-part names would incorrectly match patterns like*.example.com. The wildcard matching logic has been corrected to ensure that only valid subdomains matching the pattern are accepted.#14776
3537876Thanks @ktym4a! - Fixes the behavior ofpassthroughImageServiceso it does not generate webp.Updated dependencies [
9e9c528,0f75f6b]:v5.15.8Compare Source
Patch Changes
#14772
00c579aThanks @matthewp! - Improves the security of Server Islands slots by encrypting them before transmission to the browser, matching the security model used for props. This improves the integrity of slot content and prevents injection attacks, even when component templates don't explicitly support slots.Slots continue to work as expected for normal usage—this change has no breaking changes for legitimate requests.
#14771
6f80081Thanks @matthewp! - Fix middleware pathname matching by normalizing URL-encoded pathsMiddleware now receives normalized pathname values, ensuring that encoded paths like
/%61dminare properly decoded to/adminbefore middleware checks. This prevents potential security issues where middleware checks might be bypassed through URL encoding.v5.15.7Compare Source
Patch Changes
#14765
03fb47cThanks @florian-lefebvre! - Fixes a case whereprocess.envwouldn't be properly populated during the build#14690
ae7197dThanks @fredriknorlin! - Fixes a bug where Astro's i18n fallback system withfallbackType: 'rewrite'would not generate fallback files for pages whose filename started with a locale key.v5.15.6Compare Source
Patch Changes
#14751
18c55e1Thanks @delucis! - Fixes hydration of client components when running the dev server and using a barrel file that re-exports both Astro and UI framework components.#14750
35122c2Thanks @florian-lefebvre! - Updates the experimental Fonts API to log a warning if families with a conflictingcssVariableare provided#14737
74c8852Thanks @Arecsu! - Fixes an error when usingtransition:persistwith components that use declarative Shadow DOM. Astro now avoids re-attaching a shadow root if one already exists, preventing"Unable to re-attach to existing ShadowDOM"navigation errors.#14750
35122c2Thanks @florian-lefebvre! - Updates the experimental Fonts API to allow for more granular configuration of remote font familiesA font family is defined by a combination of properties such as weights and styles (e.g.
weights: [500, 600]andstyles: ["normal", "bold"]), but you may want to download only certain combinations of these.For greater control over which font files are downloaded, you can specify the same font (ie. with the same
cssVariable,name, andproviderproperties) multiple times with different combinations. Astro will merge the results and download only the required files. For example, it is possible to download normal500and600while downloading only italic500:v5.15.5Compare Source
Patch Changes
#14712
91780cfThanks @florian-lefebvre! - Fixes a case where build'sprocess.envwould be inlined in the server output#14713
666d5a7Thanks @florian-lefebvre! - Improves fallbacks generation when using the experimental Fonts API#14743
dafbb1bThanks @matthewp! - ImprovesX-Forwardedheader validation to prevent cache poisoning and header injection attacks. Now properly validatesX-Forwarded-Proto,X-Forwarded-Host, andX-Forwarded-Portheaders against configuredallowedDomainspatterns, rejecting malformed or suspicious values. This is especially important when running behind a reverse proxy or load balancer.v5.15.4Compare Source
Patch Changes
#14703
970ac0fThanks @ArmandPhilippot! - Adds missing documentation for some public utilities exported fromastro:i18n.#14715
3d55c5dThanks @ascorbic! - Adds support for client hydration ingetContainerRenderer()The
getContainerRenderer()function is exported by Astro framework integrations to simplify the process of rendering framework components when using the experimental Container API inside a Vite or Vitest environment. This update adds the client hydration entrypoint to the returned object, enabling client-side interactivity for components rendered using this function. Previously this required users to manually callcontainer.addClientRenderer()with the appropriate client renderer entrypoint.See the
container-with-vitestdemo for a usage example, and the Container API documentation for more information on using framework components with the experimental Container API.#14711
a4d284dThanks @deining! - Fixes typos in documenting our error messages and public APIs.#14701
9be54c7Thanks @florian-lefebvre! - Fixes a case where the experimental Fonts API would filter available font files too aggressively, which could prevent the download of woff files when using the google providerv5.15.3Compare Source
Patch Changes
#14627
b368de0Thanks @matthewp! - Fixes skew protection support for images and font URLsAdapter-level query parameters (
assetQueryParams) are now applied to all image and font asset URLs, including:/_imageendpoint#14631
3ad33f9Thanks @KurtGokhan! - Adds theastro/jsx-dev-runtimeexport as an alias forastro/jsx-runtimev5.15.2Compare Source
Patch Changes
#14623
c5fe295Thanks @delucis! - Fixes a leak of server runtime code when importing SVGs in client-side code. Previously, when importing an SVG file in client code, Astro could end up adding code for rendering SVGs on the server to the client bundle.#14621
e3175d9Thanks @GameRoMan! - Updatesviteversion to fix CVEv5.15.1Compare Source
Patch Changes
18552c7Thanks @ematipico! - Fixes a regression introduced in Astro v5.14.7 that caused?urlimports to not work correctly. This release reverts #14142.v5.15.0Compare Source
Minor Changes
#14543
9b3241dThanks @matthewp! - Adds two new adapter configuration optionsassetQueryParamsandinternalFetchHeadersto the Adapter API.Official and community-built adapters can now use
client.assetQueryParamsto specify query parameters that should be appended to asset URLs (CSS, JavaScript, images, fonts, etc.). The query parameters are automatically appended to all generated asset URLs during the build process.Adapters can also use
client.internalFetchHeadersto specify headers that should be included in Astro's internal fetch calls (Actions, View Transitions, Server Islands, Prefetch).This enables features like Netlify's skew protection, which requires the deploy ID to be sent with both internal requests and asset URLs to ensure client and server versions match during deployments.
#14489
add4277Thanks @dev-shetty! - Adds a new Copy to Clipboard button to the error overlay stack trace.When an error occurs in dev mode, you can now copy the stack trace with a single click to more easily share it in a bug report, a support thread, or with your favorite LLM.
#14564
5e7cebbThanks @florian-lefebvre! - Updatesastro add cloudflareto scaffold more configuration filesRunning
astro add cloudflarewill now emitwrangler.jsoncandpublic/.assetsignore, allowing your Astro project to work out of the box as a worker.Patch Changes
#14591
3e887ecThanks @matthewp! - Adds TypeScript support for thecomponentsprop on MDXContentcomponent when usingawait render(). Developers now get proper IntelliSense and type checking when passing custom components to override default MDX element rendering.#14598
7b45c65Thanks @delucis! - Reduces terminal text styling dependency size by switching fromkleurtopicocolors#13826
8079482Thanks @florian-lefebvre! - Adds the option to specify in thepreloaddirective which weights, styles, or subsets to preload for a given font family when using the experimental Fonts API:Variable weight font files will be preloaded if any weight within its range is requested. For example, a font file for font weight
100 900will be included when400is specified in apreloadobject.v5.14.8Compare Source
Patch Changes
577d051Thanks @matthewp! - Fixes image path resolution in content layer collections to support bare filenames. Theimage()helper now normalizes bare filenames like"cover.jpg"to relative paths"./cover.jpg"for consistent resolution behavior between markdown frontmatter and JSON content collections.v5.14.7Compare Source
Patch Changes
#14582
7958c6bThanks @florian-lefebvre! - Fixes a regression that caused Actions to throw errors while loading#14567
94500bbThanks @matthewp! - Fixes the actions endpoint to return 404 for non-existent actions instead of throwing an unhandled error#14566
946fe68Thanks @matthewp! - Fixes handling malformed cookies gracefully by returning the unparsed value instead of throwingWhen a cookie with an invalid value is present (e.g., containing invalid URI sequences),
Astro.cookies.get()now returns the raw cookie value instead of throwing a URIError. This aligns with the behavior of the underlyingcookiepackage and prevents crashes when manually-set or corrupted cookies are encountered.#14142
73c5de9Thanks @P4tt4te! - Updates handling of CSS for hydrated client components to prevent duplicates#14576
2af62c6Thanks @aprici7y! - Fixes a regression that causedAstro.siteto always beundefinedingetStaticPaths()eslint/eslint (eslint)
v9.39.1Compare Source
v9.39.0Compare Source
ota-meshi/eslint-plugin-astro (eslint-plugin-astro)
v1.5.0Compare Source
Minor Changes
ffee791Thanks @ota-meshi! - chore: use tsdown and isolatedDeclarationsv1.4.0Compare Source
Minor Changes
#497
a109899Thanks @jp-knj! - feat: addastro/no-unsafe-inline-scriptsrule that disallow unsafe inline scripts#469
15053d9Thanks @renovate! - fix(deps): update dependency globals to v16Patch Changes
bb6a323Thanks @ota-meshi! - chore: use trusted publishingsindresorhus/globals (globals)
v16.5.0Compare Source
6d441caea31521pnpm/pnpm (pnpm)
v10.23.0: pnpm 10.23Compare Source
Minor Changes
--lockfile-onlyoption topnpm list#10020.Patch Changes
pnpm self-updateshould download pnpm from the configured npm registry #10205.pnpm self-updateshould always install the non-executable pnpm package (pnpm in the registry) and never the@pnpm/exepackage, when installing v11 or newer. We currently cannot ship@pnpm/exeaspkgdoesn't work with ESM #10190.pnpm add, if there's aengines.runtimesetting declared inpackage.json#10209.pnpm listandpnpm whynow display npm: protocol for aliased packages (e.g.,foo npm:[email protected]) #8660.pnpm store pruneshould not fail if the store contains Node.js packages #10131.Platinum Sponsors
Gold Sponsors
v10.22.0: pnpm 10.22Compare Source
Minor Changes
Added support for
trustPolicyExclude#10164.You can now list one or more specific packages or versions that pnpm should allow to install, even if those packages don't satisfy the trust policy requirement. For example:
Allow to override the
enginesfield on publish by thepublishConfig.enginesfield.Patch Changes
Platinum Sponsors
Gold Sponsors
v10.21.0Compare Source
v10.20.0Compare Source
Minor Changes
--alloption inpnpm --helpto list all commands #8628.Patch Changes
latestversion doesn't satisfy the maturity requirement configured byminimumReleaseAge, pick the highest version that is mature enough, even if it has a different major version #10100.createcommand should not verify patch info.managePackageManagerVersionstofalse, when switching to a different version of pnpm CLI, in order to avoid subsequent switches #10063.v10.19.0Compare Source
Minor Changes
You can now allow specific versions of dependencies to run postinstall scripts.
onlyBuiltDependenciesnow accepts package names with lists of trusted versions. For example:Related PR: #10104.
Added support for exact versions in
minimumReleaseAgeExclude#9985.You can now list one or more specific versions that pnpm should allow to install, even if those versions don’t satisfy the maturity requirement set by
minimumReleaseAge. For example:lovell/sharp (sharp)
v0.34.5Compare Source
Upgrade to libvips v8.17.3 for upstream bug fixes.
Add experimental support for prebuilt Linux RISC-V 64-bit binaries.
Support building from source with npm v12+, deprecate
--build-from-sourceflag.#4458
Add support for BigTIFF output.
#4459
@throwbi
Improve error messaging when only warnings issued.
#4465
Simplify ICC processing when retaining input profiles.
#4468
steveukx/git-js (simple-git)
v3.30.0Compare Source
Minor Changes
bc77774: Correctly identify current branch name when usinggit.statusin a cloned empty repo.Previously
git.statuswould report the current brancConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.