Update all non-major dependencies - #313
Merged
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
September 9, 2026 20:45
02017ce to
f909e48
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
September 11, 2026 01:33
f909e48 to
b8cab36
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.3.0→7.3.1^0.41.1→^0.42.07.2.10→7.3.226.8.1-bookworm-slim→26.8.2-bookworm-slimWarning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
withastro/astro (@astrojs/markdown-remark)
v7.3.1Compare Source
Patch Changes
a548223Thanks @matthewp! - Fixes<script>/<style>rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a<script>/<style>child (e.g.<script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Useset:htmlto explicitly opt a dynamic value back into raw rendering.withastro/starlight (@astrojs/starlight)
v0.42.0Compare Source
Minor Changes
#3572
292fb17Thanks @HiDeoo! - Distributes package as JavaScript files with dedicated type declaration files instead of TypeScript source files.#4121
2623ae6Thanks @delucis! - Simplifies markup for Starlight’s mobile menu toggleMobileMenuTogglebutton orPageFramecomponents, you may need to adjust these for the new markup. The button is no longer wrapped in a<starlight-menu-button>custom element and no longer uses thearia-expandedattribute. Instead, you can use the.sl-menu-buttonclass name to target the button and the:popover-openpseudo-class to style the menu open state specifically.In the following example, custom styles for the menu button are updated for the new approach:
See
MobileMenuToggle.astroandPageFrame.astroon GitHub for the full source code of the updated components.#3572
292fb17Thanks @HiDeoo! - Removes thetaglineconfiguration option, which was never used.If your configuration included a
taglineoption, you can safely remove it without any replacement.#4134
6135f01Thanks @HiDeoo! - Updates internal@astrojs/mdx,@astrojs/markdown-satteri, andsatteridependencies.astrov7.2.10 or later@astrojs/markdown-satteri0.4.0 or later (if you use it)@astrojs/markdown-remark7.3.0 or later (if you use it)Please update Starlight and Astro together:
#4121
2623ae6Thanks @delucis! - Refactors Starlight’s mobile menu toggle to work when JavaScript fails or is disabledThis change also removes the
data-mobile-menu-expandedattribute, which was previously added to<body>while the mobile menu is open. If you have custom code that was depending on this attribute, you will need to update it to use a new selector to check if the mobile menu is open.In the following example, a custom background colour for the site header while the menu is open is updated for the new approach:
v0.41.11Compare Source
Patch Changes
#4167
32a5e29Thanks @HiDeoo! - Fixes a layout issue and anchor links appearing for hidden headings, e.g. footnote headings, whenmarkdown.headingLinksis enabled or the<AnchorHeading>component is used.#4148
cdfafd8Thanks @ematipico! - Optimizes sidebar data generation logic to speed up sites with large sidebarswithastro/astro (astro)
v7.3.2Compare Source
Patch Changes
#17896
a548223Thanks @matthewp! - Fixes<script>/<style>rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a<script>/<style>child (e.g.<script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Useset:htmlto explicitly opt a dynamic value back into raw rendering.#17931
c1a6a89Thanks @astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover#17908
42e9188Thanks @astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like/energy/en/aboutinto/esergy/en/about#17936
4b92ddcThanks @astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is presentUpdated dependencies [
a548223]:v7.3.1Compare Source
Patch Changes
0389640Thanks @ematipico! - Fixes an error that prevented projects usingastro:assetsfrom starting or buildingv7.3.0Compare Source
Minor Changes
#17767
ce7c91fThanks @astro-factory! - Adds--ignore-lockflag toastro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.#17818
c0b6581Thanks @florian-lefebvre! - Adds aloggerparameter to image services hooksCustom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in
loggerand respect your log level, instead of being written straight to the console:Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.
#17818
c0b6581Thanks @florian-lefebvre! - Addsloggerto the context object passed to cache providersCustom cache providers now receive Astro's runtime logger on the context passed to
onRequest(). Messages logged with it are routed through the destination configured inloggerand respect your log level, instead of being written straight to the console:Astro's built-in
memoryCache()provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.Patch Changes
#17818
c0b6581Thanks @florian-lefebvre! - Updates Astro's remaining internal warnings and errors to be written through the configured logger instead of directly to the console, when possible#17886
e747cbaThanks @matthewp! - Fixes the memory cache provider to skip responses withVary: CookieorVary: *#17885
916b738Thanks @Princesseuh! - Improves build performance for sites with a large number of pages coming from a large amount of different modules.#17795
15e2debThanks @matthewp! - Adds concurrent rendering support forexperimental.incrementalBuild, including when using@astrojs/cloudflareIncremental builds no longer disable caching when
build.concurrencyis greater than1. Projects that setbuild.concurrency: 1to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.#17879
21c34a6Thanks @matthewp! - Fixes missing styles, links, and scripts from content collection entries rendered inside server islands#17861
3193988Thanks @ethanstoner! - Fixes i18n fallback routes being generated with a corrupted path when the locale code also appears at the start of a later path segment. A page such assrc/pages/en/enterprise.astrowithfallback: { es: 'en' }produced the route/es/esterpriseinstead of/es/enterprise, so the fallback never matched the intended URL. Only the leading locale segment is rewritten now.nodejs/node (node)
v26.8.2: 2026-09-09, Version 26.8.2 (Current), @aduh95Compare Source
Notable Changes
616bd3fa26] - doc: deprecateServer.prototype._listen2innode:net(Antoine du Hamel) #65593ae1801eb55] - meta: refine the security vuln posture for experimental features (James M Snell) #6543809feba74c8] - deps: update Undici to 8.10.2 (Node.js GitHub Bot) #657887efdbe3eb9] - deps: update OpenSSL to 3.5.8 (Node.js GitHub Bot) #65542Commits
d8aedd6584] - build: skip dockit on riscv64 (Stewart X Addison) #622511899c274eb] - build: activate correct default flags for riscv64 (Stewart X Addison) #65708ec8a3be996] - build: derive NODE_ARCH from target_cpu in the GN build (Shelley Vohr) #65491b73118a507] - build,win: remove LTO parallelisation limit (Stefan Stojanovic) #6553509feba74c8] - deps: update undici to 8.10.2 (Node.js GitHub Bot) #65788e47c432dd6] - deps: upgrade npm to 11.19.1 (npm team) #655732fd6ce36a9] - deps: update corepack to 0.36.0 (Node.js GitHub Bot) #6565349dec2767a] - deps: update googletest to36ba75f(Node.js GitHub Bot) #65654676174a071] - deps: update simdjson to 4.6.9 (Node.js GitHub Bot) #656552f1b7fa0bb] - deps: update perfetto to 58.2 (Node.js GitHub Bot) #6565612acd0ad15] - deps: update zlib to 1.3.2.1-motley-5eb4d7e (Node.js GitHub Bot) #6549448631c80fb] - deps: update archs files for openssl-3.5.8 (Node.js GitHub Bot) #655427efdbe3eb9] - deps: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) #65542bdc75900ee] - doc: replacenode:modulesdocumentation header (René) #6580044c8a499ba] - doc: clarify return type offs.mkdtemp*(Antoine du Hamel) #65743025fb5eeb0] - doc: updatechangelog-makerinstructions for releasing (Juan José) #657075f64847afa] - doc: add stability status tocrypto.setEngine(Antoine du Hamel) #65746299dee0cb9] - doc: remove outdated TLS authorized warning (Tim Perry) #65597e97dcc0278] - doc: fix brokenusinglink in ffi.md (Soul Lee) #656322c9cc7d237] - doc: fix some broken links (Antoine du Hamel) #655830c330ec329] - doc: fix stale TOC in maintaining-dependencies (greenhead) #655239c522a3a69] - doc: refactor the AI guidelines (Joyee Cheung) #6526946cbf1bf8c] - doc: fix triggerAsyncId() comment in async_hooks example (soreavis) #64583788904ff78] - doc: fix fsPromises.watch overflow value (Matt Radbourne) #646053d06ff19e8] - doc: clarify stream direction in options.stdio note (Avocado) #65236d334838379] - doc: clarify signal listener behavior (Som Samantray) #65243d55a2bd56a] - doc: add test reporter event lifecycle diagram (sangwook) #63780c17dfc87de] - doc: discourage AbortSignal cleanup for long-lived resources (Efe Karasakal) #64342616bd3fa26] - doc: deprecateServer.prototype._listen2innode:net(Antoine du Hamel) #655934e6d7e0ca6] - meta: cleanup targos emeritus changes (Antoine du Hamel) #65738a70cfe1747] - meta: bump github/codeql-action/init from 4.37.3 to 4.37.9 (dependabot[bot]) #65714e43a0ad4ce] - meta: bump github/codeql-action/autobuild from 4.37.3 to 4.37.9 (dependabot[bot]) #6571799e06288f1] - meta: bump actions/checkout from 7.0.0 to 7.0.1 (dependabot[bot]) #6571889662762b3] - meta: bump cachix/install-nix-action from 31.11.0 to 31.11.1 (dependabot[bot]) #657196b8f078672] - meta: bump actions/setup-node from 6.4.0 to 7.0.0 (dependabot[bot]) #657206c6fb18e63] - meta: bump step-security/harden-runner from 2.20.0 to 2.21.0 (dependabot[bot]) #657210e002e859f] - meta: bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.9 (dependabot[bot]) #6572298aaffe4b9] - meta: bump github/codeql-action/analyze from 4.37.3 to 4.37.9 (dependabot[bot]) #65723d247cb2975] - meta: document collaborator automation (Filip Skokan) #65671ae1801eb55] - meta: refine the security vuln posture for experimental features (James M Snell) #65438fab81d15c3] - test: widen the gap in the resolver maxTimeout comparison (Shelley Vohr) #6578062e2a6265c] - test: fix the thread-spawn handshake in the WASI threads fixture (Shelley Vohr) #657807eb20b1810] - test: only count restarts after the write in watch emit-restarted test (Shelley Vohr) #6578014c3a77bc5] - test: ignore tunnel resets in proxy invalid-char-in-url test (Shelley Vohr) #65780ebc99e0560] - test: handle EPIPE in closed channel test (Christian Aurich) #657705e73a2ca79] - test: deflake test-permission-net-udp-handle (Christian Aurich) #65767beb669f7de] - test: deflake test-runner-coverage (Christian Aurich) #65728ef4b6bfa62] - test: set type=none on IBM i for empty source (Abdirahim Musse) #65545027eef0691] - test: deflake WASI poll timing checks (Filip Skokan) #65672a352b0e2fe] - test: skipfs-watch-recursive-delete-raceon AIX (Antoine du Hamel) #65698f9ce35aa43] - test: deflake test-inspect-async-hook-setup-at-inspect (Christian Aurich) #6558432281cec7b] - test: deflake test-watch-mode-restart-esm-loading-error (Christian Aurich) #6562379be5d61be] - test: avoid orphaned child on Windows abort test (Kirill Saied) #654518972b8540b] - test: fix link-local dgram scope assertion (Filip Skokan) #65629b7cd1d96de] - test: riscv64: skip node-api sea test (Stewart X Addison) #655697eeb9d0e57] - test: mark platform-specific tests as flaky (Filip Skokan) #65562649ac82bda] - test: account for varied OpenSSL CCM final behaviours (Filip Skokan) #65542050fb1a15d] - tools: bump @humanfs/node from 0.16.7 to 0.16.8 in /tools/eslint (dependabot[bot]) #657575314dda396] - tools: bump browserslist from 4.28.4 to 4.28.8 in /tools/eslint (dependabot[bot]) #657585938a08929] - tools: do not hardcodeyamllintpath (Antoine du Hamel) #65747d8408f7415] - tools: refine contributor guidance workflow (Filip Skokan) #65745196e372b69] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #657167e986b09f6] - tools: do not flag force push as invalid message (Antoine du Hamel) #65700837ce2ccef] - tools: do not hardcode path to Ruff (Antoine du Hamel) #656811c7149a96a] - tools: retry first-time contributor query (Filip Skokan) #65648bd310a2bea] - tools: query first-time contributor status (Filip Skokan) #65592ab7b57e547] - tools: offset GitHub crons by 3 minutes (Michaël Zasso) #6561262ece28eae] - tools: label PRs lacking second approval (Filip Skokan) #6553868227b4029] - tools: welcome first-time contributors (Filip Skokan) #65533490dc93e37] - tools: enable concurrency for eslint (Huáng Jùnliàng) #62352d794676217] - typings: fix fs_event_wrap start filename type (leah-1ee) #6566129e2b5a325] - typings: add fs_event_wrap internal binding types (leah-1ee) #656616357c8f56e] - typings: add stream_pipe internal binding types (Seongeun Lee) #65664569720ac7f] - typings: add profiler internal binding types (Seongeun Lee) #6566052ae89c69d] - typings: add ffi internal binding types (Donghoon Kang) #6573422c7469062] - typings: update zlib binding declarations (이혜미) #65639Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.