[dependabot]

Bumps the docs-security group with 1 update in the /docs directory: astro.

Updates astro from 7.4.2 to 7.4.12

Release notes

Sourced from astro's releases.

astro@7.4.12

Patch Changes

• #18409 2917650 Thanks @​matthewp! - Fixes a typo in the error message shown when a font cssVariable is invalid

• #18709 6f1a2a8 Thanks @​ematipico! - Reduces memory usage during astro build by releasing content collection entries from memory once the content layer sync is complete.

• #18713 59052e7 Thanks @​delucis! - Unpins @astrojs/* dependencies to allow versions matching the ^ range to be installed

• Updated dependencies [59052e7]:

  • @​astrojs/markdown-satteri@​0.4.10
  • @​astrojs/vite-plugin-astro@​0.1.3

astro@7.4.11

Patch Changes

• #18641 08e2cee Thanks @​astro-factory! - Validates the protocol, host and port from X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port together against each security.allowedDomains entry, instead of one at a time:

  • A forwarded protocol is only applied when an entry allows it for the host in use.
  • A forwarded port is only applied when the entry for that host lists it.
  • A forwarded host without a forwarded protocol is validated with the protocol of the server.
  • An entry with port: '443' (or '80' for http) now matches a host that doesn't include a port.

• #18651 93a9057 Thanks @​umeraamir69! - Returns 400 Bad Request for malformed percent-encoded paths in the dev server and static preview instead of bubbling into a 500

• #18672 e901468 Thanks @​astro-factory! - Fixes astro check reporting @astrojs/check as missing when the package is installed but throws while loading. The original error is now shown instead of an install prompt.

• #18641 08e2cee Thanks @​astro-factory! - Fixes security.allowedDomains accepting non-HTTP(S) X-Forwarded-Proto values (such as ftp or ws) when the list mixes patterns with and without a protocol

• #18686 62bb716 Thanks @​astro-factory! - Fixes astro build deleting the license file generated by Vite's build.license option. Astro now removes only its own Vite manifest from the .vite/ output folder.

• #18629 e9916e1 Thanks @​decrek! - Fixes spreading an object onto an element with scoped styles changing that object. When the same object was spread on every render, for example a constant imported from another module, its class grew with every request.

• #18641 08e2cee Thanks @​astro-factory! - Tightens how security.allowedDomains validates the Host and X-Forwarded-Host headers. Only a plain hostname with an optional port is accepted, and the validated host is applied to Astro.url exactly as it was matched.

• Updated dependencies [d13beeb, e9916e1]:

  • @​astrojs/markdown-satteri@​0.4.9
  • @​astrojs/runtime@​0.1.1
  • @​astrojs/vite-plugin-astro@​0.1.2

astro@7.4.10

Patch Changes

• #18621 8a61493 Thanks @​marcalexiei! - Fixes the dev toolbar's audit freezing an image's CSS animations in Safari, by reading the image's size from the request that loaded it instead of fetching it again

• #18691 f787792 Thanks @​ematipico! - Improves startup time of astro commands by loading SVGO only when svgoOptimizer() optimizes an SVG, instead of whenever astro/config is imported

• #18678 ea63d76 Thanks @​astro-factory! - Fixes duplicate CSS loading for hydrated islands that share modules or are imported through a path alias. The client build no longer emits and preloads stylesheets that are already linked on the page by the server build.

• Updated dependencies [57137ed]:

  • @​astrojs/internal-helpers@​0.13.2
  • @​astrojs/markdown-satteri@​0.4.8
  • @​astrojs/vite-plugin-astro@​0.1.1

... (truncated)

Changelog

Sourced from astro's changelog.

7.4.12

Patch Changes

• #18409 2917650 Thanks @​matthewp! - Fixes a typo in the error message shown when a font cssVariable is invalid

• #18709 6f1a2a8 Thanks @​ematipico! - Reduces memory usage during astro build by releasing content collection entries from memory once the content layer sync is complete.

• #18713 59052e7 Thanks @​delucis! - Unpins @astrojs/* dependencies to allow versions matching the ^ range to be installed

• Updated dependencies [59052e7]:

  • @​astrojs/markdown-satteri@​0.4.10
  • @​astrojs/vite-plugin-astro@​0.1.3

7.4.11

Patch Changes

• #18641 08e2cee Thanks @​astro-factory! - Validates the protocol, host and port from X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port together against each security.allowedDomains entry, instead of one at a time:

  • A forwarded protocol is only applied when an entry allows it for the host in use.
  • A forwarded port is only applied when the entry for that host lists it.
  • A forwarded host without a forwarded protocol is validated with the protocol of the server.
  • An entry with port: '443' (or '80' for http) now matches a host that doesn't include a port.

• #18651 93a9057 Thanks @​umeraamir69! - Returns 400 Bad Request for malformed percent-encoded paths in the dev server and static preview instead of bubbling into a 500

• #18672 e901468 Thanks @​astro-factory! - Fixes astro check reporting @astrojs/check as missing when the package is installed but throws while loading. The original error is now shown instead of an install prompt.

• #18641 08e2cee Thanks @​astro-factory! - Fixes security.allowedDomains accepting non-HTTP(S) X-Forwarded-Proto values (such as ftp or ws) when the list mixes patterns with and without a protocol

• #18686 62bb716 Thanks @​astro-factory! - Fixes astro build deleting the license file generated by Vite's build.license option. Astro now removes only its own Vite manifest from the .vite/ output folder.

• #18629 e9916e1 Thanks @​decrek! - Fixes spreading an object onto an element with scoped styles changing that object. When the same object was spread on every render, for example a constant imported from another module, its class grew with every request.

• #18641 08e2cee Thanks @​astro-factory! - Tightens how security.allowedDomains validates the Host and X-Forwarded-Host headers. Only a plain hostname with an optional port is accepted, and the validated host is applied to Astro.url exactly as it was matched.

• Updated dependencies [d13beeb, e9916e1]:

  • @​astrojs/markdown-satteri@​0.4.9
  • @​astrojs/runtime@​0.1.1
  • @​astrojs/vite-plugin-astro@​0.1.2

7.4.10

Patch Changes

• #18621 8a61493 Thanks @​marcalexiei! - Fixes the dev toolbar's audit freezing an image's CSS animations in Safari, by reading the image's size from the request that loaded it instead of fetching it again

• #18691 f787792 Thanks @​ematipico! - Improves startup time of astro commands by loading SVGO only when svgoOptimizer() optimizes an SVG, instead of whenever astro/config is imported

• #18678 ea63d76 Thanks @​astro-factory! - Fixes duplicate CSS loading for hydrated islands that share modules or are imported through a path alias. The client build no longer emits and preloads stylesheets that are already linked on the page by the server build.

• Updated dependencies [57137ed]:

... (truncated)

Commits

• 5b7c327 [ci] release (#18714)
• 6f1a2a8 fix(content): release the content layer after sync in builds (#18709)
• f9a1062 docs: correct build.client and build.server @​default to include trailing slas...
• 59052e7 Use workspace:^ for monorepo deps (#18713)
• d68e4f6 [ci] release (#18699)
• 2e83637 [ci] format
• 93a9057 fix(astro): return 400 for malformed paths in dev and static preview (#18651)
• 08e2cee Mixed allowedDomains patterns no longer accept non-http(s) X-Forwarded-Proto ...
• e9916e1 fix: don't mutate objects spread onto elements with scoped styles (#18629)
• e901468 Show real import errors instead of a false missing-package prompt in `astro c...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cloudflare-workers-and-pages]

Deploying podnotes with    Cloudflare Pages

Latest commit:	f08907b
Status:	✅  Deploy successful!
Preview URL:	https://80dceedc.podnotes.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-docs-lelw.podnotes.pages.dev

View logs

[cursor]

Docs-only security patch of astro 7.4.2 → 7.4.12. Diff is docs/package.json + docs/package-lock.json. Plugin runtime, main.js, and root lockfile are untouched. Title is docs(deps): and will not cut a plugin release.

Advisories this bump closes

• GHSA-mh32-jxcr-mh9f (low): XSS via attribute injection in dynamic tag names, patched in 7.4.5. This Starlight site uses static tags in custom components; set:html on hero title/tagline is author-controlled frontmatter, not user input.
• GHSA-r3h5-4585-7x3w (medium): @astrojs/node image endpoint path-case sibling read, patched in 7.4.7. Not applicable: docs are output: "static" with no Node adapter.

7.4.8–7.4.12 are patches (CLI yargs-parser → mri, extracted @astrojs/runtime / @astrojs/vite-plugin-astro, forwarded-header hardening, build-memory). None of the experimental/i18n/CSP/adapter surfaces are used. engines.node stays >=22.23.4, matching .nvmrc.

Verification (Node 22.23.4)

• npm ci --prefix docs frozen; lockfile not rewritten; astro@7.4.12
• astro build → 22 pages, internal links valid, 112 legacy fragments resolve
• npm audit --prefix docs 0
• GitHub Test, Docs, PR Title, Dependency Review, Cloudflare Pages green. CodeQL neutral (configurations not found on lockfile SHA); merge state UNSTABLE/MERGEABLE, same class as #528/#530/#533.

Approving and squash-merging.

  

_{Sent by Cursor Automation: Dependabot PRs}