chore(deps): update all non-major dependencies #16
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^12.6.4→^12.6.7^3.5.0→^3.5.1^1.2.63→^1.2.65^19.1.10→^19.2.7^19.1.7→^19.2.3^5.13.2→^5.16.8^0.14.0→^0.15.010.27.0→10.28.0^1.3.7→^1.4.0^1.0.2→^1.0.3^4.31.0→^4.58.0Release Notes
withastro/astro (@astrojs/cloudflare)
v12.6.12Compare Source
Patch Changes
#14777
9720b70Thanks @iclectic! - Updates assets handling to use@astrojs/internal-helpersUpdated dependencies []:
v12.6.11Compare Source
Patch Changes
9e9c528,0f75f6b]:v12.6.10Compare Source
Patch Changes
b8ca69bThanks @ascorbic! - Refactor remote path detectionUpdated dependencies [
b8ca69b]:v12.6.9Compare Source
Patch Changes
1e2499e]:v12.6.8Compare Source
Patch Changes
#14326
c24a8f4Thanks @jsparkdev! - Updatesviteversion to fix CVEUpdated dependencies []:
withastro/astro (@astrojs/sitemap)
v3.6.1Compare Source
Patch Changes
dd06779Thanks @florian-lefebvre! - Updates how routes are retrieved to avoid relying on a deprecated APIv3.6.0Compare Source
Minor Changes
#14285
bedc31bThanks @jdcolombo! - Adds a new configuration optionnamespacesfor more control over XML namespaces used in sitemap generationExcluding unused namespaces can help create cleaner, more focused sitemaps that are faster for search engines to parse and use less bandwidth. If your site doesn't have news content, videos, or multiple languages, you can exclude those namespaces to reduce XML bloat.
The
namespacesoption allows you to configurenews,xhtml,image, andvideonamespaces independently. All namespaces are enabled by default for backward compatibility and no change to existing projects is necessary. But now, you can choose to streamline your XML and avoid unnecessary code.For example, to exclude the video namespace from your sitemap, set
video: falsein your configuration:The generated XML will not include the
xmlns:videonamespace:withastro/astro (astro)
v5.16.8Compare Source
Patch Changes
#15124
81db3c0Thanks @leonace924! - Fixes an issue where requests with query parameters to thebasepath would return a 404 if trailingSlash was not'ignore'in development#15152
39ee41fThanks @rururux! - Fixes a case wherecontext.cookies.set()would be overriden when setting cookies via response headers in development#15140
6f6f8f8Thanks @cameronraysmith! - Fixes esbuild warning due to dead code in assets virtual module#15127
2cff904Thanks @Princesseuh! - Updates "Unsupported page types found" error to only appear in more realistic cases#15149
34f84c2Thanks @rahuld109! - Skips "Use the Image component" audit warning for images inside framework components (React, Vue, Svelte, etc.)v5.16.7Compare Source
Patch Changes
#15122
b137946Thanks @florian-lefebvre! - Improves JSDoc annotations forAstroGlobal,AstroSharedContextandAPIContexttypes#15123
3f58fa2Thanks @43081j! - Improves rendering performance by grouping render chunks when emitting from async iterables to avoid encoding costs#14954
7bec4bdThanks @volpeon! - Fixes remote imagesEtagheader handling by disabling internal cache#15052
b2bcd5aThanks @Princesseuh! - Fixes images not working in development when using setups with port forwarding#15028
87b19b8Thanks @Princesseuh! - Fixes certain aliases not working when using images in JSON files with the content layer#15118
cfa382bThanks @florian-lefebvre! - BREAKING CHANGE to the experimental Fonts API onlyRemoves the
defineAstroFontProvider()type helper.If you are building a custom font provider, remove any occurrence of
defineAstroFontProvider()and use theFontProvidertype instead:#15055
4e28db8Thanks @delucis! - Reduces Astro’s install size by around 8 MB#15088
a19140fThanks @martrapp! - Enables the ClientRouter to preserve the original hash part of the target URL during server side redirects.#15117
b1e8e32Thanks @florian-lefebvre! - BREAKING CHANGE to the experimental Fonts API onlyChanges the font format downloaded by default when using the experimental Fonts API. Additionally, adds a new
formatsconfiguration option to specify which font formats to download.Previously, Astro was opinionated about which font sources would be kept for usage, mainly keeping
woff2andwofffiles.You can now specify what font formats should be downloaded (if available). Only
woff2files are downloaded by default.What should I do?
If you were previously relying on Astro downloading the
woffformat, you will now need to specify this explicitly with the newformatsconfiguration option. Additionally, you may also specify any additional file formats to download if available:// astro.config.mjs import { defineConfig, fontProviders } from 'astro/config' export default defineConfig({ experimental: { fonts: [{ name: 'Roboto', cssVariable: '--font-roboto', provider: fontProviders.google(), + formats: ['woff2', 'woff', 'otf'] }] } })8115752Thanks @florian-lefebvre! - Fixes a vite warning log during builds when using npmv5.16.6Compare Source
Patch Changes
#14982
6849e38Thanks @Princesseuh! - Fixes images outside the project directory not working when using astro:assets in development mode#14987
9dd9fcaThanks @Princesseuh! - Fixes SVGs not working in dev mode when using the passthrough image service#15014
a178422Thanks @delucis! - Adds support for extending the type of the props accepted by Astro’s<Image>component,<Picture>component, andgetImage()API.v5.16.5Compare Source
Patch Changes
#14985
c016f10Thanks @florian-lefebvre! - Fixes a case where JSDoc annotations wouldn't show for fonts related APIs in the Astro config#14973
ed7cc2fThanks @amankumarpandeyin! - Fixes performance regression and OOM errors when building medium-sized blogs with many content entries. Replaced O(n²) object spread pattern with direct mutation ingenerateLookupMap.#14958
70eb542Thanks @ascorbic! - Gives a helpful error message if a user setsoutput: "hybrid"in their Astro config.The option was removed in Astro 5, but lots of content online still references it, and LLMs often suggest it. It's not always clear that the replacement is
output: "static", rather thanoutput: "server". This change adds a helpful error message to guide humans and robots.#14901
ef53716Thanks @Darknab! - Updates theglob()loader to log a warning when duplicated IDs are detectedUpdated dependencies [
d8305f8]:v5.16.4Compare Source
Patch Changes
#14940
2cf79c2Thanks @ematipico! - Fixes a bug where Astro didn't properly combine CSP resources from thecspconfiguration with those added using the runtime API (Astro.csp.insertDirective()) to form grammatically correct CSP headersNow Astro correctly deduplicate CSP resources. For example, if you have a global resource in the configuration file, and then you add a
a new one using the runtime APIs.
v5.16.3Compare Source
Patch Changes
#14889
4bceeb0Thanks @florian-lefebvre! - Fixes actions types when using specific TypeScript configurations#14929
e0f277dThanks @matthewp! - Fixes authentication bypass via double URL encoding in middlewarePrevents attackers from bypassing path-based authentication checks using multi-level URL encoding (e.g.,
/%2561dmininstead of/%61dmin). Pathnames are now validated after decoding to ensure no additional encoding remains.v5.16.2Compare Source
Patch Changes
#14876
b43dc7fThanks @florian-lefebvre! - Fixes a vite warning log during builds when using npm#14884
10273e0Thanks @florian-lefebvre! - Fixes a case where setting the status of a page to404in ssr would show an empty page (or404.astropage if provided) instead of using the current pagev5.16.1Compare Source
Patch Changes
#14769
b43ee71Thanks @adriandlam! - Fixes an unhandled rejection issue when using Astro with Vercel Workflow DevKit#14761
345eb22Thanks @ooga! - Updatesbuttonattributes types to allowcommandandcommandfor#14866
65e214bThanks @GameRoMan! - FixesAstro.globto be correctly marked as deprecated#14894
1ad9a5bThanks @delucis! - Fixes support for Astro component rendering in Vitest test suites using a “client” environment such ashappy-domorjsdom#14782
abed929Thanks @florian-lefebvre! - Improves syncingv5.16.0Compare Source
Minor Changes
#13880
1a2ed01Thanks @azat-io! - Adds experimental SVGO optimization support for SVG assetsAstro now supports automatic SVG optimization using SVGO during build time. This experimental feature helps reduce SVG file sizes while maintaining visual quality, improving your site's performance.
To enable SVG optimization with default settings, add the following to your
astro.config.mjs:To customize optimization, pass a SVGO configuration object:
For more information on enabling and using this feature in your project, see the experimental SVG optimization docs.
#14810
2e845feThanks @ascorbic! - Adds a hint for code agents to use the--yesflag to skip prompts when runningastro add#14698
f42ff9bThanks @mauriciabad! - Adds theActionInputSchemautility type to automatically infer the TypeScript type of an action's input based on its Zod schemaFor example, this type can be used to retrieve the input type of a form action:
#14574
4356485Thanks @jacobdalamb! - Adds new CLI shortcuts available when runningastro preview:o+enter: open the site in your browserq+enter: quit the previewh+enter: print all available shortcutsPatch Changes
#14813
e1dd377Thanks @ematipico! - Removespicocolorsas dependency in favor of the forkpiccolore.#14609
d774306Thanks @florian-lefebvre! - Improvesastro info#14796
c29a785Thanks @florian-lefebvre! - BREAKING CHANGE to the experimental Fonts API onlyUpdates the default
subsetsto["latin"]Subsets have been a common source of confusion: they caused a lot of files to be downloaded by default. You now have to manually pick extra subsets.
Review your Astro config and update subsets if you need, for example if you need greek characters:
import { defineConfig, fontProviders } from "astro/config" export default defineConfig({ experimental: { fonts: [{ name: "Roboto", cssVariable: "--font-roboto", provider: fontProviders.google(), + subsets: ["latin", "greek"] }] } })openapi-ts/openapi-typescript (openapi-fetch)
v0.15.0Compare Source
Minor Changes
8f96eb5Thanks @Kauabunga! - Enable request level middlewares optionv0.14.1Compare Source
Patch Changes
7527d1eThanks @jthacker! - Fix Request parameter being ignored by client methodspnpm/pnpm (pnpm)
v10.28.0Compare Source
Wombosvideo/tw-animate-css (tw-animate-css)
v1.4.0Compare Source
Changelog
902e37a: fix: remove support for prefix, add new export for prefixed version. Closes #58.fab2a5b: chore: bump version to 1.4.0 and update dependenciesc20dc32: fix(build): make transform.ts accept two argumentsSupport for Tailwind CSS's prefix option was moved to
tw-animate-css/prefixbecause it was breaking the--spacingfunction. Users requiring prefixes should replace their import:I do not plan to introduce breaking changes like this to non-major releases in the future. But because more people use spacing rather than prefixes, reverting the previous version's (obviously breaking) change seems reasonable.
v1.3.8Compare Source
Changelog
b5ff23a: fix: add support for global CSS variable prefix. Closes #4803e5f12: feat: add support for ng-primitives height variables #56 (thanks @immohammadjaved)b076cfb: docs: fix various issues in accordion and collapsible docs9485e33: chore: bump version to 1.3.8 and update dependenciesAdding support for prefixes broke custom spacing. It is recommended that you skip this version if you do not use Tailwind CSS's prefix option, and use v1.4.0 instead. If you are actually using prefixes, you can use a special version supporting prefixes:
I do not plan to fix the incompatibility between the spacing and prefix versions due to time constraints. Feel free to investigate and open a pull request if you manage to fix it.
luxass/unplugin-build-meta (unplugin-build-meta)
v1.0.5Compare Source
No significant changes
View changes on GitHub
cloudflare/workers-sdk (wrangler)
v4.58.0Compare Source
Minor Changes
#11728
7d63fa5Thanks @NuroDev! - Add command categories towranglerhelp menuThe help output now groups commands by product category (Account, Compute & AI, Storage & Databases, Networking & Security) to match the Cloudflare dashboard organization:
This improves discoverability by organizing the 20+ wrangler commands into logical groups.
Patch Changes
#11822
97e67b9Thanks @dependabot! - chore: update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
Updated dependencies [
97e67b9]:v4.57.0Compare Source
Minor Changes
#11682
b993d95Thanks @ascorbic! - Addwrangler auth tokencommand to retrieve your current authentication credentials.You can now retrieve your authentication token for use with other tools and scripts:
The command returns whichever authentication method is currently configured:
wrangler login(automatically refreshed if expired)CLOUDFLARE_API_TOKENenvironment variableUse
--jsonto get structured output including the token type, which also supports API key/email authentication:This is similar to
gh auth tokenin the GitHub CLI.#11702
f612b46Thanks @gpanders! - Add support for trusted_user_ca_keys in WranglerYou can now configure SSH trusted user CA keys for containers. Add the following to your wrangler.toml:
This allows you to specify CA public keys that can be used to verify SSH user certificates.
#11437
9e360f6Thanks @ichernetsky-cf! - Drop deprecated containersobservability.loggingfield#11616
fc95831Thanks @NuroDev! - Add type generation support towrangler devYou can now have your worker configuration types be automatically generated when the local Wrangler development server starts.
To use it you can either:
--typesflag when runningwrangler dev.dev.generate_typesboolean property.{ "$schema": "node_modules/wrangler/config-schema.json", "name": "example", "main": "src/index.ts", "compatibility_date": "2025-12-12", "dev": { "generate_types": true } }#11524
b0dbf1aThanks @penalosa! - Add hidden CLI flags towrangler setupfor suppressing outputTwo new hidden flags have been added to
wrangler setup:--no-completion-message: Suppresses the deployment details message after setup completes--no-install-wrangler: Skips Wrangler installation during project setup#11777
69979a3Thanks @MattieTK! - Add analytics properties to secret commands for better usage insightsSecret commands (
wrangler secret put,wrangler secret bulk, and their Pages/versions equivalents) now include additional analytics properties to help understand how secrets are being managed:secretOperation: Whether this is a "single" or "bulk" secret operationsecretSource: How the secret was provided ("interactive", "stdin", or "file")secretFormat: For bulk operations, the format used ("json" or "dotenv")hasEnvironment: Whether an environment was specifiedThese properties help improve the developer experience by understanding common usage patterns. No sensitive information (secret names, values, or counts) is tracked.
#11738
c54f8daThanks @jamesopstad! - Add defaultTextmodule rule for.sqlfiles.This enables importing
.sqlfiles directly in Wrangler and the Cloudflare Vite plugin without extra configuration.#11692
df1f9c9Thanks @dario-piotrowicz! - Support Waku in autoconfig#11549
d059f69Thanks @dario-piotrowicz! - Support Vike in autoconfigPatch Changes
#11683
02fbd22Thanks @ascorbic! - Display a warning when authentication errors occur and theaccount_idin your Wrangler configuration does not match any of your authenticated accounts. This helps identify configuration issues where you may have the wrong account ID set in yourwrangler.tomlorwrangler.jsoncfile.#11704
77078efThanks @dario-piotrowicz! - Fix autoconfig handling of Next.js apps with CJS config files and incompatible Next.js versionsPreviously,
wrangler setupandwrangler deploy --x-autoconfigwould fail when working with Next.js applications that use CommonJS config files (next.config.cjs) or have versions of Next.js that don't match the required peer dependencies. The autoconfig process now uses dynamic imports and forced installation to handle these scenarios gracefully.#11796
2510723Thanks @dario-piotrowicz! -wrangler deploydelegates toopennextjs-cloudflare deployonly when the--x-autoconfigflag is usedThe
wrangler deploycommand has been updated to delegate to theopennextjs-cloudflare deploycommand when run in an open-next project. Once this behavior had been introduced it caused a few issues. So it's been decided to enable it for the time being only when the--x-autoconfigflag is set (since this behavior, although generally valid, is only strictly necessary for thewrangler deploy's autoconfig flow).#11764
9f6dd71Thanks @terakoya76! - Fix R2 Data Catalog snapshot-expiration API field namesThe
wrangler r2 bucket catalog snapshot-expiration enablecommand was sending incorrect field namesto the Cloudflare API, resulting in a 422 Unprocessable Entity error. This fix updates the API request
body to use the correct field names:
olderThanDays->max_snapshot_age(as duration string, e.g., "30d")retainLast->min_snapshots_to_keepThe CLI options (
--older-than-daysand--retain-last) remain unchanged.#11651
d123ad0Thanks @dario-piotrowicz! - Surface a more helpful error message for TOML Date, Date-Time, and Time values invarsTOML parses unquoted date/time values like
DATE = 2024-01-01as objects. Previously this would cause an unhelpful error message further down the stack. Now wrangler surfaces a more helpful error message earlier, telling you to quote the value as a string, e.g.DATE = "2024-01-01".#11711
5121b23Thanks @southpolesteve! - Show an error when D1 migration commands are run without a configuration filePreviously, running
wrangler d1 migrations apply,wrangler d1 migrations list, orwrangler d1 migrations createin a directory without a Wrangler configuration file would silently exit with no feedback. Now these commands display a clear error message:"No configuration file found. Create a wrangler.jsonc file to define your D1 database."
#11710
82e7e90Thanks @dario-piotrowicz! - Fix arguments passed towrangler deploynot being forwarded toopennextjs-cloudflare deploywrangler deployrun in an open-next project delegates toopennextjs-cloudflare deploy, as part of this all the arguments passed towrangler deployneed be forwarded toopennextjs-cloudflare deploy, before the arguments would be lost, now they will be successfully forwarded (for examplewrangler deploy --keep-varswill callopennextjs-cloudflare deploy --keep-vars)#10750
4688f59Thanks @jacoblearned! - Notify user on local dev server reload.When running
wrangler dev, the local server suppresses Miniflare's reload messages to prevent duplicate log entries from the proxy and user workers. This update adds a reload complete message so users know their changes were applied, instead of only seeing "Reloading local server...".#11673
b827893Thanks @MattieTK! - Breaks out version numbers into sortable number types for analytics loggingUpdated dependencies [
65d1850,1615fce,b2769bf,554a4df,8eede3f,6a05b1c,62fd118,a7e9f80,eac5cf7]:v4.56.0Compare Source
Minor Changes
#11196
171cfd9Thanks @emily-shen! - For containers being created in a FedRAMP high environment, registry credentials are encrypted by the container platform.Update wrangler to correctly send a request to configure a registry for FedRAMP containers.
#11646
472cf72Thanks @vovacf201! - feat: add R2 Data Catalog snapshot expiration commandsAdds new commands to manage automatic snapshot expiration for R2 Data Catalog tables:
wrangler r2 bucket catalog snapshot-expiration enable- Enable automatic snapshot expirationwrangler r2 bucket catalog snapshot-expiration disable- Disable automatic snapshot expirationSnapshot expiration helps manage storage costs by automatically removing old table snapshots while keeping a minimum number of recent snapshots for recovery purposes.
Example usage:
Patch Changes
#11649
428ae9eThanks @ascorbic! - fix: respect TypeScript path aliases when resolving non-JS modules with module rulesWhen importing non-JavaScript files (like
.graphql,.txt, etc.) using TypeScript path aliases defined intsconfig.json, Wrangler's module-collection plugin now correctly resolves these imports. Previously, path aliases were only respected for JavaScript/TypeScript files, causing imports likeimport schema from '~lib/schema.graphql'to fail when using module rules.#11647
c0e249eThanks @dario-piotrowicz! - The auto-configuration logic present inwrangler setupandwrangler deploy --x-autoconfigcannot reliably handle Hono projects, so in these cases make sure to properly error saying that automatically configuring such projects is not supported.#11694
3853200Thanks @dario-piotrowicz! - fix: improve the open-next detection thatwrangler deployperforms to eliminate false positives for non open-next projectsUpdated dependencies [
ae1ad22,737c0f4]:v4.55.0Compare Source
Minor Changes
#11301
6c590a0Thanks @dario-piotrowicz! - Makewrangler deployrunopennextjs-cloudflare deploywhen executed in an open-next project#11045
12a63efThanks @edmundhung! - Add an internalunstable_printBindingsAPI for vite plugin integration#11590
7d8d4a6Thanks @pombosilva! - Add Workflows send-event to wrangler commands.#11301
6c590a0Thanks @dario-piotrowicz! - Support Next.js (via OpenNext) projects in autoconfigPatch Changes
ed42010Thanks [@elithrar](https://rediConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.