Skip to content

fix(deps): update astro monorepo - #915

Merged
riderx merged 1 commit into
mainfrom
renovate/astro-monorepo
Sep 4, 2026
Merged

fix(deps): update astro monorepo#915
riderx merged 1 commit into
mainfrom
renovate/astro-monorepo

Conversation

@renovate

@renovate renovate Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@astrojs/check (source) 0.9.9 → 0.9.10 age confidence
@astrojs/cloudflare (source) 14.1.2 → 14.3.0 age confidence
@astrojs/markdown-remark (source) 7.2.1 → 7.3.0 age confidence
@astrojs/mdx (source) 7.0.2 → 7.0.8 age confidence
@astrojs/sitemap (source) 3.7.3 → 3.7.4 age confidence
astro (source) 7.0.3 → 7.3.1 age confidence

Release Notes

withastro/astro (@​astrojs/check)

v0.9.10

Compare Source

Patch Changes
withastro/astro (@​astrojs/cloudflare)

v14.3.0

Compare Source

Minor Changes

  • #​17795 15e2deb Thanks @​matthewp! - Adds concurrent rendering support for experimental.incrementalBuild, including when using @astrojs/cloudflare

    Incremental builds no longer disable caching when build.concurrency is greater than 1. Projects that set build.concurrency: 1 to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.

  • #​17887 35aa62e Thanks @​matthewp! - Adds a Cloudflare finalize() response handler for custom request handlers

    Call finalize() to apply cookies and Cloudflare CDN cache defaults to the response from an astro/fetch pipeline:

    import { astro, FetchState } from 'astro/fetch';
import { cf, finalize } from '@astrojs/cloudflare/fetch';

export default {
  async fetch(request: Request, env: Env, context: ExecutionContext) {
    const state = new FetchState(request);
    const asset = await cf(state, env, context);
    if (asset) return asset;

    return finalize(state, await astro(state));
  },
};

    The @astrojs/cloudflare/hono middleware applies these response headers automatically. Cloudflare custom entrypoints also fall back to static assets when no Astro route matches and use the default server entrypoint when prerendering through workerd.

Patch Changes

v14.2.6

Compare Source

Patch Changes

v14.2.5

Compare Source

Patch Changes

  • #​17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #​17675 44d384c Thanks @​danielmlr! - Adds the Worker version to the cache metadata of cached responses when the CF_VERSION_METADATA binding is configured. Responses carry an astro-version:<id> cache tag for version-specific purging, and responses that already send Last-Modified get a weak ETag that folds the version in. Conditional revalidation then returns fresh content after a deploy that changes rendered output but not content — most commonly the hashed asset URLs in server-rendered HTML. Without the binding, nothing changes.

  • Updated dependencies []:

v14.2.4

Compare Source

Patch Changes

v14.2.3

Compare Source

Patch Changes

v14.2.2

Compare Source

Patch Changes

v14.2.1

Compare Source

Patch Changes

  • #​17627 ba6a9f6 Thanks @​astrobot-houston! - Fixes the astro peer dependency range from ^7.0.0 to ^7.2.0. The adapter imports symbols (beginContentEntryCollection, beginImageCollection, endContentEntryCollection, endImageCollection) from astro/app that were added in Astro 7.2.0, so earlier versions fail at build time with a MISSING_EXPORT error.

  • Updated dependencies [0891ac9]:

v14.2.0

Compare Source

Minor Changes

  • #​16194 2a59663 Thanks @​Daedalus-Icarus! - Adds opt-in build-time image optimization for the cloudflare-binding image service.

    When enabled, the Cloudflare IMAGES binding transforms static images in the workerd prerender environment, and the optimized bytes are written directly to the output directory. If the binding fails, it falls back to Sharp.

    To opt in, use the compound configuration form:

    export default defineConfig({
  adapter: cloudflare({
    imageService: { build: 'cloudflare-binding', runtime: 'cloudflare-binding' },
  }),
});

    The string shorthand imageService: 'cloudflare-binding' preserves the current runtime-only behavior and is unaffected.

  • #​16871 90c98ae Thanks @​adamchal! - When session: false is set in astro.config, the adapter no longer auto-wires the Cloudflare KV session driver. Combined with the matching astro change, this lets the session runtime tree-shake out of the Worker bundle.

  • #​17084 961bbe5 Thanks @​matthewp! - Supports Astro's experimental incremental static builds. When experimental.incrementalBuild is enabled, the adapter skips unchanged pages between builds.

Patch Changes

  • #​17576 0a79753 Thanks @​alexanderniebuhr! - Fixes /_image returning 500 in dev mode when using imageService: 'custom'. Astro's default dev image endpoint imports vite and node:fs, which cannot be loaded inside workerd. The custom and fallback cases now use the generic fetch-based endpoint in dev, matching the other image service modes. A user-configured image.endpoint is left untouched.

    Additionally, a dev-time warning is now logged when imageService: 'custom' resolves to the Sharp service (including when no image.service is configured), since Sharp's native binding cannot run inside workerd in dev or production.

  • #​17481 0c32649 Thanks @​ondraulehla! - Fixes a crash on /_image cache hits when the Cloudflare cache provider is enabled. Responses served from the Workers Cache API have immutable headers, and the request handler crashed with "Can't modify immutable headers" when applying its default Cloudflare-CDN-Cache-Control: no-store header to them. The handler now rebuilds the response with mutable headers when needed.

  • #​17347 ce83c39 Thanks @​astrobot-houston! - Fixes imageService: 'compile' producing unoptimized images when prerenderEnvironment is set to 'node'

  • #​17594 2b8915a Thanks @​astrobot-houston! - Fixes a type-checking error when using app.use(cf()) from @astrojs/cloudflare/hono in projects with wrangler types-generated ExecutionContext declarations

  • Updated dependencies []:

v14.1.7

Compare Source

Patch Changes

v14.1.6

Compare Source

Patch Changes

v14.1.5

Compare Source

Patch Changes

v14.1.4

Compare Source

Patch Changes

v14.1.3

Compare Source

Patch Changes
withastro/astro (@​astrojs/markdown-remark)

v7.3.0

Compare Source

Minor Changes

  • #​17262 f8e9458 Thanks @​Princesseuh! - Adds MDX rendering to the unified() and satteri() processors.

    Both processors now compile .mdx files themselves. You still need to install @astrojs/mdx to add MDX support to your project.

  • #​17262 f8e9458 Thanks @​Princesseuh! - Adds a recmaPlugins option to unified() for adding recma (estree/JSX) plugins to the MDX compiler.

Patch Changes

v7.2.4

Compare Source

Patch Changes

v7.2.3

Compare Source

Patch Changes

v7.2.2

Compare Source

Patch Changes
withastro/astro (@​astrojs/mdx)

v7.0.8

Compare Source

Patch Changes

  • #​17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #​17766 0762a83 Thanks @​HiDeoo! - Fixes Sätteri processor option types to accept all plugin entries supported by Sätteri v0.10.3.

v7.0.7

Compare Source

Patch Changes

v7.0.6

Compare Source

Patch Changes

v7.0.5

Compare Source

Patch Changes

v7.0.4

Compare Source

Patch Changes

v7.0.3

Compare Source

Patch Changes
  • #​17341 64b0d66 Thanks @​Princesseuh! - Fixes custom pre components not applying to syntax-highlighted code blocks when using the Sätteri Markdown processor with MDX.
withastro/astro (@​astrojs/sitemap)

v3.7.4

Compare Source

Patch Changes
  • #​17851 52d3f56 Thanks @​astro-factory! - Fixes the sitemap outputting a URL with an empty path for the homepage (e.g. https://example.com instead of https://example.com/) when trailingSlash is set to "never" or build.format is set to "file"
withastro/astro (astro)

v7.3.1

Compare Source

Patch Changes

v7.3.0

Compare Source

Minor Changes

  • #​17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #​17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';

const service: LocalImageService = {
  // ...
  async transform(inputBuffer, transform, imageConfig, logger) {
    logger.warn(`Could not optimize "${transform.src}". Passing it through unchanged.`);
    return { data: inputBuffer, format: 'png' };
  },
};

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #​17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { CacheProvider } from 'astro';

const provider: CacheProvider = {
  name: 'my-cache',
  async onRequest({ request, url, logger }, next) {
    logger.warn(`Skipping cache for ${url.pathname} because the response sets a cookie.`);
    return next();
  },
  // ...
};

    Astro's built-in memoryCache() provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.

Patch Changes

  • #​17818 c0b6581 Thanks @​florian-lefebvre! - Updates Astro's remaining internal warnings and errors to be written through the configured logger instead of directly to the console, when possible

  • #​17886 e747cba Thanks @​matthewp! - Fixes the memory cache provider to skip responses with Vary: Cookie or Vary: *

  • #​17885 916b738 Thanks @​Princesseuh! - Improves build performance for sites with a large number of pages coming from a large amount of different modules.

  • #​17795 15e2deb Thanks @​matthewp! - Adds concurrent rendering support for experimental.incrementalBuild, including when using @astrojs/cloudflare

    Incremental builds no longer disable caching when build.concurrency is greater than 1. Projects that set build.concurrency: 1 to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.

  • #​17879 21c34a6 Thanks @​matthewp! - Fixes missing styles, links, and scripts from content collection entries rendered inside server islands

  • #​17861 3193988 Thanks @​ethanstoner! - Fixes i18n fallback routes being generated with a corrupted path when the locale code also appears at the start of a later path segment. A page such as src/pages/en/enterprise.astro with fallback: { es: 'en' } produced the route /es/esterprise instead of /es/enterprise, so the fallback never matched the intended URL. Only the leading locale segment is rewritten now.

v7.2.10

Compare Source

Patch Changes

  • #​17262 f8e9458 Thanks @​Princesseuh! - Fixes @astrojs/markdown-remark being pinned to an exact version.

  • #​17874 10c7e63 Thanks @​astro-factory! - Fixes SSR manifest placeholder not being replaced when the server build is minified, which caused a runtime Invalid URL crash at server boot

  • #​17869 2548abf Thanks @​ematipico! - Fixes a case where the logger was improperly initialized at runtime in dev.

  • #​17878 76eff3d Thanks @​ematipico! - Fixes browser heuristic caching for cached responses that include Last-Modified or ETag validators

  • #​17833 413a6e7 Thanks @​astro-factory! - Fixes prerender conflict warnings to correctly identify the route that first rendered a duplicate pathname, instead of misattributing the conflict to an unrelated route that merely matches the URL pattern

  • #​17872 f7191cc Thanks @​jx-grxf! - Fixes Markdown images in content collections rendering an empty srcset attribute when no responsive candidates are generated.

  • #​17755 157c500 Thanks @​matthewp! - Fixes a bug where editing a content collection entry during astro dev on Windows kept serving stale content until the dev server was restarted. The data store now notifies the dev server directly after each write instead of relying only on the file watcher, which can miss the atomic rename that commits the write on some platforms.

  • Updated dependencies [f8e9458, f8e9458]:

v7.2.9

Compare Source

Patch Changes

v7.2.8

Compare Source

Patch Changes

v7.2.7

Compare Source

Patch Changes

v7.2.6

Compare Source

Patch Changes
  • #​17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

v7.2.5

Compare Source

Patch Changes

  • #​17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #​17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #​17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #​17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #​17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #​17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

    As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

  • #​17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

  • #​17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #​17783 60b14ff Thanks @​matthewp! - Fixes a type error when passing an image from a content collection image() schema to a component or <Image />. The schema returned by image() was missing the apng format, so it no longer matched the type of an imported image.

  • #​17664 d483125 Thanks @​astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases "unsafe-inline" resource. Now when "unsafe-inline", Astro won't emit hashes for the directive specified.

  • #​17810 0fc5f65 Thanks @​florian-lefebvre! - Fixes a regression in the content collections that could cause images to not be resolved

  • #​17781 aa33b44 Thanks @​matthewp! - Fixes memoryCache() storing responses that set cookies through Astro.cookies or Astro.session

  • #​17787 6661fbe Thanks @​astro-factory! - Fixes server:defer crashing the dev server with "undefined is not a function" when a deferred component imports from astro:i18n

  • #​17750 dd0e3ac Thanks @​dobrodob! - Fixes a regression where transition:persist stopped working for <audio> and <video> elements.

  • #​17774 fe1d16d Thanks @​astro-factory! - Adds support for importing .apng files as image metadata for use with standard <img> elements. Astro's image components reject APNG files to avoid removing their animation

  • #​17799 8797754 Thanks @​astro-factory! - Fixes i18n fallbackType: "rewrite" returning 500 instead of 404 when the fallback locale also has no matching static path for a prerendered dynamic route

  • #​17741 99d3d3d Thanks @​ericswpark! - Bumps the Astro compiler to the latest version. Changelog.

  • #​17782 3578d45 Thanks @​Princesseuh! - Improves the performance of the Astro CLI in local by enabling Node's module compilation cache.

  • #​17705 2043e4f Thanks @​astrobot-houston! - Fixes incremental builds serving cached HTML that references stale CSS filenames after a stylesheet-only edit

  • #​17754 3d50dfd Thanks @​astro-factory! - Fixes the dev server refusing to start in Docker containers after a restart due to PID reuse in the lock file check

  • #​17769 bbda94d Thanks @​astro-factory! - Fixes a build failure when defining vite.environments.ssr in the Astro config. User-provided environment config for ssr, prerender, or client is now properly deep-merged with Astro's internal environment settings instead of silently breaking the server entry naming.

  • #​17776 0874da8 Thanks @​astro-factory! - Fixes the glob() content loader failing to load files with colons in their names (e.g., Guide: Architecture.md)

  • Updated dependencies [0762a83, 0c99615]:

v7.2.4

Compare Source

Patch Changes

v7.2.3

Compare Source

Patch Changes

  • #​17724 97140b2 Thanks @​ematipico! - Fixes an issue where Astro could run out of memory when experimental.collectionStorage is set to chunked and there are multiple concurrent updates to the same collection.

  • #​17636 51723b1 Thanks @​matthewp! - Fixes the dev server sometimes matching against stale routes after pages were added, removed, or renamed, requiring a dev server restart to pick up the change

  • [#​17636](https://redirect.github.com

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@cursor
cursor Bot requested a review from riderx July 27, 2026 03:11
cursor[bot]
cursor Bot reviewed Jul 27, 2026
View reviewed changes

@cursor cursor Bot left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale comment

Risk: medium. Astro 7.0→7.1 is a framework minor across web/docs (plus Cloudflare/MDX), so it is above the low-risk auto-approval threshold; Bugbot was not present after the first poll. Leaving a non-blocking comment and assigning a reviewer for human check.

Open in Web View Automation 

Sent by Cursor Approval Agent: Pull Request Approver External

@socket-security

socket-security Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​astrojs/​markdown-remark@​7.2.1 ⏵ 7.3.09810071 +297 +1100
Updated@​astrojs/​check@​0.9.9 ⏵ 0.9.101001008088100
Updated@​astrojs/​sitemap@​3.7.3 ⏵ 3.7.41001008287 -5100
Updated@​astrojs/​mdx@​7.0.2 ⏵ 7.0.899 +110083 +197100
Updated@​astrojs/​cloudflare@​14.1.2 ⏵ 14.3.0100 +110084 +198 +1100
Updatedastro@​7.0.3 ⏵ 7.3.198 +10100 +588 +198100
Updatedsharp@​0.35.3 ⏵ 0.35.497 +1100100 +193100
Updatedzod@​4.4.3 ⏵ 4.5.410010010096100

View full report

@socket-security

socket-security Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@renovate
renovate Bot force-pushed the renovate/astro-monorepo branch 4 times, most recently from c04deee to 73522ef Compare July 29, 2026 16:29
@renovate
renovate Bot force-pushed the renovate/astro-monorepo branch 3 times, most recently from 423ecbf to a7ad372 Compare August 10, 2026 07:08
cursor[bot]
cursor Bot reviewed Aug 10, 2026
View reviewed changes

@cursor cursor Bot left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale comment

Risk: medium. Astro 7.0→7.2 is a framework minor across web/docs (plus Cloudflare/MDX), so it is above the low-risk auto-approval threshold; Bugbot was not present after the first poll. Leaving a non-blocking comment; reviewer already assigned for human check.

Open in Web View Automation 

Sent by Cursor Approval Agent: Pull Request Approver External

@renovate renovate Bot changed the title fix(deps): update astro monorepo Update astro monorepo Aug 10, 2026
@renovate
renovate Bot force-pushed the renovate/astro-monorepo branch from a7ad372 to 116c82a Compare August 12, 2026 04:32
cursor[bot]
cursor Bot reviewed Aug 12, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Risk: medium. Astro 7.0→7.2 is a framework minor across web/docs (plus Cloudflare/MDX), so it is above the low-risk auto-approval threshold; Bugbot was not present after the first poll. Leaving a non-blocking comment; reviewer already assigned for human check.

Open in Web View Automation 

Sent by Cursor Approval Agent: Pull Request Approver External

@renovate renovate Bot changed the title Update astro monorepo fix(deps): update astro monorepo Aug 12, 2026
@renovate
renovate Bot force-pushed the renovate/astro-monorepo branch 5 times, most recently from 6b070b9 to ee4fc64 Compare August 19, 2026 16:44
@renovate
renovate Bot force-pushed the renovate/astro-monorepo branch 6 times, most recently from baae760 to d6b0261 Compare August 27, 2026 16:42
@renovate
renovate Bot force-pushed the renovate/astro-monorepo branch 2 times, most recently from 744abed to 3ab606f Compare September 3, 2026 14:42
@renovate
renovate Bot force-pushed the renovate/astro-monorepo branch from 3ab606f to 0b08056 Compare September 4, 2026 14:03
@riderx
riderx merged commit 7df777a into main Sep 4, 2026
16 of 17 checks passed
@sonarqubecloud

sonarqubecloud Bot commented Sep 4, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@renovate
renovate Bot deleted the renovate/astro-monorepo branch September 4, 2026 14:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments
@riderx riderx Awaiting requested review from riderx

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@riderx