Bump vite, @astrojs/react, @astrojs/starlight, @cloudflare/vitest-pool-workers, astro, astro-breadcrumbs, @astro-community/astro-embed-twitter, @astro-community/astro-embed-youtube and vitest by dependabot[bot] · Pull Request #46 · johnconstant99-dev/cloudflare-docs

dependabot · 2026-07-04T05:53:05Z

Bumps vite to 8.1.3 and updates ancestor dependencies vite, @astrojs/react, @astrojs/starlight, @cloudflare/vitest-pool-workers, astro, astro-breadcrumbs, @astro-community/astro-embed-twitter, @astro-community/astro-embed-youtube and vitest. These dependencies need to be updated together.

Updates vite from 6.3.6 to 8.1.3

Release notes

Sourced from vite's releases.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

v8.0.8

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.1.3 (2026-07-02)

Bug Fixes

css: inject inlined CSS after the shebang line (#22717) (1534d36)

deps: bump es-module-lexer to 2.3.0 (#22838) (7103c3a)

preload css for nested dynamic imports (#22759) (2c53054)

ssr: correct stacktrace column position for first line (#22828) (c4acd69)

8.1.2 (2026-06-30)

Bug Fixes

deps: revert es-module-lexer to 2.1.0 (#22827) (0d3bd7c)

restore, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (#22825) (efb98cc)

revert, "fix: escape ids with multiple null bytes (#22687)" (cccef55)

revert, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (cf97711)

8.1.1 (2026-06-30)

Features

update dynamic import warning to link to Vite docs (#22823) (62bd7af)

Bug Fixes

bundled-dev: avoid stack overflow on import.meta.hot.invalidate() (#22797) (709eb8e)

bundled-dev: serve assets emitted during HMR/lazy compile (#22745) (5876b2c)

bundledDev: skip plugin transform hooks for rolldown-lazy stub modules (#22778) (8f925e2)

css: preserve dollar signs in external @import urls with lightningcss (#22718) (9fa7ab4)

css: resolve tsconfig paths in CSS and Sass @import (#22775) (ef0b891)

deps: update all non-major dependencies (#22734) (e635f49)

deps: update all non-major dependencies (#22804) (8837400)

deps: update rolldown-related dependencies (#22591) (2ce6677)

escape ids with multiple null bytes (#22687) (833fc30)

hide console window when running 'net use' on Windows (#22698) (92b63f2)

ignore bundled config temp dir (#22800) (043a810)

invert esbuild.jsxSideEffects when converting to oxc.jsx.pure (#22809) (33895ba)

optimize-deps: ignore ERR_CLOSED_SERVER in scanner (#22784) (085a0ab)

optimizer: scanner should resolve input from root (#22769) (9722b07)

resolve pnpm .modules.yaml from workspace root instead of cwd (#22757) (2531ac7)

return sourcemap field from some plugins that were lacking (#22782) (7e18bf8)

server: handle malformed URI in indexHtmlMiddleware (#22781) (84f5ccc)

Miscellaneous Chores

improve dependency optimizer messages (#22549) (092cb3b)

Code Refactoring

css: remove lightningcss null byte bug workaround (#22822) (2dafd3b)

use pre-defined environments variable to avoid duplicate Object.values calls (#22790) (1113acf)

... (truncated)

Commits

578ffb8 release: v8.1.3
7103c3a fix(deps): bump es-module-lexer to 2.3.0 (#22838)
1534d36 fix(css): inject inlined CSS after the shebang line (#22717)
c4acd69 fix(ssr): correct stacktrace column position for first line (#22828)
2c53054 fix: preload css for nested dynamic imports (#22759)
ba31193 release: v8.1.2
0d3bd7c fix(deps): revert es-module-lexer to 2.1.0 (#22827)
efb98cc fix: restore, "fix: resolve pnpm .modules.yaml from workspace root instead of...
cf97711 fix: revert, "fix: resolve pnpm .modules.yaml from workspace root instead of ...
cccef55 fix: revert, "fix: escape ids with multiple null bytes (#22687)"
Additional commits viewable in compare view

Updates @astrojs/react from 4.2.5 to 6.0.1

Release notes

Sourced from @astrojs/react's releases.

@astrojs/react@6.0.1

Patch Changes

Updated dependencies [eb6f97e]:

@astrojs/internal-helpers@0.10.1

@astrojs/react@6.0.0

Major Changes

#15819 cafec4e Thanks @delucis! - Upgrade to Vite v8

Minor Changes
#17093 4585fe5 Thanks @Princesseuh! - Replaces the import entrypoint of getContainerRenderer()

A new container-renderer entrypoint exporting getContainerRenderer() has been added to the following integrations: React, Preact, Svelte, SolidJS, Vue, and MDX. This prevents bundlers from trying to bundle unrelated exports from the package root when only the Container API is used.

If you are using the Container API, update your import statements to use the new entrypoint. The following example updates the getContainerRenderer() import for React:
- import { getContainerRenderer } from '@astrojs/react';
+ import { getContainerRenderer } from '@astrojs/react/container-renderer';
Importing getContainerRenderer() from the package root still works, but is now deprecated and logs a warning.
Patch Changes

#17027 241250b Thanks @ocavue! - Triggers beta prereleases for packages that are still on alpha

@astrojs/react@6.0.0-beta.2

Minor Changes
#17093 4585fe5 Thanks @Princesseuh! - Replaces the import entrypoint of getContainerRenderer()

A new container-renderer entrypoint exporting getContainerRenderer() has been added to the following integrations: React, Preact, Svelte, SolidJS, Vue, and MDX. This prevents bundlers from trying to bundle unrelated exports from the package root when only the Container API is used.

If you are using the Container API, update your import statements to use the new entrypoint. The following example updates the getContainerRenderer() import for React:
- import { getContainerRenderer } from '@astrojs/react';
+ import { getContainerRenderer } from '@astrojs/react/container-renderer';
Importing getContainerRenderer() from the package root still works, but is now deprecated and logs a warning.
@astrojs/react@6.0.0-beta.1

Patch Changes

#17027 241250b Thanks @ocavue! - Triggers beta prereleases for packages that are still on alpha

Changelog

Sourced from @astrojs/react's changelog.

6.0.1

Patch Changes

Updated dependencies [eb6f97e]:

@astrojs/internal-helpers@0.10.1

6.0.0

Major Changes

#15819 cafec4e Thanks @delucis! - Upgrade to Vite v8

Minor Changes
#17093 4585fe5 Thanks @Princesseuh! - Replaces the import entrypoint of getContainerRenderer()

A new container-renderer entrypoint exporting getContainerRenderer() has been added to the following integrations: React, Preact, Svelte, SolidJS, Vue, and MDX. This prevents bundlers from trying to bundle unrelated exports from the package root when only the Container API is used.

If you are using the Container API, update your import statements to use the new entrypoint. The following example updates the getContainerRenderer() import for React:
- import { getContainerRenderer } from '@astrojs/react';
+ import { getContainerRenderer } from '@astrojs/react/container-renderer';
Importing getContainerRenderer() from the package root still works, but is now deprecated and logs a warning.
Patch Changes

#17027 241250b Thanks @ocavue! - Triggers beta prereleases for packages that are still on alpha

6.0.0-beta.2

Minor Changes
#17093 4585fe5 Thanks @Princesseuh! - Replaces the import entrypoint of getContainerRenderer()

A new container-renderer entrypoint exporting getContainerRenderer() has been added to the following integrations: React, Preact, Svelte, SolidJS, Vue, and MDX. This prevents bundlers from trying to bundle unrelated exports from the package root when only the Container API is used.

If you are using the Container API, update your import statements to use the new entrypoint. The following example updates the getContainerRenderer() import for React:
- import { getContainerRenderer } from '@astrojs/react';
+ import { getContainerRenderer } from '@astrojs/react/container-renderer';
Importing getContainerRenderer() from the package root still works, but is now deprecated and logs a warning.
6.0.0-beta.1

... (truncated)

Commits

a86160e [ci] release (#17256)
2bfb179 chore: simpler package.json types (#17229)
f55ba4c [ci] release (#17132)
0da0678 [ci] release (beta) (#17089)
4585fe5 fix(integrations): Export container renderers from a dedicated export path to...
08b84d6 [ci] release (beta) (#17045)
75cfa52 chore: merge main into next
75ae5df [ci] release (#16912)
9c2b95b Merge remote-tracking branch 'origin/main' into chore/merge-main-into-next
17a0fbd chore(deps): update devalue (#16900)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @astrojs/react since your current version.

Updates @astrojs/starlight from 0.36.0 to 0.41.3

Release notes

Sourced from @astrojs/starlight's releases.

@astrojs/starlight@0.41.3

Patch Changes

#3911 1686ecc Thanks @timothyjordan! - Keeps keyboard focus inside the mobile menu while it is open, preventing focus moving to hidden interactive elements in page content.

@astrojs/starlight@0.41.2

Patch Changes

#4008 58a3520 Thanks @FrancoKaddour! - Fixes the table of contents overflowing the right edge of the viewport when a custom --sl-content-width value exceeds available space

#4015 bdbfffc Thanks @delucis! - Fixes an issue where aside icons were rendered incorrectly in projects where Astro’s MDX integration had optimization disabled

@astrojs/starlight@0.41.1

Patch Changes

#3967 72e63dc Thanks @HiDeoo! - Adds 2 new icons: link and link-alt.

#3988 ac55cfa Thanks @delucis! - Fixes a dependency resolution issue introduced in Starlight v0.41

#3967 72e63dc Thanks @HiDeoo! - Optimizes the icons of Markdown asides.

@astrojs/starlight@0.41.0

Minor Changes
#3951 1202dd4 Thanks @HiDeoo! - Adds support for Astro v7, drops support for Astro v6.

Upgrade Astro and dependencies

⚠️ BREAKING CHANGE: Astro v6 is no longer supported. Make sure you update Astro and any other official integrations at the same time as updating Starlight:
npx @astrojs/upgrade
Community Starlight plugins and Astro integrations may also need to be manually updated to work with Astro v7. If you encounter any issues, please reach out to the plugin or integration author to see if it is a known issue or if an updated version is being worked on.

⚠️ BREAKING CHANGE: This release drops official support for Chromium-based browsers prior to version 111 (released 07 March 2023) and Safari-based browsers prior to version 16.4 (released 27 March 2023). You can find a list of currently supported browsers and their versions using this browserslist query.
Patch Changes

#3953 a935d33 Thanks @HiDeoo! - Fixes Starlight Markdown processing being potentially applied to files that should not be processed.

@astrojs/starlight@0.40.0

Minor Changes
#3923 edf2e6b Thanks @Princesseuh! - Adds support for Astro 6.4 and the new Sätteri Markdown processor.

It is now possible to opt into using Astro's 6.4 Sätteri Markdown processor by installing the @astrojs/markdown-satteri package and configuring it in your astro.config.mjs file:

... (truncated)

Changelog

Sourced from @astrojs/starlight's changelog.

0.41.3

Patch Changes

#3911 1686ecc Thanks @timothyjordan! - Keeps keyboard focus inside the mobile menu while it is open, preventing focus moving to hidden interactive elements in page content.

0.41.2

Patch Changes

#4008 58a3520 Thanks @FrancoKaddour! - Fixes the table of contents overflowing the right edge of the viewport when a custom --sl-content-width value exceeds available space

#4015 bdbfffc Thanks @delucis! - Fixes an issue where aside icons were rendered incorrectly in projects where Astro’s MDX integration had optimization disabled

0.41.1

Patch Changes

#3967 72e63dc Thanks @HiDeoo! - Adds 2 new icons: link and link-alt.

#3988 ac55cfa Thanks @delucis! - Fixes a dependency resolution issue introduced in Starlight v0.41

#3967 72e63dc Thanks @HiDeoo! - Optimizes the icons of Markdown asides.

0.41.0

Minor Changes
#3951 1202dd4 Thanks @HiDeoo! - Adds support for Astro v7, drops support for Astro v6.

Upgrade Astro and dependencies

⚠️ BREAKING CHANGE: Astro v6 is no longer supported. Make sure you update Astro and any other official integrations at the same time as updating Starlight:
npx @astrojs/upgrade
Community Starlight plugins and Astro integrations may also need to be manually updated to work with Astro v7. If you encounter any issues, please reach out to the plugin or integration author to see if it is a known issue or if an updated version is being worked on.

⚠️ BREAKING CHANGE: This release drops official support for Chromium-based browsers prior to version 111 (released 07 March 2023) and Safari-based browsers prior to version 16.4 (released 27 March 2023). You can find a list of currently supported browsers and their versions using this browserslist query.
Patch Changes

#3953 a935d33 Thanks @HiDeoo! - Fixes Starlight Markdown processing being potentially applied to files that should not be processed.

0.40.0

Minor Changes

... (truncated)

Commits

96cee6e [ci] release (#4032)
1686ecc fix(MobileMenuToggle): trap keyboard focus inside the mobile menu (#3911)
3948048 [ci] release (#4016)
1a209c5 [ci] format
58a3520 fix(css): prevent TOC overflow with custom --sl-content-width (#4008)
bdbfffc Fix aside icons when MDX optimization is disabled (#4015)
a2266b9 Update playwright (#4013)
c1a3d6d [ci] release (#3989)
72e63dc Add link icons and dedupe Markdown/component icons (#3967)
ac55cfa Update astro-expressive-code (#3988)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @astrojs/starlight since your current version.

Updates @cloudflare/vitest-pool-workers from 0.9.11 to 0.18.0

Release notes

Sourced from @cloudflare/vitest-pool-workers's releases.

@cloudflare/vitest-pool-workers@0.18.0

Minor Changes
#14382 fd92d56 Thanks @petebacondarwin! - Add support for declarative Durable Object exports

wrangler deploy now accepts an exports map in wrangler.json as a declarative alternative to the legacy migrations array.

Each entry in exports is keyed by Durable Object class name. type carries the export kind (currently always "durable-object"); the state field carries the lifecycle and defaults to "created" (live) when omitted:
{
  "exports": {
    // Provision a new Durable Object class (`MyDO`)
    "MyDO": { "type": "durable-object", "storage": "sqlite" },
    // Delete Durable Object class (`OldGone`)
    "OldGone": { "type": "durable-object", "state": "deleted" },
    // Rename a Durable Object class (from `OldName` to `NewName`)
    "OldName": {
      "type": "durable-object",
      "state": "renamed",
      "renamed_to": "NewName"
    },
    "NewName": { "type": "durable-object", "storage": "sqlite" },
    // Transfer a Durable Object (`Outgoing`) to a new Worker (`target-worker`)
    "Outgoing": {
      "type": "durable-object",
      "state": "transferred",
      "transferred_to": "target-worker"
    },
    // Prepare to receive the transfer of a Durable Object (`Incoming`) from another Worker (`source-worker`)
    "Incoming": {
      "type": "durable-object",
      "state": "expecting-transfer",
      "storage": "sqlite",
      "transfer_from": "source-worker"
    }
  }
}
When a Worker declares Durable Object class bindings but no lifecycle for them (neither a migrations array nor an exports map), wrangler warns and now suggests a declarative exports entry for each class (previously it suggested a legacy migrations block).

The deployment response now surfaces the server's reconciliation result — created namespaces, applied tombstones, structured per-scenario info entries, and a removable_entries hint for stale tombstones that are safe to delete from the config. Blocking errors return the structured per-class detail with scenario tags, suggested remediation, and any referencing-script context.

wrangler versions upload also forwards exports. Declarative exports lifecycle changes are reconciled when the version is deployed (wrangler versions deploy or wrangler deploy), so a versions upload payload can declare new classes in exports without immediately provisioning them. An actor binding (durable_objects.bindings) to a class declared only in exports on the same versions upload is rejected with a clear error (code 100406) — the binding cannot be resolved until the namespace is provisioned. Either stage the new class via ctx.exports.X (no binding required) on versions upload and add the binding at deploy time, or use wrangler deploy to provision and bind in one step (the same constraint applies to the migrations flow).

Multi-version deploys (wrangler versions deploy A@50% B@50%) where the selected versions disagree on declarative exports are rejected server-side with a clear message: deploy the version that changes exports at 100% first, then run the percentage-split deploy. This prevents traffic on one branch routing to code that references unprovisioned or just-deleted DO namespaces. Single-version (100%) deploys are unaffected.

Local development (wrangler dev, vite dev and unstable_startWorker) reads Durable Object SQLite storage settings from the new exports field, so applications using the declarative flow get correct local-dev storage without needing to also declare a migrations block.

... (truncated)

Changelog

Sourced from @cloudflare/vitest-pool-workers's changelog.

0.18.0

Minor Changes
#14382 fd92d56 Thanks @petebacondarwin! - Add support for declarative Durable Object exports

wrangler deploy now accepts an exports map in wrangler.json as a declarative alternative to the legacy migrations array.

Each entry in exports is keyed by Durable Object class name. type carries the export kind (currently always "durable-object"); the state field carries the lifecycle and defaults to "created" (live) when omitted:
{
  "exports": {
    // Provision a new Durable Object class (`MyDO`)
    "MyDO": { "type": "durable-object", "storage": "sqlite" },
    // Delete Durable Object class (`OldGone`)
    "OldGone": { "type": "durable-object", "state": "deleted" },
    // Rename a Durable Object class (from `OldName` to `NewName`)
    "OldName": {
      "type": "durable-object",
      "state": "renamed",
      "renamed_to": "NewName"
    },
    "NewName": { "type": "durable-object", "storage": "sqlite" },
    // Transfer a Durable Object (`Outgoing`) to a new Worker (`target-worker`)
    "Outgoing": {
      "type": "durable-object",
      "state": "transferred",
      "transferred_to": "target-worker"
    },
    // Prepare to receive the transfer of a Durable Object (`Incoming`) from another Worker (`source-worker`)
    "Incoming": {
      "type": "durable-object",
      "state": "expecting-transfer",
      "storage": "sqlite",
      "transfer_from": "source-worker"
    }
  }
}
When a Worker declares Durable Object class bindings but no lifecycle for them (neither a migrations array nor an exports map), wrangler warns and now suggests a declarative exports entry for each class (previously it suggested a legacy migrations block).

The deployment response now surfaces the server's reconciliation result — created namespaces, applied tombstones, structured per-scenario info entries, and a removable_entries hint for stale tombstones that are safe to delete from the config. Blocking errors return the structured per-class detail with scenario tags, suggested remediation, and any referencing-script context.

wrangler versions upload also forwards exports. Declarative exports lifecycle changes are reconciled when the version is deployed (wrangler versions deploy or wrangler deploy), so a versions upload payload can declare new classes in exports without immediately provisioning them. An actor binding (durable_objects.bindings) to a class declared only in exports on the same versions upload is rejected with a clear error (code 100406) — the binding cannot be resolved until the namespace is provisioned. Either stage the new class via ctx.exports.X (no binding required) on versions upload and add the binding at deploy time, or use wrangler deploy to provision and bind in one step (the same constraint applies to the migrations flow).

Multi-version deploys (wrangler versions deploy A@50% B@50%) where the selected versions disagree on declarative exports are rejected server-side with a clear message: deploy the version that changes exports at 100% first, then run the percentage-split deploy. This prevents traffic on one branch routing to code that references unprovisioned or just-deleted DO namespaces. Single-version (100%) deploys are unaffected.

Local development (wrangler dev, vite dev and unstable_startWorker) reads Durable Object SQLite storage settings from the new exports field, so applications using the declarative flow get correct local-dev storage without needing to also declare a migrations block.

... (truncated)

Commits

473e61f Version Packages (#14503)
c8dbcf5 [wrangler] Remove experimental gate for declarative Durable Object exports (#...
fd92d56 [wrangler] Add experimental support for declarative Durable Object exports (#...
13c69dd Version Packages (#14487)
75d8cb0 Revert "Version Packages" (#14490)
5e6950b Version Packages (#14433)
6b14c5b feat(wrangler): introspect workflow with test harness (#14438)
f7ce796 [vitest-pool-workers] Support require("./x.wasm?module") in CommonJS deps (#1...
8eacfd1 Replace all the occurrences of the deprecated toThrowError API with the app...
70d97d9 Version Packages (#14401)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @cloudflare/vitest-pool-workers since your current version.

Updates astro from 5.13.7 to 7.0.6

Release notes

Sourced from astro's releases.

astro@7.0.6

Patch Changes

#17261 79aa99c Thanks @astrobot-houston! - Fixes a false deprecation warning for markdown.gfm and markdown.smartypants when using the Container API

#17247 f94280d Thanks @chatman-media! - Fixes route generation throwing "Missing parameter" (or silently dropping the segment) when a dynamic param's value is 0. The generator used truthy checks instead of checking for undefined, so paginate(posts, { params: { categoryId: 0 } }) would crash even though 0 is a perfectly valid param value.

#17278 6f11739 Thanks @astrobot-houston! - Fixes missing CSS for virtual style modules (e.g., responsive image layout styles) in dev mode when JavaScript is disabled

#17250 0b30b35 Thanks @matthewp! - Fixes the security.checkOrigin check so it is applied consistently to Astro Actions and on-demand endpoints, regardless of how the request pipeline is composed. Previously, the origin check could be skipped in the composable astro/hono pipeline depending on the order of the middleware() primitive (or when it was omitted).

#17274 8c3579b Thanks @astrobot-houston! - Fixes missing render() type overload for live collection entries. Previously, calling render() on a LiveDataEntry produced a TypeScript error when using only live.config.ts without a content.config.ts.

#17257 4208297 Thanks @astrobot-houston! - Fixes astro check failing to find @astrojs/check and typescript when astro is installed in a directory outside the project tree (e.g. pnpm virtual store)

#17272 b428648 Thanks @matthewp! - Fixes island component paths so that extensionless imports (e.g. import { Counter } from '../components/Counter') resolve to the real file on disk, matching Vite's extension order and directory index resolution. This makes the include/exclude options of JSX renderer integrations (React, Preact, Solid) match components imported without a file extension, and removes the spurious React 19 "Invalid hook call" warning logged on every request in dev when include was set alongside another JSX renderer

#17279 2aeaa44 Thanks @astrobot-houston! - Fixes a bug where <Picture inferSize> with a remote image could fail with FailedToFetchRemoteImageDimensions when the image server rate-limits requests (e.g. HTTP 429). Remote dimensions are now resolved once per render instead of once per output format.

#17251 5240e26 Thanks @matthewp! - Hardens the handling of attribute rendering when using with custom elements.

#17248 429bd62 Thanks @astrobot-houston! - Fixes a crash when using Astro's getViteConfig with Vitest browser mode (e.g., Storybook vitest runner). Astro now skips dev server setup inside Vitest, preventing errors.

#17260 14524c0 Thanks @matthewp! - Fixes a regression where a <script> inside a component rendered through Astro.slots.render() was hoisted out of its original position instead of staying next to its component content

Updated dependencies [eb6f97e]:

@astrojs/internal-helpers@0.10.1

@astrojs/markdown-remark@7.2.1

@astrojs/markdown-satteri@0.3.3

astro@7.0.5

Patch Changes
#17242 9c05ba4 Thanks @matthewp! - Fixes an error that could occur after the dev server restarts when using an adapter such as @astrojs/cloudflare, where a request would fail with a 500 referencing a missing pre-bundled dependency:
The file does not exist at "node_modules/.vite/deps_ssr/astro_compiler-runtime.js?v=6419660d" which is in the optimize deps directory. The dependency might be incompatible with the dep optimizer. Try adding it to `optimizeDeps.exclude`.
#17202 c6d254d Thanks @matthewp! - Refactors path alias resolution to use Vite's native tsconfigPaths option

This is an internal change with no expected impact on user projects. Astro now defers tsconfig and jsconfig paths alias resolution to Vite, keeping a small fallback for a few CSS cases Vite does not yet handle.

#17123 72e29bd Thanks @martrapp! - Fixes an issue where the ClientRouter wipes head elements after page transitions if the <head> contains a server:defer component.

#17232 257505e Thanks @matthewp! - Fixes a bug where <style> tags from components such as a content collection's Content could be silently dropped from the output when an await appeared before the component in an .astro file's markup.

#17193 a7352fd Thanks @jan-kubica! - Fixes the background dev server failing to start when astro is hoisted outside the project's node_modules (for example bun workspaces). The background process is now spawned from Astro's own resolved location instead of a path assumed under the project root.

#17255 581d171 Thanks @astrobot-houston! - Fixes prefetch not working for links inside server:defer components
astro@7.0.4

... (truncated)

Changelog

Sourced from astro's changelog.

7.0.6

Patch Changes

#17261 79aa99c Thanks @astrobot-houston! - Fixes a false deprecation warning for markdown.gfm and markdown.smartypants when using the Container API

#17247 f94280d Thanks @chatman-media! - Fixes route generation throwing "Missing parameter" (or silently dropping the segment) when a dynamic param's value is 0. The generator used truthy checks instead of checking for undefined, so paginate(posts, { params: { categoryId: 0 } }) would crash even though 0 is a perfectly valid param value.

#17278 6f11739 Thanks @astrobot-houston! - Fixes missing CSS for virtual style modules (e.g., responsive image layout styles) in dev mode when JavaScript is disabled

#17250 0b30b35 Thanks @matthewp! - Fixes the security.checkOrigin check so it is applied consistently to Astro Actions and on-demand endpoints, regardless of how the request pipeline is composed. Previously, the origin check could be skipped in th...
Description has been truncated

socket-security · 2026-07-04T05:53:54Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
npm/astro-breadcrumbs@3.3.1 ⏵ 3.4.1	^-6		⁺¹	⁺⁸
npm/esbuild@0.28.1
npm/@cloudflare/vitest-pool-workers@0.9.11 ⏵ 0.18.0				^-4
npm/vitest@2.1.6 ⏵ 4.1.9	⁺¹	⁺⁷⁵	⁺¹
npm/@astrojs/react@4.2.5 ⏵ 6.0.1	⁺¹		⁺²	⁺⁸
npm/@astrojs/starlight@0.36.0 ⏵ 0.41.3			⁺¹	⁺²
npm/astro@5.13.7 ⏵ 7.0.6	^-9	⁺⁴⁰	⁺¹	⁺¹

View full report

socket-security · 2026-07-04T05:53:57Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@emnapi/runtime` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/vitest@4.1.9` → `npm/@astrojs/react@6.0.1` → `npm/astro@7.0.6` → `npm/@astrojs/starlight@0.41.3` → `npm/vite-tsconfig-paths@5.1.4` → `npm/@emnapi/runtime@1.11.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/runtime@1.11.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `astro` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/astro@7.0.6` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/astro@7.0.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 4, 2026

dependabot Bot mentioned this pull request Jul 4, 2026

Bump vite, @astrojs/react, @astrojs/starlight, @cloudflare/vitest-pool-workers, astro, astro-breadcrumbs, @astro-community/astro-embed-twitter, @astro-community/astro-embed-youtube and vitest #43

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump vite, @astrojs/react, @astrojs/starlight, @cloudflare/vitest-pool-workers, astro, astro-breadcrumbs, @astro-community/astro-embed-twitter, @astro-community/astro-embed-youtube and vitest#46

Bump vite, @astrojs/react, @astrojs/starlight, @cloudflare/vitest-pool-workers, astro, astro-breadcrumbs, @astro-community/astro-embed-twitter, @astro-community/astro-embed-youtube and vitest#46
dependabot[bot] wants to merge 1 commit into
productionfrom
dependabot/npm_and_yarn/multi-084c4f8735

dependabot Bot commented on behalf of github Jul 4, 2026

Upgrade Astro and dependencies

Upgrade Astro and dependencies

Uh oh!

socket-security Bot commented Jul 4, 2026

Uh oh!

socket-security Bot commented Jul 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 4, 2026

v8.1.3

v8.1.2

v8.1.1

create-vite@8.1.0

plugin-legacy@8.1.0

v8.1.0

plugin-legacy@8.1.0-beta.0

v8.1.0-beta.0

v8.0.16

v8.0.15

v8.0.14

v8.0.13

v8.0.12

v8.0.11

v8.0.10

v8.0.9

v8.0.8

8.1.3 (2026-07-02)

Bug Fixes

8.1.2 (2026-06-30)

Bug Fixes

8.1.1 (2026-06-30)

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

@​astrojs/react@​6.0.1

Patch Changes

@​astrojs/react@​6.0.0

Major Changes

Minor Changes

Patch Changes

@​astrojs/react@​6.0.0-beta.2

Minor Changes

@​astrojs/react@​6.0.0-beta.1

Patch Changes

6.0.1

Patch Changes

6.0.0

Major Changes

Minor Changes

Patch Changes

6.0.0-beta.2

Minor Changes

6.0.0-beta.1

@​astrojs/starlight@​0.41.3

Patch Changes

@​astrojs/starlight@​0.41.2

Patch Changes

@​astrojs/starlight@​0.41.1

Patch Changes

@​astrojs/starlight@​0.41.0

Minor Changes

Upgrade Astro and dependencies

Patch Changes

@​astrojs/starlight@​0.40.0

Minor Changes

0.41.3

Patch Changes

0.41.2

Patch Changes

0.41.1

Patch Changes

0.41.0

Minor Changes

Upgrade Astro and dependencies

Patch Changes

0.40.0

Minor Changes

@​cloudflare/vitest-pool-workers@​0.18.0

Minor Changes

0.18.0

Minor Changes

astro@7.0.6

Patch Changes

astro@7.0.5

Patch Changes

astro@7.0.4

`@astrojs/react@6`.0.1

`@astrojs/react@6`.0.0

`@astrojs/react@6`.0.0-beta.2

`@astrojs/react@6`.0.0-beta.1

`@astrojs/starlight@0`.41.3

`@astrojs/starlight@0`.41.2

`@astrojs/starlight@0`.41.1

`@astrojs/starlight@0`.41.0

`@astrojs/starlight@0`.40.0

`@cloudflare/vitest-pool-workers@0`.18.0