Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 12 updates - #11

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/website/npm_and_yarn-cdd307c6fa
Open

chore(deps): bump the npm_and_yarn group across 1 directory with 12 updates#11
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/website/npm_and_yarn-cdd307c6fa

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 1 update in the /website directory: astro.

Updates astro from 7.0.7 to 7.2.0

Release notes

Sourced from astro's releases.

astro@7.2.0

Minor Changes

  • #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

    This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

    astro preview --background

    When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

    astro preview status
astro preview logs
astro preview logs --follow
astro preview stop

    If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

    To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

  • #17532 7f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

    Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

    // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
logger: {

entrypoint: new URL('./src/logger.js', import.meta.url),


entrypoint: './src/logger.js',
},
});

Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

  • #17084 961bbe5 Thanks @​matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

    A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

    import type { AstroPrerenderer, PrerenderResult } from 'astro';
const prerenderer: AstroPrerenderer = {

    • ... (truncated)

    Changelog

    Sourced from astro's changelog.

    7.2.0

    Minor Changes

    • #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

      This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

      astro preview --background

      When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

      astro preview status
astro preview logs
astro preview logs --follow
astro preview stop

      If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

      To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

    • #17532 7f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

      Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

      // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
logger: {

entrypoint: new URL('./src/logger.js', import.meta.url),


entrypoint: './src/logger.js',
},
});

    Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

  • #17084 961bbe5 Thanks @​matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

    A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

    import type { AstroPrerenderer, PrerenderResult } from 'astro';

    • ... (truncated)

    Commits

    Updates defu from 6.1.4 to 6.1.7

    Release notes

    Sourced from defu's releases.

    v6.1.7

    compare changes

    📦 Build

    • Correct the types export entry (#160)
    • Export Defu types (#157)

    ❤️ Contributors

    v6.1.6

    compare changes

    📦 Build

    v6.1.5

    compare changes

    🩹 Fixes

    • Prevent prototype pollution via __proto__ in defaults (#156)
    • Ignore inherited enumerable properties (11ba022)

    ✅ Tests

    • Add more tests for plain objects (b65f603)

    ❤️ Contributors

    Changelog

    Sourced from defu's changelog.

    v6.1.7

    compare changes

    🩹 Fixes

    • defu.d.cts: Export Defu types (#157)

    📦 Build

    • Correct the types export entry (#160)

    ❤️ Contributors

    v6.1.6

    compare changes

    📦 Build

    ❤️ Contributors

    v6.1.5

    compare changes

    🩹 Fixes

    • Prevent prototype pollution via __proto__ in defaults (#156)
    • Ignore inherited enumerable properties (11ba022)

    🏡 Chore

    ✅ Tests

    • Add more tests for plain objects (b65f603)

    🤖 CI

    ... (truncated)

    Commits
    • 80c0146 chore(release): v6.1.7
    • 40d7ef4 fix(defu.d.cts): export Defu types (#157)
    • 3d3a7c8 build: correct the types export entry (#160)
    • 001c290 chore(release): v6.1.6
    • 407b516 build: fix mixed types
    • 23e59e6 chore(release): v6.1.5
    • 11ba022 fix: ignore inherited enumerable properties
    • 3942bfb fix: prevent prototype pollution via __proto__ in defaults (#156)
    • d3ef16d chore(deps): update actions/checkout action to v6 (#151)
    • 869a053 chore(deps): update actions/setup-node action to v6 (#149)
    • Additional commits viewable in compare view

    Updates devalue from 5.6.3 to 5.8.1

    Release notes

    Sourced from devalue's releases.

    v5.8.1

    Patch Changes

    • 206ca67: fix: force sparse arrays to allocate sparsely

    v5.8.0

    Minor Changes

    • c5115b0: feat: add stringifyAsync for async serialization

    v5.7.1

    Patch Changes

    • 8becc7c: fix: handle regexes consistently in uneval's value and reference formats

    v5.7.0

    Minor Changes

    • df2e284: feat: use native alternatives to encode/decode base64
    • 498656e: feat: add DataView support
    • a210130: feat: whitelist Float16Array
    • df2e284: feat: simplify TypedArray slices

    Patch Changes

    • 5590634: fix: get uneval type handling up to parity with stringify
    • 57f73fc: fix: correctly support boxed bigints and sentinel values

    v5.6.4

    Patch Changes

    • 87c1f3c: fix: reject __proto__ keys in malformed Object wrapper payloads

      This validates the "Object" parse path and throws when the wrapped value has an own __proto__ key.

    • 40f1db1: fix: ensure sparse array indices are integers

    • 87c1f3c: fix: disallow __proto__ keys in null-prototype object parsing

      This disallows __proto__ keys in the "null" parse path so null-prototype object hydration cannot carry that key through parse/unflatten.

    Changelog

    Sourced from devalue's changelog.

    5.8.1

    Patch Changes

    • 206ca67: fix: force sparse arrays to allocate sparsely

    5.8.0

    Minor Changes

    • c5115b0: feat: add stringifyAsync for async serialization

    5.7.1

    Patch Changes

    • 8becc7c: fix: handle regexes consistently in uneval's value and reference formats

    5.7.0

    Minor Changes

    • df2e284: feat: use native alternatives to encode/decode base64
    • 498656e: feat: add DataView support
    • a210130: feat: whitelist Float16Array
    • df2e284: feat: simplify TypedArray slices

    Patch Changes

    • 5590634: fix: get uneval type handling up to parity with stringify
    • 57f73fc: fix: correctly support boxed bigints and sentinel values

    5.6.4

    Patch Changes

    • 87c1f3c: fix: reject __proto__ keys in malformed Object wrapper payloads

      This validates the "Object" parse path and throws when the wrapped value has an own __proto__ key.

    • 40f1db1: fix: ensure sparse array indices are integers

    • 87c1f3c: fix: disallow __proto__ keys in null-prototype object parsing

      This disallows __proto__ keys in the "null" parse path so null-prototype object hydration cannot carry that key through parse/unflatten.

    Commits

    Updates esbuild from 0.25.12 to 0.28.1

    Release notes

    Sourced from esbuild's releases.

    v0.28.1

    • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

      This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

      Thanks to @​dellalibera for reporting this issue.

    • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

      The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

      Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

      Thanks to @​sondt99 for reporting this issue.

    • Avoid inlining using and await using declarations (#4482)

      Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

      // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

    • Fix module evaluation when an error is thrown (#4461, #4467)

      If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

    • Fix some edge cases around the new operator (#4477)

      Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

      // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

    ... (truncated)

    Changelog

    Sourced from esbuild's changelog.

    Changelog: 2025

    This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

    0.27.2

    • Allow import path specifiers starting with #/ (#4361)

      Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

      This change was contributed by @​hybrist.

    • Automatically add the -webkit-mask prefix (#4357, #4358)

      This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

      /* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}
/* Old output (with --target=chrome110) */
main {
mask: url(x.png) center/5rem no-repeat;
}
/* New output (with --target=chrome110) */
main {
-webkit-mask: url(x.png) center/5rem no-repeat;
mask: url(x.png) center/5rem no-repeat;
}

      This change was contributed by @​BPJEnnova.

    • Additional minification of switch statements (#4176, #4359)

      This release contains additional minification patterns for reducing switch statements. Here is an example:

      // Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}

    ... (truncated)

    Commits
    Maintainer changes

    This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.


    Updates h3 from 1.15.5 to 1.15.11

    Release notes

    Sourced from h3's releases.

    v1.15.11

    compare changes

    🏡 Chore

    v1.15.10

    compare changes

    🩹 Fixes

    • Preserve percent-encoded req.url in app event handler (#1355)

    ❤️ Contributors

    v1.15.9

    compare changes

    🩹 Fixes

    • Preserve %25 in pathname (1103df6)
    • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
    • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

    v1.15.8

    compare changes

    🩹 Fixes

    • Preserve %25 in pathname (1103df6)

    v1.15.7

    compare changes

    🩹 Fixes

    • static: Narrow path traversal check to match .. as a path segment only (c049dc0)
    • app: Decode percent-encoded path segments to prevent auth bypass (313ea52)

    💅 Refactors

    • Remove implicit event handler conversion warning (#1340)

    ❤️ Contributors

    ... (truncated)

    Changelog

    Sourced from h3's changelog.

    v1.15.11

    compare changes

    🏡 Chore

    ❤️ Contributors

    v1.15.10

    compare changes

    🩹 Fixes

    • Preserve percent-encoded req.url in app event handler (#1355)

    🏡 Chore

    ❤️ Contributors

    v1.15.9

    compare changes

    🩹 Fixes

    • Preserve %25 in pathname (1103df6)
    • static: Prevent path traversal via double-encoded dot segments (%252e%252e) (c56683d)
    • sse: Sanitize carriage returns in event stream data and comments (ba3c3fe)

    🏡 Chore

    ❤️ Contributors

    ... (truncated)

    Commits

    Updates js-yaml from 4.1.1 to 4.3.0

    Changelog

    Sourced from js-yaml's changelog.

    4.3.0, 3.15.0 - 2026-06-27

    Security

    • Backported maxTotalMergeKeys option.

    [5.2.0] - 2026-06-26

    Added

    • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
    • Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

    Removed

    • maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

    Fixed

    • Round-trip of integers with exponential form (>= 1e21)

    [5.1.0] - 2026-06-23

    Added

    • Collection tags can finalize an incrementally populated carrier into a different result value.

    Changed

    • [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

    [5.0.0] - 2026-06-20

    Added

    • Added named exports for schemas, tags, parser events and AST utilities.
    • Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
    • Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
    • Added dump() transform option for changing the generated AST before rendering.
    • Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.
    • Added formal data layers (events and AST) for modular data pipelines.
      • Added low-level parser (to events), presenter and visitor APIs.
    • Added the YAML Test Suite to the test set.

    Changed

    • See the migration guide for upgrade notes.
    • Rewritten in TypeScript and reorganized the public API around flat named exports.

    ... (truncated)

    Commits
    • 33d05b5 4.3.0 released
    • 663bfab Drop demo publish, to not override new v5 one.
    • 1cb8c7b Add v4-legacy tag for publish
    • 02f27af Restore umd builds back to es5
    • 8be84ed Fix es5 compatibility
    • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
    • 6842ef6 doc polish
    • 590dbab 4.2.0 released
    • f944dc5 Add package.json funding field
    • f692719 Changelog update
    • Additional commits viewable in compare view

    Updates nanoid from 3.3.11 to 3.3.15

    Release notes

    Sourced from nanoid's releases.

    3.3.15

    • Fixed npm provenance error.

    3.3.14

    • Fixed random pool corruption on big ID sizes.

    3.3.13

    • Reduced npm package size.

    3.3.12

    • Fixed breaking Nano ID by requesting big ID.
    Changelog

    Sourced from nanoid's changelog.

    3.3.15

    • Fixed npm provenance error.

    3.3.14

    • Fixed random pool corruption on big ID sizes.

    3.3.13

    • Reduced npm package size.

    3.3.12

    • Fixed breaking Nano ID by requesting big ID.
    Commits
    Maintainer changes

    This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.


    Updates picomatch from 2.3.1 to 2.3.2

    Release notes

    Sourced from picomatch's releases.

    2.3.2

    This is a security release fixing several security relevant issues.

    What's Changed

    Full Changelog: micromatch/picomatch@2.3.1...2.3.2

    Changelog

    Sourced from picomatch's changelog.

    Release history

    All notable changes to this project will be documented in this file.

    The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

    • Changelogs are for humans, not machines.
    • There should be an entry for every single version.
    • The same types of changes should be grouped.
    • Versions and sections should be linkable.
    • The latest version comes first.
    • The release date of each versions is displayed.
    • Mention whether you follow Semantic Versioning.

    Changelog entries are classified using the following labels (from keep-a-changelog):

    • Added for new features.
    • Changed for changes in existing functionality.
    • Deprecated for soon-to-be removed features.
    • Removed for now removed features.
    • Fixed for any bug fixes.
    • Security in case of vulnerabilities.

    4.0.0 (2024-02-07)

    Fixes

    Changed

    3.0.1

    Fixes

    ... (truncated)

    Commits

    Updates postcss from 8.5.6 to 8.5.17

    Release notes

    Sourced from postcss's releases.

    8.5.17

    • Fixed Maximum call stack size exceeded error.
    • Fixed Prototype hijacking for postcss.fromJSON().
    • Fixed Input#origin() for unmapped end position (by @​chatman-media).

    8.5.16

    8.5.15

    • Fixed declaration parsing performance (by @​homanp).

    8.5.14

    8.5.13

    • Fixed postcss-scss commend regression.

    8.5.12

    • Fixed reading any file via user-generated CSS.
    • Added opts.unsafeMap to disable checks.

    8.5.11

    • Fixed nested brackets parsing performance (by @​offset).

    8.5.10

    • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

    8.5.9

    • Speed up source map encoding paring in case of the error.

    8.5.8

    • Fixed Processor#version.

    8.5.7

    • Improved source map annotation cleaning performance (by CodeAnt AI).
    Changelog

    Sourced from postcss's changelog.

    8.5.17

    • Fixed Maximum call stack size exceeded error.
    • Fixed Prototype hijacking for postcss.fromJSON().
    • Fixed Input#origin() for unmapped end position (by @​chatman-media).

    8.5.16

    8.5.15

    • Fixed declaration parsing performance (by @​homanp).

    8.5.14

    8.5.13

    • Fixed postcss-scss commend regression.

    8.5.12

    • Fixed reading any file via user-generated CSS.
    • Added opts.unsafeMap to disable checks.

    8.5.11

    • Fixed nested brackets parsing performance (by @​offset).

    8.5.10

    • Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

    8.5.9

    • Speed up source map encoding paring in case of the error.

    8.5.8

    • Fixed Processor#version.

    8.5.7

    • Improved source map annotation cleaning performance (by CodeAnt AI).
    Commits
    Maintainer changes

    This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


    Updates smol-toml from 1.6.0 to 1.7.0

    Release notes

    Sourced from smol-toml's releases.

    v1.7.0

    This version slightly changes the behaviour of stringify: integers beyond the safe range are always emitted as float numbers.

    String decode logic has been rewritten, it is a bit faster now and uses a single-pass approach instead of a dual-pass approach as it did previously. The code should be a bit smaller too, though I didn't actually measure that.

    The package is now published with source-maps, declaration-maps, and a copy of the original TypeScript source files. This will improve your DX if you're like me and like Ctrl+Click'ing things a lot. ;)

    What's Changed

    New Contributors

    Full Changelog: squirrelchat/smol-toml@v1.6.1...v1.7.0

    v1.6.1

    This release addresses a minor security vulnerability where an attacker-controlled TOML document can exploit an unrestricted recustion and cause a stack overflow error with a document that contains thousands of sucessive commented lines. Security advisory: GHSA-v3rj-xjv7-4jmq

    Commits
    • a62f06f revert: keep using vite 7
    • 89aa9a3 chore: remove prepare script
    • 17c7974 chore: make devEngine more lax w/ node version
    • e5280a3 ci: checkout repo first
    • 241c256 chore: version bump
    • 0bfe7f4 chore: build cjs with rolldown instead of esbuild
    • e0620ab chore: fmt
    • 96114cb test: add tests for large integers
    • f4537b6 fix: handle missed edge-cases in string parse
    • 7b39aed chore: include source files in published package
    • Additional commits viewable in compare view

    Updates svgo from 4.0.0 to 4.0.2

    Release notes

    Sourced from svgo's releases.

    v4.0.2

    What's Changed

    Security

    Bug Fixes

    Performance

    Other Changes

    v4.0.1

    What's Changed

    Dependencies

    • Sets minimum version of sax (XML parser) to v1.5.0, which improves built-in guards against entity expansion.

    Bug Fixes

    Performance

    • convertPathData, refactor to reduce redundant equality ...

      Description has been truncated

    @dependabot
    chore(deps): bump the npm_and_yarn group across 1 directory with 12 u…
    b57bee7 
    …pdates

Bumps the npm_and_yarn group with 1 update in the /website directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro).


Updates `astro` from 7.0.7 to 7.2.0
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.0/packages/astro)

Updates `defu` from 6.1.4 to 6.1.7
- [Release notes](https://github.com/unjs/defu/releases)
- [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md)
- [Commits](unjs/defu@v6.1.4...v6.1.7)

Updates `devalue` from 5.6.3 to 5.8.1
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.6.3...v5.8.1)

Updates `esbuild` from 0.25.12 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md)
- [Commits](evanw/esbuild@v0.25.12...v0.28.1)

Updates `h3` from 1.15.5 to 1.15.11
- [Release notes](https://github.com/h3js/h3/releases)
- [Changelog](https://github.com/h3js/h3/blob/v1.15.11/CHANGELOG.md)
- [Commits](h3js/h3@v1.15.5...v1.15.11)

Updates `js-yaml` from 4.1.1 to 4.3.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.1...4.3.0)

Updates `nanoid` from 3.3.11 to 3.3.15
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.11...3.3.15)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `postcss` from 8.5.6 to 8.5.17
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.17)

Updates `smol-toml` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/squirrelchat/smol-toml/releases)
- [Commits](squirrelchat/smol-toml@v1.6.0...v1.7.0)

Updates `svgo` from 4.0.0 to 4.0.2
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v4.0.0...v4.0.2)

Updates `vite` from 6.4.1 to 8.1.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.4/packages/vite)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 7.2.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: defu
  dependency-version: 6.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: devalue
  dependency-version: 5.8.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: h3
  dependency-version: 1.15.11
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.15
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.17
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: smol-toml
  dependency-version: 1.7.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: svgo
  dependency-version: 4.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
    @dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 10, 2026
    @socket-security

    socket-security Bot commented Aug 10, 2026

    Copy link
    Copy Markdown

    Review the following changes in direct dependencies. Learn more about Socket for GitHub.

    Diff Package Supply Chain
    Security    		 Vulnerability Quality Maintenance License
    Added@​astrojs/​starlight@​0.41.7981008597100
    Addedastro@​7.2.0971008896100
    Addedsharp@​0.35.39710010092100

    View full report

    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Reviewers

    No reviews

    Assignees

    No one assigned

    Labels

    dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

    Projects

    None yet

    Milestone

    No milestone

    Development

    Successfully merging this pull request may close these issues.

    0 participants