Skip to content

chore(deps): bump the npm_and_yarn group across 8 directories with 9 updates - #1364

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-4719ef7c0c
Open

chore(deps): bump the npm_and_yarn group across 8 directories with 9 updates#1364
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-4719ef7c0c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026 •
edited by cubic-dev-ai Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package From To
astro 6.4.8 7.1.0
vite 6.4.2 6.4.3
linkify-it 5.0.0 5.0.2
markdown-it 14.1.1 14.3.0
tar 7.5.15 7.5.20
ws 8.19.0 8.21.1

Bumps the npm_and_yarn group with 4 updates in the /apps/devrel directory: vite, esbuild, js-yaml and ws.
Bumps the npm_and_yarn group with 1 update in the /changelog directory: astro.
Bumps the npm_and_yarn group with 1 update in the /demos/remotion-video directory: esbuild.
Bumps the npm_and_yarn group with 1 update in the /docs-site directory: astro.
Bumps the npm_and_yarn group with 1 update in the /landing directory: astro.
Bumps the npm_and_yarn group with 1 update in the /presentation directory: vite.
Bumps the npm_and_yarn group with 3 updates in the /website directory: astro, vite and ws.

Updates astro from 6.4.8 to 7.1.0

Release notes

Sourced from astro's releases.

astro@7.1.0

Minor Changes

  • #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

    // src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

  • #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

    Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

    // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});

    Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

  • #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

    Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

    Scoping sources and hashes in your config

    Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.

    // astro.config.mjs

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.0

Minor Changes

  • #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

    // src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

  • #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

    Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

    // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});

    Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

  • #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

    Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

    Scoping sources and hashes in your config

    Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.

    

    • 






... (truncated)





Commits






Updates vite from 6.4.2 to 6.4.3



Release notes

Sourced from vite's releases.




v6.4.3


Please refer to CHANGELOG.md for details.







Changelog

Sourced from vite's changelog.




6.4.3 (2026-06-01)








Commits






Updates linkify-it from 5.0.0 to 5.0.2



Changelog

Sourced from linkify-it's changelog.




5.0.2 / 2026-07-02


    

  • Fixed DoS in mailto: links (restrict user name to 64 chars).
    • 

  • Restricted user/pass part length in links.
    • 



5.0.1 / 2026-05-23


    

  • Fixed DoS in fuzzy links/emails search.
    • 

  • Reworked search logic - check each pattern separate, use g regexes instead
of slice.
    • 

  • Removed internal cache - useless overcomplication.
    • 








Commits






Updates markdown-it from 14.1.1 to 14.3.0



Changelog

Sourced from markdown-it's changelog.




[14.3.0] - 2026-07-02


Changed


    

  • Reworked build pipeline & tools.
    • 

  • Added source maps.
    • 

  • Bumped linkify-it to 5.0.2.
    • 



Fixed


    

  • Preserve backslash-space hard line breaks, matching CommonMark 6.7, #1185.
    • 



[14.2.0] - 2026-05-24


Added


    

  • isPunctCharCode to utilities.
    • 



Fixed


    

  • Don't end HTML comment blocks on a blank line, #1155.
    • 

  • Properly recognize astral chars (surrogates) in delimiter scans for
emphasis-like markers, #1072. Big thanks to @​tats-u for his global efforts
with improving CJK support.
    • 

  • Preserve unicode whitespaces when trimm headings/paragraphs, #1074.
    • 

  • More strict entities decode to avoid false positives ;, #1096.
    • 

  • Restore block parser state on fail in lheading rule, #1131.
    • 



Security


    

  • Fixed poor smartquotes perfomance on > 70k quotes in single block
    • 

  • Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.
    • 








Commits

    

  • ff0ee08 14.3.0 released
    • 

  • 52e2749 Bump linkify-it / vite deps
    • 

  • 56c2404 fix: keep backslash-space hard line break (CommonMark 6.7) (#1185)
    • 

  • 0fbb18b Bump vite from 8.0.14 to 8.0.16 (#1181)
    • 

  • 83450e2 Rework benchmark deps and bump versions
    • 

  • 57a6863 benchmark => tinybench
    • 

  • 7608db1 Update CI config
    • 

  • 9d8eb42 Added package-lock and updated versions to latest possible
    • 

  • 0aee70d lint: enable @​stylistic/no-multi-spaces rule
    • 

  • 8878985 lint => neostandard
    • 

  • Additional commits viewable in compare view
    • 







Updates tar from 7.5.15 to 7.5.20



Commits






Updates ws from 8.19.0 to 8.21.1



Release notes

Sourced from ws's releases.




8.21.1


Bug fixes


    

  • Empty fragments are now counted toward the limit (a2f4e7c0).
    • 

  • The default values of the maxBufferedChunks and maxFragments options have
been reduced (f197ac65).
    • 



8.21.0


Features


    

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).
    • 



Bug fixes


    

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).
    • 



A high volume of tiny fragments and data chunks could be sent by a peer, using
modest network traffic, to crash a ws server or client due to OOM.


import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});





... (truncated)





Commits

    

  • ae1de54 [dist] 8.21.1
    • 

  • 8e9511b [ci] Trust Coveralls Homebrew tap
    • 

  • f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
    • 

  • 8df8265 [ci] Update actions/checkout action to v7
    • 

  • a2f4e7c [fix] Count empty fragments toward the limit (#2329)
    • 

  • e79f912 [pkg] Approve install scripts for bufferutil and utf-8-validate
    • 

  • 4ea355d [doc] Document 32-bit signed integer coercion for option values
    • 

  • 2120f4c [example] Remove uuid dependency
    • 

  • 4c534a6 [security] Add latest vulnerability to SECURITY.md
    • 

  • bca91ad [dist] 8.21.0
    • 

  • Additional commits viewable in compare view
    • 







Updates vite from 7.3.3 to 7.3.6



Release notes

Sourced from vite's releases.




v6.4.3


Please refer to CHANGELOG.md for details.







Changelog

Sourced from vite's changelog.




6.4.3 (2026-06-01)








Commits






Updates @babel/core from 7.28.5 to 7.29.7



Release notes

Sourced from @​babel/core's releases.




v7.29.7 (2026-05-25)


Re-release all packages with npm provenance attestations


v7.29.6 (2026-05-25)


🐛 Bug Fix



Committers: 3



v7.29.5 (2026-05-05)


🏠  Internal


    

  • babel-preset-env

      

    • Update @babel/* dependencies
      • 

    

    • 



v7.29.4 (2026-05-05)


🐛 Bug Fix


    

  • babel-plugin-transform-modules-systemjs

      

    • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)
      • 

    

    • 



Committers: 1



v7.29.3 (2026-04-30)


👓 Spec Compliance



🐛 Bug Fix


    

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

      

    • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
      • 

    

    • 

  • babel-register


    • 

  • babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env


    • 



💅 Polish


    

  • babel-parser
    • 






... (truncated)





Commits






Updates esbuild from 0.27.2 to 0.28.1



Release notes

Sourced from esbuild's releases.




v0.28.1


    

  • 

    Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)
    

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.
    

    Thanks to @​dellalibera for reporting this issue.
    

    • 

  • 

    Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)
    

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.
    

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.
    

    Thanks to @​sondt99 for reporting this issue.
    

    • 

  • 

    Avoid inlining using and await using declarations (#4482)
    

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
    

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
    

    • 

  • 

    Fix module evaluation when an error is thrown (#4461, #4467)
    

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
    

    • 

  • 

    Fix some edge cases around the new operator (#4477)
    

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
    

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();
    

    • 






... (truncated)





Changelog

Sourced from esbuild's changelog.




Changelog: 2025


This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).







Commits






Updates vite from 7.3.3 to 7.3.6



Release notes

Sourced from vite's releases.




v6.4.3


Please refer to CHANGELOG.md for details.







Changelog

Sourced from vite's changelog.




6.4.3 (2026-06-01)








Commits






Removes js-yaml


Updates ws from 8.18.3 to 8.21.1



Release notes

Sourced from ws's releases.




8.21.1


Bug fixes


    

  • Empty fragments are now counted toward the limit (a2f4e7c0).
    • 

  • The default values of the maxBufferedChunks and maxFragments options have
been reduced (f197ac65).
    • 



8.21.0


Features


    

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).
    • 



Bug fixes


    

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).
    • 



A high volume of tiny fragments and data chunks could be sent by a peer, using
modest network traffic, to crash a ws server or client due to OOM.


import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});





... (truncated)





Commits

    

  • ae1de54 [dist] 8.21.1
    • 

  • 8e9511b [ci] Trust Coveralls Homebrew tap
    • 

  • f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
    • 

  • 8df8265 [ci] Update actions/checkout action to v7
    • 

  • a2f4e7c [fix] Count empty fragments toward the limit (#2329)
    • 

  • e79f912 [pkg] Approve install scripts for bufferutil and utf-8-validate
    • 

  • 4ea355d [doc] Document 32-bit signed integer coercion for option values
    • 

  • 2120f4c [example] Remove uuid dependency
    • 

  • 4c534a6 [security] Add latest vulnerability to SECURITY.md
    • 

  • bca91ad [dist] 8.21.0
    • 

  • Additional commits viewable in compare view
    • 







Updates astro from 6.1.10 to 7.1.0



Release notes

Sourced from astro's releases.




astro@7.1.0


Minor Changes


    

  • 

    #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader
    

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.
    

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
    

    // src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
    

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
    

    • 

  • 

    #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store
    

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.
    

    Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
    

    // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
    

    Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.
    

    • 

  • 

    #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.
    

    Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.
    

    Scoping sources and hashes in your config
    

    Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.
    

    // astro.config.mjs
    

    • 






... (truncated)





Changelog

Sourced from astro's changelog.




7.1.0


Minor Changes


    

  • 

    #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader
    

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.
    

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
    

    // src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
    

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
    

    • 

  • 

    #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store
    

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.
    

    Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
    

    // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
    

    Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.
    

    • 

  • 

    #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.
    

    Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.
    

    Scoping sources and hashes in your config
    

    Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.
    

    

    • 






... (truncated)





Commits






Updates vite from 7.3.3 to 8.1.5



Release notes

Sourced from vite's releases.




v6.4.3


Please refer to CHANGELOG.md for details.







Changelog

Sourced from vite's changelog.




6.4.3 (2026-06-01)








Commits

    

  • 6c2c881 release: v6.4.3
    • 

  • 96b0c10 fix: backport #22572, reject windows alternate paths (#22576)
    • 

  • 8fed5cf fix(deps...

    Description has been truncated
    


    

    Summary by cubic
    

    Upgrade dependencies across the monorepo to adopt astro 7.x and refresh build tooling. This also pulls in security fixes from ws, tar, linkify-it, and esbuild.
    

      

    • 

      Dependencies
      

        

      • astro → 7.1.x across root, changelog, docs-site, landing, and website; updated @astrojs/react and @astrojs/vercel to match.
        • 

      • vite bumped (root to 6.4.3; website to 8.1.5) along with related tooling (@vitejs/plugin-react in apps/devrel).
        • 

      • Security updates: ws 8.21.1 (DoS fix, new fragment limits), tar 7.5.20 (decompression guard), linkify-it 5.0.2 (DoS fixes), esbuild 0.28.1 (Windows path hardening).
        • 

      • Dev tools: @storybook/react-vite 10.5.3, @slidev/cli 52.18.0, @remotion/cli 4.0.496, eslint 10 in apps/devrel.
        • 

      

      • 

    • 

      Migration
      

        

      • Install and rebuild each app: run npm install, then build/preview locally.
        • 

      • For astro 7: verify astro.config.*, content collections, and @astrojs/* integrations.
        • 

      • For vite 8 in website: confirm plugin compatibility and dev server middleware.
        • 

      

      • 

    

    Written for commit 01e287e. Summary will update on new commits.
    

    Review in cubic
    


    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          chore(deps): bump the npm_and_yarn group across 8 directories with 9 …
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          01e287e
        
      

    

  

    

      
…updates

Bumps the npm_and_yarn group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `6.4.8` | `7.1.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.2` | `6.4.3` |
| [linkify-it](https://github.com/markdown-it/linkify-it) | `5.0.0` | `5.0.2` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.1` | `14.3.0` |
| [tar](https://github.com/isaacs/node-tar) | `7.5.15` | `7.5.20` |
| [ws](https://github.com/websockets/ws) | `8.19.0` | `8.21.1` |

Bumps the npm_and_yarn group with 4 updates in the /apps/devrel directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [esbuild](https://github.com/evanw/esbuild), [js-yaml](https://github.com/nodeca/js-yaml) and [ws](https://github.com/websockets/ws).
Bumps the npm_and_yarn group with 1 update in the /changelog directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro).
Bumps the npm_and_yarn group with 1 update in the /demos/remotion-video directory: [esbuild](https://github.com/evanw/esbuild).
Bumps the npm_and_yarn group with 1 update in the /docs-site directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro).
Bumps the npm_and_yarn group with 1 update in the /landing directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro).
Bumps the npm_and_yarn group with 1 update in the /presentation directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Bumps the npm_and_yarn group with 3 updates in the /website directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [ws](https://github.com/websockets/ws).


Updates `astro` from 6.4.8 to 7.1.0
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.0/packages/astro)

Updates `vite` from 6.4.2 to 6.4.3
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `linkify-it` from 5.0.0 to 5.0.2
- [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/linkify-it@5.0.0...5.0.2)

Updates `markdown-it` from 14.1.1 to 14.3.0
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@14.1.1...14.3.0)

Updates `tar` from 7.5.15 to 7.5.20
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v7.5.15...v7.5.20)

Updates `ws` from 8.19.0 to 8.21.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.19.0...8.21.1)

Updates `vite` from 7.3.3 to 7.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `@babel/core` from 7.28.5 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core)

Updates `esbuild` from 0.27.2 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md)
- [Commits](evanw/esbuild@v0.27.2...v0.28.1)

Updates `vite` from 7.3.3 to 7.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Removes `js-yaml`

Updates `ws` from 8.18.3 to 8.21.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.19.0...8.21.1)

Updates `astro` from 6.1.10 to 7.1.0
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.0/packages/astro)

Updates `vite` from 7.3.3 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `esbuild` from 0.27.7 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md)
- [Commits](evanw/esbuild@v0.27.2...v0.28.1)

Updates `js-yaml` from 4.1.1 to 4.3.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `esbuild` from 0.28.0 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md)
- [Commits](evanw/esbuild@v0.27.2...v0.28.1)

Updates `ws` from 8.17.1 to 8.21.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.19.0...8.21.1)

Updates `astro` from 6.3.3 to 7.1.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.0/packages/astro)

Updates `vite` from 7.3.3 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `esbuild` from 0.27.7 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md)
- [Commits](evanw/esbuild@v0.27.2...v0.28.1)

Updates `js-yaml` from 4.1.1 to 4.3.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `astro` from 6.1.10 to 7.1.0
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.0/packages/astro)

Updates `vite` from 7.3.3 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `esbuild` from 0.27.7 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md)
- [Commits](evanw/esbuild@v0.27.2...v0.28.1)

Updates `js-yaml` from 4.1.1 to 4.3.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `vite` from 7.3.3 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `@babel/core` from 7.29.0 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core)

Updates `js-yaml` from 3.14.2 to 3.15.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `linkify-it` from 5.0.0 to 5.0.2
- [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/linkify-it@5.0.0...5.0.2)

Updates `markdown-it` from 14.1.1 to 14.3.0
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@14.1.1...14.3.0)

Updates `astro` from 6.1.10 to 7.1.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.0/packages/astro)

Updates `vite` from 6.4.2 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `@babel/core` from 7.28.5 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core)

Updates `js-yaml` from 4.1.1 to 4.3.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `ws` from 8.18.3 to 8.21.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.19.0...8.21.1)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 7.1.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 6.4.3
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: linkify-it
  dependency-version: 5.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: markdown-it
  dependency-version: 14.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-version: 7.5.20
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.21.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.3.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@babel/core"
  dependency-version: 7.29.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.3.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version:
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.21.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 7.1.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.21.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 7.1.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 7.1.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@babel/core"
  dependency-version: 7.29.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.15.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: linkify-it
  dependency-version: 5.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: markdown-it
  dependency-version: 14.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 7.1.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@babel/core"
  dependency-version: 7.29.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.21.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
          

  
  

  
    

        

              @dependabot


        

      

            dependabot
Bot

              requested a review
  from wildcard
    as a code owner


        July 21, 2026 18:51        
        
      

    





    

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      

  dependencies

  Dependency updates

      

  javascript

  Pull requests that update javascript code

  labels


      Jul 21, 2026

    

  








      

  
      



  

  @vercel






  



    

      

  

    

      
          
      

      
            vercel
    Bot

      

      

      commented


        Jul 21, 2026



      
  •

  

    
      

        
          edited
          
        
        
      

    
    
      
  
        
      Loading


  
    
  



    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        



        

    

  





      


        



  
    

      
          
The latest updates on your projects. Learn more about Vercel for GitHub.






Project
Deployment
Actions
Updated (UTC)






caro-foss-website
Error Error

Jul 21, 2026 6:52pm






5 Skipped Deployments





Project
Deployment
Actions
Updated (UTC)






caro-docs
Ignored Ignored

Jul 21, 2026 6:52pm




caro-slides
Ignored Ignored

Jul 21, 2026 6:52pm




caro-storybook
Ignored Ignored

Jul 21, 2026 6:52pm




cmdai
Ignored Ignored

Jul 21, 2026 6:52pm




cmdai-saas
Ignored Ignored

Jul 21, 2026 6:52pm








Request Review


      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
            

    

      
    

    


      


          @github-actions
github-actions
Bot



            added
      

  website

  Related to website

      

  size/XL

  Extra large PR (> 500 lines)

    and removed
      

  dependencies

  Dependency updates

  labels


      Jul 21, 2026

    

  



  

  







      

  
      



  

  @github-actions






  



    

      

  

    

      
          
      

      
            github-actions
    Bot

      

      

      commented


        Jul 21, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        

  
    Contributor


        

    

  





      


        



  
    

      
          
Dependency Review Summary


The full dependency review summary was too large to display here (1409KB, limit is 1024KB).


Please download the artifact named "dependency-review-summary" to view the complete report.


View full job summary



      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    
















  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    


      

          


  
      @wildcard
  
    wildcard


          Awaiting requested review from wildcard


                    wildcard is a code owner
      



      







    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

      

    javascript

  Pull requests that update javascript code
  

    size/XL

  Extra large PR (> 500 lines)
  

    website

  Related to website








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
        

  

    

      0 participants