Skip to content

build(deps): bump astro from 7.1.3 to 7.2.8 in /src/frontend - #1641

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/frontend/astro-7.2.8
Closed

build(deps): bump astro from 7.1.3 to 7.2.8 in /src/frontend#1641
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/frontend/astro-7.2.8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor

Bumps astro from 7.1.3 to 7.2.8.

Release notes

Sourced from astro's releases.

astro@7.2.8

Patch Changes

astro@7.2.7

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

  • #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

astro@7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

astro@7.2.5

Patch Changes

  • #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

    As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

  • #17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #17783 60b14ff Thanks @​matthewp! - Fixes a type error when passing an image from a content collection image() schema to a component or <Image />. The schema returned by image() was missing the apng format, so it no longer matched the type of an imported image.

  • #17664 d483125 Thanks @​astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases "unsafe-inline" resource. Now when "unsafe-inline", Astro won't emit hashes for the directive specified.

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.8

Patch Changes

7.2.7

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

  • #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

7.2.5

Patch Changes

  • #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

    As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

  • #17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump astro from 7.1.3 to 7.2.8 in /src/frontend
bc337b4 
Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 7.1.3 to 7.2.8.
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.8/packages/astro)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 7.2.8
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 10, 2026
Copilot AI lite review requested due to automatic review settings September 10, 2026 01:49
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 10, 2026
Copilot AI reviewed Sep 10, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The Astro bump introduces a Sharp minimum version expectation and a markdown-remark peer version mismatch that should be reconciled in src/frontend/package.json and the lockfile before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the src/frontend Astro (and related lockfile transitive dependencies) to the latest patch release to keep the documentation site/tooling current.

Changes:

  • Bump astro from 7.1.3 to 7.2.8 in src/frontend/package.json.
  • Refresh src/frontend/pnpm-lock.yaml to reflect Astro 7.2.8’s updated transitive dependency graph (e.g., Vite/esbuild, Sharp, etc.).
File summaries
File Description
src/frontend/package.json Updates the direct Astro dependency version.
src/frontend/pnpm-lock.yaml Re-locks dependencies after the Astro upgrade, pulling in updated transitive versions and metadata.
Review details
  • Files reviewed: 1/2 changed files
  • Comments generated: 2
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread src/frontend/package.json
Comment on lines 79 to 81
"asciinema-player": "^3.17.0",
"astro": "^7.1.3",
"astro": "^7.2.8",
"astro-contributors": "^0.9.0",
Comment thread src/frontend/pnpm-lock.yaml
Comment on lines 2304 to 2306
peerDependencies:
'@astrojs/markdown-remark': 7.2.1
'@astrojs/markdown-remark': 7.2.4
peerDependenciesMeta:
@IEvangelist David Pine (IEvangelist) mentioned this pull request Sep 10, 2026
Open
@IEvangelist

David Pine (IEvangelist) commented Sep 10, 2026

Copy link
Copy Markdown
Member

Tracked/superseded by #1645 — the [auto-sec] canonical remediation for the aspire.dev frontend npm security cluster, which folds this update in and clears all 12 open Dependabot alerts. Keeping this open until the canonical PR is confirmed green, then it will be closed as superseded.

@IEvangelist

David Pine (IEvangelist) commented Sep 10, 2026

Copy link
Copy Markdown
Member

Superseded by #1645, the canonical [auto-sec] consolidation for /src/frontend npm dependencies. #1645 is open, mergeable, conflict-free, and CI-green (frontend build + all E2E suites pass), and it already includes this bump (regenerated pnpm-lock.yaml with public-registry tarballs + overrides clearing all Dependabot alerts). Closing per the automation closure gate; will be reopened if #1645 is not merged.

@dependabot @github

dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/src/frontend/astro-7.2.8 branch September 10, 2026 15:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@IEvangelist David Pine (IEvangelist) Awaiting requested review from IEvangelist IEvangelist is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@IEvangelist