fix(deps): update all non-major dependencies#573
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
seren-dev | 4b582cc | May 11 2026, 09:10 PM |
71e2b4a to
073b90e
Compare
44ac806 to
dc8b74a
Compare
Owner
|
Cannot be merged until https://github.com/withastro/astro/blob/main/.changeset/cloudflare-session-kv-duplication.md (permalink) is released. |
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
dc8b74a to
4b582cc
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.



This PR contains the following updates:
13.3.0→13.5.04.2.4→4.3.0^6.2.1→^6.3.1^19.2.5→^19.2.6^19.2.5→^19.2.64.2.4→4.3.08.1.0→8.2.04.87.0→4.90.0Release Notes
withastro/astro (@astrojs/cloudflare)
v13.5.0Compare Source
Minor Changes
4d72482Thanks @ematipico! - The adapter now depends on Astro 6.3.0.v13.4.0Compare Source
Minor Changes
#16519
1b1c218Thanks @louisescher! - Adds support for redirecting URLs in remote image optimization.Previously, when a remote image URL meant to be optimized by Astro led to a redirect, Astro would fail silently and ignore the redirect. Now, Astro tracks up to 10 redirects for these images. If any of the redirects are not covered by a pattern in
image.remotePatternsor a domain inimage.domains, Astro will fail with a helpful error message.In the following example, the first image would be loaded successfully, while the second would lead to Astro throwing an error:
In cases where all redirects to HTTPS hosts should be trusted, the following configuration for
image.remotePatternscan be used:Patch Changes
v13.3.1Compare Source
Patch Changes
#16552
409f6efThanks @web-dev0521! - Fixes an issue where existing KV namespace bindings were silently removed when session support was enabled.#16277
7666bcdThanks @Calvin-LL! - Fix static assets and prerendered pages 404ing whenbaseis configured.Updated dependencies []:
tailwindlabs/tailwindcss (@tailwindcss/vite)
v4.3.0Compare Source
Added
@container-sizeutility (#18901)scrollbar-{auto,thin,none}utilities forscrollbar-width, andscrollbar-thumb-*/scrollbar-track-*color utilities forscrollbar-color(#19981, #20019)scrollbar-gutter-*utilities (#20018)zoom-*utilities (#20020)tab-*utilities (#20022)@variantwith stacked variants (e.g.@variant hover:focus { … }) (#19996)@variantwith compound variants (e.g.@variant hover, focus { … }) (#19996)--default(…)in--value(…)and--modifier(…)for functional@utilitydefinitions (#19989)Fixed
@pluginresolves package JavaScript entries instead of browser CSS entries when using@tailwindcss/vite(#19949)@importand@pluginpaths resolving from the wrong directory when using@tailwindcss/vite(#19965)@variantare processed by@tailwindcss/vite(#19966)basewhenresult.opts.fromis not provided when using@tailwindcss/postcss(#19980)_whitespace in arbitrary values (#19986)w-[calc(100%---spacing(60))]→w-[calc(100%-(--spacing(60)))]) (#19986)-mt-[20in]→mt-[-20in], notmt-[-1920px]) (#19988):has()variants from[&:has(…)]tohas-[…](#19991)styleattributes (e.g.style="flex-grow: 1"→style="flex-grow: 1", notstyle="grow: 1") (#19918)@utilitydefinitions with the same name but different value types (#19777)PluginWithConfigtype fromtailwindcss/pluginto fix errors when inferring plugin config types (#19707)startandendlegacy utilities without values do not generate CSS (#20003)--value(…)is required in functional@utilitydefinitions (#20005)-left-[(var(--a)+var(--b))]) (#20011)withastro/astro (astro)
v6.3.1Compare Source
Patch Changes
15fbc41Thanks @matthewp! - Fixes local images returning 404 on non-prerendered pages when using the generic image endpointv6.3.0Compare Source
Minor Changes
#16366
d69f858Thanks @matthewp! - Adds a newexperimental.advancedRoutingoption that lets you take full control of Astro's request handling pipeline by creating asrc/app.tsfile in your project.Today, Astro handles every incoming request through a fixed internal pipeline: trailing slash normalization, redirects, actions, middleware, page rendering, i18n, and so on. That pipeline works great for most sites, but as projects grow you often want to run your own logic between those steps — an auth check before rendering, a rate limiter before actions, custom logging around the whole stack. Advanced routing gives you that control.
When enabled, Astro looks for a
src/app.tsfile in your project. If it finds one, that file becomes the entrypoint for all server-rendered requests. You compose the pipeline yourself using the handlers Astro provides, and you can slot your own logic anywhere in the chain.Enabling advanced routing
Two ways to build your pipeline
Astro ships two entrypoints for advanced routing:
astro/fetchandastro/hono.astro/fetchis a low-level, framework-free API built on the Web Fetch standard. You create aFetchStatefrom the incoming request, then call handler functions in sequence. Each handler takes the state, does its work, and returns aResponse(orundefinedto pass through). This is the core primitive that everything else is built on:astro/honowraps the same handlers as Hono middleware, so you can mix Astro's pipeline with Hono's ecosystem of middleware (logger, CORS, JWT, rate limiting, etc.) using theapp.use()pattern you already know:Both approaches give you the same power — pick whichever fits your project. If you don't need a framework,
astro/fetchkeeps things minimal. If you want a rich middleware ecosystem,astro/honogets you there with one import.For more information on enabling and using this feature in your project, see the experimental advanced routing docs. To give feedback, or to keep up with its development, see the advanced routing RFC for more information and discussion.
#16366
d69f858Thanks @matthewp! - Adds aconsume()instance method toAstroCookies. This method marks the cookies as consumed and returns theSet-Cookieheader values. After consumption, any subsequentset()calls will log a warning, since the headers have already been sent.Previously this was only available as a static method
AstroCookies.consume(cookies). The static method is now deprecated but kept for backward compatibility with existing adapters.#16412
ba2d2e3Thanks @0xbejaxer! - Add retry and error event handling forastro-islandhydration import failures to reduce unrecoverable hydration errors on transient network failures.#16582
885cd31Thanks @Princesseuh! - Adds a newimage.dangerouslyProcessSVGflag to optionally enable processing SVG inputs. For security reasons, Astro will no longer rasterizes SVG image sources by default in its default image service and endpoint.Set
image.dangerouslyProcessSVG: trueto opt back into processing SVG inputs.Note that this is a breaking change for users who were previously relying on Astro's default image service to rasterize SVG inputs, but it is a necessary change to improve security and prevent potential vulnerabilities.
#16519
1b1c218Thanks @louisescher! - Adds support for redirecting URLs in remote image optimization.Previously, when a remote image URL meant to be optimized by Astro led to a redirect, Astro would fail silently and ignore the redirect. Now, Astro tracks up to 10 redirects for these images. If any of the redirects are not covered by a pattern in
image.remotePatternsor a domain inimage.domains, Astro will fail with a helpful error message.In the following example, the first image would be loaded successfully, while the second would lead to Astro throwing an error:
In cases where all redirects to HTTPS hosts should be trusted, the following configuration for
image.remotePatternscan be used:Patch Changes
#16592
9c6efc5Thanks @matthewp! - Escapes interpolated values in the dev server redirect HTML template, consistent with how the 404 template already handles them#16585
78f305eThanks @web-dev0521! - Fixesz.array(z.boolean())in form actions incorrectly coercing the string"false"totrue. Boolean array elements now use the same'true'/'false'string comparison as singlez.boolean()fields, so submitting["false", "true", "false"]correctly parses as[false, true, false].#16567
12a03f2Thanks @matthewp! - Fixes deleted content collection entries persisting ingetCollection()results during dev#16595
ce9b25cThanks @web-dev0521! - FixespushDirectivein the CSP runtime duplicating the new directive once per existing non-matching directive. CallinginsertDirective()(or otherwise pushing a directive whose name is not yet in the list) now appends it exactly once, and a directive that merges with a later existing entry no longer leaves an unmerged copy behind.#16600
94e4b7cThanks @web-dev0521! - FixesAstro.preferredLocalereturning the wrong value wheni18n.localesmixes object-form entries ({ path, codes }) with string entries that normalize to the same locale. The first matching code in the configuredlocalesorder is now selected, matching the documented behavior.#16591
cce20f7Thanks @matthewp! - Uses a consistent generic error message in the image endpoint across all adapters#16629
f54be80Thanks @g-taki! - Fixes a bug where SSR responses inastro devcould crash withTypeError: this.logger.flush is not a function.#16589
3740b24Thanks @ArmandPhilippot! - Fixes an outdated code snippet in the documentation for session storage configuration.Updated dependencies [
354e231]:v6.2.2Compare Source
Patch Changes
#16292
00f48eeThanks @p-linnane! - Fixes head metadata propagation in dev for adapters that load modules in theprerenderVite environment, such as@astrojs/cloudflare. Theastro:head-metadataplugin previously only tracked thessrenvironment, somaybeRenderHead()could fire inside an unrelated component's<template>element, trapping subsequent hoisted<style>blocks.#16451
778865fThanks @maximslo! - Fixes build crash when processing animated AVIF images. Sharp now gracefully passes through unsupported image formats instead of crashing during the build.#16548
7214d3eThanks @senutpal! - Fixes scoped styles applying to the wrong element whenvite.css.transformeris set to'lightningcss'and a selector uses a nested&inside:where(...), such as Tailwind v4'sspace-x-*,space-y-*, anddivide-*utilities.#16566
9ac96b4Thanks @web-dev0521! - Fixesdata-astro-prefetch="tap"not triggering when clicking nested elements (e.g.<span>,<img>,<svg>) inside an anchor tag.#15994
1e70d18Thanks @ossaidqadri! - Fix<style>compilation failure when importing Astro components via tsconfig path aliases#16144
1cd6650Thanks @fkatsuhiro! - Fixed a regression where.htmlwas unexpectedly stripped from dynamic route parameters on non-page routes (.tsendpoints and redirects). This caused endpoints like/some/[...id].tsreturningid: 'file.html'ongetStaticPathsto not serve that file because the generated route (/some/file.html) would get matched asid: filethat is not part of the list returned bygetStaticPaths.#16415
559c0fdThanks @0xbejaxer! - Fix CSS traversal boundaries so pages withexport const partial = truestill contribute styles when imported as components by other pages.#16516
17f1867Thanks @fkatsuhiro! - Fixes an issue where the index route would return a 404 error when using a custombasepath combined withtrailingSlash: 'never'. This ensures that the home page and internal rewrites are correctly matched under these configurations.#16515
280ec88Thanks @jp-knj! - Fixes an issue wherei18n.fallbackpages withfallbackType: 'rewrite'were emitted with empty bodies duringastro build.#16565
7959798Thanks @enjoyandlove! - Fixes session persistence whensession.delete()is the first mutation in a request (no priorget,set,has, orkeys). The session was marked dirty in memory, but persistence skipped the save because#datastayedundefined, so the backing store could still return the deleted key on the next request.#16527
86fd80dThanks @enjoyandlove! - Prevents script deduplication state from being consumed while rendering inert<template>contexts.#16540
e59c637Thanks @ascorbic! - Skips session storage reads when no session cookie is present. Previously, callingsession.get()on a request without a session cookie would initialize the storage driver and make a read that was guaranteed to miss. On network-backed drivers this added latency and resource usage to every anonymous request.#16517
6ab0b3cThanks @adamchal! - Removes inline CSS for prerendered routes from the SSR manifest. The static HTML on disk already inlines those styles, and the SSR worker never renders prerendered routes, so the data was dead weight. Builds with many prerendered routes andbuild.inlineStylesheets: "always"(or"auto"with small stylesheets) will see a smaller SSR entry chunk, which reduces cold-start parse time on platforms like Cloudflare Workers.#16509
d3d3557Thanks @cyphercodes! - Fix conditional named slot callbacks receiving arguments fromAstro.slots.render().#16236
c6b068eThanks @fkatsuhiro! - Fixes thepositionprop on<Image />and<Picture />components to correctly applyobject-positionstyles#16018
d14f47cThanks @felmonon! - FixdefineLiveCollection()soLiveLoaderdata types declared as interfaces are accepted.facebook/react (react)
v19.2.6: 19.2.6 (May 6th, 2026)Compare Source
React Server Components
(by @eps1lon and @unstubbable)
nodejs/undici (undici)
v8.2.0Compare Source
What's Changed
New Contributors
Full Changelog: nodejs/undici@v8.1.0...v8.2.0
cloudflare/workers-sdk (wrangler)
v4.90.0Compare Source
Minor Changes
#12279
248bc08Thanks @penalosa! - Add deprecation warning fordelivery_delayin queue producer bindingsThe
delivery_delaysetting in[[queues.producers]]was silently having no effect since 2024. This change adds a deprecation warning when the setting is used, informing users that queue-level settings should be configured usingwrangler queues updateinstead. The setting will be removed in a future version.Patch Changes
#13853
8852b0cThanks @gpanders! - Fix Containers SSH config#13858
e414e56Thanks @penalosa! - Fixwrangler whoamiand account selection failing for Account API TokensThe
/membershipsfallback for Account API Tokens was checking for code 9109, but/membershipsactually returns 9106 for that case. Correct the code so the fallback to/accountstriggers as intended.Updated dependencies []:
v4.89.1Compare Source
Patch Changes
#13824
dd3baf3Thanks @emily-shen! - Fix container deployment being skipped for Workers for Platforms user workersPreviously, deploying a worker with
--dispatch-namespacewould early-exit before callingdeployContainers(), meaning container-app registration that links the image to the Durable Object namespace was never executed for WfP user workers. Container deployment now runs before the WfP early exit.Updated dependencies [
5cf6f81]:v4.89.0Compare Source
Minor Changes
#13055
f3fed88Thanks @GregBrimble! - Introducing thecacheconfiguration option for Workers.You can now set
{ cache: { enabled: true } }in your Wrangler configuration file to enable a HTTP cache in front of your Worker'sfetchhandler. This is also supported in[previews]configuration —previews.cacheoverrides the top-levelcachesetting for preview deployments, and falls back to the top-level value when absent. More information can be found in our documentation.#13776
1a54ac5Thanks @petebacondarwin! -wrangler devand other Miniflare-backed commands now run the localworkerdruntime withTZ=UTCto match productionPreviously,
wrangler dev(and other commands that spin up Miniflare, such aswrangler kv,wrangler d1,wrangler r2,wrangler check) inherited the host machine's timezone, soDateandIntlAPIs inside a Worker observed the developer's local timezone during local development but UTC in production. This caused subtle, hard-to-debug differences between local and deployed behaviour.Local development now matches production. Code that previously relied on the host timezone during
wrangler devwill need to either accept UTC (the production behaviour) or explicitly construct dates/formatters with the desired timezone.Patch Changes
#13829
2284f20Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#13841
332f527Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#13777
18e833dThanks @matingathani! - fix: throw a clear error when _routes.json contains invalid JSON instead of silently skipping it#13751
b6cea17Thanks @matingathani! - fix: ensurewrangler types --check --env-filedoes not falsely report stale types when.dev.varsexists#13775
53e846aThanks @maxwellpeterson! - Fixwrangler previewnot propagating theassetsbinding to preview deploymentsPreviously,
wrangler previewwould upload the asset manifest correctly but the resulting preview deployment had noASSETSbinding (or whatever name was configured underassets.binding). Workers reading from the binding would seeundefinedand fail at runtime.The fix emits the assets binding into the deployment's
envmap alongside other bindings, mirroringwrangler deploy.#13770
beff19cThanks @petebacondarwin! - Only show accounts available for the current login auth inwrangler whoamiand the interactive account pickerWrangler now lists the intersection of
/accountsand/membershipsinstead of either endpoint alone, dropping accounts the active OAuth token or API token has no membership in. Theaccountsfield ofwrangler whoami --jsonis filtered the same way. When/membershipsis inaccessible to the current auth (e.g. Account API Tokens) Wrangler falls back to/accountsso those tokens continue to work as before.#13832
af42fedThanks @gpanders! - Showcontainers sshinwrangler containers --helpand inwrangler containers ssh --helpThe
containers sshcommand was previously hidden, so it did not appear in the list of subcommands shown bywrangler containers --help, and its description was omitted fromwrangler containers ssh --help. The command is now listed with its description in both places.Updated dependencies [
2284f20,332f527,039bada,1a54ac5]:v4.88.0Compare Source
Minor Changes
#13760
e07825aThanks @danielgek! - Addbuiltinstorage option towrangler ai-search create.wrangler ai-search createnow supports a third storage type,builtin, in addition tor2andweb-crawler. When--type builtinis selected (or chosen interactively), Wrangler creates the instance using Cloudflare-managed storage by omittingtypeandsourcefrom the API request — the API treats an absenttypeas builtin storage. Builtin instances do not accept--source,--prefix,--include-items, or--exclude-items.#13721
58899d8Thanks @danielgek! - Add optionalcustom_metadatastep towrangler ai-search createThe
wrangler ai-search createinteractive wizard now lets you declare custom metadata fields that the new AI Search instance should index. Each field is afield_namepaired with adata_type(text,number,boolean, ordatetime).You can provide fields up-front via the new repeatable
--custom-metadataflag usingfield_name:data_typesyntax:For larger schemas, use
--custom-metadata-schemato point at a JSON file containing an array of{ field_name, data_type }objects:[ { "field_name": "title", "data_type": "text" }, { "field_name": "views", "data_type": "number" } ]#13701
18b9d5bThanks @dario-piotrowicz! - Prompt for missing name and compatibility date interactively duringwrangler deployWhen deploying without a project name or
compatibility_datein your configuration or CLI arguments,wrangler deploynow interactively prompts for the missing values instead of immediately failing with an error. For compatibility date, the prompt offers to use today's date; if you decline, the existing error is shown. The compatibility date prompt is skipped when--latestis passed. In non-interactive or CI environments, behavior is unchanged.Additionally, when no config file exists,
wrangler deploynow offers to save the prompted name and compatibility date to awrangler.jsoncfile for future use. This interactive flow is available for allwrangler deployinvocations — not just asset-only deployments.[#13810](https://redirect.github.com/cloudflare/workers-sdk/p
Configuration
📅 Schedule: (UTC)
* * * * 0,6)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.