chore(deps): bump the website group with 3 updates

[dependabot]

Bumps the website group with 3 updates: @cloudflare/nimbus-docs, @plausible-analytics/tracker and astro.

Updates @cloudflare/nimbus-docs from 0.8.2 to 0.10.0

Release notes

Sourced from @​cloudflare/nimbus-docs's releases.

@​cloudflare/nimbus-docs@​0.10.0

Minor Changes

• #71 e5d74f9 Thanks @​MohamedH1998! - Enable MDX optimization by default to reduce large-site build memory usage. Sites can opt out with mdx: { optimize: false }.

  Verified the generated starter with optimization on and with mdx: { optimize: false } forced; the rendered HTML is structurally equivalent for element names, attributes, and non-whitespace text. AC#3 is treated as semantic/structural render parity rather than byte identity: raw bytes differ due to serializer escaping and inter-block whitespace, but the rendered document is lossless.

  Spot-checked the starter components page, which includes JSX tags in prose, inline code with <...>, quoted code, and package names. The optimized and opt-out renders preserve those special-character text probes and match structurally.

  Constrain the supported Astro peer range to >=7.0.0 <7.1.0 || >=7.2.0 <8.0.0: the 7.1.x line is excluded while its static-build regression is open upstream, but 7.2.x is admitted (verified against a sub-path build). Generated templates and the dev pin stay on the verified 7.0.x line.

• #76 acfac20 Thanks @​mvvmm! - Replace astro-icon with a built-in icon system. This is a breaking change for any project using astro-icon directly.

  Why: astro-icon stamped a generated lastModified timestamp into its virtual module on every build, invalidating thousands of cached pages in Astro's incremental build cache. The package is unmaintained so an upstream fix isn't coming.

  What's new: Nimbus now provides virtual:nimbus/icons (a Vite plugin) and @cloudflare/nimbus-docs/components/Icon.astro. The plugin auto-detects installed @iconify-json/* packages and loads local SVGs from src/icons/. The component API is compatible with astro-icon (name, size, width, height, is:inline, title, desc, and all <svg> attributes). SVG bodies are passed through replaceIDs so internal IDs (clipPath, mask, gradient defs) are unique per render — preventing collisions when the same icon appears more than once on a page.

  Breaking changes:

  • Remove astro-icon from your package.json and astro.config.ts
  • Replace import { Icon } from "astro-icon/components" with import Icon from "@cloudflare/nimbus-docs/components/Icon.astro"
  • SVG output structure changed: SVGs are always inlined; the previous <symbol>/<use> pattern produced duplicate DOM IDs when the same icon was used more than once on a page, so it has been removed. Any CSS or JS targeting symbol or use elements will need updating.

  Migration:

  - import { Icon } from "astro-icon/components";
  + import Icon from "@cloudflare/nimbus-docs/components/Icon.astro";

  Starter templates updated: removed astro-icon dependency and icon() integration from astro.config.ts; all component imports updated to the new path.

Patch Changes

• #77 1c49268 Thanks @​MohamedH1998! - Fix NimbusHead emitting base-less SEO URLs on sub-path deployments (e.g. base: '/docs').

  new URL(path, Astro.site) resolves against the origin only and drops the configured base, so the rel=sitemap link, the LLM-index rel=alternate, og:image/twitter:image, the JSON-LD isPartOf.url, the versioned canonical, and the cross-version rel=alternate all pointed at the origin root and 404'd under a sub-path. Every internal path handed to new URL(..., Astro.site) is now base-prefixed via a withBase helper, matching the existing BASE_URL handling for the favicon and Shiki stylesheet.

  Root deployments (base: '/') are unaffected: the helper is a no-op when no base is configured, and already-based paths pass through unchanged (idempotent).

• #80 ec71a7b Thanks @​MohamedH1998! - Fix syntax-highlighted code rendering uncoloured in dev on sites with a non-root base (e.g. base: "/docs"). The dev middleware that serves _nimbus/shiki.css compared the request path exactly against the based asset path, but Vite strips base from req.url at a non-root base, so the request 404'd and tokens fell back to their inherited colour. It now matches by suffix, serving the stylesheet regardless of how Vite presents base. Production was unaffected — the stylesheet is written statically at build time.

@​cloudflare/nimbus-docs@​0.9.0

Minor Changes

• #64 e1e4e8d Thanks @​MohamedH1998! - Add nimbus-docs check — a build-free preflight that reports readiness honestly

  One command a human, CI, or agent runs to catch setup, structural, authoring, and type problems before a build. It runs four categories — environment (Node floor, config locatable, site not a placeholder, pagefind, wrangler), structure (config Zod, duplicate routes, MDX component resolution — the same validators the build gates on), authoring (the shipped lint rules), and types (a build-free type-check) — and normalizes every result into one envelope.

  The types category type-checks your TypeScript with your project's own tsc, build-free — no astro build, no astro sync, nothing spawned (your TypeScript is resolved from your project, never bundled into the CLI). Astro transpiles rather than type-checks, so a type error never fails the build on its own; catching it in the preflight is the point. Because tsc can't parse .astro SFCs, their internals and prop types are out of scope (that needs astro check); an injected ambient declare module "*.astro" keeps .ts files that import .astro components from being false-flagged.

... (truncated)

Changelog

Sourced from @​cloudflare/nimbus-docs's changelog.

0.10.0

Minor Changes

• #71 e5d74f9 Thanks @​MohamedH1998! - Enable MDX optimization by default to reduce large-site build memory usage. Sites can opt out with mdx: { optimize: false }.

  Verified the generated starter with optimization on and with mdx: { optimize: false } forced; the rendered HTML is structurally equivalent for element names, attributes, and non-whitespace text. AC#3 is treated as semantic/structural render parity rather than byte identity: raw bytes differ due to serializer escaping and inter-block whitespace, but the rendered document is lossless.

  Spot-checked the starter components page, which includes JSX tags in prose, inline code with <...>, quoted code, and package names. The optimized and opt-out renders preserve those special-character text probes and match structurally.

  Constrain the supported Astro peer range to >=7.0.0 <7.1.0 || >=7.2.0 <8.0.0: the 7.1.x line is excluded while its static-build regression is open upstream, but 7.2.x is admitted (verified against a sub-path build). Generated templates and the dev pin stay on the verified 7.0.x line.

• #76 acfac20 Thanks @​mvvmm! - Replace astro-icon with a built-in icon system. This is a breaking change for any project using astro-icon directly.

  Why: astro-icon stamped a generated lastModified timestamp into its virtual module on every build, invalidating thousands of cached pages in Astro's incremental build cache. The package is unmaintained so an upstream fix isn't coming.

  What's new: Nimbus now provides virtual:nimbus/icons (a Vite plugin) and @cloudflare/nimbus-docs/components/Icon.astro. The plugin auto-detects installed @iconify-json/* packages and loads local SVGs from src/icons/. The component API is compatible with astro-icon (name, size, width, height, is:inline, title, desc, and all <svg> attributes). SVG bodies are passed through replaceIDs so internal IDs (clipPath, mask, gradient defs) are unique per render — preventing collisions when the same icon appears more than once on a page.

  Breaking changes:

  • Remove astro-icon from your package.json and astro.config.ts
  • Replace import { Icon } from "astro-icon/components" with import Icon from "@cloudflare/nimbus-docs/components/Icon.astro"
  • SVG output structure changed: SVGs are always inlined; the previous <symbol>/<use> pattern produced duplicate DOM IDs when the same icon was used more than once on a page, so it has been removed. Any CSS or JS targeting symbol or use elements will need updating.

  Migration:

  - import { Icon } from "astro-icon/components";
  + import Icon from "@cloudflare/nimbus-docs/components/Icon.astro";

  Starter templates updated: removed astro-icon dependency and icon() integration from astro.config.ts; all component imports updated to the new path.

Patch Changes

• #77 1c49268 Thanks @​MohamedH1998! - Fix NimbusHead emitting base-less SEO URLs on sub-path deployments (e.g. base: '/docs').

  new URL(path, Astro.site) resolves against the origin only and drops the configured base, so the rel=sitemap link, the LLM-index rel=alternate, og:image/twitter:image, the JSON-LD isPartOf.url, the versioned canonical, and the cross-version rel=alternate all pointed at the origin root and 404'd under a sub-path. Every internal path handed to new URL(..., Astro.site) is now base-prefixed via a withBase helper, matching the existing BASE_URL handling for the favicon and Shiki stylesheet.

  Root deployments (base: '/') are unaffected: the helper is a no-op when no base is configured, and already-based paths pass through unchanged (idempotent).

• #80 ec71a7b Thanks @​MohamedH1998! - Fix syntax-highlighted code rendering uncoloured in dev on sites with a non-root base (e.g. base: "/docs"). The dev middleware that serves _nimbus/shiki.css compared the request path exactly against the based asset path, but Vite strips base from req.url at a non-root base, so the request 404'd and tokens fell back to their inherited colour. It now matches by suffix, serving the stylesheet regardless of how Vite presents base. Production was unaffected — the stylesheet is written statically at build time.

0.9.0

Minor Changes

• #64 e1e4e8d Thanks @​MohamedH1998! - Add nimbus-docs check — a build-free preflight that reports readiness honestly

  One command a human, CI, or agent runs to catch setup, structural, authoring, and type problems before a build. It runs four categories — environment (Node floor, config locatable, site not a placeholder, pagefind, wrangler), structure (config Zod, duplicate routes, MDX component resolution — the same validators the build gates on), authoring (the shipped lint rules), and types (a build-free type-check) — and normalizes every result into one envelope.

... (truncated)

Commits

• 0f62b2e chore: bump package versions
• 94367e1 Merge pull request #76 from cloudflare/replace-astro-icon
• 85d0426 fix: pass SVG body through replaceIDs to prevent internal ID collisions
• 56fcbb6 fix: restore is:inline prop and config export for astro-icon API compat
• 07b308f fix: always inline SVG body, remove is:inline prop and symbol/use pattern
• 4baf507 feat: add overview frontmatter field, render above Installation
• 161ce47 docs: clarify Icon uses Iconify-packaged sets (Phosphor, etc.)
• 1869aea Merge pull request #80 from cloudflare/fix/shiki-dev-css-base-match
• e52472f fix: shiki dev css base matching
• 960280f chore: widen Astro peer range to admit 7.2.x
• Additional commits viewable in compare view

Updates @plausible-analytics/tracker from 0.4.5 to 0.4.6

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​plausible-analytics/tracker since your current version.

Updates astro from 7.1.4 to 7.2.2

Release notes

Sourced from astro's releases.

astro@7.2.2

Patch Changes

• #17611 9bc3207 Thanks @​thelazylamaGit! - Fixes component styles rendered from content entries remaining stale until a second save when an adapter uses Astro's fallback development environment

• #17634 2267eee Thanks @​astrobot-houston! - Fixes incremental builds dropping optimized images for cached pages when using a collectStaticImages prerenderer (e.g. @astrojs/cloudflare with compile-time image optimization)

• #17650 4cdf128 Thanks @​astrobot-houston! - Fixes intermittent ImageNotFound errors during build on projects with many images. The build now limits concurrent image file reads to avoid exhausting OS file descriptors (EMFILE) and retries transient I/O errors with backoff. Non-transient errors are no longer silently swallowed.

• #17683 2378221 Thanks @​astrobot-houston! - Fixes prerenderConflictBehavior not applying to content collection duplicate ID warnings in the glob() and file() loaders. Setting it to 'error' now throws during content sync, and 'ignore' suppresses the warning.

• #17659 90c6ea4 Thanks @​astrobot-houston! - Fixes the Fonts API breaking experimental.incrementalBuild caching by embedding a build-local, randomly-assigned server port in generated code used for the dependency hash

• #17630 fd1d9ee Thanks @​ericclemmons! - Fixes incremental builds becoming prohibitively slow for sites with many pages or content entries that share a large dependency graph.

• #17690 93beecc Thanks @​NgoQuocViet2001! - Prevents files in directories whose names start with pages from being treated as page routes

• #17671 09f0dc7 Thanks @​tarikermis! - Fixes astro dev refusing to start after a Docker container restart when an unrelated process reuses the PID from a persisted lock file. Astro now checks the process command across platforms, so stale lock files are cleaned up and --force does not signal the unrelated process.

astro@7.2.1

Patch Changes

• #17612 7133730 Thanks @​thelazylamaGit! - Fixes CSS hot module replacement after navigating between pages with ClientRouter

• #17628 4ada248 Thanks @​astrobot-houston! - Fixes a CSP violation when using both security.csp and experimental.clientPrerender with data-astro-prefetch links. The dynamically injected <script type="speculationrules"> now uses a static "source": "document" approach with a CSS selector, producing a deterministic payload that is hashed and included in the CSP script-src directive at build time.

• #17605 89e4647 Thanks @​ashleigh-yeoman! - Fixes middleware HMR not responding to changes in imported modules. Previously, only direct edits to the middleware file would trigger a reload.

• #17582 bd2c1a5 Thanks @​astrobot-houston! - Fixes a regression where content collection reference() fields silently accepted entry IDs that don't exist, such as an ID that doesn't match a loader's slugified version of it. Astro now logs an error for references that point to a missing entry after all loaders finish syncing.

• #17661 97b0cc7 Thanks @​ArmandPhilippot! - Improves Markdown options documentation with links to the Markdown guide and official processors.

• #17349 4328c73 Thanks @​astrobot-houston! - Fixes an issue where requests handled by the dev prerender environment (e.g. /_image with @astrojs/cloudflare's prerenderEnvironment: 'node') returned a 500 when a prerendered catch-all route existed, because non-prerendered route modules were imported in an environment where their runtime-specific APIs are unavailable

• #17603 722eed6 Thanks @​astrobot-houston! - Fixes <video> and <audio> elements being non-functional after navigating via view transitions (<ClientRouter />)

• #17616 3a890d2 Thanks @​lazerg! - Fixes experimental.incrementalBuild re-rendering unchanged routes that import more than one asset. The route's dependency hash depended on the order the assets finished building, so two builds of identical sources could produce different hashes. The hash is now based on the file name each asset resolves to.

• #17547 fba468c Thanks @​dmgawel! - Improves getCollection() and getEntry() performance for entries without local image references

• #17602 16e0d9d Thanks @​astrobot-houston! - Fixes a build error caused by hash collisions in generated content collection image import identifiers

astro@7.2.0

Minor Changes

• #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

  This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.2

Patch Changes

• #17611 9bc3207 Thanks @​thelazylamaGit! - Fixes component styles rendered from content entries remaining stale until a second save when an adapter uses Astro's fallback development environment

• #17634 2267eee Thanks @​astrobot-houston! - Fixes incremental builds dropping optimized images for cached pages when using a collectStaticImages prerenderer (e.g. @astrojs/cloudflare with compile-time image optimization)

• #17650 4cdf128 Thanks @​astrobot-houston! - Fixes intermittent ImageNotFound errors during build on projects with many images. The build now limits concurrent image file reads to avoid exhausting OS file descriptors (EMFILE) and retries transient I/O errors with backoff. Non-transient errors are no longer silently swallowed.

• #17683 2378221 Thanks @​astrobot-houston! - Fixes prerenderConflictBehavior not applying to content collection duplicate ID warnings in the glob() and file() loaders. Setting it to 'error' now throws during content sync, and 'ignore' suppresses the warning.

• #17659 90c6ea4 Thanks @​astrobot-houston! - Fixes the Fonts API breaking experimental.incrementalBuild caching by embedding a build-local, randomly-assigned server port in generated code used for the dependency hash

• #17630 fd1d9ee Thanks @​ericclemmons! - Fixes incremental builds becoming prohibitively slow for sites with many pages or content entries that share a large dependency graph.

• #17690 93beecc Thanks @​NgoQuocViet2001! - Prevents files in directories whose names start with pages from being treated as page routes

• #17671 09f0dc7 Thanks @​tarikermis! - Fixes astro dev refusing to start after a Docker container restart when an unrelated process reuses the PID from a persisted lock file. Astro now checks the process command across platforms, so stale lock files are cleaned up and --force does not signal the unrelated process.

7.2.1

Patch Changes

• #17612 7133730 Thanks @​thelazylamaGit! - Fixes CSS hot module replacement after navigating between pages with ClientRouter

• #17628 4ada248 Thanks @​astrobot-houston! - Fixes a CSP violation when using both security.csp and experimental.clientPrerender with data-astro-prefetch links. The dynamically injected <script type="speculationrules"> now uses a static "source": "document" approach with a CSS selector, producing a deterministic payload that is hashed and included in the CSP script-src directive at build time.

• #17605 89e4647 Thanks @​ashleigh-yeoman! - Fixes middleware HMR not responding to changes in imported modules. Previously, only direct edits to the middleware file would trigger a reload.

• #17582 bd2c1a5 Thanks @​astrobot-houston! - Fixes a regression where content collection reference() fields silently accepted entry IDs that don't exist, such as an ID that doesn't match a loader's slugified version of it. Astro now logs an error for references that point to a missing entry after all loaders finish syncing.

• #17661 97b0cc7 Thanks @​ArmandPhilippot! - Improves Markdown options documentation with links to the Markdown guide and official processors.

• #17349 4328c73 Thanks @​astrobot-houston! - Fixes an issue where requests handled by the dev prerender environment (e.g. /_image with @astrojs/cloudflare's prerenderEnvironment: 'node') returned a 500 when a prerendered catch-all route existed, because non-prerendered route modules were imported in an environment where their runtime-specific APIs are unavailable

• #17603 722eed6 Thanks @​astrobot-houston! - Fixes <video> and <audio> elements being non-functional after navigating via view transitions (<ClientRouter />)

• #17616 3a890d2 Thanks @​lazerg! - Fixes experimental.incrementalBuild re-rendering unchanged routes that import more than one asset. The route's dependency hash depended on the order the assets finished building, so two builds of identical sources could produce different hashes. The hash is now based on the file name each asset resolves to.

• #17547 fba468c Thanks @​dmgawel! - Improves getCollection() and getEntry() performance for entries without local image references

• #17602 16e0d9d Thanks @​astrobot-houston! - Fixes a build error caused by hash collisions in generated content collection image import identifiers

7.2.0

Minor Changes

• #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

... (truncated)

Commits

• 14f8f87 [ci] release (#17673)
• 93beecc Fix page directory boundary detection (#17690)
• 2378221 fix(content): apply prerenderConflictBehavior to content collection duplicate...
• fd1d9ee fix(build): Optimize incremental builds with shared content graph hashing (#1...
• 8df416a test: skip type check tests in ecosystem-ci (#17587)
• 09f0dc7 Detect stale dev server lock files after PID reuse (#17671)
• 2267eee fix: preserve restored image transforms when merging adapter-collected images...
• 4cdf128 fix(assets): prevent EMFILE errors on large image builds with concurrency lim...
• 90c6ea4 fix(fonts): strip volatile server address from incremental build hash (#17659)
• 9bc3207 fix(dev): apply the dev CSS plugin to the fallback Astro environment (#17611)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions