fix(deps): update all minor dependencies by renovate[bot] · Pull Request #60 · openscript-ch/starlight-theme

renovate · 2026-05-05T13:54:12Z

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/starlight (source)	`^0.38.3` → `^0.39.0`
@changesets/changelog-github (source)	`^0.6.0` → `^0.7.0`
@types/node (source)	`25.6.0` → `25.9.1`
@typescript-eslint/parser (source)	`8.59.2` → `8.59.4`
astro (source)	`6.2.2` → `6.3.6`
eslint (source)	`10.3.0` → `10.4.0`
pnpm (source)	`10.33.3` → `10.33.4`
typescript-eslint (source)	`8.59.2` → `8.59.4`

Release Notes

withastro/starlight (@astrojs/starlight)

`v0.39.2`

Compare Source

Patch Changes

#3890 2d05e18 Thanks @tats-u! - Fixes CSS selector for text-autospace styles in Chromium browsers

`v0.39.1`

Compare Source

Patch Changes

#3885 010eed1 Thanks @ArmandPhilippot! - Fixes the version mentioned in an error message related to autogenerated sidebar groups support.
#3887 b3c6990 Thanks @delucis! - Adds 13 new icons: clock, desktop, mobile-android, window, database, server, code-branch, notes, question, question-circle, analytics, padlock, and solidjs.

`v0.39.0`

Compare Source

Minor Changes

#3618 dcf6d09 Thanks @HiDeoo! - ⚠️ BREAKING CHANGE: This release changes how autogenerated links work in Starlight’s sidebar configuration.

If you have sidebar groups using the autogenerate key, you must now wrap that configuration in an items array:
```
{
    label: 'My group',
-   autogenerate: { directory: 'some-dir' },
+   items: [{ autogenerate: { directory: 'some-dir' } }],
}
```
This change unlocks the possibility to mix autogenerated links and other links in a single group, for example:
```
{
  label: 'Mixed group',
  items: [
    'example-page',
    { autogenerate: { directory: 'examples' } },
    { label: 'More examples', link: 'https://example.com' },
  ],
}
```
This release also updates the shape of autogenerated sidebar entries in route data. Autogenerated links and groups in Astro.locals.starlightRoute.sidebar now include an autogenerate object with the configured directory value:
```
{
  type: 'link',
  label: 'Example',
  href: '/examples/example/',
  isCurrent: false,
  autogenerate: { directory: 'examples' }
}
```
#3618 dcf6d09 Thanks @HiDeoo! - ⚠️ BREAKING CHANGE: This release changes the default collapsed state of autogenerated sidebar subgroups.

Autogenerated subgroups no longer inherit the collapsed value from their parent group. They are now expanded by default unless explicitly configured with autogenerate.collapsed.

If your sidebar configuration relies on a collapsed parent group to also collapse its autogenerated subgroups, update your configuration to set autogenerate.collapsed to true:
```
{
  label: 'Reference',
  collapsed: true,
  items: [
-   { autogenerate: { directory: 'reference' } },
+   { autogenerate: { directory: 'reference', collapsed: true } },
  ],
}
```
#3845 4d755f5 Thanks @delucis! - Adds a <link rel="alternate" hreflang="x-default" href="..."> tag pointing to the default locale in multilingual sites. The x-default alternate is used as a signal of which language to fall back to if no other is available. Learn more in Google’s SEO localization docs.
#3862 ec70630 Thanks @itrew! - Makes spacing of items in nested lists more consistent
#3872 417a66c Thanks @tats-u! - Enables the CSS property text-autospace in Chinese and Japanese documents.

If you would prefer to disable autospacing in Chinese and Japanese pages, you can add the following custom CSS to your site:
```
[lang]:where(:lang(zh, ja)) {
  text-autospace: initial;
}
```
#3797 9764ebd Thanks @delucis! - Avoids the risk of layout shift when users expand and collapse sidebar groups

This release can introduce additional padding to the site sidebar on certain devices to reserve space for scrollbars. You may wish to inspect your site sidebar visually when upgrading.

If you would prefer to keep the previous styling, you can add the following custom CSS to your site:
```
.sidebar-pane {
  scrollbar-gutter: auto;
}
```
#3858 6672c35 Thanks @delucis! - Updates i18next, used for Starlight’s localization APIs, from v23 to v26

There should not be any user-facing changes from this update

`v0.38.5`

Compare Source

Patch Changes

#3854 ccf6000, #3877 47451bc Thanks @delucis! - Updates internal dependencies

changesets/changesets (@changesets/changelog-github)

`v0.7.0`

Compare Source

Minor Changes

#1255 94578cf Thanks @Kauhsa! - Added disableThanks option

typescript-eslint/typescript-eslint (@typescript-eslint/parser)

`v8.59.4`

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

`v8.59.3`

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

withastro/astro (astro)

`v6.3.6`

Compare Source

Patch Changes

#16774 8f77583 Thanks @astrobot-houston! - Fixes markdown images with empty alt text (![](image.jpg)) in content collections dropping the alt attribute entirely. The alt="" attribute is now correctly preserved in the rendered HTML output, which is important for accessibility (indicating decorative images).
#16776 3d10b5e Thanks @matthewp! - Fixes HMR serving stale content when components are passed as props via getStaticPaths()
#16784 7453860 Thanks @ematipico! - Improved the printing of the build time if it goes over the 60 seconds.
#16665 3dbbcee Thanks @Princesseuh! - Fixes remote SVG sources erroring with dangerouslyProcessSVG after the v6.3 SVG-processing gate. The default Sharp service now resolves the output format from the source up-front when it can (URL extension, data: MIME, ESM metadata), and from the actual buffer at request time when it can't, so SVG sources pass through untouched without needing to set image.dangerouslyProcessSVG: true or an explicit format="svg".

The error message has also been updated to point at format="svg" as the simpler workaround when an SVG source is encountered without dangerouslyProcessSVG enabled.
#16777 1754b91 Thanks @matthewp! - Fixes HMR serving stale content for dynamically imported components through barrel files
#16730 068d924 Thanks @harshagarwalnyu! - Fixes an issue where the file() content loader did not generate a valid JSON Schema for collections whose JSON or YAML data is a top-level array instead of an object.

`v6.3.5`

Compare Source

Patch Changes

#16771 07c8805 Thanks @ematipico! - Fixes position prop on <Image> and <Picture> components breaking Content Security Policy (CSP).
#16593 50924ce Thanks @yanthomasdev! - Improves error messages with more consistent and correct writing.
#16757 5d661cd Thanks @astrobot-houston! - Fixes dev server serving stale content when SSR-only modules change (e.g. .astro files outside the project root in a monorepo, or dynamically imported components).

Previously, the astro:hmr-reload plugin returned an empty array after detecting SSR-only module changes, which prevented Vite's updateModules from propagating the invalidation to the SSR module runner. The runner's evaluated module cache stayed stale, so subsequent requests continued returning old content.

Now the plugin returns the SSR-only modules so Vite can process them through updateModules, which properly invalidates the module runner's cache and ensures fresh content on the next request.

`v6.3.4`

Compare Source

Patch Changes

#16723 0f10bfe Thanks @matthewp! - Adds fetchFile option to experimental.advancedRouting to customize or disable the entrypoint file

export default defineConfig({
  experimental: {
    advancedRouting: {
      fetchFile: 'fetch.ts',
    },
  },
});

#16723 0f10bfe Thanks @matthewp! - Fixes Hono cache() middleware to follow the standard wrapper pattern

#16723 0f10bfe Thanks @matthewp! - Adds App.Providers interface for typing custom context providers on Astro and ctx

declare namespace App {
  interface Providers {
    oauth: import('./lib/oauth').OAuthSession;
  }
}

#16723 0f10bfe Thanks @matthewp! - Adds FetchState.response property, set automatically after pages() or middleware() completes
```
const response = await middleware(state, (s) => pages(s));
console.log(state.response === response); // true
```

#16723 0f10bfe Thanks @matthewp! - Adds Fetchable type export for typing the advanced routing entrypoint

import type { Fetchable } from 'astro';

export default {
  async fetch(request) {
    return new Response('ok');
  },
} satisfies Fetchable;

#16572 4a5a077 Thanks @DORI2001! - Suppresses [WARN] Vite warning: unused imports from "@astrojs/internal-helpers/remote" during prerender builds. The package is now bundled alongside astro in the prerender environment, matching how it is handled in the SSR environment.
#16756 b6ee23d Thanks @astrobot-houston! - Fixes styles from Markdoc/MDX custom components not being extracted to <head> in the dev server when using the Cloudflare adapter with prerenderEnvironment: 'node' and rendering content through a wrapper component.
#16747 904d19a Thanks @astrobot-houston! - Fixes Astro action requests failing in astro dev when using the Cloudflare adapter with prerenderEnvironment: 'node' alongside a prerendered catch-all route such as [...page].astro.

Actions and other SSR POST endpoints now continue to work in dev instead of returning an HTTP 500 error.
#16701 3495ce4 Thanks @demaisj! - Fix Map and Set instances saved in a content collection being broken when retrieving entries.
#16614 fca1c32 Thanks @Eptagone! - Fixes entry.data type inference when a live collection is configured without a schema.
#16661 03b8f7f Thanks @ocavue! - Updates typescript to v6. No changes are needed from users.
#16681 c22770a Thanks @dotnetCarpenter! - Fixes an issue where SVG images with width="0" or height="0" incorrectly threw a NoImageMetadata error instead of being treated as valid dimensions.

`v6.3.3`

Compare Source

Patch Changes

#16737 bd84f33 Thanks @matthewp! - Fixes a reflected XSS vulnerability where slot names on hydrated components were not HTML-escaped in SSR output

`v6.3.2`

Compare Source

Patch Changes

#16675 11d4592 Thanks @ascorbic! - Fixes a regression where Astro.cache was undefined when experimental.cache was not configured.

The previous documented behavior is for Astro.cache to always be defined as a no-op shim: cache.set() warns once, cache.invalidate() throws and cache.enabled can be used to gate. This allows library and user code can call cache methods without conditional checks. The cache provider registration was being gated at the call site on experimental.cache being configured, which meant the disabled shim branch inside the provider was unreachable and the Astro.cache getter was never attached to the context.
#16691 0f0a4ce Thanks @matthewp! - Fixes HTMLElement is not defined error during HMR when using components with client-side scripts (e.g. Starlight <Tabs>) and the Cloudflare adapter
#16562 07529ec Thanks @matthewp! - Fixes non-prerendered routes failing when a dynamic prerendered route exists in the same project with prerenderEnvironment: 'node'
#16638 272185b Thanks @ematipico! - Fixes a bug where the Astro compiler wasn't freed at the end of the build. After the fix, the memory used by the compiler is now correctly freed at the end of the build.
#16544 d365c97 Thanks @matthewp! - Tightens isRemotePath() to reject control characters after a leading slash and fixes the dev image endpoint origin check
#16685 889e748 Thanks @farrosfr! - Improve validation messages for security.csp.directives when script-src or style-src are incorrectly placed in the directives array.
#16605 772f13a Thanks @rururux! - Fixes assetsPrefix not being available on build from astro:config/server.
#16556 f38dec7 Thanks @matthewp! - Rejects double-encoded URL paths with a 400 response instead of silently falling back to partial decoding
#16659 38bcb25 Thanks @jsparkdev! - Fixes & characters appearing as raw entity strings (e.g. &#38;) in <meta> tags when viewed in link previews or raw HTML.
Updated dependencies [d365c97, 9256345]:
- @astrojs/internal-helpers@0.9.1
- @astrojs/markdown-remark@7.1.2

`v6.3.1`

Compare Source

Patch Changes

#16646 15fbc41 Thanks @matthewp! - Fixes local images returning 404 on non-prerendered pages when using the generic image endpoint

`v6.3.0`

Compare Source

Minor Changes

#16366 d69f858 Thanks @matthewp! - Adds a new experimental.advancedRouting option that lets you take full control of Astro's request handling pipeline by creating a src/app.ts file in your project.

Today, Astro handles every incoming request through a fixed internal pipeline: trailing slash normalization, redirects, actions, middleware, page rendering, i18n, and so on. That pipeline works great for most sites, but as projects grow you often want to run your own logic between those steps — an auth check before rendering, a rate limiter before actions, custom logging around the whole stack. Advanced routing gives you that control.

When enabled, Astro looks for a src/app.ts file in your project. If it finds one, that file becomes the entrypoint for all server-rendered requests. You compose the pipeline yourself using the handlers Astro provides, and you can slot your own logic anywhere in the chain.

Enabling advanced routing

// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  experimental: {
    advancedRouting: true,
  },
});

Two ways to build your pipeline

Astro ships two entrypoints for advanced routing: astro/fetch and astro/hono.

astro/fetch is a low-level, framework-free API built on the Web Fetch standard. You create a FetchState from the incoming request, then call handler functions in sequence. Each handler takes the state, does its work, and returns a Response (or undefined to pass through). This is the core primitive that everything else is built on:

// src/app.ts
import {
  FetchState,
  trailingSlash,
  redirects,
  actions,
  middleware,
  pages,
  i18n,
} from 'astro/fetch';

export default {
  async fetch(request: Request) {
    const state = new FetchState(request);

    // Early exits — these return a Response only when they apply.
    const slash = trailingSlash(state);
    if (slash) return slash;

    const redirect = redirects(state);
    if (redirect) return redirect;

    const action = await actions(state);
    if (action) return action;

    // Middleware wraps page rendering; i18n post-processes the response.
    const response = await middleware(state, () => pages(state));
    return i18n(state, response);
  },
};

astro/hono wraps the same handlers as Hono middleware, so you can mix Astro's pipeline with Hono's ecosystem of middleware (logger, CORS, JWT, rate limiting, etc.) using the app.use() pattern you already know:

// src/app.ts
import { Hono } from 'hono';
import { getCookie } from 'hono/cookie';
import { logger } from 'hono/logger';
import { actions, middleware, pages, i18n } from 'astro/hono';

const app = new Hono();

app.use(logger());

// Auth gate — only runs for /dashboard routes.
app.use('/dashboard/*', async (c, next) => {
  const session = getCookie(c, 'session');
  if (!session) return c.redirect('/login');
  return next();
});

app.use(actions());
app.use(middleware());
app.use(pages());
app.use(i18n());

export default app;

Both approaches give you the same power — pick whichever fits your project. If you don't need a framework, astro/fetch keeps things minimal. If you want a rich middleware ecosystem, astro/hono gets you there with one import.

For more information on enabling and using this feature in your project, see the experimental advanced routing docs. To give feedback, or to keep up with its development, see the advanced routing RFC for more information and discussion.

#16366 d69f858 Thanks @matthewp! - Adds a consume() instance method to AstroCookies. This method marks the cookies as consumed and returns the Set-Cookie header values. After consumption, any subsequent set() calls will log a warning, since the headers have already been sent.

Previously this was only available as a static method AstroCookies.consume(cookies). The static method is now deprecated but kept for backward compatibility with existing adapters.
#16412 ba2d2e3 Thanks @0xbejaxer! - Add retry and error event handling for astro-island hydration import failures to reduce unrecoverable hydration errors on transient network failures.
#16582 885cd31 Thanks @Princesseuh! - Adds a new image.dangerouslyProcessSVG flag to optionally enable processing SVG inputs. For security reasons, Astro will no longer rasterizes SVG image sources by default in its default image service and endpoint.

Set image.dangerouslyProcessSVG: true to opt back into processing SVG inputs.
```
// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  // ...
  image: {
    dangerouslyProcessSVG: true,
  },
});
```
Note that this is a breaking change for users who were previously relying on Astro's default image service to rasterize SVG inputs, but it is a necessary change to improve security and prevent potential vulnerabilities.
#16519 1b1c218 Thanks @louisescher! - Adds support for redirecting URLs in remote image optimization.

Previously, when a remote image URL meant to be optimized by Astro led to a redirect, Astro would fail silently and ignore the redirect. Now, Astro tracks up to 10 redirects for these images. If any of the redirects are not covered by a pattern in image.remotePatterns or a domain in image.domains, Astro will fail with a helpful error message.

In the following example, the first image would be loaded successfully, while the second would lead to Astro throwing an error:
```
export default defineConfig({
  image: {
    domains: ['example.com', 'cdn.example.com'],
  },
});
```
```
{
  /* Redirects to https://cdn.example.com/assets/image.png: */
}
<Image
  src="https://example.com/assets/image.png"
  width="1920"
  height="1080"
  alt="An example image."
/>;

{
  /* Redirects to https://malicious.com/image.png: */
}
<Image
  src="https://example.com/bad-image.png"
  width="1920"
  height="1080"
  alt="An example image."
/>;
```
In cases where all redirects to HTTPS hosts should be trusted, the following configuration for image.remotePatterns can be used:
```
export default defineConfig({
  image: {
    remotePatterns: [
      {
        protocol: 'https',
      },
    ],
  },
});
```

Patch Changes

#16592 9c6efc5 Thanks @matthewp! - Escapes interpolated values in the dev server redirect HTML template, consistent with how the 404 template already handles them
#16585 78f305e Thanks @web-dev0521! - Fixes z.array(z.boolean()) in form actions incorrectly coercing the string "false" to true. Boolean array elements now use the same 'true'/'false' string comparison as single z.boolean() fields, so submitting ["false", "true", "false"] correctly parses as [false, true, false].
#16567 12a03f2 Thanks @matthewp! - Fixes deleted content collection entries persisting in getCollection() results during dev
#16595 ce9b25c Thanks @web-dev0521! - Fixes pushDirective in the CSP runtime duplicating the new directive once per existing non-matching directive. Calling insertDirective() (or otherwise pushing a directive whose name is not yet in the list) now appends it exactly once, and a directive that merges with a later existing entry no longer leaves an unmerged copy behind.
#16600 94e4b7c Thanks @web-dev0521! - Fixes Astro.preferredLocale returning the wrong value when i18n.locales mixes object-form entries ({ path, codes }) with string entries that normalize to the same locale. The first matching code in the configured locales order is now selected, matching the documented behavior.
#16591 cce20f7 Thanks @matthewp! - Uses a consistent generic error message in the image endpoint across all adapters
#16629 f54be80 Thanks @g-taki! - Fixes a bug where SSR responses in astro dev could crash with TypeError: this.logger.flush is not a function.
#16589 3740b24 Thanks @ArmandPhilippot! - Fixes an outdated code snippet in the documentation for session storage configuration.
Updated dependencies [354e231]:
- @astrojs/telemetry@3.3.2

eslint/eslint (eslint)

`v10.4.0`

Compare Source

pnpm/pnpm (pnpm)

`v10.33.4`: pnpm 10.33.4

Compare Source

Patch Changes

Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.

A new gitHosted: true field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.
Fix a regression where pnpm --recursive --filter '!<pkg>' run/exec/test/add would include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative --filter arguments are provided, matching the documented behavior. To include the root, pass --include-workspace-root #11341.

Platinum Sponsors

Gold Sponsors

typescript-eslint/typescript-eslint (typescript-eslint)

`v8.59.4`

Compare Source

🩹 Fixes

typescript-eslint: export Compatible* types from typescript-eslint to resolve pnpm TS error (#12340)

❤️ Thank You

Kirk Waiblinger @kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

`v8.59.3`

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added the dependencies label May 5, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch from ecc0f34 to 8b0afdd Compare May 5, 2026 19:13

renovate Bot changed the title ~~chore(deps): update dependency @changesets/changelog-github to ^0.7.0~~ chore(deps): update all minor dependencies May 5, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 66f5b83 to 4f47baa Compare May 7, 2026 15:33

renovate Bot changed the title ~~chore(deps): update all minor dependencies~~ fix(deps): update all minor dependencies May 7, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from bf5b862 to 1d50d54 Compare May 14, 2026 17:02

renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from cf8f327 to 23b62d3 Compare May 19, 2026 18:43

fix(deps): update all minor dependencies

6c171f1

renovate Bot force-pushed the renovate/all-minor-patch branch from 23b62d3 to 6c171f1 Compare May 20, 2026 11:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update all minor dependencies#60

fix(deps): update all minor dependencies#60
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented May 5, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Enabling advanced routing

Two ways to build your pipeline

Patch Changes

v10.33.4: pnpm 10.33.4

Patch Changes

Platinum Sponsors

Gold Sponsors

🩹 Fixes

❤️ Thank You

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 5, 2026 •

edited

Loading

`v10.33.4`: pnpm 10.33.4