chore: update npm dependencies - #790
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/npm
branch
3 times, most recently
from
June 8, 2026 19:12
29d5d1e to
cfddbbb
Compare
|
✨✨ That's perfect, there is no visual difference! ✨✨ |
renovate
Bot
force-pushed
the
renovate/npm
branch
7 times, most recently
from
June 16, 2026 11:40
7a0778e to
de3d12e
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
6 times, most recently
from
June 23, 2026 13:46
73ee219 to
b8be7ed
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
4 times, most recently
from
June 26, 2026 21:06
8e73e74 to
7ab4141
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
9 times, most recently
from
July 7, 2026 07:04
811588d to
bc239c2
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
4 times, most recently
from
July 18, 2026 00:39
b882761 to
edadb7a
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
4 times, most recently
from
July 29, 2026 18:14
01bce61 to
7dc39b9
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
6 times, most recently
from
August 4, 2026 02:54
e866c00 to
c1bfd16
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
8 times, most recently
from
August 10, 2026 01:37
1c34781 to
9f6ca17
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
5 times, most recently
from
August 17, 2026 01:13
b78c8a2 to
9ddd969
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
from
August 18, 2026 20:43
9ddd969 to
42aa676
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.41.6→0.41.710.5.6→10.5.710.5.9(+1)10.5.6→10.5.710.5.9(+1)10.5.6→10.5.710.5.9(+1)^7.0.0→^7.0.126.1.2→26.2.07.1.6→7.2.07.2.3(+2)10.8.0→10.8.116.2.2→16.2.3>=20.19.0→>=24.19.0>=20.12.0→>=24.19.0>=18.2.0→>=19.2.8>=18.2.0→>=19.2.810.5.6→10.5.710.5.9(+1)6.0.3→7.0.28.2.0→8.2.1Release Notes
withastro/starlight (@astrojs/starlight)
v0.41.7Compare Source
Patch Changes
3e486fbThanks @delucis! - Fixes processing of code examples in RTL languages when using Astro’s Sätteri Markdown processorstorybookjs/storybook (@storybook/builder-vite)
v10.5.7Compare Source
testing-library/jest-dom (@testing-library/jest-dom)
v7.0.1Compare Source
withastro/astro (astro)
v7.2.0Compare Source
Minor Changes
#17174
0224a3aThanks @matthewp! - Adds theastro preview --backgroundflag to start preview servers as background processes.This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.
When a preview server is running in the background, you can inspect or stop it with new
astro previewsubcommands:If Astro detects that
astro previewis being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior forastro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.To opt out of automatic background mode for preview servers, set
ASTRO_PREVIEW_BACKGROUND=0before runningastro preview.#17532
7f94895Thanks @florian-lefebvre! - Adds support for paths relative to your project root inlogger.entrypointPreviously, pointing
logger.entrypointat a custom log handler living in your own project required building an absoluteURL. You can now write the path directly:// astro.config.mjs import { defineConfig } from 'astro/config'; export default defineConfig({ logger: { - entrypoint: new URL('./src/logger.js', import.meta.url), + entrypoint: './src/logger.js', }, });Paths starting with
./or../are resolved against your project root. Package specifiers such as@org/astro-logger, absolute paths, andURLentrypoints keep working as before.#17084
961bbe5Thanks @matthewp! - Widens theAstroPrerendererrender()return type so prerenderers can report incremental-build metadataA prerenderer's
render()may now resolve to either aResponse(as before) or aPrerenderResultobject that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.This is a non-breaking widening: prerenderers that return a bare
Responsecontinue to work unchanged, and in-process prerenderers can keep returning aResponsesince the build collects their metadata directly.#16871
90c98aeThanks @adamchal! - Addssession: falseinastro.configto opt out of session support. Projects that do not setsession: falsesee no behavior change.The session runtime and dependencies (
unstorage) are now tree-shaken out of the SSR bundle for any project where no session driver is wired via:session: falsesessionconfig at allsessionconfig without a driverUseful for serverless/edge runtimes where cold-start parse time is sensitive.
#17084
961bbe5Thanks @matthewp! - Adds experimental support for incremental static builds withexperimental.incrementalBuild.When enabled, Astro can skip regenerating static pages from dynamic routes when both the page's module dependencies and its data cache key are unchanged from the previous build. This currently applies to pages returned from
getStaticPaths()that include acacheKey.Return a
cacheKeyfor each generated page fromgetStaticPaths():For incremental builds to skip rendering in CI, Astro's cache directory must be preserved between builds. Astro empties the output directory on each build and restores skipped pages from the cache directory, so only that directory needs to persist. For the default config, cache and restore
node_modules/.astro/before runningastro build.See the experimental incremental static builds documentation for more information.
#17084
961bbe5Thanks @matthewp! - Adds the optionaldigestproperty to content collection entries.Loaders can provide an opaque digest value that changes when an entry changes. This is now reflected in the
CollectionEntrytype returned bygetCollection()andgetEntry(), making it easier to detect content changes without re-hashing large entry bodies.The property is optional because not every loader provides a digest. See incremental static builds for how
digestcan be used as acacheKey.Patch Changes
#17534
5a5337eThanks @florian-lefebvre! - Improveslogger.entrypointreference docs#17529
d52a787Thanks @QVinto! - Fixesastro devcrashing withInvalid URLwhen--hostis set to a specific non-loopback addressVite only reports a
localURL for loopback hosts. When the dev server was started with--host <custom-address>bound to a specific non-loopback address (a LAN or Tailscale IP, for example), the URL was reported undernetworkandlocalwas empty, so writing the dev lock file threwInvalid URLand killed a server that had already started successfully.The lock file URL now falls back to the network URL, and a server that exposes no URL at all is left untracked rather than being taken down by lock file bookkeeping.
#17566
296248cThanks @astrobot-houston! - FixesfontProviders.googleicons()returning the full icon font (~3.9MB) instead of only the requested glyphs when multipleexperimental.glyphsare specified#17560
ef45de1Thanks @astrobot-houston! - FixesAstro.url.pathnamefor non-index pages when usingbuild.format: 'preserve'. Previously, a page likesrc/pages/about-me.astrowould output todist/about-me.htmlbutAstro.url.pathnamewould incorrectly return/about-me/instead of/about-me.html.#17573
0089f83Thanks @astrobot-houston! - Fixes a Content Layer build crash that could occur when another dependency causes an older version ofneotraverseto be hoisted to the project root#17571
116f700Thanks @astrobot-houston! - Fixes cookies set viaAstro.cookies.set()inside a custom404.astroor500.astroerror page being silently dropped from the final response#17579
3ea55ceThanks @bluwy! - Supports thedevEnginesfield in package.json when detecting the package manager for install commands#17422
e4e2037Thanks @jiwonyoon-dev! - Fixespopoverbeing rendered aspopover="true"/popover="false"on custom elements (tag names containing a hyphen). Per the Popover API, the attribute only accepts"auto","manual", or being absent, so boolean values are now always rendered as a barepopoverattribute (or omitted), regardless of the tag name.eslint/eslint (eslint)
v10.8.1Compare Source
Bug Fixes
18eb0a7fix: prevent ASI hazard inno-unused-labelsautofix (#21173) (dongkyu lee)151ba3ffix: false positives ingetter-returnandaccessor-pairs(#21163) (Grit)6898df9fix: ignore meta-property names inid-denylist(#21166) (Pixel)4d7db66fix: ignore meta-property names inid-match(#21167) (Pixel)677214efix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)Documentation
7d0cbf8docs: Update README (GitHub Actions Bot)0a05812docs: add missing backticks tono-duplicate-imports.js(#21183) (Lee Daeun)678c90bdocs: Update README (GitHub Actions Bot)8a10424docs: Update README (GitHub Actions Bot)69bb948docs: Update README (GitHub Actions Bot)Chores
0a14800chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])05adcb1test: fix failing ecosystem test foreslint-plugin-unicorn(#21191) (Lazizbek Ergashev)5611035test: add error locations info tono-void(#21185) (Lee Daeun)ee47333ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])f131c03chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)1f6eddechore: update ecosystem plugins (#21182) (ESLint Bot)d3266fbchore: unpinwebpackdependency (#21172) (Francesco Trotta)65a6519chore: add allowScripts field to package.json (#21092) (GiHoon Noh)22e5256ci: addtriage:nolabel to Dependabot PRs (#21141) (lumir)55c9038ci: bump actions/labeler from 6 to 7 (#21159) (dependabot[bot])7280e78chore: update dependency prettier to v3.9.6 (#21162) (renovate[bot])eddbad6test: fix failing ecosystem test foreslint-plugin-unicorn(#21156) (Francesco Trotta)60a178dchore: update ecosystem plugins (#21150) (ESLint Bot)f9f61dctest: add error locations tono-unreachable(#21151) (JIYEON)d086293test: add error locations tono-undef(#21147) (JIYEON)cc01b67test: add error locations tono-useless-catch(#21144) (devoil)688e75echore: add missing backticks in JSDoc (#21143) (Bo Hyun Kim)7c1e175test: add error locations torequire-await(#21145) (Grit)588a26dtest: add error locations tono-extra-label(#21139) (dongkyu lee)059aa89test: add error locations tono-useless-concat(#21140) (dongkyu lee)5a452a8test: add error locations tono-const-assign(#21138) (dongkyu lee)sindresorhus/globby (globby)
v16.2.3Compare Source
.gitignorerules5775ffbnodejs/node (node)
v24.19.0: 2026-08-03, Version 24.19.0 'Krypton' (LTS), @aduh95Compare Source
Notable Changes
d08872b530] - (SEMVER-MINOR) buffer: implementblob.textStream()(Matthew Aitken) #6403635222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217d6ab039f24] - (SEMVER-MINOR) doc: updateblockListstability status to release candidate (alphaleadership) #630501da05fb79d] - doc: markstream.composestable (Matteo Collina) #625623c1636dabf] - (SEMVER-MINOR) esm: add--experimental-import-textflag (Efe) #62300e323e877be] - (SEMVER-MINOR) fs: support caller-suppliedreadFile()buffers (Matteo Collina) #63634c1248c9544] - (SEMVER-MINOR) http: addhttpValidationoption to configure header value validation (RajeshKumar11) #61597a534b65815] - (SEMVER-MINOR) net: supportTCP_KEEPINTVLandTCP_KEEPCNTinsetKeepAlive(Guy Bedford) #63825a23cdec683] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #629357428b57a37] - (SEMVER-MINOR) src: allow empty--experimental-config-file(Marco Ippolito) #61610e57597173c] - (SEMVER-MINOR) stream: exposeReadableStreamTee(Matteo Collina) #641955396235993] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #641195e901b5cd9] - (SEMVER-MINOR) tls: addcertificateCompressionoption (Tim Perry) #62217Commits
676467fa9f] - benchmark: trim down the argon2 sets (Filip Skokan) #64218a77a2000b7] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929dd4482e915] - buffer: remove unreachable overflow check in atob (haramjeong) #60161081c41eb86] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169d08872b530] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #640366e2f7e6013] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #6374787e0675f51] - build: build codecache and snapshot with libnode (Chengzhong Wu) #6362632174a7bae] - build: support setting an emulator from configure script (Ivan Trubach) #5389969cfb2f240] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #6362937ac6e8cb5] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #641182424207191] - build: suppress compiler warnings for histogram (Richard Lau) #6398063502b7404] - build,win: fix VS2022 arm64 PGO build (Stefan Stojanovic) #63413fe4e4055d0] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #63972aa2f3c066e] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930fcf32cf77a] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #639337907134734] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026b505cd5465] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #639880f54a872e2] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975824ec11c05] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #6362273aba92689] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556c83b79874e] - crypto: reject invalid raw key imports (Filip Skokan) #63134934fda64b9] - crypto: improve accuracy of SubtleCrypto.supports (Filip Skokan) #63104e392e1f791] - crypto: fix large DH generator validation (Tobias Nießen) #64092e75a363e70] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942adbaf7af9b] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910bb1aea8897] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #6326112c87732c1] - crypto: handle cipher context allocation failures (Tian Teng) #63542858496b453] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #636449a29cb0964] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #634908bb536066d] - crypto: optimize normalizeAlgorithm dispatch hot path (Filip Skokan) #62756329e5496ff] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #6389597b7a3f9c7] - debugger: add --max-hit option to probe mode (Joyee Cheung) #637049098585c5e] - debugger: add more logs to probe mode (Joyee Cheung) #6366359cca26cd5] - debugger: surface inspector failures in probe mode (Joyee Cheung) #634372922290eae] - debugger: disambiguate probe location binding (Joyee Cheung) #632866fb2c2c7e2] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969688e792551] - debugger: defer probe pause handling until startup (Trivikram Kamat) #636081ac93cc05a] - debugger: await initialization after run and restart (Trivikram Kamat) #6360792a909cf72] - debugger,test: deflake resume failure test and add debug logs (Joyee Cheung) #635248b37af8b11] - deps: V8: backportbef0d9c(Joyee Cheung) #621328832126422] - deps: V8: cherry-pick64b36b4(Dan Carney) #6171275990c2cd6] - deps: update googletest to8b53336(Node.js GitHub Bot) #641818500c7ba86] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180dc78091b45] - deps: c-ares: cherry-pick8ba37af(René) #64110873cc72125] - deps: update googletest to0b1e895(Node.js GitHub Bot) #640391d3d166538] - deps: update acorn to 8.17.0 (Node.js GitHub Bot) #6390135222948be] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217e40cee5f79] - deps: upgrade npm to 11.17.0 (npm team) #6385785c6d46606] - deps: add ngtcp2_fmt.c to build configuration (ngtcp2.gyp) (沈鸿飞) #63821d2ea8b7a8c] - deps: update googletest to7140cd4(Node.js GitHub Bot) #6377525b4d57bb6] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774a96368e4c7] - deps: update zlib to 1.3.2.1-motley-3246f1b (Node.js GitHub Bot) #63773b59f1f5f37] - deps: update amaro to 1.1.10 (Node.js GitHub Bot) #636700b3b56ee95] - deps: update googletest to8736d2c(Node.js GitHub Bot) #63669aa67b5b9c4] - dgram: add synchronous Socket connectSync() (Guy Bedford) #63932ef38374875] - dgram: add synchronous Socket.prototype.bindSync() (Guy Bedford) #638386edc3a9967] - dgram: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) #64133d4cfe2d8ac] - dns: coerce -0 to +0 in lookup and resolver inputs (Filip Skokan) #6355691c9ce5a45] - doc: improvefs.StatFsproperties descriptions (aymanxdev) #6257854e21675fa] - doc: fix inconsistencies in CJS code snippets (Antoine du Hamel) #6319964c23daa76] - doc: remove typo comma from man page (Vas Sudanagunta) #63080bc943cd34a] - doc: update Http2SecureServer.on("timeout") default value (YuSheng Chen) #64187a46bc452a6] - doc: add note on visibility of CI failures to new contributor guide (Stewart X Addison) #64256c0fb52506c] - doc: clarify HTTP/1.1 response ordering (Matteo Collina) #64213d3073a7ba6] - doc: recommend node-stress-single-test for flaky tests (Trivikram Kamat) #64223bb9951ead0] - doc: fix typo in examples (Vas Sudanagunta) #64184fe674e96fc] - doc: clarify defense-in-depth issues (Matteo Collina) #64215faad042184] - doc: add guide and answers to FAQs for first-time contributors (Joyee Cheung) #6368579d685adf3] - doc: updateHttp2Server.close&Http2SecureServer.close(YuSheng Chen) #63298744e40e05e] - doc: update list of people inSECURITY.md(Richard Lau) #64152185f57c4a4] - doc: add missing option to man page (Richard Lau) #641568933303568] - doc: fix callback example import in fs docs (Kamal Rawal) #639123a0549dacb] - doc: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) #639745a35e48d08] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #6419366e7f815f1] - doc: add aduh95 to last security release steward (Antoine du Hamel) #63981a7e35040dd] - doc: fix typo in util.md (Daijiro Wachi) #63961d74b3a7e90] - doc: clarify callback exceptions (Matteo Collina) #63939b7a8f8fabd] - doc: fix incorrect test runner mock examples (Kimaswa Emmanuel Yusufu) #63656f11aa690cd] - doc: fix typo in cli.md (Daijiro Wachi) #63883df85f50269] - doc: fix typo in vm.md (Daijiro Wachi) #63881a00a567175] - doc: fix typo in packages.md (Daijiro Wachi) #63882206c1b8437] - doc: fix a/an article typos in module, util, and dns (Daijiro Wachi) #63766e3e5ef1cff] - doc: update npm supported versions link (hojeong park) #63672e3c4852413] - doc: fix AES-OCB IV length in SubtleCrypto.supports example (Anshika Jain) #637170b3fbc82d7] - doc: add webstreams to args forpipelinefromstream/promises(David Sanders) #6362862078a8328] - doc: fix "used to sent" → "used to send" in http2 (Daijiro Wachi) #63700fd74eefb23] - doc: clarify tty raw mode applies to input processing only (Muhammad Zeeshan) #6343842cd7e47de] - doc: add worker_threads history entries (Bob Put) #63545d6ab039f24] - (SEMVER-MINOR) doc: updateblockListstability status to release candidate (alphaleadership) #6305056bdd87378] - doc: move hyperlinks outside of text blocks (Aviv Keller) #634931da05fb79d] - doc: mark stream.compose stable (Matteo Collina) #625627bb6dab70c] - doc,crypto: mark argon2 and encap/decap as stable (Filip Skokan) #639241a4edb3c22] - doc,lib: align WebCrypto names with spec (Filip Skokan) #635183c1636dabf] - (SEMVER-MINOR) esm: add--experimental-import-textflag (Efe) #62300e0f211ca79] - events: improveaddAbortListenerperf by caching options object (Raz Luvaton) #52367a124429b36] - fs: do not treat EPERM as ENOTEMPTY on Windows (Kirill Saied) #63709e323e877be] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634a41b4824d7] - fs: prevent spurious recursive watch events on prefix siblings (Marco) #63095c63e00e3a5] - fs: ignore deleted dirs in recursive watch scan (Trivikram Kamat) #63686d3d7cd05e3] - fs: coerce -0 to +0 in mode flags and watch intervals (Filip Skokan) #635566f6387ecb3] - gyp: update deps gypfiles (Nad Alaba) #63117592544af44] - http: document and validate options.path when it's in absolute-form (Joyee Cheung) #64108c1248c9544] - (SEMVER-MINOR) http: add httpValidation option to configure header value validation (RajeshKumar11) #6159785a223bf15] - http: fix drain event with cork/uncork (David Evans) #640388b060a9628] - inspector: fix crash when writing to closed inspector socket (ympark2011) #64209e68a3d33ac] - inspector: fix inspector.close() documented behavior (Chengzhong Wu) #63837d3682930b7] - lib: fix missing lazyDOMException import (Filip Skokan) #64033af9ea9cfcf] - lib: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) #64174cd1ea26110] - lib: use__proto__: nullwhen callingObjectDefineProperty(Antoine du Hamel) #642395b264398ce] - lib: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) #63702823efe8c71] - lib: improve control abstraction coverage in frozen intrinsics (Renegade334) #636987f4af5568f] - lib: add Iterator global to primordials (Renegade334) #63698c8f3f5e5a5] - lib: makeNavigator#languagegetter throw on invalidthis(Mohamed Sayed) #636011ebbbd59cf] - lib: optimize webidl conversion options (Filip Skokan) #6275688590d1bb7](https://redirect.github.com/nodejs/nConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.