chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates #206

dependabot · 2025-10-17T17:18:58Z

Bumps the npm_and_yarn group with 2 updates in the /site directory: astro and prismjs.

Updates astro from 4.16.18 to 5.14.3

Release notes

[email protected]

Patch Changes

#14505 28b2a1d Thanks @matthewp! - Fixes Cannot set property manifest error in test utilities by adding a protected setter for the manifest property

#14235 c4d84bb Thanks @toxeeec! - Fixes a bug where the "tap" prefetch strategy worked only on the first clicked link with view transitions enabled

[email protected]

Patch Changes

#14440 a3e16ab Thanks @florian-lefebvre! - Fixes a case where the URLs generated by the experimental Fonts API would be incorrect in dev

[email protected]

Minor Changes
#13520 a31edb8 Thanks @openscript! - Adds a new property routePattern available to GetStaticPathsOptions

This provides the original, dynamic segment definition in a routing file path (e.g. /[...locale]/[files]/[slug]) from the Astro render context that would not otherwise be available within the scope of getStaticPaths(). This can be useful to calculate the params and props for each page route.

For example, you can now localize your route segments and return an array of static paths by passing routePattern to a custom getLocalizedData() helper function. The params object will be set with explicit values for each route segment (e.g. locale, files, and slug). Then, these values will be used to generate the routes and can be used in your page template via Astro.params.
// src/pages/[...locale]/[files]/[slug].astro
import { getLocalizedData } from "../../../utils/i18n"; export async function getStaticPaths({ routePattern
}) { const response = await fetch('...'); const data = await response.json(); console.log(routePattern);
// [...locale]/[files]/[slug] // Call your custom helper with routePattern to generate the static
paths return data.flatMap((file) => getLocalizedData(file, routePattern)); } const { locale, files,
slug } = Astro.params;
For more information about this advanced routing pattern, see Astro's routing reference.
#13651 dcfbd8c Thanks @ADTC! - Adds a new SvgComponent type

You can now more easily enforce type safety for your .svg assets by directly importing SVGComponent from astro/types:
---
// src/components/Logo.astro
import type { SvgComponent } from 'astro/types';
import HomeIcon from './Home.svg';
interface Link {
  url: string;
  text: string;
  icon: SvgComponent;
}
const links: Link[] = [
  {
    url: '/',

... (truncated)

Changelog

Sourced from astro's changelog.

5.14.3

Patch Changes

#14505 28b2a1d Thanks @matthewp! - Fixes Cannot set property manifest error in test utilities by adding a protected setter for the manifest property

#14235 c4d84bb Thanks @toxeeec! - Fixes a bug where the "tap" prefetch strategy worked only on the first clicked link with view transitions enabled

5.14.2

Patch Changes
#14459 916f9c2 Thanks @florian-lefebvre! - Improves font files URLs in development when using the experimental fonts API by showing the subset if present

b8ca69b Thanks @ascorbic! - Aligns dev image server file base with Vite rules

#14469 1c090b0 Thanks @delucis! - Updates tinyexec dependency

#14460 008dc75 Thanks @florian-lefebvre! - Fixes a case where astro:config/server values typed as URLs would be serialized as strings

#13730 7260367 Thanks @razonyang! - Fixes a bug in i18n, where Astro caused an infinite loop when a locale that doesn't have an index, and Astro falls back to the index of the default locale.
6ee63bf Thanks @matthewp! - Adds security.allowedDomains configuration to validate X-Forwarded-Host headers in SSR

The X-Forwarded-Host header will now only be trusted if it matches one of the configured allowed host patterns. This prevents host header injection attacks that can lead to cache poisoning and other security vulnerabilities.

Configure allowed host patterns to enable X-Forwarded-Host support:
// astro.config.mjs
export default defineConfig({
  output: 'server',
  adapter: node(),
  security: {
    allowedDomains: [
      { hostname: 'example.com' },
      { hostname: '*.example.com' },
      { hostname: 'cdn.example.com', port: '443' },
    ],
  },
});
The patterns support wildcards (* and **) for flexible hostname matching and can optionally specify protocol and port.

Breaking change

Previously, Astro.url would reflect the value of the X-Forwarded-Host header. While this header is commonly used by reverse proxies like Nginx to communicate the original host, it can be sent by any client, potentially allowing malicious actors to poison caches with incorrect URLs.

If you were relying on X-Forwarded-Host support, add security.allowedDomains to your configuration to restore this functionality securely. When allowedDomains is not configured, X-Forwarded-Host headers are now ignored by default.

... (truncated)

Commits

fe1d35c [ci] release (#14507)
7926882 [ci] format
c4d84bb fix(prefetch): Fix "tap" prefetch strategy when view transitions are enabled ...
3bb14b7 [ci] release (#14466)
7a5aaff [ci] format
28b2a1d Fix failing x-forwarded-host tests (#14505)
ec307b0 [ci] format
6ee63bf Merge commit from fork
7260367 fix(i18n): ensure the redirect pathname is non-empty (#13730)
d1b3409 [ci] format
Additional commits viewable in compare view

Updates devalue from 5.1.1 to 5.4.1

Release notes

Sourced from devalue's releases.

v5.4.1

Patch Changes

ca3c7b6: chore: Remove impossible void type from replacer's uneval

v5.4.0

Minor Changes

9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

b617c7c: perf: shrink uneval output with null-proto objects

v5.3.2

Patch Changes

0623a47: fix: disallow array method access when parsing

0623a47: fix: disallow __proto__ properties on objects

v5.3.1

Patch Changes

ae904c5: fix: correctly differentiate between +0 and -0

v5.3.0

Minor Changes

2896e7b: feat: support Temporal

fec694d: feat: support URL and URLSearchParams objects

Changelog

Sourced from devalue's changelog.

5.4.1

Patch Changes

ca3c7b6: chore: Remove impossible void type from replacer's uneval

5.4.0

Minor Changes

9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

b617c7c: perf: shrink uneval output with null-proto objects

5.3.2

Patch Changes

0623a47: fix: disallow array method access when parsing

0623a47: fix: disallow __proto__ properties on objects

5.3.1

Patch Changes

ae904c5: fix: correctly differentiate between +0 and -0

5.3.0

Minor Changes

2896e7b: feat: support Temporal

fec694d: feat: support URL and URLSearchParams objects

5.2.1

Patch Changes

e46f4c8: fix: handle repeated array buffers and subarrays

2dfa504: fix: handle custom classes with null proto as pojo

5.2.0

Handle custom classes with null proto as pojo (#95)

Commits

8b0c28d Version Packages (#117)
ca3c7b6 chore: Remove impossible void type from replacer's uneval (#116)
8fb152e Version Packages (#115)
9306d09 feat: pass uneval to replacer, for handling nested custom types (#114)
2124b5b chore: simplify NullObject (#104)
b617c7c perf: shrink uneval output with null-proto objects (#112)
2635155 set up OIDC publishing (#111)
86a6a66 Version Packages (#109)
0623a47 Merge commit from fork
02d20e8 Version Packages (#108)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for devalue since your current version.

Updates esbuild from 0.21.5 to 0.25.11

Release notes

Sourced from esbuild's releases.

v0.25.11
Add support for with { type: 'bytes' } imports (#4292)

The import bytes proposal has reached stage 2.7 in the TC39 process, which means that although it isn't quite recommended for implementation, it's generally approved and ready for validation. Furthermore it has already been implemented by Deno and Webpack. So with this release, esbuild will also add support for this. It behaves exactly the same as esbuild's existing binary loader. Here's an example:
import data from './image.png' with { type: 'bytes' }
const view = new DataView(data.buffer, 0, 24)
const width = view.getInt32(16)
const height = view.getInt32(20)
console.log('size:', width + '\xD7' + height)
Lower CSS media query range syntax (#3748, #4293)

With this release, esbuild will now transform CSS media query range syntax into equivalent syntax using min-/max- prefixes for older browsers. For example, the following CSS:
@media (640px <= width <= 960px) {
  main {
    display: flex;
  }
}
will be transformed like this with a target such as --target=chrome100 (or more specifically with --supported:media-range=false if desired):
@media (min-width: 640px) and (max-width: 960px) {
  main {
    display: flex;
  }
}
v0.25.10
Fix a panic in a minification edge case (#4287)

This release fixes a panic due to a null pointer that could happen when esbuild inlines a doubly-nested identity function and the final result is empty. It was fixed by emitting the value undefined in this case, which avoids the panic. This case must be rare since it hasn't come up until now. Here is an example of code that previously triggered the panic (which only happened when minifying):
function identity(x) { return x }
identity({ y: identity(123) })
Fix @supports nested inside pseudo-element (#4265)

When transforming nested CSS to non-nested CSS, esbuild is supposed to filter out pseudo-elements such as ::placeholder for correctness. The CSS nesting specification says the following:

The nesting selector cannot represent pseudo-elements (identical to the behavior of the ':is()' pseudo-class). We’d like to relax this restriction, but need to do so simultaneously for both ':is()' and '&', since they’re intentionally built on the same underlying mechanisms.

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

Fix regression with --define and import.meta (#4010, #4012, #4013)

The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

This fix was contributed by @sapphi-red.

0.24.1
Allow es2024 as a target in tsconfig.json (#4004)

TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:
{
  "compilerOptions": {
    "target": "ES2024"
  }
}
As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

This fix was contributed by @billyjanitsch.
Allow automatic semicolon insertion after get/set

This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:
class Foo {
  get
  *x() {}
  set
  *y() {}
}
The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.
Allow quoted property names in --define and --pure (#4008)

The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

6b7c4f2 publish 0.25.11 to npm
7295c1a css: also parse media queries in @import rules
e3991dd css: some adjustments to @import parsing
8bb82ca fix #3748, fix #4293: lower css media range syntax
d8c3f87 css: parse and print media queries
6e75bc7 run make update-compat-table
8f506d5 fix #4292: support with { type: bytes }
d6b668f publish 0.25.10 to npm
5088c19 refactor: use strings.Builder (#4290)
755da31 run make update-compat-table
Additional commits viewable in compare view

Updates prismjs from 1.29.0 to 1.30.0

Release notes

Sourced from prismjs's releases.

v1.30.0

What's Changed

check that currentScript is set by a script tag by @lkuechler in PrismJS/prism#3863

New Contributors

@lkuechler made their first contribution in PrismJS/prism#3863

Full Changelog: PrismJS/prism@v1.29.0...v1.30.0

Changelog

Sourced from prismjs's changelog.

Prism Changelog

Commits

76dde18 Release 1.30.0
93cca40 npm pkg fix
99c5ca9 Add release script
8e8b935 check that currentScript is set by a script tag (#3863)
f894dc2 Fix logo in the footer
ac38dce Delete CNAME
9b5b09a Enable CORS
See full diff in compare view

Maintainer changes

This version was pushed to npm by dmitrysharabin, a new releaser for prismjs since your current version.

Updates vite from 5.4.14 to 6.4.0

Release notes

Sourced from vite's releases.

[email protected]

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

v6.3.6

Please refer to CHANGELOG.md for details.

v6.3.5

Please refer to CHANGELOG.md for details.

v6.3.4

Please refer to CHANGELOG.md for details.

v6.3.3

Please refer to CHANGELOG.md for details.

v6.3.2

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.3.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.3.0

Please refer to CHANGELOG.md for details.

v6.3.0-beta.2

Please refer to CHANGELOG.md for details.

v6.3.0-beta.1

Please refer to CHANGELOG.md for details.

v6.3.0-beta.0

Please refer to CHANGELOG.md for details.

v6.2.7

Please refer to CHANGELOG.md for details.

v6.2.6

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

7.1.10 (2025-10-14)

Bug Fixes

css: avoid duplicate style for server rendered stylesheet link and client inline style during dev (#20767) (3a92bc7)

css: respect emitAssets when cssCodeSplit=false (#20883) (d3e7eee)

deps: update all non-major dependencies (879de86)

deps: update all non-major dependencies (#20894) (3213f90)

dev: allow aliases starting with // (#20760) (b95fa2a)

dev: remove timestamp query consistently (#20887) (6537d15)

esbuild: inject esbuild helpers correctly for esbuild 0.25.9+ (#20906) (446eb38)

normalize path before calling fileToBuiltUrl (#20898) (73b6d24)

preserve original sourcemap file field when combining sourcemaps (#20926) (c714776)

Documentation

correct WebSocket spelling (#20890) (29e98dc)

Miscellaneous Chores

deps: update rolldown-related dependencies (#20923) (a5e3b06)

7.1.9 (2025-10-03)

Reverts

server: drain stdin when not interactive (#20885) (12d72b0)

7.1.8 (2025-10-02)

Bug Fixes

css: improve url escape characters handling (#20847) (24a61a3)

deps: update all non-major dependencies (#20855) (788a183)

deps: update artichokie to 0.4.2 (#20864) (e670799)

dev: skip JS responses for document requests (#20866) (6bc6c4d)

glob: fix HMR for array patterns with exclusions (#20872) (63e040f)

keep ids for virtual modules as-is (#20808) (d4eca98)

server: drain stdin when not interactive (#20837) (bb950e9)

server: improve malformed URL handling in middlewares (#20830) (d65a983)

Documentation

create-vite: provide deno example (#20747) (fdb758a)

Miscellaneous Chores

deps: update rolldown-related dependencies (#20810) (ea68a88)

deps: update rolldown-related dependencies (#20854) (4dd06fd)

update url of create-react-app license (#20865) (166a178)

7.1.7 (2025-09-22)

Bug Fixes

... (truncated)

Commits

5fdcfe7 release: v6.3.0
d4ee5e8 fix(hmr): avoid infinite loop happening with hot.invalidate in circular dep...
5003434 fix(preview): use host url to open browser (#19836)
bf9728e release: v6.3.0-beta.2
380c10e fix(hmr): run HMR handler sequentially (#19793)
8bed1de fix: addWatchFile doesn't work if base is specified (fixes #19792) (#19794)
0a0c50a refactor: simplify pluginFilter implementation (#19828)
59d0b35 perf(css): avoid constructing renderedModules (#19775)
175a839 fix: reject requests with # in request-target (#19830)
e2e11b1 fix(module-runner): allow already resolved id as entry (#19768)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 2 updates in the /site directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) and [prismjs](https://github.com/PrismJS/prism). Updates `astro` from 4.16.18 to 5.14.3 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/[email protected]/packages/astro) Updates `devalue` from 5.1.1 to 5.4.1 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.1.1...v5.4.1) Updates `esbuild` from 0.21.5 to 0.25.11 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.21.5...v0.25.11) Updates `prismjs` from 1.29.0 to 1.30.0 - [Release notes](https://github.com/PrismJS/prism/releases) - [Changelog](https://github.com/PrismJS/prism/blob/v2/CHANGELOG.md) - [Commits](PrismJS/prism@v1.29.0...v1.30.0) Updates `vite` from 5.4.14 to 6.4.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/[email protected]/packages/vite) --- updated-dependencies: - dependency-name: astro dependency-version: 5.14.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.4.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.25.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: prismjs dependency-version: 1.30.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

cloudflare-workers-and-pages · 2025-10-17T17:19:21Z

Deploying chisel-operator with Cloudflare Pages

Latest commit:	`d2e6656`
Status:	🚫 Build failed.

View logs

socket-security · 2025-10-17T17:20:37Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/astro@4.16.18 ⏵ 5.14.3		⁺¹³

View full report

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 17, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates #206

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates #206

Uh oh!

dependabot bot commented on behalf of github Oct 17, 2025

Breaking change

Uh oh!

cloudflare-workers-and-pages bot commented Oct 17, 2025

Uh oh!

socket-security bot commented Oct 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates #206

Are you sure you want to change the base?

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates #206

Uh oh!

Conversation

dependabot bot commented on behalf of github Oct 17, 2025

[email protected]

Patch Changes

[email protected]

Patch Changes

[email protected]

Minor Changes

5.14.3

Patch Changes

5.14.2

Patch Changes

Breaking change

v5.4.1

Patch Changes

v5.4.0

Minor Changes

Patch Changes

v5.3.2

Patch Changes

v5.3.1

Patch Changes

v5.3.0

Minor Changes

5.4.1

Patch Changes

5.4.0

Minor Changes

Patch Changes

5.3.2

Patch Changes

5.3.1

Patch Changes

5.3.0

Minor Changes

5.2.1

Patch Changes

5.2.0

v0.25.11

v0.25.10

Changelog: 2024

0.24.2

0.24.1

v1.30.0

What's Changed

New Contributors

Prism Changelog

[email protected]

v6.4.0

v6.3.7

v6.3.6

v6.3.5

v6.3.4

v6.3.3

v6.3.2

[email protected]

v6.3.1

[email protected]

v6.3.0

v6.3.0-beta.2

v6.3.0-beta.1

v6.3.0-beta.0

v6.2.7

v6.2.6

7.1.10 (2025-10-14)

Bug Fixes

Documentation

Miscellaneous Chores

7.1.9 (2025-10-03)

Reverts

7.1.8 (2025-10-02)

Bug Fixes

Documentation

Miscellaneous Chores

7.1.7 (2025-09-22)