Repository navigation
chore(deps): bump astro and @astrojs/starlight - #337
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) and [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight). These dependencies needed to be updated together. Updates `astro` from 6.3.2 to 7.1.6 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.1.6/packages/astro) Updates `@astrojs/starlight` from 0.38.1 to 0.41.6 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.6/packages/starlight) --- updated-dependencies: - dependency-name: astro dependency-version: 7.1.6 dependency-type: direct:production - dependency-name: "@astrojs/starlight" dependency-version: 0.41.6 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Contributor
|
Superseded by #339. Astro 7 / Starlight 0.41 need repo-side changes that this bot PR can't include: Starlight 0.39 removed labelled autogenerated sidebar groups, which is why the build here fails. #339 preserves the bump commit from this PR and adds the sidebar fix, the generator fix that keeps synced Motoko pages working, an llms.txt section-label fix, and the |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
marc0olo
added a commit
that referenced
this pull request
Aug 4, 2026
## Summary Replaces #337 (dependabot), which could not merge as-is: Astro 7 / Starlight 0.41 need repo-side changes. Dependabot's bump commit is preserved here, with the required fixes on top. - `astro` 6.3.2 → 7.1.6, `@astrojs/starlight` 0.38.1 → 0.41.6 (cherry-picked from #337) - Wrap all autogenerate sidebar configs in `items` arrays (Starlight 0.39 removed labelled autogenerated groups) - Normalise the sidebar shape in `scripts/postprocess-motoko.mjs` so synced Motoko pages keep working - Fix `deriveSections()` in `plugins/astro-agent-docs.mjs` so llms.txt keeps its section labels, and make the same class of failure fail the build in future - Migrate `markdown.remarkPlugins` / `rehypePlugins` to `processor: unified({ ... })` - Align `validate.yml` on Node 22 ## Why the extra changes **Sidebar (build blocker).** Starlight 0.39 requires the autogenerate config to sit inside an `items` array: ```diff { label: "Backends", collapsed: true, - autogenerate: { directory: "guides/backends" }, + items: [{ autogenerate: { directory: "guides/backends", collapsed: true } }], } ``` `collapsed` is set on the autogenerate config too, because autogenerated subgroups no longer inherit the parent's collapsed state as of 0.39. No autogenerate directory currently has subdirectories, so this is a no-op today and keeps behaviour correct if one is added. **Motoko sidebar (would regress on the next sync).** `sidebar-motoko.mjs` is generated from `doc/site/sidebar.mjs` in the pinned `.sources/motoko` submodule, which still uses the pre-0.39 shape. Hand-editing the generated file alone would be undone by the next Motoko sync, breaking the build again. Instead `transformEntry()` now normalises both shapes, so the output is valid whichever shape upstream emits and no coordination with `caffeinelabs/motoko` is required. Verified: both shapes produce byte-identical output, and regeneration is idempotent. **llms.txt (silent break, now guarded).** `deriveSections()` read the section label off the autogenerate node. Once nested, that node is unlabelled and the label lives on the parent group, so all 15 autogenerated sections rendered as `## undefined` in llms.txt — with a clean build log and a zero exit code. Beyond fixing the derivation, the derived sections are now validated at module load and the build throws with the offending directory and the function to update. Verified by reintroducing the original bug: the build fails immediately instead of shipping. This guards the whole class of failure, since these labels are inferred from the sidebar's shape and future Starlight majors can change it again. **Markdown processor.** Astro 7 defaults to the Sätteri processor and deprecates the top-level plugin arrays (the build warned about it). `processor: unified({ ... })` opts back into the remark/rehype pipeline the 5 remark and 2 rehype plugins need. `@astrojs/markdown-remark` is declared as a direct dependency instead of relying on Astro's transitive copy; only the root dependency entry is added to the lockfile. **Node 22 in `validate.yml`.** Astro 7 requires `^20.19.0 || >=22.12.0`. The previous `'20'` pin resolved to a satisfying 20.x and that job does not run Astro, so this aligns it with the other five workflows rather than fixing a break. ## Verification Built against a `main` baseline and compared output: - 209 pages build clean, no errors, no deprecation warnings - Sidebar identical: 38 groups, same labels, same collapsed states, 196 nav links - `llms.txt`, `llms-full.txt`, `feed.xml` and all 209 markdown endpoints byte-identical - Rendered article content identical on 204 of 208 pages; the 4 differences are 3 smart-quote corrections (`”Canister is not ready”` → `“Canister is not ready”`) and one whitespace change between flex items in a Starlight LinkCard on the homepage, which does not render - Confirmed on the deployed preview: the submodule-sourced Motoko pages that use `file=` includes render in full, and `llms.txt` is byte-identical to the local build - Build time 33s → 28s ## Notes - Starlight 0.41 drops support for Chromium < 111 and Safari < 16.4. - Upstream `caffeinelabs/motoko` pins Starlight ^0.41.3 in `doc/site/package.json` while its `sidebar.mjs` still uses the pre-0.39 shape, and no workflow there builds `doc/site`, so their own preview site hits this same error unnoticed. Worth a separate upstream PR; this branch does not depend on it. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Sep 14, 2026
marc0olo
added a commit
that referenced
this pull request
Sep 14, 2026
## Summary Closes #384, which cannot resolve: astro 7.2.10 changed its `@astrojs/markdown-remark` peer from an exact pin to `^7.3.0`, and only `@astrojs/mdx` 8 satisfies that, which only arrives with Starlight 0.42. Dependabot bumps one package, so `npm ci` fails with ERESOLVE. Same shape as #337 → #339. Clears three advisories: | | severity | patched in | |---|---|---| | GHSA-26w7-cxv4-gfx2 — astro RCE via AVIF image optimization | critical | astro 7.2.8 | | GHSA-376h-93r7-7g6f — astro auth bypass when stripping `base` | medium | astro 7.2.4 | | GHSA-2v37-7h3g-55p8 — nanoid infinite loop (transitive, via postcss) | high | nanoid 3.3.18 | `npm audit` reports 0 vulnerabilities after the bump. ## Starlight 0.42 breaking changes - **Mobile menu** moved to `popover` + `.sl-menu-button`, dropping `starlight-menu-button`, `aria-expanded` and `data-mobile-menu-expanded`. Nothing in `src/` or `custom.css` targets those. - **`tagline` config option removed.** Our `Hero.astro` uses the `hero.tagline` frontmatter field, which is unaffected. - **Package now ships JS + `.d.ts`** instead of TS source. We only import `@astrojs/starlight/loaders`, `/schema` and `/components`. - **Browser floor raised** to Chrome/Edge 116, Safari 17, Firefox 125. ## Verification Built against a `main` baseline, both on node 22: - `llms.txt`, `llms-full.txt`, `sitemap.xml` and all 210 `.md` endpoints byte-identical; `feed.xml` differs only by `lastBuildDate` and item order (pre-existing nondeterminism) - HTML diffs across all 210 pages are confined to the new mobile-menu markup, the `generator` meta tags, and page-local tab ids (a 0.41.8 change) - `package-lock.json` keeps its `libc` metadata; a macOS `npm install` strips it, so it was restored by hand and re-validated with `npm ci` ## One upstream bug worked around Under astro 7.3 / mdx 8, an `.astro` component with scoped styles rendered inside another component's slot in MDX gets `xmlns` serialized as `:xmlns`. It reproduces with a minimal component inside `<TabItem>` and is specific to `xmlns` (`xmlns:xlink`, `viewBox` and ordinary attributes are fine). Here it hit the two footer icons of `CodeExample`, so those SVGs now omit `xmlns` — inline SVG does not need it. To be reported upstream; nothing is filed yet.
marc0olo
added a commit
that referenced
this pull request
Sep 14, 2026
## Summary There is no `.github/dependabot.yml` today, so dependabot runs **security updates only**, and those bump one package at a time. Astro releases `astro` and `@astrojs/*` in lockstep with narrow peer ranges, so a single-package bump inside that family frequently cannot resolve at all: #384 fails `npm ci` with ERESOLVE, as did #337 before it. This enables npm version updates with three groups: - `astro` / `astro-security` — `astro` + `@astrojs/*` in one PR, so dependabot resolves the family in a single pass. This is the fix for the #384 class. - `rest` — everything else in one PR, so the weekly run stays at two PRs. ## What this does not fix Grouping fixes resolution, not code. A Starlight minor is a breaking release, so a grouped PR still fails the build check whenever the new version needs source changes (0.39 changed the `autogenerate` sidebar shape, 0.42 rewrote the mobile-menu markup). Those still get taken over by hand on an `infra/` branch, which is also the only way to get a preview: `preview-deployment.yml` is skipped on dependabot PRs because their token is read-only. `.agents/upstream-tracking.md` gains a section recording that, plus the two lockfile and rendering checks worth running when taking a bump over.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps astro and @astrojs/starlight. These dependencies needed to be updated together.
Updates
astrofrom 6.3.2 to 7.1.6Release notes
Sourced from astro's releases.
... (truncated)
Changelog
Sourced from astro's changelog.
... (truncated)
Commits
9865d1c[ci] release (#17539)5214663fix: bump compiler (#17545)bbc1ec9fix: chuncked content collections (#17543)296e1b0fix(dev): refresh stale CSS for component\<style>block HMR (#17383)ff97b86fix(build): introduce two-staged build to prevent race condition with concurr...b0535ca[ci] release (#17528)c895b12Update js-yaml to 4.3.0 (#17474)f61ba9cfix(logger): loading at runtime when entrypoint is a URL (#17480)e614b7bfix(astro): do not resolve action function properties as path segments (#17525)7613030Return a response when request finalization fails (#17524)Updates
@astrojs/starlightfrom 0.38.1 to 0.41.6Release notes
Sourced from @astrojs/starlight's releases.
... (truncated)
Changelog
Sourced from @astrojs/starlight's changelog.
... (truncated)
Commits
ae0838f[ci] release (#4106)f1dddc0Add Forgejo icon (#4102)5b06909[ci] release (#4097)bb06434Fix union schemaextendregression (#4095)ab2792b[ci] release (#4090)712eeddfix: invalid option error when modifying enums in docsSchema's extend (#3936)0896b91Support links with any protocol in sidebars (#4092)4486ba4Remove pagehide event from sidebar persistence script (#4088)96cee6e[ci] release (#4032)1686eccfix(MobileMenuToggle): trap keyboard focus inside the mobile menu (#3911)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.