[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@analogjs/content (source)	2.7.5 → 2.8.0
@analogjs/platform (source)	2.7.5 → 2.8.0
@analogjs/router (source)	2.7.5 → 2.8.0
@analogjs/vite-plugin-angular	2.7.5 → 2.8.0
@angular/build	22.2.0 → 22.2.1
@angular/common (source)	22.2.0 → 22.2.1
@angular/compiler (source)	22.2.0 → 22.2.1
@angular/compiler-cli (source)	22.2.0 → 22.2.1
@angular/core (source)	22.2.0 → 22.2.1
@angular/platform-browser (source)	22.2.0 → 22.2.1
@angular/platform-server (source)	22.2.0 → 22.2.1
@angular/router (source)	22.2.0 → 22.2.1
@astryxdesign/core (source)	0.6.3 → 0.6.4
@astryxdesign/theme-neutral (source)	0.6.3 → 0.6.4
@cloudflare/codemods (source)	0.3.0 → 0.4.0
@cloudflare/vite-plugin (source)	1.62.2 → 1.62.4
@cloudflare/workers-auth (source)	0.9.5 → 0.11.1
@cloudflare/workers-types	5.20260929.1 → 5.20261001.1
@nkzw/fate	1.7.3 → 1.7.5
@shikijs/engine-javascript (source)	4.4.3 → 4.5.0
@shikijs/transformers (source)	4.4.3 → 4.5.0
@tanstack/react-router (source)	1.170.40 → 1.170.41
@tanstack/react-start (source)	1.168.59 → 1.168.60
@vitest/browser (source)	5.0.2 → 5.0.3
@vitest/browser-preview (source)	5.0.2 → 5.0.3
@vitest/mocker (source)	5.0.2 → 5.0.3
@vitest/pretty-format (source)	5.0.2 → 5.0.3
@vitest/snapshot (source)	5.0.2 → 5.0.3
@vitest/spy (source)	5.0.2 → 5.0.3
@vitest/utils (source)	5.0.2 → 5.0.3
arktype (source)	2.2.5 → 2.2.7
better-auth (source)	1.7.6 → 1.7.7
cf (source)	1.0.0-beta.9 → 1.0.0-beta.10
ignore	7.0.10 → 7.0.11
pg (source)	8.23.0 → 8.23.1
postal-mime (source)	4.0.0 → 4.0.2
react-fate	1.7.3 → 1.7.5
shiki (source)	4.4.3 → 4.5.0
vinext (source)	1.0.0 → 1.0.1
vitest (source)	5.0.2 → 5.0.3
wrangler (source)	4.144.0 → 4.146.0

---

Release Notes

analogjs/analog (@​analogjs/content)

v2.8.0

Compare Source

Bug Fixes

• content: restore docs content loading and hydration (#​2586) (ababebb)
• platform: isolate concurrent i18n rendering with locale workers (#​2572) (6deb462)
• router: harden experimental streaming SSR (#​2587) (e0a9939), closes #​2531
• vite-plugin-angular: emit source-linked workspace packages (#​2544) (e26a1f5)
• vite-plugin-angular: handle boundary conformance and deferred dependencies (#​2564) (3901663)
• vite-plugin-angular: lazily create JavaScript transformers (#​2582) (4a1c52c)
• vite-plugin-angular: preprocess styles with the top-level resolved config (#​2557) (d05e143)
• vite-plugin-angular: release compilation API program after emit in builds (#​2590) (14d7f4c)
• vite-plugin-angular: support Angular 22.2 transformer and source caches (#​2576) (00c2002)
• vitest-angular: use Vite 8 in setup schematic (#​2592) (82abd74)

Features

• astro-angular: support content projection for island components (#​2560) (96ed98d)
• router: add opt-in form enhancements and validation helpers (#​2565) (f0cd5bb)
• router: add opt-in type-safe routing (#​2561) (e0a512a)
• router: add TanStack Query integration (#​2552) (d0cfbd6)
• router: add typed action and API route helpers (#​2562) (1335448)
• router: add typed route data and relative navigation (#​2596) (92023cf)
• vitest-angular: add support for Vitest 5 (#​2573) (a02502a)

Performance Improvements

• vite-plugin-angular: batch compilation and hot update notifications (#​2594) (2344881)

angular/angular-cli (@​angular/build)

v22.2.1

Compare Source

@​angular/cli

Commit	Type	Description
db053444e0	fix	skip components with a change detection strategy in the zoneless migration tool

@​schematics/angular

Commit	Type	Description
663c580c86	fix	add browsers option to angular.json during vitest browser provider ng-add

@​angular-devkit/schematics-cli

Commit	Type	Description
e6350b6f57	fix	correctly parse inline boolean values in CLI options (#​34201)

@​angular-devkit/architect

Commit	Type	Description
516df4ee6d	fix	correctly parse inline boolean values in CLI options (#​34201)

@​angular-devkit/build-angular

Commit	Type	Description
ac70f86208	fix	do not mark standalone expression statements as pure

@​angular/build

Commit	Type	Description
ec9c0b51c2	fix	deduplicate spurious chokidar polling change events (#​34188)
c1b5154180	fix	encode script type in auto-CSP loader
cb4dd71a1b	fix	ensure @​angular/compiler is loaded for Vitest TestBed initialization
b198044048	fix	preserve nested workspace path for git worktree cache
5194b41531	fix	prevent chokidar from scanning unimported node_modules in watch mode
37cf399d95	fix	reset component updates on dev-server SSR page request
ddff42cb03	fix	serve emitted HTML assets in dev-server
e3e893682d	fix	watchers outside the workspace via parcel didn't work
d55e899954	perf	avoid loading compiler-cli and typescript in js transform worker
3d08e5b053	perf	avoid sharding intermediate files under worker surplus in i18n inliner
5ea36fe8b8	perf	bound aggregate worker allocation across dominant files in i18n inliner
90ee193bd1	perf	bound concurrent worker allocation for dominant files in i18n inliner
41b353856b	perf	process batch locales sequentially in i18n inliner worker

angular/angular (@​angular/common)

v22.2.1

Compare Source

common

Commit	Type	Description
ad2f291ba0	fix	let NgOptimizedImage pass a [srcset] binding through when srcset optimization is disabled

compiler

Commit	Type	Description
0ecaf8e7ab	fix	add explicit return types to generated functions
c451a3b98d	fix	avoid incorrectly stripping parentheses in template pipeline
bbc556daa9	fix	avoid stripping parentheses from some expressions

compiler-cli

Commit	Type	Description
fe9ebf5bf5	fix	support extendedConfigCache in readConfiguration

core

Commit	Type	Description
21851fc3a3	fix	add debugName on afterRenderEffect
7c634ecec4	fix	block dangerous data: and vbscript: URLs in URL sanitizer
9aeef8df6f	fix	extend data: URL allowlist for non-executable MIME types
f5e8edc5a6	fix	include signal and component name in NG0600 error message
88614a5407	fix	render error boundary fallbacks after HMR

http

Commit	Type	Description
6dee7fe91c	fix	forward reportProgress of httpResource as reportDownloadProgress

platform-server

Commit	Type	Description
928dcfd258	fix	reject protocol-relative paths in resolveUrl

router

Commit	Type	Description
568d6a83a2	fix	do not copy URL-sized objects into every route snapshot
a6e6097b3d	fix	fall back when serializing protocol-relative URLs
8b6dd5e947	fix	limit absolute redirects from redirect functions
3b6796f1ab	fix	reject duplicate outlets in production builds
e9bf52aa03	fix	require outlets to match a route before processing child segments
d23932f2fd	fix	set initial blocking resource input synchronously on activation
14793bfe4b	perf	do not retain UrlTree instances in RouterLink

facebook/astryx (@​astryxdesign/core)

v0.6.4

Compare Source

New Features

• Add Timer for standardized elapsed durations without React tick renders. (#​6438)
  Use Timer for active-operation elapsed time. It starts from mount by default, accepts an earlier Unix-millisecond startTime, offers elapsed and clock formats with adaptive cadence, and matches Timestamp typography props.

• DialogHeader: expose the start- and end-content wrappers as theme targets (#​6415)
  Adds dialog-header-start-content and dialog-header-end-content so themes can style the existing content-slot wrappers without relying on their DOM positions. The end-content slot also contains the optional close button. Default layout and behavior are unchanged.

• DialogHeader title and subtitle now accept any ReactNode, not only strings.
  A title can carry inline markup and still renders inside the focusable h2 that receives focus on open and names the Dialog; the accessible name is the title's text content. A subtitle can carry inline content such as a Link. String callers are unchanged. An empty-string, boolean, or nullish subtitle renders nothing, and a numeric 0 subtitle now renders inside the subtitle text.

• DropdownMenuItem, DropdownMenuCheckboxItem and DropdownMenuRadioItem forward a ref to the row root (#​6687).
  The ref reaches the element carrying role="menuitem" (or menuitemcheckbox / menuitemradio), the way Item and DropdownMenuDivider already forward one, so a menu row can be registered with an element-keyed observer or overlay — an IntersectionObserver for an impression, a measurement, a debug outline — without a wrapper between role="menu" and the row.

• Add presentation to DateInput, DateTimeInput, and TimeInput (spec:AST-043) (#​6628).
  presentation names every picker surface, distinguishing Astryx's desktop surface, Astryx's bottom sheet (including a new TimeInput sheet), the browser/OS picker, and — for TimeInput only — a plain typed field. DateInput and DateTimeInput accept five values: 'popover' | 'bottom-sheet' | 'native' | 'adaptive-bottom-sheet' | 'adaptive-native' (default). TimeInput accepts those five plus 'text-input', the typed field on every pointer, because that is the surface its released nativePicker="never" already was. presentation="native" always shows native; adaptive-native keeps the released native fallbacks.

  nativePicker is deprecated but keeps working exactly as released (touch→adaptive-native, always→native, never→adaptive-bottom-sheet, or text-input for TimeInput); presentation wins when both are set. astryx upgrade ships migrate-native-picker-to-presentation for static callsites.

• List: add edgeCompensation="inline" to compensate for item content inset within container padding (#​2626)
  ListItem insets its content by a density-dependent horizontal padding, so a list under a section heading reads as misaligned and consumers reach for negative-margin custom CSS. edgeCompensation="inline" on List cancels, per inline edge, the smaller of that inset and the container's published padding on that edge; zero-padding and full-bleed surfaces therefore stay in place, asymmetric container padding never over-cancels an edge, and headers, hover backgrounds, and selection backgrounds keep their existing geometry.

  Item now publishes its inline inset as --_item-inset-inline and derives its own paddingInline from it, and the clamped cancelling margin reads the same variable — so the cancel tracks density and theme overrides instead of mirroring hardcoded values. Themes that set paddingInline on item feed the variable automatically via the derived var registry.

• Markdown: add the first-party soft-breaks plugin (#​6459)
  Use markdownSoftBreaksPlugin from @astryxdesign/core/Markdown/plugins to render soft line endings as hard breaks without preprocessing source. The plugin matches the real remark-breaks package through Astryx's supported adapter path while keeping code and other opaque content unchanged.

• Table: add a selection-aware bulk-actions wrapper that consumes useTableSelectionState output while keeping the selection plugin behavior-only. (#​6474)

Fixes

• Preserve authored heading and text component styles when theme adaptations change the type scale (#​6710)
• AvatarGroup keeps its overlap when avatars are wrapped in a HoverCard or Tooltip. Every avatar and the overflow indicator now take the overlap margin, and the group pads its start edge to match, so the overlap no longer depends on each avatar being a direct child of the group (#​6736).
• Avatar initials skip punctuation: each word's initial is its first letter, digit or emoji, so Northwind Workbench (automation) renders NA instead of N( and “Ada” Lovelace renders AL instead of “L. Words with none of those, such as a lone -, are ignored, and a name made only of punctuation shows the default icon rather than a stray symbol (#​6698).
• Size an Astryx Icon without an explicit size to match its Button or
  IconButton: 16px for small and medium controls, and 20px for large controls. (#​5762)
• ChatComposerInput: an empty input no longer shrinks by 8px when isDisabled flips to true, which shifted anything bottom-aligned beside it (e.g. a send button in a grid row) (#​6654).
  The root's minHeight was set to the shared line-height only, not the padding editable and placeholder both add on top of it — normally immaterial, since the editable region reserves its own padded box even when empty. A disabled, empty contentEditable region stops reserving that empty line at all in Chromium, and the absolutely positioned placeholder standing in for it doesn't contribute to layout height, so the root fell back to just the line-height and lost the padding. minHeight now explicitly accounts for both.
• ChatComposerInput no longer scrolls for a short single-line draft with maxRows={1}. Removing vertical padding also keeps the empty input and placeholder aligned when disabled. (#​6733)
• Keep numeric zero aligned in ChatMessageBubble name and metadata slots. (#​6600)
  The aligned wrappers are omitted for non-rendering scalar values (null, undefined, booleans, and the empty string), while numeric 0 remains visible inside the same inset as other slot content.
• Render numeric zero when it is passed as the ChatMessageList empty state. A valid ReactNode should not disappear when the transcript is empty. (#​6636)
• Omit empty ChatMessageMetadata slots and their separators (#​6637).
  Boolean and empty-string timestamp or footer values no longer leave a blank row or a stray dot. Numeric zero remains visible, and all delivery statuses keep their existing labels and icons.
• Compose accepted onClick handlers with ChatSendButton's send and stop actions instead of replacing them (#​6653). Consumers that used onClick to replace sending should move that logic to onSend, because both handlers now run.
• Allow long ChatSystemMessage content to wrap within narrow chat layouts instead of crossing the container edge (#​6655).
• ChatTokenizedText now ignores empty token values so tokenized messages always finish rendering (#​6679).
• ChatToolCalls now displays custom group labels, keeps collapsed details out of keyboard navigation, adds visible focus treatment, and uses readable secondary text for neutral metadata (#​6680).
• Stop ChatLayout's scroll-to-bottom button from being a tab stop while it is invisible. At rest the layout's default scrollButton renders hidden, but opacity: 0 and pointer-events: none leave it in sequential focus navigation — so a keyboard user's first Tab into any chat landed on a control with no visible focus indicator (WCAG 2.2 SC 2.4.7), and Enter scrolled the transcript. The hidden state now also sets visibility: hidden, which the fade transition carries so the animation is unchanged; the visible button keeps its keyboard access. The pill's height and collapsed width now track --size-element-md instead of a hardcoded 32px, so a theme that retunes the element scale can no longer make the pill clip its own Button. ChatLayout's consumer docs also gain the density prop, which was undocumented, and drop the claim that density adapts automatically to container width — it never did. A Chromium evidence spec pins the hidden/visible/re-hidden keyboard contract and the pill's containment of its Button under a size-retuning theme, and the RTL applicability ledger records why ChatLayout and its scroll button have no applicable RTL dimension. (#​6466)
• Make a theme that styles chat-layout-scroll-button actually restyle the chat scroll-to-bottom pill. The documented target sat on the invisible full-width row that centres the pill, so a backgroundColor override painted a band across the chat dock while the pill kept the surface the theme asked to replace — and every automated check passed, because the override did reach an element. The target now rides the pill, which is what paints the fill, elevation, and radius (architecture:component-theming-surface INV4). The target keeps its name, stays a single target, and the component's props, DOM shape, ref target, and consumer passthrough are unchanged. A Chromium spec pins the placement and proves the repair by moving the target back and showing the pill go unstyled under a theme. (#​6482)
• Correct CheckboxIndicator theming, replacement-content, and focus guidance ([#​6745](https://redirect.github.com/facebook/astryx/issue

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 10am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​shikijs/​engine-javascript@​4.4.3 ⏵ 4.5.0			+1
	@​shikijs/​transformers@​4.4.3 ⏵ 4.5.0			+1
	@​analogjs/​content@​2.7.5 ⏵ 2.8.0	+1
	@​angular/​platform-browser@​22.2.0 ⏵ 22.2.1
	@​analogjs/​router@​2.7.5 ⏵ 2.8.0	+1		+1
	@​analogjs/​platform@​2.7.5 ⏵ 2.8.0	+1		+1
	@​angular/​compiler-cli@​22.2.0 ⏵ 22.2.1	+1		+1
	@​angular/​router@​22.2.0 ⏵ 22.2.1	+1		+1	+1
	@​angular/​platform-server@​22.2.0 ⏵ 22.2.1	+1		+1
	shiki@​4.4.3 ⏵ 4.5.0
	react-fate@​1.7.3 ⏵ 1.7.5				+1
	@​angular/​build@​22.2.0 ⏵ 22.2.1	-7		+1	-1
	@​angular/​compiler@​22.2.0 ⏵ 22.2.1			+1
	@​angular/​core@​22.2.0 ⏵ 22.2.1	+1		+1	-1
	@​angular/​common@​22.2.0 ⏵ 22.2.1			+1
	vinext@​1.0.0 ⏵ 1.0.1			+1	+1	-19
	@​nkzw/​fate@​1.7.3 ⏵ 1.7.5	+1		+1	+1
	@​cloudflare/​workers-auth@​0.9.5 ⏵ 0.11.1			+1	+1
	better-auth@​1.7.6 ⏵ 1.7.7	+1		+1	+2
	@​tanstack/​react-router@​1.170.40 ⏵ 1.170.41			+1
	@​tanstack/​react-start@​1.168.59 ⏵ 1.168.60
	@​cloudflare/​codemods@​0.4.0
	ignore@​7.0.10 ⏵ 7.0.11			+1	-2
	pg@​8.23.1
	arktype@​2.2.5 ⏵ 2.2.7	+1		+1	+3
	postal-mime@​4.0.0 ⏵ 4.0.2	+1			+1
	@​astryxdesign/​core@​0.6.3 ⏵ 0.6.4	+1		+1
	cf@​1.0.0-beta.9 ⏵ 1.0.0-beta.10	+1			+1
	@​cloudflare/​workers-types@​5.20260929.1 ⏵ 5.20261001.1			+1
	@​analogjs/​vite-plugin-angular@​2.7.5 ⏵ 2.8.0	+1		+1
	@​astryxdesign/​theme-neutral@​0.6.3 ⏵ 0.6.4	+1		+2

View full report

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://renovate-npm-packages-void-cloud.voidzero-docs.workers.dev (commit 0732a86)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://294c6dfe-void-cloud.voidzero-docs.workers.dev	0732a86	2026-10-04T23:37:25.809Z	Visit the dashboard ↗