Bump the npm_and_yarn group across 1 directory with 6 updates by dependabot[bot] · Pull Request #704 · webstackdev/astro.webstackbuilders.com

dependabot · 2026-08-01T23:32:15Z

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
astro	`7.0.6`	`7.1.6`
postcss	`8.5.16`	`8.5.25`
dompurify	`3.4.11`	`3.4.12`
fast-uri	`3.1.3`	`3.1.5`
fast-xml-parser	`5.9.3`	`5.10.1`
svgo	`4.0.1`	`4.0.2`

Updates astro from 7.0.6 to 7.1.6

Release notes

Sourced from astro's releases.

astro@7.1.6

Patch Changes
#17536 ff97b86 Thanks @dmgawel! - Fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes

#17383 296e1b0 Thanks @thelazylamaGit! - Fixes stale dev CSS after editing component style blocks and CSS files in dev
#17543 bbc1ec9 Thanks @ematipico! - Adds a feature to experimental.collectionStorage that allows to change the size of chunks.

For example, you can reduce the size of chunks to 1MB:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: {
type: 'chunked',
chunkSize: 1024 * 1024,
},
},
});
#17545 5214663 Thanks @ematipico! - Bumps the Astro compiler to the latest version. Changelog.
astro@7.1.5

Patch Changes

#17524 7613030 Thanks @matthewp! - Fixes a bug where an error while finalizing a request could prevent a response from being sent

#17480 f61ba9c Thanks @florian-lefebvre! - Fixes a case where a custom logger.entrypoint failed to load at runtime in a built server bundle.

#17525 e614b7b Thanks @matthewp! - Fixes action path resolution so that properties of a resolved action function are not treated as routable path segments

#17284 c775c1f Thanks @matthewp! - Fixes a bug where the custom 404 (or 500) page was not rendered when a middleware rewrite targeted a route that returned an empty 404/500 response, and a blank page was returned instead

#17474 c895b12 Thanks @nicksnyder! - Updates dependency js-yaml to v4.3.0

Updated dependencies [c895b12]:

@astrojs/internal-helpers@0.10.2

@astrojs/markdown-remark@7.2.2

@astrojs/markdown-satteri@0.3.5

astro@7.1.4

Patch Changes

#17488 d4f266d Thanks @emerson-d-lopes! - Fixes duplicate CSS files being emitted in server output when a prerendered page and a server-rendered page share the same styles (e.g. a shared layout importing Tailwind). The prerender and SSR environments each emitted their own copy of the same stylesheet (index.X.css and _..Y.css); the SSR build now reuses the CSS asset filename from the prerender build when the stylesheet is backed by the same CSS source modules, so only a single file is emitted.

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.6

Patch Changes
#17536 ff97b86 Thanks @dmgawel! - Fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes

#17383 296e1b0 Thanks @thelazylamaGit! - Fixes stale dev CSS after editing component style blocks and CSS files in dev
#17543 bbc1ec9 Thanks @ematipico! - Adds a feature to experimental.collectionStorage that allows to change the size of chunks.

For example, you can reduce the size of chunks to 1MB:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: {
type: 'chunked',
chunkSize: 1024 * 1024,
},
},
});
#17545 5214663 Thanks @ematipico! - Bumps the Astro compiler to the latest version. Changelog.
7.1.5

Patch Changes

#17524 7613030 Thanks @matthewp! - Fixes a bug where an error while finalizing a request could prevent a response from being sent

#17480 f61ba9c Thanks @florian-lefebvre! - Fixes a case where a custom logger.entrypoint failed to load at runtime in a built server bundle.

#17525 e614b7b Thanks @matthewp! - Fixes action path resolution so that properties of a resolved action function are not treated as routable path segments

#17284 c775c1f Thanks @matthewp! - Fixes a bug where the custom 404 (or 500) page was not rendered when a middleware rewrite targeted a route that returned an empty 404/500 response, and a blank page was returned instead

#17474 c895b12 Thanks @nicksnyder! - Updates dependency js-yaml to v4.3.0

Updated dependencies [c895b12]:

@astrojs/internal-helpers@0.10.2

@astrojs/markdown-remark@7.2.2

@astrojs/markdown-satteri@0.3.5

7.1.4

Patch Changes

... (truncated)

Commits

9865d1c [ci] release (#17539)
5214663 fix: bump compiler (#17545)
bbc1ec9 fix: chuncked content collections (#17543)
296e1b0 fix(dev): refresh stale CSS for component \<style> block HMR (#17383)
ff97b86 fix(build): introduce two-staged build to prevent race condition with concurr...
b0535ca [ci] release (#17528)
c895b12 Update js-yaml to 4.3.0 (#17474)
f61ba9c fix(logger): loading at runtime when entrypoint is a URL (#17480)
e614b7b fix(astro): do not resolve action function properties as path segments (#17525)
7613030 Return a response when request finalization fails (#17524)
Additional commits viewable in compare view

Updates postcss from 8.5.16 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

Changelog

Sourced from postcss's changelog.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

Commits

08c989c Release 8.5.25 version
24f6814 Fix 8.5.17 visitor regression
f2fa53f Add supply chain security requirement to PostCSS plugin guide
10edf0b fix: return empty array for empty string in list.split (#2121)
0ebe8ad Release 8.5.24 version
73218c6 Update dependencies
9a114f6 Preserve the BOM when stringifying (#2119)
9069261 Fix types check
eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
Additional commits viewable in compare view

Updates dompurify from 3.4.11 to 3.4.12

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0

Hardened the handling of hooks removing elements, @mkrause-bee360

Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM

Hardened the handling of declarative partial updates

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

Commits

a9ca1e5 release: 3.4.12 (#1537)
See full diff in compare view

Updates fast-uri from 3.1.3 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

Commits

5e179cb Bumped v3.1.5
2cad02d Merge commit from fork
6aeece6 Bumped v3.1.4
2d50fba fix: reject literal backslash in URI authority
See full diff in compare view

Updates fast-xml-parser from 5.9.3 to 5.10.1

Release notes

Sourced from fast-xml-parser's releases.

v5.10.1

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1

v5.10.0

What's Changed

Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in NaturalIntelligence/fast-xml-parser#849

Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @dependabot[bot] in NaturalIntelligence/fast-xml-parser#848

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.0

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.10.1 / 2026-07-17

fix: multiple DOCTYPE declarations.

deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

upgrade:

xml-naming v0.3.0: cache support

PEM v1.6.2: sibling bug fix

is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

update strnum

*5.9.2 / 2026-06-17

dummy release to test changes in github action

*5.9.1 / 2026-06-17

dummy release to test release from github action

*5.9.0 / 2026-06-15

update strnum to 2.3.0

you can set hex, binary, enotation, infinity, unicode

validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)

This will consider xml-version as well. '1.0' is default

update strnum to 2.3.0

You can set octal and binary parsing which is bydeault off

update fast-xml-builder to 1.2.0

can sanitize tag names if found invalid

fix format output

5.7.3 / 2006-05-05

fix: alwaysCreateTextNode should create text node when attributes are present for self closing node

fix stop node expression when ns prefix is removed (found by iruizsalinas)

update XML Builder to 1.1.7

mark addEntity deprecated

5.7.2 / 2026-04-25

allow numerical external entity for backward compatibility

... (truncated)

Commits

2ce7191 5.10.1
4e1bb01 update for release
ffd1269 deps: @nodable/entities for treeshaking
4e546e0 fix: multiple DOCTYPE are not allowed
296b332 5.10.0
75f7565 update package guide
2d8d1d0 update details
e58e4dd upgrade: xml-naming v0.3.0, PEM v1.6.2, is-unsafe v2.0.0
545e491 Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 (#848)
5ea8aa1 Bump actions/checkout from 6.0.3 to 7.0.0 (#849)
See full diff in compare view

Updates svgo from 4.0.1 to 4.0.2

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.0.6` | `7.1.6` | | [postcss](https://github.com/postcss/postcss) | `8.5.16` | `8.5.25` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.12` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.3` | `3.1.5` | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.9.3` | `5.10.1` | | [svgo](https://github.com/svg/svgo) | `4.0.1` | `4.0.2` | Updates `astro` from 7.0.6 to 7.1.6 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.1.6/packages/astro) Updates `postcss` from 8.5.16 to 8.5.25 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.16...8.5.25) Updates `dompurify` from 3.4.11 to 3.4.12 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.11...3.4.12) Updates `fast-uri` from 3.1.3 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.3...v3.1.5) Updates `fast-xml-parser` from 5.9.3 to 5.10.1 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.1) Updates `svgo` from 4.0.1 to 4.0.2 - [Commits](https://github.com/svg/svgo/commits) --- updated-dependencies: - dependency-name: astro dependency-version: 7.1.6 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.25 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-xml-parser dependency-version: 5.10.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 4.0.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-01T23:32:38Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 2 package(s) with unknown licenses.

View full job summary

github-actions · 2026-08-04T21:23:05Z

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	71.15%	11012 / 15476
🔵	Statements	69.77%	11419 / 16365
🔵	Functions	73.24%	2155 / 2942
🔵	Branches	56.12%	6236 / 11110

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/lib/markdown/plugins/remark-blockquote/index.ts	90.37%	80%	100%	95.83%	87, 94, 132, 139-146, 155, 161, 170, 175, 179, 190

Generated in workflow #583 for commit 2648a5a by the Vitest Coverage Report Action

github-actions · 2026-08-04T21:41:37Z

This pull request has been deployed to Vercel.

Latest commit:	`2648a5a`
✅ Preview:	https://astro-webstackbuilders-n1jigxai4-kevin-browns-projects-dd474f73.vercel.app
🔍 Inspect:	https://vercel.com/kevin-browns-projects-dd474f73/astro-webstackbuilders-com/xxbHGHNSmtGF985p7xwkYb6cnJeP

View Workflow Logs

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 1, 2026

dependabot Bot temporarily deployed to preview August 1, 2026 23:32 Inactive

dependabot Bot had a problem deploying to testing August 1, 2026 23:32 Failure

Fix type error surfaced by dependencies upgrade

e24ca41

webstackdev temporarily deployed to testing August 4, 2026 21:08 — with GitHub Actions Inactive

webstackdev had a problem deploying to preview August 4, 2026 21:08 — with GitHub Actions Failure

webstackdev temporarily deployed to testing August 4, 2026 21:08 — with GitHub Actions Inactive

Fix node versioning in Action Workflows and package.json

2648a5a

webstackdev temporarily deployed to preview August 4, 2026 21:26 — with GitHub Actions Inactive

webstackdev temporarily deployed to testing August 4, 2026 21:26 — with GitHub Actions Inactive

github-actions Bot temporarily deployed to Preview August 4, 2026 21:39 Inactive

github-actions Bot added the deployed label Aug 4, 2026

webstackdev merged commit 0aa28a8 into main Aug 4, 2026
19 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-9ce75a1b8d branch August 4, 2026 22:26

Navigation Menu

Bump the npm_and_yarn group across 1 directory with 6 updates - #704

Bump the npm_and_yarn group across 1 directory with 6 updates#704
webstackdev merged 3 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-9ce75a1b8d

dependabot Bot commented on behalf of github Aug 1, 2026

Uh oh!

github-actions Bot commented Aug 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Aug 1, 2026

astro@7.1.6

Patch Changes

astro@7.1.5

Patch Changes

astro@7.1.4

Patch Changes

7.1.6

Patch Changes

7.1.5

Patch Changes

7.1.4

Patch Changes

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

DOMPurify 3.4.12

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

v5.10.1

v5.10.0

What's Changed

Uh oh!

github-actions Bot commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Uh oh!

github-actions Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Aug 1, 2026 •

edited

Loading

github-actions Bot commented Aug 4, 2026 •

edited

Loading