Skip to content

chore(deps-dev): bump the development-minor-and-patch group with 4 updates - #3777

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-minor-and-patch-67b1537401
Closed

chore(deps-dev): bump the development-minor-and-patch group with 4 updates#3777
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-minor-and-patch-67b1537401

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the development-minor-and-patch group with 4 updates: @astrojs/mdx, astro, astro-auto-import and svgo.

Updates @astrojs/mdx from 7.0.7 to 7.0.8

Release notes

Sourced from @​astrojs/mdx's releases.

@​astrojs/mdx@​7.0.8

Patch Changes

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #17766 0762a83 Thanks @​HiDeoo! - Fixes Sätteri processor option types to accept all plugin entries supported by Sätteri v0.10.3.

Changelog

Sourced from @​astrojs/mdx's changelog.

7.0.8

Patch Changes

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #17766 0762a83 Thanks @​HiDeoo! - Fixes Sätteri processor option types to accept all plugin entries supported by Sätteri v0.10.3.

Commits

Updates astro from 7.2.4 to 7.2.6

Release notes

Sourced from astro's releases.

astro@7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

astro@7.2.5

Patch Changes

  • #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

    As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

  • #17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #17783 60b14ff Thanks @​matthewp! - Fixes a type error when passing an image from a content collection image() schema to a component or <Image />. The schema returned by image() was missing the apng format, so it no longer matched the type of an imported image.

  • #17664 d483125 Thanks @​astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases "unsafe-inline" resource. Now when "unsafe-inline", Astro won't emit hashes for the directive specified.

  • #17810 0fc5f65 Thanks @​florian-lefebvre! - Fixes a regression in the content collections that could cause images to not be resolved

  • #17781 aa33b44 Thanks @​matthewp! - Fixes memoryCache() storing responses that set cookies through Astro.cookies or Astro.session

  • #17787 6661fbe Thanks @​astro-factory! - Fixes server:defer crashing the dev server with "undefined is not a function" when a deferred component imports from astro:i18n

  • #17750 dd0e3ac Thanks @​dobrodob! - Fixes a regression where transition:persist stopped working for <audio> and <video> elements.

  • #17774 fe1d16d Thanks @​astro-factory! - Adds support for importing .apng files as image metadata for use with standard <img> elements. Astro's image components reject APNG files to avoid removing their animation

  • #17799 8797754 Thanks @​astro-factory! - Fixes i18n fallbackType: "rewrite" returning 500 instead of 404 when the fallback locale also has no matching static path for a prerendered dynamic route

  • #17741 99d3d3d Thanks @​ericswpark! - Bumps the Astro compiler to the latest version. Changelog.

  • #17782 3578d45 Thanks @​Princesseuh! - Improves the performance of the Astro CLI in local by enabling Node's module compilation cache.

  • #17705 2043e4f Thanks @​astrobot-houston! - Fixes incremental builds serving cached HTML that references stale CSS filenames after a stylesheet-only edit

  • #17754 3d50dfd Thanks @​astro-factory! - Fixes the dev server refusing to start in Docker containers after a restart due to PID reuse in the lock file check

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

7.2.5

Patch Changes

  • #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

    As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

  • #17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #17783 60b14ff Thanks @​matthewp! - Fixes a type error when passing an image from a content collection image() schema to a component or <Image />. The schema returned by image() was missing the apng format, so it no longer matched the type of an imported image.

  • #17664 d483125 Thanks @​astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases "unsafe-inline" resource. Now when "unsafe-inline", Astro won't emit hashes for the directive specified.

  • #17810 0fc5f65 Thanks @​florian-lefebvre! - Fixes a regression in the content collections that could cause images to not be resolved

  • #17781 aa33b44 Thanks @​matthewp! - Fixes memoryCache() storing responses that set cookies through Astro.cookies or Astro.session

  • #17787 6661fbe Thanks @​astro-factory! - Fixes server:defer crashing the dev server with "undefined is not a function" when a deferred component imports from astro:i18n

  • #17750 dd0e3ac Thanks @​dobrodob! - Fixes a regression where transition:persist stopped working for <audio> and <video> elements.

  • #17774 fe1d16d Thanks @​astro-factory! - Adds support for importing .apng files as image metadata for use with standard <img> elements. Astro's image components reject APNG files to avoid removing their animation

  • #17799 8797754 Thanks @​astro-factory! - Fixes i18n fallbackType: "rewrite" returning 500 instead of 404 when the fallback locale also has no matching static path for a prerendered dynamic route

  • #17741 99d3d3d Thanks @​ericswpark! - Bumps the Astro compiler to the latest version. Changelog.

  • #17782 3578d45 Thanks @​Princesseuh! - Improves the performance of the Astro CLI in local by enabling Node's module compilation cache.

  • #17705 2043e4f Thanks @​astrobot-houston! - Fixes incremental builds serving cached HTML that references stale CSS filenames after a stylesheet-only edit

... (truncated)

Commits
  • 22e439b [ci] release (#17814)
  • 29af6da Fix FetchState manifest resolution in development (#17812)
  • d38ed60 [ci] release (#17753)
  • 0fc5f65 fix: content image regression (#17810)
  • 493796b Skip URL normalization writes that would not change the path (#17416)
  • 8797754 Fix i18n fallback rewrite returning 500 instead of 404 for missing prerendere...
  • 99d3d3d fix: bump compiler (#17741)
  • 6661fbe fix(dev): break circular import in virtual:astro:routes by importing from ast...
  • 60b14ff Fix type error when using content collection images after apng support (#17783)
  • 3578d45 perf(cli): enable the Node.js compile cache (#17782)
  • Additional commits viewable in compare view

Updates astro-auto-import from 0.5.2 to 0.6.0

Release notes

Sourced from astro-auto-import's releases.

astro-auto-import@0.6.0

Minor Changes

  • #173 8e62391 Thanks @​xsynaptic! - Adds support for the Sätteri Markdown processor, which is Astro 7’s default.

    ⚠️ BREAKING CHANGE: Drops support for versions of Astro lower than 7.2.4.

Changelog

Sourced from astro-auto-import's changelog.

0.6.0

Minor Changes

  • #173 8e62391 Thanks @​xsynaptic! - Adds support for the Sätteri Markdown processor, which is Astro 7’s default.

    ⚠️ BREAKING CHANGE: Drops support for versions of Astro lower than 7.2.4.

Commits

Updates svgo from 4.0.2 to 4.1.0

Release notes

Sourced from svgo's releases.

v4.1.0

This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.

Support SVGO

If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.

Stricter XML validation

SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#2257).

The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:

  • disallowed control characters such as &[#1](https://github.com/svg/svgo/issues/1);, &#xB;, and &#x1F;;
  • UTF-16 surrogate code points such as &#xD800;;
  • invalid XML code points such as &#xFFFF;.

Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.

Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.

This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.

Security

The removeScripts plugin has been hardened against several script-execution bypasses:

  • Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#2263).
  • Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#2264).
  • Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&[#9](https://github.com/svg/svgo/issues/9);script: from bypassing detection while preserving elements in unrelated custom namespaces (#2268).

These changes address:

Dependencies

  • Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#2244).

Project maintenance

@​TrySound is back as an active SVGO maintainer.

Many thanks to @​KTibow, @​SethFalco, and @​XhmikosR for maintaining and improving SVGO over the past several years.

Full Changelog: svg/svgo@v4.0.2...v4.1.0

Commits
  • 5765cbe chore: prepare v4.1.0 release (#2275)
  • 3db3ef3 fix(removeScripts): handle anchor URL bypasses (#2268)
  • 4e9b9ae chore: cache regression screenshots (#2267)
  • d55270c chore(regression): migrate comparison workers to Tinypool (#2266)
  • fd51e47 fix(removeScripts): sanitize foreignObject content (#2264)
  • dcaf957 chore: optimize fixtures in a bounded worker pool (#2265)
  • a354293 fix(removeScripts): filter executable data URLs (#2263)
  • 4e0d2ac ci(typecheck): return typechecking on CI
  • 0b97fed test(typescript): drop tsd for vitest type testing API
  • f6e8ae1 chore(pnpm): drop package.json#pnpm.onlyBuiltDependencies
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.


You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-dev): bump the development-minor-and-patch group with 4 up…
930e8fc 
…dates

Bumps the development-minor-and-patch group with 4 updates: [@astrojs/mdx](https://github.com/withastro/astro/tree/HEAD/packages/integrations/mdx), [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro), [astro-auto-import](https://github.com/delucis/astro-auto-import/tree/HEAD/packages/astro-auto-import) and [svgo](https://github.com/svg/svgo).


Updates `@astrojs/mdx` from 7.0.7 to 7.0.8
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/mdx/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/mdx@7.0.8/packages/integrations/mdx)

Updates `astro` from 7.2.4 to 7.2.6
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.6/packages/astro)

Updates `astro-auto-import` from 0.5.2 to 0.6.0
- [Release notes](https://github.com/delucis/astro-auto-import/releases)
- [Changelog](https://github.com/delucis/astro-auto-import/blob/main/packages/astro-auto-import/CHANGELOG.md)
- [Commits](https://github.com/delucis/astro-auto-import/commits/astro-auto-import@0.6.0/packages/astro-auto-import)

Updates `svgo` from 4.0.2 to 4.1.0
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v4.0.2...v4.1.0)

---
updated-dependencies:
- dependency-name: "@astrojs/mdx"
  dependency-version: 7.0.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-minor-and-patch
- dependency-name: astro
  dependency-version: 7.2.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-minor-and-patch
- dependency-name: astro-auto-import
  dependency-version: 0.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-minor-and-patch
- dependency-name: svgo
  dependency-version: 4.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 28, 2026
@dependabot
dependabot Bot requested a review from louismaximepiton as a code owner August 28, 2026 04:05
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 28, 2026
@boosted-bot boosted-bot moved this from In Progress / Draft to Need Dev Review in 🟣 [Orange-Boosted-Bootstrap] PRs Board Aug 28, 2026
@netlify

netlify Bot commented Aug 28, 2026

Copy link
Copy Markdown

✅ Deploy Preview for boosted ready!

Name Link
🔨 Latest commit 930e8fc
🔍 Latest deploy log https://app.netlify.com/projects/boosted/deploys/6a91090425e484000757754e
😎 Deploy Preview https://deploy-preview-3777--boosted.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@dependabot @github

dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 4, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/development-minor-and-patch-67b1537401 branch September 4, 2026 04:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@louismaximepiton louismaximepiton Awaiting requested review from louismaximepiton louismaximepiton is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

🟣 [Orange-Boosted-Bootstrap] PRs Board
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@boosted-bot