Skip to content

chore(deps-dev): bump astro from 4.16.19 to 7.2.8 - #22

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/astro-7.2.8
Closed

chore(deps-dev): bump astro from 4.16.19 to 7.2.8#22
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/astro-7.2.8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps astro from 4.16.19 to 7.2.8.

Release notes

Sourced from astro's releases.

astro@7.2.8

Patch Changes

astro@7.2.7

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

  • #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

Changelog

Sourced from astro's changelog.

7.2.8

Patch Changes

7.2.7

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

  • #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

7.2.5

Patch Changes

  • #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

    As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

  • #17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for astro since your current version.

@dependabot
dependabot Bot requested a review from reverb256 as a code owner October 16, 2026 12:14
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 16, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 16, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@reverb256

reverb256 commented Oct 16, 2026

Copy link
Copy Markdown
Owner

Held 2026-10-16: blocked by this repo's own CI (astro-ci runs npm run lint / astro:build, neither script exists in package.json, so every PR is red regardless of content — tracked in our board as t_f7e4f59b). Also a major: astro 4.16 -> 7.2.8 crosses three majors; it needs the CI working AND a build check before it can land.

@reverb256 reverb256 mentioned this pull request Oct 16, 2026
Closed
@reverb256

reverb256 commented Oct 16, 2026

Copy link
Copy Markdown
Owner

Update: the remaining blocker is not the fixed CI config but main itself — npm ci dies with ERESOLVE (typescript@7.0.2 vs @astrojs/check@0.9.10 peer). Every dependabot PR fails at the install step regardless of content. Follow-up task filed with the exact log; this PR stays held until main installs cleanly.

@dependabot
chore(deps-dev): bump astro from 4.16.19 to 7.2.8
785a52c 
Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 4.16.19 to 7.2.8.
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.8/packages/astro)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 7.2.8
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/astro-7.2.8 branch from 3a2069f to 785a52c Compare October 16, 2026 18:43
@reverb256

reverb256 commented Oct 16, 2026

Copy link
Copy Markdown
Owner

Build-verified on the fixed main: this bump cannot install. Astro CI run 38949577762 fails at the Install dependencies step (both lockfile-sync legs and build-test):

npm error ERESOLVE could not resolve
npm error While resolving: @astrojs/tailwind@6.0.2
npm error Found: astro@7.2.8
npm error Could not resolve dependency:
npm error peer astro@^3.0.0 || ^4.0.0 || ^5.0.0 from @astrojs/tailwind@6.0.2

astro 7 needs the deprecated @astrojs/tailwind integration replaced or removed (Astro 5+ uses @tailwindcss/vite) in the same change. Leaving this open for a coordinated migration - see STACK.md. Tracked by kanban t_ad03095f.

reverb256 pushed a commit that referenced this pull request Oct 16, 2026
ops (hermes)
chore(hygiene): untrack committed build junk, guard it, stop re-raisi…
4231c10 
…ng blocked majors

Kanban t_3f22909d ITEM 3 + ITEM 2.

Hygiene (15 files, 945 lines out of the tree):
- untrack hugo.tar.gz (18 MB), package.json.bak, tailwind.config.js.bak,
  .github/workflows/astro-ci.yml.bak, playwright-report/, test-results/,
  .hugo_build.lock (tracked although already in .gitignore) and the generated
  .astro/ types (8 files, recreated by `astro sync`/`astro check`)
- .gitignore covers all of them
- new .github/workflows/hygiene.yml fails the build if any of them is tracked
  again - the regression check for this incident

Dependabot majors (ITEM 2):
- .github/dependabot.yml ignores major bumps of astro, typescript and
  tailwindcss. Verified blocked, not guessed: @astrojs/tailwind@6.0.2 peers
  astro ^3 || ^4 || ^5 (PR #22, run 38949577762), and the latest published
  @astrojs/check@0.9.10 peers typescript ^5 || ^6 (PR #23, run 38949692235).
  Minor/patch updates still arrive. Remove the entries when a real
  Astro/tailwind migration lands.

Docs:
- STACK.md: correct the stale live-site facts (the live site returns
  `Hugo 0.155.3` from the 2026-04-14 deploy of `fec386e`, not 0.140.2) and
  record the status of all three follow-up items, including the deploy change
  that is open as PR #24.
- AGENTS.md: point the deploy note at that PR.

Verified locally on nexus (hugo extended 0.140.2, node 26 / npm 11):
- `npx astro check` -> 0 errors after .astro/ is untracked (it regenerates)
- `npm run build` -> docs/ and static/css byte-identical (git status empty);
  32 pages / 156 static files
- the new guard command prints nothing on the committed tree

Not done on purpose: git history is not rewritten. `hugo.tar.gz` stays in old
commits, so the clone stays ~290 MB; rewriting `main` is destructive and needs
an explicit decision.
@reverb256

reverb256 commented Oct 16, 2026

Copy link
Copy Markdown
Owner

Closed 2026-10-16 - kanban t_3f22909d ITEM 2.

This bump cannot install against this repo's integration set, and the repo does
not build Astro for the public site at all:

  • STACK.md records the canonical stack as Hugo 0.140.2 + postcss +
    tailwindcss v3 -> docs/    . src/*.astro is half-migrated work carried over
    from feature/astro-migration; nothing on main builds or serves it.
  • CI run 38949577762
    (this PR, sha 785a52c) fails at "Install dependencies":
    npm error ERESOLVE / peer astro@^3.0.0 || ^4.0.0 || ^5.0.0 from @astrojs/tailwind@6.0.2 / Found: astro@7.2.8.
  • Registry check: npm view @astrojs/tailwind peerDependencies ->
    astro: ^3.0.0 || ^4.0.0 || ^5.0.0. Astro 5+ replaced that integration with
    @tailwindcss/vite, so a bump to astro 7 has to migrate the integration set in
    the same PR. npm view astro version -> 7.4.0, so this would need to be
    redone as a migration anyway.

Closing rather than holding: a major bump that crosses three majors on a stack
the site does not use is a migration decision, not a dependency bump.

To reopen the work: delete the astro entry from the ignore: block in
.github/dependabot.yml (added in 4231c10 for this card) and open the real
migration - @astrojs/tailwind -> @tailwindcss/vite plus the config changes -
together with the version bump.

@reverb256 reverb256 closed this Oct 16, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 16, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/astro-7.2.8 branch October 16, 2026 18:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@reverb256 reverb256 Awaiting requested review from reverb256 reverb256 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@reverb256