chore(deps): bump the npm_and_yarn group across 4 directories with 5 updates by dependabot[bot] · Pull Request #483 · dallay/agentsync

dependabot · 2026-08-01T22:15:57Z

Bumps the npm_and_yarn group with 1 update in the / directory: astro.
Bumps the npm_and_yarn group with 1 update in the /tests/e2e/fixtures/repos/mega-monorepo/apps/docs directory: astro.
Bumps the npm_and_yarn group with 1 update in the /tests/e2e/fixtures/repos/mixed-stack-a directory: astro.
Bumps the npm_and_yarn group with 1 update in the /website/docs directory: astro.

Updates astro from 6.1.10 to 7.1.1

Release notes

Sourced from astro's releases.

astro@7.1.1

Patch Changes

#17399 4b03702 Thanks @matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

astro@7.1.0

Minor Changes
#17302 5f4dc03 Thanks @astrobot-houston! - Adds a new deferRender option to the glob() content loader

When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
#17296 30698a2 Thanks @ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.
#17214 44c4989 Thanks @ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

Scoping sources and hashes in your config

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.1

Patch Changes

#17399 4b03702 Thanks @matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

7.1.0

Minor Changes
#17302 5f4dc03 Thanks @astrobot-houston! - Adds a new deferRender option to the glob() content loader

When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
#17296 30698a2 Thanks @ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.
#17214 44c4989 Thanks @ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

... (truncated)

Commits

91c645a [ci] release (#17403)
4b03702 Normalize domain-based i18n request paths consistently (#17399)
fdd673c [ci] release (#17387)
d9f99e1 Preserve CSP resource defaults for element directives (#17394)
092da56 Add more escaping for rendered content (#17393)
186a1e7 fix(logger): allows setting in updateConfig() (#17391)
4407483 fix(logger): use console API in JSON logger for cross-runtime compatibility...
16de021 feat(logger): allow passing entrypoint as URL (#17389)
ed71eaf fix(logger): make AstroLoggerDestination not generic (#17390)
30698a2 feat: chunk data store (#17296)
Additional commits viewable in compare view

Updates esbuild from 0.27.7 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1
Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

Thanks to @dellalibera for reporting this issue.

Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

Thanks to @sondt99 for reporting this issue.
Avoid inlining using and await using declarations (#4482)

Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
// Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
Fix module evaluation when an error is thrown (#4461, #4467)

If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
Fix some edge cases around the new operator (#4477)

Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
// Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1
Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

Thanks to @dellalibera for reporting this issue.

Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

Thanks to @sondt99 for reporting this issue.
Avoid inlining using and await using declarations (#4482)

Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
// Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
Fix module evaluation when an error is thrown (#4461, #4467)

If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
Fix some edge cases around the new operator (#4477)

Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
// Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Commits

bb9db84 publish 0.28.1 to npm
9ff053e security: add integrity checks to the Deno API
0a9bf21 enforce non-negative size in gzip parser
e2a1a71 security: forbid \\ in local dev server requests
83a2cbf fix #4482: don't inline using declarations
308ad74 fix #4471: renaming of nested var declarations
f013f5f fix some typos
aafd6e4 chore: fix some minor issues in comments (#4462)
15300c3 follow up: cjs evaluation fixes
1bda0c3 fix #4461, fix #4467: esm evaluation fixes
Additional commits viewable in compare view

Updates postcss from 8.5.12 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

Changelog

Sourced from postcss's changelog.

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

... (truncated)

Commits

08c989c Release 8.5.25 version
24f6814 Fix 8.5.17 visitor regression
f2fa53f Add supply chain security requirement to PostCSS plugin guide
10edf0b fix: return empty array for empty string in list.split (#2121)
0ebe8ad Release 8.5.24 version
73218c6 Update dependencies
9a114f6 Preserve the BOM when stringifying (#2119)
9069261 Fix types check
eb9e1fe Release 8.5.23 version
9d19c78 Update dependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates svgo from 4.0.1 to 4.0.2

Commits

See full diff in compare view

Updates vite from 7.3.2 to 8.2.0

Release notes

Sourced from vite's releases.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.2.0 (2026-07-30)

Features

add input to server.fs.allow (#23035) (95a3cda)

bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)

bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)

config: include column in config incompatibility location (#23064) (8a24572)

dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)

Bug Fixes

bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)

deps: update all non-major dependencies (#23069) (4c07b74)

hmr: preserve environment snapshot during server restart (#22992) (b1186c3)

importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)

module-runner: keep stack trace interception working when Object.prototype is frozen (#23073) (599c5b0)

server: strip base in indexHtml module graph lookup (#22932) (fa005d1)

support resolving top-level input option with plugins (#23101) (41df81a)

Documentation

config: correct cacheDir default fallback description (#23060) (aafa103)

Tests

config CJS module vars in ESM case (#23010) (d8cd388)

8.2.0-beta.0 (2026-07-22)

Features

add input option (#22642) (9beae37)

config: warn features incompatible with native loader in bundle loader (#22850) (05302b0)

css: export PostCSS config type for type-safe configs (#22792) (302c755)

dev: label network URLs with their interface name (#22830) (78accc4)

optimizer: support aube lockfile (#22813) (6319827)

optimizer: support nub lockfile (#22891) (65d3604)

update rolldown-related dependencies and use client-side HMR in bundled-dev (#22961) (960e9ef)

wasm: expand test suite, unwrap WebAssembly.Global and enable js-string builtins (#22674) (9e79b51)

Bug Fixes

build: map CSS chunks in chunk import maps (fix #22946) (#22947) (e16ff3a)

config: exclude virtual modules from native config compat check (#22979) (2ced1fe)

css: rewrite urls in OnceExit-injected content (#22983) (abb793e)

deps: update all non-major dependencies (#22985) (04f345b)

deps: update dependency magic-string to v1 (#22998) (c60b4d7)

hmr: remove hot data after prune (#23002) (be96316)

resolve root to real path (#22832) (55bba7b)

Performance Improvements

... (truncated)

Commits

572aaca release: v7.2.2
728c8ee fix: revert "refactor: use fs.cpSync (#21019)" (#21081)
a532e68 release: v7.2.1
82d2d6c fix(worker): some worker asset was missing (#21074)
f83264f refactor(build): rename indexOfMatchInSlice to findPreloadMarker (#21054)
8293de0 release: v7.2.0
2833c55 fix(types): add undefined to optional properties for exactOptionalProperties ...
e3a6a83 chore(deps): update rolldown-related dependencies (#21047)
b1fd616 fix(css): fallback to sass when sass-embedded platform binary is missing (#21...
ad5b3bf fix(module-runner): make getBuiltins response JSON serializable (#21029)
Additional commits viewable in compare view

Updates astro from 6.1.10 to 7.1.1

Release notes

Sourced from astro's releases.

astro@7.1.1

Patch Changes

#17399 4b03702 Thanks @matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

astro@7.1.0

Minor Changes
#17302 5f4dc03 Thanks @astrobot-houston! - Adds a new deferRender option to the glob() content loader

When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
#17296 30698a2 Thanks @ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.
#17214 44c4989 Thanks @ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

Scoping sources and hashes in your config

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.1

Patch Changes

#17399 4b03702 Thanks @matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

7.1.0

Minor Changes
#17302 5f4dc03 Thanks @astrobot-houston! - Adds a new deferRender option to the glob() content loader

When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
#17296 30698a2 Thanks @ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.
#17214 44c4989 Thanks @ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

... (truncated)

Commits

91c645a [ci] release (#17403)
4b03702 Normalize domain-based i18n request paths consistently (#17399)
fdd673c [ci] release (#17387)
d9f99e1 Preserve CSP resource defaults for element directives (#17394)
092da56 Add more escaping for rendered content (#17393)
186a1e7 fix(logger): allows setting in updateConfig() (#17391)
4407483 fix(logger): use console API in JSON logger for cross-runtime compatibility...
16de021 feat(logger): allow passing entrypoint as URL (#17389)
ed71eaf fix(logger): make AstroLoggerDestination not generic (#17390)
30698a2 feat: chunk data store (#17296)
Additional commits viewable in compare view

Updates astro from 6.1.10 to 7.1.1

Release notes

Sourced from astro's releases.

astro@7.1.1

Patch Changes

#17399 4b03702 Thanks @matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

astro@7.1.0

Minor Changes
#17302 5f4dc03 Thanks @astrobot-houston! - Adds a new deferRender option to the glob() content loader

When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
#17296 30698a2 Thanks @ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.
#17214 44c4989 Thanks @ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

Scoping sources and hashes in your config

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.1

Patch Changes

#17399 4b03702 Thanks @matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

7.1.0

Minor Changes
#17302 5f4dc03 Thanks @astrobot-houston! - Adds a new deferRender option to the glob() content loader

When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
#17296 30698a2 Thanks @ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The d...
Description has been truncated

…updates Bumps the npm_and_yarn group with 1 update in the / directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). Bumps the npm_and_yarn group with 1 update in the /tests/e2e/fixtures/repos/mega-monorepo/apps/docs directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). Bumps the npm_and_yarn group with 1 update in the /tests/e2e/fixtures/repos/mixed-stack-a directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). Bumps the npm_and_yarn group with 1 update in the /website/docs directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). Updates `astro` from 6.1.10 to 7.1.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.1.1/packages/astro) Updates `esbuild` from 0.27.7 to 0.28.1 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.7...v0.28.1) Updates `postcss` from 8.5.12 to 8.5.25 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.12...8.5.25) Updates `svgo` from 4.0.1 to 4.0.2 - [Commits](https://github.com/svg/svgo/commits) Updates `vite` from 7.3.2 to 8.2.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/create-vite@8.2.0/packages/vite) Updates `astro` from 6.1.10 to 7.1.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.1.1/packages/astro) Updates `astro` from 6.1.10 to 7.1.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.1.1/packages/astro) Updates `astro` from 6.1.10 to 7.1.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.1.1/packages/astro) --- updated-dependencies: - dependency-name: astro dependency-version: 7.1.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.25 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 4.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: astro dependency-version: 7.1.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: astro dependency-version: 7.1.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: astro dependency-version: 7.1.1 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-08-01T22:16:29Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/astro@6.4.8 ⏵ 7.1.1	^-22	⁺⁴		⁺¹
	npm/astro@6.4.8 ⏵ 7.1.6	^-22	⁺⁴		⁺¹

View full report

socket-security · 2026-08-01T22:16:31Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@emnapi/runtime` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/astro@7.1.1` → `npm/astro@7.1.6` → `npm/@emnapi/runtime@1.11.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/runtime@1.11.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `astro` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/astro@7.1.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/astro@7.1.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `astro` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tests/e2e/fixtures/repos/mixed-stack-a/package.json → `npm/astro@7.1.6` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/astro@7.1.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies javascript Pull requests that update javascript code labels Aug 1, 2026

github-actions Bot added the ci label Aug 1, 2026

yacosta738 merged commit 775078e into main Aug 2, 2026
20 of 21 checks passed

yacosta738 deleted the dependabot/npm_and_yarn/npm_and_yarn-bfaafcdfea branch August 2, 2026 06:04

Navigation Menu

Uh oh!

chore(deps): bump the npm_and_yarn group across 4 directories with 5 updates - #483

chore(deps): bump the npm_and_yarn group across 4 directories with 5 updates#483
yacosta738 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-bfaafcdfea

dependabot Bot commented on behalf of github Aug 1, 2026

Scoping sources and hashes in your config

Scoping sources and hashes in your config

Scoping sources and hashes in your config

Uh oh!

socket-security Bot commented Aug 1, 2026

Uh oh!

socket-security Bot commented Aug 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 1, 2026

astro@7.1.1

Patch Changes

astro@7.1.0

Minor Changes

Scoping sources and hashes in your config

7.1.1

Patch Changes

7.1.0

Minor Changes

v0.28.1

0.28.1

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

create-vite@8.2.0

plugin-legacy@8.2.0

v8.2.0

v8.2.0-beta.0

v8.1.5

v8.1.4

v8.1.3

v8.1.2

v8.1.1

create-vite@8.1.0

plugin-legacy@8.1.0

v8.1.0

plugin-legacy@8.1.0-beta.0

v8.1.0-beta.0

v8.0.16

v8.0.15

v8.0.14

8.2.0 (2026-07-30)

Features

Bug Fixes

Documentation

Tests

8.2.0-beta.0 (2026-07-22)

Features

Bug Fixes

Performance Improvements

astro@7.1.1

Patch Changes

astro@7.1.0

Minor Changes

Scoping sources and hashes in your config

7.1.1

Patch Changes

7.1.0

Minor Changes

astro@7.1.1

Patch Changes

astro@7.1.0

Minor Changes

Scoping sources and hashes in your config

7.1.1

Patch Changes