deps(deps): bump the astro group with 3 updates

[dependabot]

Bumps the astro group with 3 updates: astro, @astrojs/starlight and @astrojs/cloudflare.

Updates astro from 7.1.6 to 7.2.0

Release notes

Sourced from astro's releases.

astro@7.2.0

Minor Changes

• #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

  This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

  astro preview --background

  When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

  astro preview status
  astro preview logs
  astro preview logs --follow
  astro preview stop

  If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

  To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

• #17532 7f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

  Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  logger: {
  
  entrypoint: new URL('./src/logger.js', import.meta.url),
  
  
  entrypoint: './src/logger.js',
  },
  });

Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

#17084 961bbe5 Thanks @​matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

import type { AstroPrerenderer, PrerenderResult } from 'astro';
const prerenderer: AstroPrerenderer = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.0

Minor Changes

• #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

  This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

  astro preview --background

  When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

  astro preview status
  astro preview logs
  astro preview logs --follow
  astro preview stop

  If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

  To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

• #17532 7f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

  Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  logger: {
  
  entrypoint: new URL('./src/logger.js', import.meta.url),
  
  
  entrypoint: './src/logger.js',
  },
  });

Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

#17084 961bbe5 Thanks @​matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

import type { AstroPrerenderer, PrerenderResult } from 'astro';

... (truncated)

Commits

• 60e9432 [ci] release (#17558)
• af92694 docs: slightly reword session options description (#17607)
• caace2e [ci] format
• 0224a3a Add background mode for astro preview (#17174)
• 961bbe5 Experimental incremental static builds (#17084)
• 7f94895 feat(logger): allow passing relative string entrypoints (#17532)
• 90c98ae feat(session): add session: false to opt out of session support (#16871)
• 3ea55ce Support detect devEngines for installs (#17579)
• 0089f83 Fix Content Layer build crash when neotraverse 0.6.x is hoisted by another de...
• f4150da [ci] format
• Additional commits viewable in compare view

Updates @astrojs/starlight from 0.41.5 to 0.41.7

Release notes

Sourced from @​astrojs/starlight's releases.

@​astrojs/starlight@​0.41.7

Patch Changes

• #4114 3e486fb Thanks @​delucis! - Fixes processing of code examples in RTL languages when using Astro’s Sätteri Markdown processor

@​astrojs/starlight@​0.41.6

Patch Changes

• #4102 f1dddc0 Thanks @​delucis! - Adds 1 new icon: forgejo

Changelog

Sourced from @​astrojs/starlight's changelog.

0.41.7

Patch Changes

• #4114 3e486fb Thanks @​delucis! - Fixes processing of code examples in RTL languages when using Astro’s Sätteri Markdown processor

0.41.6

Patch Changes

• #4102 f1dddc0 Thanks @​delucis! - Adds 1 new icon: forgejo

Commits

• 656ffd5 [ci] release (#4115)
• 612fd0a Update dependencies (#4113)
• 3e486fb Refactor Sätteri RTL code support plugin (#4114)
• ae0838f [ci] release (#4106)
• f1dddc0 Add Forgejo icon (#4102)
• See full diff in compare view

Updates @astrojs/cloudflare from 14.1.7 to 14.2.0

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.2.0

Minor Changes

• #16194 2a59663 Thanks @​Daedalus-Icarus! - Adds opt-in build-time image optimization for the cloudflare-binding image service.

  When enabled, the Cloudflare IMAGES binding transforms static images in the workerd prerender environment, and the optimized bytes are written directly to the output directory. If the binding fails, it falls back to Sharp.

  To opt in, use the compound configuration form:

  export default defineConfig({
    adapter: cloudflare({
      imageService: { build: 'cloudflare-binding', runtime: 'cloudflare-binding' },
    }),
  });

  The string shorthand imageService: 'cloudflare-binding' preserves the current runtime-only behavior and is unaffected.

• #16871 90c98ae Thanks @​adamchal! - When session: false is set in astro.config, the adapter no longer auto-wires the Cloudflare KV session driver. Combined with the matching astro change, this lets the session runtime tree-shake out of the Worker bundle.

• #17084 961bbe5 Thanks @​matthewp! - Supports Astro's experimental incremental static builds. When experimental.incrementalBuild is enabled, the adapter skips unchanged pages between builds.

Patch Changes

• #17576 0a79753 Thanks @​alexanderniebuhr! - Fixes /_image returning 500 in dev mode when using imageService: 'custom'. Astro's default dev image endpoint imports vite and node:fs, which cannot be loaded inside workerd. The custom and fallback cases now use the generic fetch-based endpoint in dev, matching the other image service modes. A user-configured image.endpoint is left untouched.

  Additionally, a dev-time warning is now logged when imageService: 'custom' resolves to the Sharp service (including when no image.service is configured), since Sharp's native binding cannot run inside workerd in dev or production.

• #17481 0c32649 Thanks @​ondraulehla! - Fixes a crash on /_image cache hits when the Cloudflare cache provider is enabled. Responses served from the Workers Cache API have immutable headers, and the request handler crashed with "Can't modify immutable headers" when applying its default Cloudflare-CDN-Cache-Control: no-store header to them. The handler now rebuilds the response with mutable headers when needed.

• #17347 ce83c39 Thanks @​astrobot-houston! - Fixes imageService: 'compile' producing unoptimized images when prerenderEnvironment is set to 'node'

• #17594 2b8915a Thanks @​astrobot-houston! - Fixes a type-checking error when using app.use(cf()) from @astrojs/cloudflare/hono in projects with wrangler types-generated ExecutionContext declarations

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.3

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.2.0

Minor Changes

• #16194 2a59663 Thanks @​Daedalus-Icarus! - Adds opt-in build-time image optimization for the cloudflare-binding image service.

  When enabled, the Cloudflare IMAGES binding transforms static images in the workerd prerender environment, and the optimized bytes are written directly to the output directory. If the binding fails, it falls back to Sharp.

  To opt in, use the compound configuration form:

  export default defineConfig({
    adapter: cloudflare({
      imageService: { build: 'cloudflare-binding', runtime: 'cloudflare-binding' },
    }),
  });

  The string shorthand imageService: 'cloudflare-binding' preserves the current runtime-only behavior and is unaffected.

• #16871 90c98ae Thanks @​adamchal! - When session: false is set in astro.config, the adapter no longer auto-wires the Cloudflare KV session driver. Combined with the matching astro change, this lets the session runtime tree-shake out of the Worker bundle.

• #17084 961bbe5 Thanks @​matthewp! - Supports Astro's experimental incremental static builds. When experimental.incrementalBuild is enabled, the adapter skips unchanged pages between builds.

Patch Changes

• #17576 0a79753 Thanks @​alexanderniebuhr! - Fixes /_image returning 500 in dev mode when using imageService: 'custom'. Astro's default dev image endpoint imports vite and node:fs, which cannot be loaded inside workerd. The custom and fallback cases now use the generic fetch-based endpoint in dev, matching the other image service modes. A user-configured image.endpoint is left untouched.

  Additionally, a dev-time warning is now logged when imageService: 'custom' resolves to the Sharp service (including when no image.service is configured), since Sharp's native binding cannot run inside workerd in dev or production.

• #17481 0c32649 Thanks @​ondraulehla! - Fixes a crash on /_image cache hits when the Cloudflare cache provider is enabled. Responses served from the Workers Cache API have immutable headers, and the request handler crashed with "Can't modify immutable headers" when applying its default Cloudflare-CDN-Cache-Control: no-store header to them. The handler now rebuilds the response with mutable headers when needed.

• #17347 ce83c39 Thanks @​astrobot-houston! - Fixes imageService: 'compile' producing unoptimized images when prerenderEnvironment is set to 'node'

• #17594 2b8915a Thanks @​astrobot-houston! - Fixes a type-checking error when using app.use(cf()) from @astrojs/cloudflare/hono in projects with wrangler types-generated ExecutionContext declarations

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.3

Commits

• 60e9432 [ci] release (#17558)
• a2240c4 fix(test): provide experimental config in Cloudflare session-false test (#17606)
• 961bbe5 Experimental incremental static builds (#17084)
• 90c98ae feat(session): add session: false to opt out of session support (#16871)
• 2b8915a fix(cloudflare): inline executionCtx type in HonoCloudflareContextLike to avo...
• 0a79753 fix(cloudflare): use workerd-safe dev image endpoint for custom image service...
• 2a59663 Add opt-in Cloudflare binding image optimization during build (#16194)
• 0c32649 fix(cloudflare): don't mutate immutable headers on cached responses (#17481)
• ce83c39 fix(@​astrojs/cloudflare): fix imageService: 'compile' silent noop with `pre...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​astrojs/​cloudflare@​14.2.0
	@​astrojs/​starlight@​0.41.7
	astro@​7.2.0

View full report