chore(deps): update non-major dependencies - #62
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
2 times, most recently
from
July 21, 2026 20:54
7bd73d6 to
3468db8
Compare
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
2 times, most recently
from
July 23, 2026 06:39
6873283 to
f38f3d6
Compare
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
8 times, most recently
from
July 30, 2026 14:05
9d378dc to
4d1515c
Compare
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
7 times, most recently
from
August 7, 2026 20:53
ae6735e to
c85dd6d
Compare
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
7 times, most recently
from
August 14, 2026 20:30
6f59f9d to
2d7f303
Compare
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
27 times, most recently
from
September 3, 2026 02:45
ea95fd7 to
0fe2719
Compare
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
2 times, most recently
from
September 3, 2026 20:04
f496382 to
2644211
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^0.41.1→^0.42.0v1.48.0→v1.51.1v0.72.0→v0.74.07.1.0→7.3.1v2.1.1→v2.2.1v2.0.8→v2.0.9v2.0.5→v2.0.6v1.3.1→v1.3.2v0.11.7→v0.11.8v1.199.0→v1.206.0v3.13.2→v3.13.3v2.17.0→v2.18.1v0.0.23→v0.0.24v0.55.0→v0.56.0v1.6.0→v1.7.00.35.3→0.35.4Release Notes
withastro/starlight (@astrojs/starlight)
v0.42.0Compare Source
Minor Changes
#3572
292fb17Thanks @HiDeoo! - Distributes package as JavaScript files with dedicated type declaration files instead of TypeScript source files.#4121
2623ae6Thanks @delucis! - Simplifies markup for Starlight’s mobile menu toggleMobileMenuTogglebutton orPageFramecomponents, you may need to adjust these for the new markup. The button is no longer wrapped in a<starlight-menu-button>custom element and no longer uses thearia-expandedattribute. Instead, you can use the.sl-menu-buttonclass name to target the button and the:popover-openpseudo-class to style the menu open state specifically.In the following example, custom styles for the menu button are updated for the new approach:
See
MobileMenuToggle.astroandPageFrame.astroon GitHub for the full source code of the updated components.#3572
292fb17Thanks @HiDeoo! - Removes thetaglineconfiguration option, which was never used.If your configuration included a
taglineoption, you can safely remove it without any replacement.#4134
6135f01Thanks @HiDeoo! - Updates internal@astrojs/mdx,@astrojs/markdown-satteri, andsatteridependencies.astrov7.2.10 or later@astrojs/markdown-satteri0.4.0 or later (if you use it)@astrojs/markdown-remark7.3.0 or later (if you use it)Please update Starlight and Astro together:
#4121
2623ae6Thanks @delucis! - Refactors Starlight’s mobile menu toggle to work when JavaScript fails or is disabledThis change also removes the
data-mobile-menu-expandedattribute, which was previously added to<body>while the mobile menu is open. If you have custom code that was depending on this attribute, you will need to update it to use a new selector to check if the mobile menu is open.In the following example, a custom background colour for the site header while the menu is open is updated for the new approach:
v0.41.11Compare Source
Patch Changes
#4167
32a5e29Thanks @HiDeoo! - Fixes a layout issue and anchor links appearing for hidden headings, e.g. footnote headings, whenmarkdown.headingLinksis enabled or the<AnchorHeading>component is used.#4148
cdfafd8Thanks @ematipico! - Optimizes sidebar data generation logic to speed up sites with large sidebarsv0.41.10Compare Source
Patch Changes
#4160
88442c3Thanks @ArmandPhilippot! - Adds the missing translations for Expressive Code in the following locales:ar,hi,it,ja,ko,pt,zh-CN, andzh-TW.#4156
57af92dThanks @pyxelr! - Adds 1 new icon:hypothesis#4159
a0e0ba2Thanks @trueberryless! - Adds 1 new icon:npmxv0.41.9Compare Source
Patch Changes
1c90d69Thanks @pyxelr! - Adds 1 new icon:goodreadsv0.41.8Compare Source
Patch Changes
#4142
cacbc9fThanks @alebelcor! - Adds 1 new icon:whatsApp#4133
3944311Thanks @delucis! - Internal refactor: numberedidattributes in the<Tabs>component are now page-specific instead of using a global counter#4138
cd4b665Thanks @delucis! - Fixes localisation of code block UI elements when using the Sätteri Markdown processorv0.41.7Compare Source
Patch Changes
3e486fbThanks @delucis! - Fixes processing of code examples in RTL languages when using Astro’s Sätteri Markdown processorv0.41.6Compare Source
Patch Changes
f1dddc0Thanks @delucis! - Adds 1 new icon:forgejov0.41.5Compare Source
Patch Changes
bb06434Thanks @HiDeoo! - Fixes a regression when using a union to extend Starlight’sdocsSchema().v0.41.4Compare Source
Patch Changes
#3936
712eeddThanks @miichom! - Fixes support for modifying Zod enums when passing anextendoption to Starlight’sdocsSchema()#4092
0896b91Thanks @delucis! - Fixes support for links containing a protocol likemailto:in the sidebar#4088
4486ba4Thanks @delucis! - Simplifies Starlight’s client-side sidebar state persistence script slightlyanchore/syft (anchore/syft)
v1.51.1Compare Source
Bug Fixes
Additional Changes
Dependencies
72 dependency changes (70 updated, 1 added, 1 removed). 3 vulnerabilities remediated.
🟢 Remediated (3)
Updated (70 packages)
v0.25.1→v0.25.2v0.18.2→v0.22.0v1.5.3→v1.11.0v1.13.1→v1.18.0v0.8.0→v1.2.0v1.24.3→v1.29.0v1.61.3→v1.64.0v1.11.7→v1.16.0v1.32.0→v1.33.0v0.55.0→v0.57.0v0.55.0→v0.57.0v0.55.0→v0.57.0v0.3.0→v0.3.1v1.41.5→v1.43.4v1.7.8→v1.7.16v1.32.12→v1.32.35v1.19.12→v1.19.34v1.18.20→v1.18.35v1.4.21→v1.4.35v2.7.21→v2.7.35v1.4.22→v1.4.36v1.13.7→v1.13.15v1.9.13→v1.9.28v1.13.21→v1.13.35v1.19.21→v1.19.36v1.97.3→v1.106.5v1.0.8→v1.5.4v1.30.13→v1.33.4v1.35.17→v1.38.4v1.41.9→v1.45.4v1.24.2→v1.27.6v2.3.3→v2.3.4v1.0.0-rc.4→v1.0.0-rc.5v29.6.1+incompatible→v29.7.2+incompatiblev0.7.0→v0.8.1v1.18.0→v1.19.0v1.4.13→v1.4.15v0.21.7→v0.21.9v0.0.0-a4b03ec→v0.0.0-ef3492dv0.3.14→v0.3.19v2.17.0→v2.23.0v2.0.0-beta.72→v2.0.0-beta.74v1.8.6→v1.8.8v1.8.0→v1.9.0v1.19.1→v1.19.2v0.0.20→v0.0.24v0.5.0→v0.5.1v2.6.0→v2.7.0v0.5.2→v0.5.3v1.11.1→v1.12.1v1.43.0→v1.44.0v1.43.0→v1.44.0(🟢 remediated GO-2026-5158)v1.40.0→v1.44.0v1.43.0→v1.44.0v1.43.0→v1.44.0v1.43.0→v1.44.0v1.43.0→v1.44.0v0.54.0→v0.55.0v0.38.0→v0.40.0(🟢 remediated GO-2026-6179, GO-2026-6180)v0.57.0→v0.58.0v0.40.0→v0.41.0v0.48.0→v0.49.0v0.271.0→v0.292.0v0.0.0-8636f87→v0.0.0-aa98bbav0.0.0-afd174a→v0.0.0-925bb5dv0.0.0-afd174a→v0.0.0-6ac0973v1.82.1→v1.83.0v4.29.0→v4.29.1v1.74.1→v1.74.4v1.55.0→v1.56.0Added (1 package)
v0.66.0Removed (1 package)
v1.8.6(Full Changelog)
v1.51.0Compare Source
Added Features
Bug Fixes
<name>@unknownpackages for subpath or export-map stub package.json files [Issue #5118]Dependencies
9 dependency changes (9 updated). 2 vulnerabilities remediated.
🟢 Remediated (2)
Updated (9 packages)
v1.9.3→v1.9.4v5.9.0→v5.9.1v5.19.1→v5.19.2(🟢 remediated GHSA-hc8v-wwc9-vgxm, GHSA-qgq7-7hm3-q39j)v6.8.1→v6.8.3v1.19.0→v1.19.1v1.8.10→v1.18.11v0.5.15→v0.5.16v3.0.4→v3.0.5v1.54.0→v1.55.0(Full Changelog)
v1.50.0Compare Source
Added Features
Bug Fixes
Additional Changes
Dependencies
14 dependency changes (14 updated). 1 vulnerability remediated.
🟢 Remediated (1)
Updated (14 packages)
v1.31.0→v1.32.0v0.0.0-ee656c7→v0.0.0-dba9d58v1.36.0→v1.37.0v1.3.0→v1.3.3v0.24.1→v0.25.0v1.39.0→v1.43.0v0.0.0-9d38bb4→v0.0.0-afd174av0.0.0-6f92a3b→v0.0.0-afd174av1.80.0→v1.82.1(🟢 remediated GHSA-hrxh-6v49-42gf)v4.28.4→v4.29.0v4.34.4→v4.34.6v3.1.3→v3.1.4v1.73.4→v1.74.1v1.53.0→v1.54.0(Full Changelog)
v1.49.0Compare Source
Added Features
application/vnd.oci.image.index.v1+jsonmanifests in root OCI layout [Issue #1545] [PR #5074 @jasonpaulos]Bug Fixes
Dependencies
16 dependency changes (16 updated).
Updated (16 packages)
v0.1.0→v0.2.0v0.2.2→v0.3.0v2.3.2→v2.3.3v29.5.3+incompatible→v29.6.1+incompatiblev0.5.22→v0.5.23v1.54.2→v1.55.0v0.4.1→v0.5.0v2.3.1→v2.4.3v0.53.0→v0.54.0v0.37.0→v0.38.0v0.56.0→v0.57.0v0.21.0→v0.22.0v0.46.0→v0.47.0v0.44.0→v0.45.0v0.38.0→v0.40.0v0.47.0→v0.48.0(Full Changelog)
aquasecurity/trivy (aquasecurity/trivy)
v0.74.0Compare Source
⚡ Highlights ⚡
👉 https://redirect.github.com/aquasecurity/trivy/discussions/11096
Changelog
https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0740-2026-08-14
v0.73.0Compare Source
⚡ Highlights ⚡
👉 https://redirect.github.com/aquasecurity/trivy/discussions/11033
Changelog
https://github.com/aquasecurity/trivy/blob/main/CHANGELOG.md#0730-2026-08-03
withastro/astro (astro)
v7.3.1Compare Source
Patch Changes
0389640Thanks @ematipico! - Fixes an error that prevented projects usingastro:assetsfrom starting or buildingv7.3.0Compare Source
Minor Changes
#17767
ce7c91fThanks @astro-factory! - Adds--ignore-lockflag toastro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.#17818
c0b6581Thanks @florian-lefebvre! - Adds aloggerparameter to image services hooksCustom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in
loggerand respect your log level, instead of being written straight to the console:Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.
#17818
c0b6581Thanks @florian-lefebvre! - Addsloggerto the context object passed to cache providersCustom cache providers now receive Astro's runtime logger on the context passed to
onRequest(). Messages logged with it are routed through the destination configured inloggerand respect your log level, instead of being written straight to the console:Astro's built-in
memoryCache()provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.Patch Changes
#17818
c0b6581Thanks @florian-lefebvre! - Updates Astro's remaining internal warnings and errors to be written through the configured logger instead of directly to the console, when possible#17886
e747cbaThanks @matthewp! - Fixes the memory cache provider to skip responses withVary: CookieorVary: *#17885
916b738Thanks @Princesseuh! - Improves build performance for sites with a large number of pages coming from a large amount of different modules.#17795
15e2debThanks @matthewp! - Adds concurrent rendering support forexperimental.incrementalBuild, including when using@astrojs/cloudflareIncremental builds no longer disable caching when
build.concurrencyis greater than1. Projects that setbuild.concurrency: 1to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.#17879
21c34a6Thanks @matthewp! - Fixes missing styles, links, and scripts from content collection entries rendered inside server islands#17861
3193988Thanks @ethanstoner! - Fixes i18n fallback routes being generated with a corrupted path when the locale code also appears at the start of a later path segment. A page such assrc/pages/en/enterprise.astrowithfallback: { es: 'en' }produced the route/es/esterpriseinstead of/es/enterprise, so the fallback never matched the intended URL. Only the leading locale segment is rewritten now.v7.2.10Compare Source
Patch Changes
#17262
f8e9458Thanks @Princesseuh! - Fixes@astrojs/markdown-remarkbeing pinned to an exact version.#17874
10c7e63Thanks @astro-factory! - Fixes SSR manifest placeholder not being replaced when the server build is minified, which caused a runtimeInvalid URLcrash at server boot#17869
2548abfThanks @ematipico! - Fixes a case where the logger was improperly initialized at runtime in dev.#17878
76eff3dThanks @ematipico! - Fixes browser heuristic caching for cached responses that includeLast-ModifiedorETagvalidators#17833
413a6e7Thanks @astro-factory! - Fixes prerender conflict warnings to correctly identify the route that first rendered a duplicate pathname, instead of misattributing the conflict to an unrelated route that merely matches the URL pattern#17872
f7191ccThanks @jx-grxf! - Fixes Markdown images in content collections rendering an emptysrcsetattribute when no responsive candidates are generated.#17755
157c500Thanks @matthewp! - Fixes a bug where editing a content collection entry duringastro devon Windows kept serving stale content until the dev server was restarted. The data store now notifies the dev server directly after each write instead of relying only on the file watcher, which can miss the atomic rename that commits the write on some platforms.Updated dependencies [
f8e9458,f8e9458]:v7.2.9Compare Source
Patch Changes
#17846
b441180Thanks @Princesseuh! - Fixes importing.htmlfiles not being typed outside of.astrofiles#17831
32e8b44Thanks @astro-factory! - Fixes a crash when requesting/index.htmlagainst a dynamic page route like[slug].astro#17841
c35448eThanks @astro-factory! - Fixes SSR manifest containing staleentryModulesreferences to prerender-only chunks that no longer exist in the final build output#17847
eb87a23Thanks @matthewp! - Fixesset:textescaping in MDX script and style elementsv7.2.8Compare Source
Patch Changes
#17837
ecb4082Thanks @matthewp! - Updates the minimum supported version of Sharp to 0.35.4#17786
db7c53bThanks @gameroman! - Replaces the internalfind-processdependency with a smaller, lighter alternativev7.2.7Compare Source
Patch Changes
#17415
55d38c8Thanks @iseraph-dev! - Deserializes each route once when loading the SSR manifest#17772
023b48bThanks @matthewp! - Fixes route selection for normalized request paths in adapter and development request handling#17819
633855bThanks @matthewp! - Updates generated and default Cloudflarecompatibility_datevalues to match the installed runtime and requires Wrangler^4.125.0#17813
ae26d18Thanks @matthewp! - Fixesrewrite()andnext(payload)for GET and HEAD requests with host-provided bodies#17816
a0d2fe3Thanks @astro-factory! - Fixes the experimentalsvgOptimizernot generating unique per-file ID prefixes when using SVGO'sprefixIdspluginv7.2.6Compare Source
Patch Changes
29af6daThanks @matthewp! - Fixes a bug wherenew FetchState(request)could fail in development when server dependencies were optimizedv7.2.5Compare Source
Patch Changes
#17758
5f419e2Thanks @astro-factory! - Fixes a bug whereexperimental_getFontFileURL()rejected valid font URLs when using the Cloudflare adapter#17416
493796bThanks @iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs#17712
bd374b7Thanks @fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8#17719
dac1768Thanks @astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys#17770
84eb7e7Thanks @astro-factory! - Fixes--mode,--site,--base,--out-dir,--verbose,--silent, and--openflags being silently dropped when usingastro dev --backgroundorastro preview --background#17713
d035290Thanks @wakqasahmed! - Fixescontent-modules.mjsnot removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modulesAs part of this fix,
#moduleImportsis now fully rebuilt fromdeferredRenderentries before every write, so a module import added only through the publicaddModuleImport()API without a correspondingdeferredRenderentry in the store will no longer be preserved across writes.#17743
adc750fThanks @contactjawad! - FixesAstro.preferredLocaleandAstro.preferredLocaleListignoringAccept-Languagequality values when they are absent or0. An entry without an explicitq=now correctly counts as quality1.0(per RFC 7231) and an entry withq=0is treated as not acceptable, so the highest-quality locale is selected regardless of header order.#17757
660991cThanks @astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error#17783
60b14ffThanks @matthewp! - Fixes a type error when passing an image from a content collectionimage()schema to a component or<Image />. The schema returned byimage()was missing theapngformat, so it no longer matched the type of an imported image.#17664
d483125Thanks @astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases"unsafe-inline"resource. Now when"unsafe-inline", Astro won't emit hashes for the directive specified.#17810
0fc5f65Thanks @florian-lefebvre! - Fixes a regression in the content collections that could cause images to not be resolved#17781
aa33b44Thanks @matthewp! - Fixes `memoryCachConfiguration
📅 Schedule: (in timezone America/Chicago)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.