fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
@astrojs/rss (source)	4.0.7 -> 4.0.11					dependencies	patch
@biomejs/biome (source)	1.8.3 -> 1.9.4					devDependencies	minor
accesskit	0.16.0 -> 0.17.0					workspace.dependencies	minor
accesskit_winit	0.22.0 -> 0.23.0					workspace.dependencies	minor
astro (source)	5.0.8 -> 5.4.1					dependencies	minor
gilrs	0.10.8 -> 0.11.0					dev-dependencies	minor
itertools	0.13.0 -> 0.14.0					dependencies	minor
itertools	0.13.0 -> 0.14.0					dev-dependencies	minor
rand (source)	0.8.5 -> 0.9.0					dev-dependencies	minor
rfd	0.14.1 -> 0.15.0					dev-dependencies	minor
shipyard	0.6.3 -> 0.7.0					workspace.dependencies	minor
skia-safe	0.81.0 -> 0.82.0					workspace.dependencies	minor
tailwindcss (source)	3.4.4 -> 3.4.17					dependencies	patch
tree-sitter-highlight (source)	0.23.0 -> 0.25.0					dev-dependencies	minor

---

Release Notes

withastro/astro (@​astrojs/rss)

v4.0.11

Compare Source

Patch Changes

• #​12829 ebe2aa9 Thanks @​SapphicMoe! - Revert incorrect Content-Type header applied for RSS XML file

v4.0.10

Compare Source

Patch Changes

• #​12644 5b9b618 Thanks @​kunyan! - Sends the standard RSS content type response header, with UTF-8 charset

v4.0.9

Compare Source

Patch Changes

• #​12157 925cff3 Thanks @​bholmesdev! - Improves README configuration reference.

v4.0.8

Compare Source

Patch Changes

• #​12137 50dd88b Thanks @​ArmandPhilippot! - Fixes an error that occurred when the optional pubDate property was missing in an item.

• #​12137 50dd88b Thanks @​ArmandPhilippot! - Fixes an error where docs incorrectly stated the title, link and pubDate properties of RSS items was required.

biomejs/biome (@​biomejs/biome)

v1.9.4

Compare Source

v1.9.3

Compare Source

v1.9.2

Compare Source

v1.9.1

Compare Source

v1.9.0

Compare Source

AccessKit/accesskit (accesskit)

v0.17.1: accesskit: v0.17.1

Compare Source

Bug Fixes

• Fix some broken links in the documentation (#​484) (0a51225)

v0.17.0: accesskit: v0.17.0

Compare Source

This new version of AccessKit contains a few important changes. Here are the highlights:

• NodeBuilder has been renamed to Node and its build method has been removed. The old Node struct was renamed to FrozenNode but you would typically not use it since the convertion now happens automatically.
• The name property is now called label to be consistent with the labelled_by property.
• You must now set the content of label nodes by using the value property instead of label.
• DefaultActionVerb has been removed: adding supported Actions is now all that is needed to tell assistive technologies how they can interact with a node.
• Action::Default has been renamed to Click.
• Role::InlineTextBox is now called TextRun.
• The property is_hovered have been removed and there is no replacement for it.

Read the Changelog for more information.

v0.16.3: accesskit: v0.16.3

Compare Source

Bug Fixes

• Eliminate duplicate definitions (#​461) (59826d4)

v0.16.2: accesskit: v0.16.2

Compare Source

Bug Fixes

• Don't use a macro to generate Action debug helper function (#​459) (ed1fb73)
• Update minimum supported Rust version to 1.75 (#​457) (fc622fe)

v0.16.1: accesskit: v0.16.1

Compare Source

Bug Fixes

• Improve debug representation of Node and NodeBuilder (#​452) (119aa1d)

withastro/astro (astro)

v5.4.1

Compare Source

Patch Changes

• #​13336 8f632ef Thanks @​ematipico! - Fixes a regression where some asset utilities were move across monorepo, and not re-exported anymore.

• #​13320 b5dabe9 Thanks @​{! - Adds support for typing experimental session data

  You can add optional types to your session data by creating a src/env.d.ts file in your project that extends the global App.SessionData interface. For example:

  declare namespace App {
    interface SessionData {
  
        id: string;
        email: string;
      };
      lastLogin: Date;
    }
  }

  Any keys not defined in this interface will be treated as any.

  Then when you access Astro.session in your components, any defined keys will be typed correctly:

v5.4.0

Compare Source

Minor Changes

• #​12052 5be12b2 Thanks @​Fryuni! - Exposes extra APIs for scripting and testing.

Config helpers

Two new helper functions exported from astro/config:

• mergeConfig() allows users to merge partially defined Astro configurations on top of a base config while following the merge rules of updateConfig() available for integrations.
• validateConfig() allows users to validate that a given value is a valid Astro configuration and fills in default values as necessary.

These helpers are particularly useful for integration authors and for developers writing scripts that need to manipulate Astro configurations programmatically.

Programmatic build

The build API now receives a second optional BuildOptions argument where users can specify:

• devOutput (default false): output a development-based build similar to code transformed in astro dev.
• teardownCompiler (default true): teardown the compiler WASM instance after build.

These options provide more control when running Astro builds programmatically, especially for testing scenarios or custom build pipelines.

• #​13278 4a43c4b Thanks @​ematipico! - Adds a new configuration option server.allowedHosts and CLI option --allowed-hosts.

  Now you can specify the hostnames that the dev and preview servers are allowed to respond to. This is useful for allowing additional subdomains, or running the dev server in a web container.

  allowedHosts checks the Host header on HTTP requests from browsers and if it doesn't match, it will reject the request to prevent CSRF and XSS attacks.

  astro dev --allowed-hosts=foo.bar.example.com,bar.example.com

  astro preview --allowed-hosts=foo.bar.example.com,bar.example.com

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  
  export default defineConfig({
    server: {
      allowedHosts: ['foo.bar.example.com', 'bar.example.com'],
    },
  });

  This feature is the same as Vite's server.allowHosts configuration.

• #​13254 1e11f5e Thanks @​p0lyw0lf! - Adds the ability to process and optimize remote images in Markdown files

  Previously, Astro only allowed local images to be optimized when included using ![]() syntax in plain Markdown files. Astro's image service could only display remote images without any processing.

  Now, Astro's image service can also optimize remote images written in standard Markdown syntax. This allows you to enjoy the benefits of Astro's image processing when your images are stored externally, for example in a CMS or digital asset manager.

  No additional configuration is required to use this feature! Any existing remote images written in Markdown will now automatically be optimized. To opt-out of this processing, write your images in Markdown using the HTML <img> tag instead. Note that images located in your public/ folder are still never processed.

Patch Changes

• #​13256 509fa67 Thanks @​p0lyw0lf! - Adds experimental responsive image support in Markdown

  Previously, the experimental.responsiveImages feature could only provide responsive images when using the <Image /> and <Picture /> components.

  Now, images written with the ![]() Markdown syntax in Markdown and MDX files will generate responsive images by default when using this experimental feature.

  To try this experimental feature, set experimental.responsiveImages to true in your astro.config.mjs file:

  {
     experimental: {
        responsiveImages: true,
     },
  }

  Learn more about using this feature in the experimental responsive images feature reference.

  For a complete overview, and to give feedback on this experimental API, see the Responsive Images RFC.

• #​13323 80926fa Thanks @​ematipico! - Updates esbuild and vite to the latest to avoid false positives audits warnings caused by esbuild.

• #​13313 9e7c71d Thanks @​martrapp! - Fixes an issue where a form field named "attributes" shadows the form.attributes property.

• #​12052 5be12b2 Thanks @​Fryuni! - Fixes incorrect config update when calling updateConfig from astro:build:setup hook.

  The function previously called a custom update config function made for merging an Astro config. Now it calls the appropriate mergeConfig() utility exported by Vite that updates functional options correctly.

• #​13303 5f72a58 Thanks @​ematipico! - Fixes an issue where the dev server was applying second decoding of the URL of the incoming request, causing issues for certain URLs.

• Updated dependencies [1e11f5e, 1e11f5e]:

  • @​astrojs/internal-helpers@​0.6.0
  • @​astrojs/markdown-remark@​6.2.0

v5.3.1

Compare Source

Patch Changes

• #​13233 32fafeb Thanks @​joshmkennedy! - Ensures consistent behaviour of Astro.rewrite/ctx.rewrite when using base and trailingSlash options.

• #​13003 ea79054 Thanks @​chaegumi! - Fixes a bug that caused the vite.base value to be ignored when running astro dev

• #​13299 2e1321e Thanks @​bluwy! - Uses tinyglobby for globbing files

• #​13233 32fafeb Thanks @​joshmkennedy! - Ensures that Astro.url/ctx.url is correctly updated with the base path after rewrites.

  This change fixes an issue where Astro.url/ctx.url did not include the configured base path after Astro.rewrite was called. Now, the base path is correctly reflected in Astro.url.

  Previously, any rewrites performed through Astro.rewrite/ctx.rewrite failed to append the base path to Astro.url/ctx.rewrite, which could lead to incorrect URL handling in downstream logic. By fixing this, we ensure that all routes remain consistent and predictable after a rewrite.

  If you were relying on the work around of including the base path in astro.rewrite you can now remove it from the path.

v5.3.0

Compare Source

Minor Changes

• #​13210 344e9bc Thanks @​VitaliyR! - Handle HEAD requests to an endpoint when a handler is not defined.

  If an endpoint defines a handler for GET, but does not define a handler for HEAD, Astro will call the GET handler and return the headers and status but an empty body.

• #​13195 3b66955 Thanks @​MatthewLymer! - Improves SSR performance for synchronous components by avoiding the use of Promises. With this change, SSR rendering of on-demand pages can be up to 4x faster.

• #​13145 8d4e566 Thanks @​ascorbic! - Adds support for adapters auto-configuring experimental session storage drivers.

  Adapters can now configure a default session storage driver when the experimental.session flag is enabled. If a hosting platform has a storage primitive that can be used for session storage, the adapter can automatically configure the session storage using that driver. This allows Astro to provide a more seamless experience for users who want to use sessions without needing to manually configure the session storage.

Patch Changes

• #​13145 8d4e566 Thanks @​ascorbic! - ⚠️ BREAKING CHANGE FOR EXPERIMENTAL SESSIONS ONLY ⚠️

  Changes the experimental.session option to a boolean flag and moves session config to a top-level value. This change is to allow the new automatic session driver support. You now need to separately enable the experimental.session flag, and then configure the session driver using the top-level session key if providing manual configuration.

  defineConfig({
    // ...
    experimental: {
  -    session: {
  -      driver: 'upstash',
  -    },
  +    session: true,
    },
  +  session: {
  +    driver: 'upstash',
  +  },
  });

  You no longer need to configure a session driver if you are using an adapter that supports automatic session driver configuration and wish to use its default settings.

  defineConfig({
    adapter: node({
      mode: "standalone",
    }),
    experimental: {
  -    session: {
  -      driver: 'fs',
  -      cookie: 'astro-cookie',
  -    },
  +    session: true,
    },
  +  session: {
  +    cookie: 'astro-cookie',
  +  },
  });

  However, you can still manually configure additional driver options or choose a non-default driver to use with your adapter with the new top-level session config option. For more information, see the experimental session docs.

• #​13101 2ed67d5 Thanks @​corneliusroemer! - Fixes a bug where HEAD and OPTIONS requests for non-prerendered pages were incorrectly rejected with 403 FORBIDDEN

v5.2.6

Compare Source

Patch Changes

• #​13188 7bc8256 Thanks @​ematipico! - Fixes the wording of the an error message

• #​13205 9d56602 Thanks @​ematipico! - Fixes and issue where a server island component returns 404 when base is configured in i18n project.

• #​13212 fb38840 Thanks @​joshmkennedy! - An additional has been added during the build command to add clarity around output and buildOutput.

• #​13213 6bac644 Thanks @​joshmkennedy! - Allows readonly arrays to be passed to the paginate() function

v5.2.5

Compare Source

Patch Changes

• #​13133 e76aa83 Thanks @​ematipico! - Fixes a bug where Astro was failing to build an external redirect when the middleware was triggered

• #​13119 ac43580 Thanks @​Hacksore! - Adds extra guidance in the terminal when using the astro add tailwind CLI command

  Now, users are given a friendly reminder to import the stylesheet containing their Tailwind classes into any pages where they want to use Tailwind. Commonly, this is a shared layout component so that Tailwind styling can be used on multiple pages.

v5.2.4

Compare Source

Patch Changes

• #​13130 b71bd10 Thanks @​ascorbic! - Fixes a bug that caused duplicate slashes inside query params to be collapsed

• #​13131 d60c742 Thanks @​ascorbic! - Ignores trailing slashes for endpoints with file extensions in the route

• Updated dependencies [b71bd10]:

  • @​astrojs/internal-helpers@​0.5.1

v5.2.3

Compare Source

Patch Changes

• #​13113 3a26e45 Thanks @​unprintable123! - Fixes the bug that rewrite will pass encoded url to the dynamic routing and cause params mismatch.

• #​13111 23978dd Thanks @​ascorbic! - Fixes a bug that caused injected endpoint routes to return not found when trailingSlash was set to always

• #​13112 0fa5c82 Thanks @​ematipico! - Fixes a bug where the i18n middleware was blocking a server island request when the prefixDefaultLocale option is set to true

v5.2.2

Compare Source

Patch Changes

• #​13106 187c4d3 Thanks @​ascorbic! - Fixes a bug that caused peer dependency errors when running astro add tailwind

v5.2.1

Compare Source

Patch Changes

• #​13095 740eb60 Thanks @​ascorbic! - Fixes a bug that caused some dev server asset requests to return 404 when trailingSlash was set to "always"

v5.2.0

Compare Source

Minor Changes

• #​12994 5361755 Thanks @​ascorbic! - Redirects trailing slashes for on-demand pages

  When the trailingSlash option is set to always or never, on-demand rendered pages will now redirect to the correct URL when the trailing slash doesn't match the configuration option. This was previously the case for static pages, but now works for on-demand pages as well.

  Now, it doesn't matter whether your visitor navigates to /about/, /about, or even /about///. In production, they'll always end up on the correct page. For GET requests, the redirect will be a 301 (permanent) redirect, and for all other request methods, it will be a 308 (permanent, and preserve the request method) redirect.

  In development, you'll see a helpful 404 page to alert you of a trailing slash mismatch so you can troubleshoot routes.

• #​12979 e621712 Thanks @​ematipico! - Adds support for redirecting to external sites with the redirects configuration option.

  Now, you can redirect routes either internally to another path or externally by providing a URL beginning with http or https:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  
  export default defineConfig({
    redirects: {
      '/blog': 'https://example.com/blog',
      '/news': {
        status: 302,
        destination: 'https://example.com/news',
      },
    },
  });

• #​13084 0f3be31 Thanks @​ematipico! - Adds a new experimental virtual module astro:config that exposes a type-safe subset of your astro.config.mjs configuration

  The virtual module exposes two sub-paths for controlled access to your configuration:

  • astro:config/client: exposes config information that is safe to expose to the client.
  • astro:config/server: exposes additional information that is safe to expose to the server, such as file/dir paths.

  To enable this new virtual module, add the experimental.serializeManifest feature flag to your Astro config:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
    experimental: {
      serializeManifest: true,
    },
  });

  Then, you can access the module in any file inside your project to import and use values from your Astro config:

  // src/utils.js
  import { trailingSlash } from 'astro:config/client';
  
  function addForwardSlash(path) {
    if (trailingSlash === 'always') {
      return path.endsWith('/') ? path : path + '/';
    } else {
      return path;
    }
  }

  For a complete overview, and to give feedback on this experimental API, see the Serialized Manifest RFC.

Patch Changes

• #​13049 2ed4bd9 Thanks @​florian-lefebvre! - Updates astro add tailwind to add the @tailwindcss/vite plugin instead of the @astrojs/tailwind integration

• #​12994 5361755 Thanks @​ascorbic! - Returns a more helpful 404 page in dev if there is a trailing slash mismatch between the route requested and the trailingSlash configuration

• #​12666 037495d Thanks @​Thodor12! - Added additional generated typings for the content layer

• Updated dependencies [5361755, db252e0]:

  • @​astrojs/internal-helpers@​0.5.0
  • @​astrojs/markdown-remark@​6.1.0

v5.1.10

Compare Source

Patch Changes

• #​13058 1a14b53 Thanks @​ascorbic! - Fixes broken type declaration

• #​13059 e36837f Thanks @​ascorbic! - Fixes a bug that caused tsconfig path aliases to break if there was more than one wildcard pattern

• #​13045 c7f1366 Thanks @​mtwilliams-code! - Fixes a bug where the some utility functions of the astro:i18n virtual module would return an incorrect result when trailingSlash is set to never

v5.1.9

Compare Source

Patch Changes

• #​12986 8911bda Thanks @​wetheredge! - Updates types and dev toolbar for ARIA 1.2 attributes and roles

• #​12892 8f520f1 Thanks @​louisescher! - Adds a more descriptive error when a content collection entry has an invalid ID.

• #​13031 f576519 Thanks @​florian-lefebvre! - Updates the server islands encoding logic to only escape the script end tag open delimiter and opening HTML comment syntax

• #​13026 1d272f6 Thanks @​ascorbic! - Fixes a regression that prevented the import of Markdown files as raw text or URLs.

v5.1.8

Compare Source

Patch Changes

• #​12998 9ce0038 Thanks @​Kynson! - Fixes the issue that audit incorrectly flag images as above the fold when the scrolling container is not body

• #​12990 2e12f1d Thanks @​ascorbic! - Fixes a bug that caused references to be incorrectly reported as invalid

• #​12984 2d259cf Thanks @​ascorbic! - Fixes a bug in dev where files would stop being watched if the Astro config file was edited

• #​12984 2d259cf Thanks @​ascorbic! - Fixes a bug where the content layer would use an outdated version of the Astro config if it was edited in dev

• #​12982 429aa75 Thanks @​bluwy! - Fixes an issue where server islands do not work in projects that use an adapter but only have prerendered pages. If an adapter is added, the server island endpoint will now be added by default.

• #​12995 78fd73a Thanks @​florian-lefebvre! - Fixes a case where astro:actions types would not work when using src/actions.ts

• #​13011 cf30880 Thanks @​ascorbic! - Upgrades Vite

• #​12733 bbf1d88 Thanks @​ascorbic! - Fixes a bug that caused the dev server to return an error if requesting "//"

• #​13001 627aec3 Thanks @​ascorbic! - Fixes a bug that caused Astro to attempt to inject environment variables into non-source files, causing performance problems and broken builds

v5.1.7

Compare Source

Patch Changes

• #​12361 3d89e62 Thanks @​LunaticMuch! - Upgrades the esbuild version to match vite

• #​12980 1a026af Thanks @​florian-lefebvre! - Fixes a case where setting the status of a page to 404 in development would show the default 404 page (or custom one if provided) instead of using the current page

• #​12182 c30070b Thanks @​braden-w! - Improves matching of 404 and 500 routes

• Updated dependencies [3d89e62]:

  • @​astrojs/markdown-remark@​6.0.2

v5.1.6

Compare Source

Patch Changes

• #​12956 3aff68a Thanks @​kaytwo! - Removes encryption of empty props to allow server island cacheability

• #​12977 80067c0 Thanks @​florian-lefebvre! - Fixes a case where accessing astro:env APIs or import.meta.env inside the content config file would not work

• #​12839 57be349 Thanks @​mtwilliams-code! - Fix Astro.currentLocale returning the incorrect locale when using fallback rewrites in SSR mode

• #​12962 4b7a2ce Thanks @​ascorbic! - Skips updating content layer files if content is unchanged

• #​12942 f00c2dd Thanks @​liruifengv! - Improves the session error messages

• #​12966 d864e09 Thanks @​ascorbic! - Ensures old content collection entry is deleted if a markdown frontmatter slug is changed in dev

v5.1.5

Compare Source

Patch Changes

• #​12934 673a518 Thanks @​ematipico! - Fixes a regression where the Astro Container didn't work during the build, using pnpm

• #​12955 db447f2 Thanks @​martrapp! - Lets TypeScript know about the "blocking" and "disabled" attributes of the <link> element.

• #​12922 faf74af Thanks @​adamchal! - Improves performance of static asset generation by fixing a bug that caused image transforms to be performed serially. This fix ensures that processing uses all CPUs when running in a multi-core environment.

• #​12947 3c2292f Thanks @​ascorbic! - Fixes a bug that caused empty content collections when running dev with NODE_ENV set

v5.1.4

Compare Source

Patch Changes

• #​12927 ad2a752 Thanks @​ematipico! - Fixes a bug where Astro attempted to decode a request URL multiple times, resulting in an unexpected behaviour when decoding the character %

• #​12912 0c0c66b Thanks @​florian-lefebvre! - Improves the config error for invalid combinations of context and access properties under env.schema

• #​12935 3d47e6b Thanks @​AirBorne04! - Fixes an issue where Astro.locals coming from an adapter weren't available in the 404.astro, when using the astro dev command,

• #​12925 44841fc Thanks @​ascorbic! - Ensures image styles are not imported unless experimental responsive images are enabled

• #​12926 8e64bb7 Thanks @​oliverlynch! - Improves remote image cache efficiency by separating image data and metadata into a binary and sidecar JSON file.

• #​12920 8b9d530 Thanks @​bluwy! - Processes markdown with empty body as remark and rehype plugins may add additi

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 74.83%. Comparing base (3a12888) to head (45a3d9d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #761   +/-   ##
=======================================
  Coverage   74.83%   74.83%           
=======================================
  Files         232      232           
  Lines       28446    28446           
=======================================
  Hits        21288    21288           
  Misses       7158     7158           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.