Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 9 updates - #337

Open
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-691e82af1d
Open

chore(deps): bump the npm_and_yarn group across 1 directory with 9 updates#337
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-691e82af1d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package From To
@astrojs/rss 4.0.18 4.0.19
astro 6.3.5 7.1.4
brace-expansion 1.1.14 1.1.16
esbuild 0.27.7 0.28.1
vite 7.3.3 7.3.6
fast-uri 3.1.2 3.1.4
postcss 8.5.15 8.5.23

Updates @astrojs/rss from 4.0.18 to 4.0.19

Release notes

Sourced from @​astrojs/rss's releases.

@​astrojs/rss@​4.0.19

Patch Changes

  • #17209 fbcfa03 Thanks @​matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.
Changelog

Sourced from @​astrojs/rss's changelog.

4.0.19

Patch Changes

  • #17209 fbcfa03 Thanks @​matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.
Commits

Updates astro from 6.3.5 to 7.1.4

Release notes

Sourced from astro's releases.

astro@7.1.4

Patch Changes

  • #17488 d4f266d Thanks @​emerson-d-lopes! - Fixes duplicate CSS files being emitted in server output when a prerendered page and a server-rendered page share the same styles (e.g. a shared layout importing Tailwind). The prerender and SSR environments each emitted their own copy of the same stylesheet (index.X.css and _..Y.css); the SSR build now reuses the CSS asset filename from the prerender build when the stylesheet is backed by the same CSS source modules, so only a single file is emitted.

  • #17472 4dc590c Thanks @​astrobot-houston! - Adds the missing background prop to the <Image /> and <Picture /> component types. The prop already worked at runtime, but was absent from the types, causing astro check to report that background does not exist on the component props

  • #17292 0fc519d Thanks @​astrobot-houston! - Fixes missing scoped styles for child components inside client:only islands in production builds

  • #17421 f1448de Thanks @​iamkaleemsajjad-hue! - Fixes session runtime errors being silently swallowed by console.error instead of routing through Astro's logger

  • #17421 f1448de Thanks @​iamkaleemsajjad-hue! - Fixes a session being left in a partial state after a storage failure during session.regenerate(), preventing unnecessary storage reads on subsequent operations

  • #17517 82bf7e2 Thanks @​Hashim1999164! - Prevents a visible terminal window from popping up on Windows when the dev server runs in background mode. The detached child process is now spawned with windowsHide: true, so console-subsystem grandchildren (such as workerd.exe) no longer get a new focus-stealing window allocated by Windows Terminal.

  • #17510 eaa1fb0 Thanks @​astrobot-houston! - Fixes the glob() loader watcher so negation patterns like !docs/drafts/** correctly exclude files during development, matching the behavior of the initial scan. Previously, negations were treated as independent matchers, causing unrelated files (including .astro/data-store.json) to be ingested as collection entries

  • #17511 704e570 Thanks @​astrobot-houston! - Fixes TypeScript path aliases from tsconfig.json not resolving in astro.config.ts

astro@7.1.3

Patch Changes

  • #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

astro@7.1.2

Patch Changes

  • #17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

  • #17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

  • #17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

astro@7.1.1

Patch Changes

astro@7.1.0

Minor Changes

  • #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

    

    • 






... (truncated)





Changelog

Sourced from astro's changelog.




7.1.4


Patch Changes


    

  • 

    #17488 d4f266d Thanks @​emerson-d-lopes! - Fixes duplicate CSS files being emitted in server output when a prerendered page and a server-rendered page share the same styles (e.g. a shared layout importing Tailwind). The prerender and SSR environments each emitted their own copy of the same stylesheet (index.X.css and _..Y.css); the SSR build now reuses the CSS asset filename from the prerender build when the stylesheet is backed by the same CSS source modules, so only a single file is emitted.
    

    • 

  • 

    #17472 4dc590c Thanks @​astrobot-houston! - Adds the missing background prop to the <Image /> and <Picture /> component types. The prop already worked at runtime, but was absent from the types, causing astro check to report that background does not exist on the component props
    

    • 

  • 

    #17292 0fc519d Thanks @​astrobot-houston! - Fixes missing scoped styles for child components inside client:only islands in production builds
    

    • 

  • 

    #17421 f1448de Thanks @​iamkaleemsajjad-hue! - Fixes session runtime errors being silently swallowed by console.error instead of routing through Astro's logger
    

    • 

  • 

    #17421 f1448de Thanks @​iamkaleemsajjad-hue! - Fixes a session being left in a partial state after a storage failure during session.regenerate(), preventing unnecessary storage reads on subsequent operations
    

    • 

  • 

    #17517 82bf7e2 Thanks @​Hashim1999164! - Prevents a visible terminal window from popping up on Windows when the dev server runs in background mode. The detached child process is now spawned with windowsHide: true, so console-subsystem grandchildren (such as workerd.exe) no longer get a new focus-stealing window allocated by Windows Terminal.
    

    • 

  • 

    #17510 eaa1fb0 Thanks @​astrobot-houston! - Fixes the glob() loader watcher so negation patterns like !docs/drafts/** correctly exclude files during development, matching the behavior of the initial scan. Previously, negations were treated as independent matchers, causing unrelated files (including .astro/data-store.json) to be ingested as collection entries
    

    • 

  • 

    #17511 704e570 Thanks @​astrobot-houston! - Fixes TypeScript path aliases from tsconfig.json not resolving in astro.config.ts
    

    • 



7.1.3


Patch Changes


    

  • #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.


    • 



7.1.2


Patch Changes


    

  • 

    #17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.
    

    • 

  • 

    #17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)
    

    • 

  • 

    #17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().
    

    • 



7.1.1


Patch Changes



7.1.0


Minor Changes






... (truncated)





Commits

    

  • 112d3ea [ci] release (#17469)
    • 

  • 82bf7e2 fix(astro): hide console window for background dev server on Windows (#17517)
    • 

  • 0fc519d fix(css): preserve styles for child components of client:only islands during ...
    • 

  • d4f266d fix(build): deduplicate CSS assets between prerender and SSR environments (#1...
    • 

  • fbffc96 Fix Container API build errors when using the Cloudflare adapter's workerd pr...
    • 

  • eaa1fb0 Fix glob() loader watcher ignoring negation patterns, causing unrelated files...
    • 

  • 704e570 Fix tsconfig path aliases not resolving in astro.config.ts (#17418) (#17511)
    • 

  • 898f008 chore: use star import consistently (#17473)
    • 

  • 8e2b64b [ci] format
    • 

  • f1448de fix(sessions): route session diagnostics through AstroLogger and reset partia...
    • 

  • Additional commits viewable in compare view
    • 







Updates brace-expansion from 1.1.14 to 1.1.16



Release notes

Sourced from brace-expansion's releases.




v1.1.15


    

  • Backport v5.0.6 change to v1 (#111)  0b09384
    • 





juliangruber/brace-expansion@v1.1.14...v1.1.15







Commits






Updates esbuild from 0.27.7 to 0.28.1



Release notes

Sourced from esbuild's releases.




v0.28.1


    

  • 

    Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)
    

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.
    

    Thanks to @​dellalibera for reporting this issue.
    

    • 

  • 

    Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)
    

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.
    

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.
    

    Thanks to @​sondt99 for reporting this issue.
    

    • 

  • 

    Avoid inlining using and await using declarations (#4482)
    

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
    

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
    

    • 

  • 

    Fix module evaluation when an error is thrown (#4461, #4467)
    

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
    

    • 

  • 

    Fix some edge cases around the new operator (#4477)
    

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
    

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();
    

    • 






... (truncated)





Changelog

Sourced from esbuild's changelog.




0.28.1


    

  • 

    Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)
    

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.
    

    Thanks to @​dellalibera for reporting this issue.
    

    • 

  • 

    Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)
    

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.
    

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.
    

    Thanks to @​sondt99 for reporting this issue.
    

    • 

  • 

    Avoid inlining using and await using declarations (#4482)
    

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
    

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
    

    • 

  • 

    Fix module evaluation when an error is thrown (#4461, #4467)
    

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
    

    • 

  • 

    Fix some edge cases around the new operator (#4477)
    

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
    

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();
    

    • 






... (truncated)





Commits






Updates vite from 7.3.3 to 7.3.6



Release notes

Sourced from vite's releases.




v7.3.6


Please refer to CHANGELOG.md for details.


v7.3.5


Please refer to CHANGELOG.md for details.







Changelog

Sourced from vite's changelog.




7.3.6 (2026-06-25)


Features



7.3.5 (2026-06-01)


Bug Fixes



Miscellaneous Chores



7.3.4 (2026-06-01)


Bug Fixes








Commits






Updates fast-uri from 3.1.2 to 3.1.4



Release notes

Sourced from fast-uri's releases.




v3.1.4


⚠️ Security Release


Fix for GHSA-v2hh-gcrm-f6hx


Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4


v3.1.3


⚠️ Security Release



Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3







Commits






Updates postcss from 8.5.15 to 8.5.23



Release notes

Sourced from postcss's releases.




8.5.23


    

  • Do not load source map without opts.from for security reasons.
    • 



8.5.22



8.5.21



8.5.20



8.5.19


    

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).
    • 



8.5.18


    

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).
    • 



8.5.17


    

  • Fixed Maximum call stack size exceeded error.
    • 

  • Fixed Prototype hijacking for postcss.fromJSON().
    • 

  • Fixed Input#origin() for unmapped end position (by @​chatman-media).
    • 



8.5.16








Changelog

Sourced from postcss's changelog.




8.5.23


    

  • Do not load source map without opts.from for security reasons.
    • 



8.5.22



8.5.21



8.5.20



8.5.19


    

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).
    • 



8.5.18


    

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).
    • 



8.5.17


    

  • Fixed Maximum call stack size exceeded error.
    • 

  • Fixed Prototype hijacking for postcss.fromJSON().
    • 

  • Fixed Input#origin() for unmapped end position (by @​chatman-media).
    • 



8.5.16








Commits





Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.






Updates sharp from 0.34.5 to 0.35.3



Release notes

Sourced from sharp's releases.




v0.35.3


    

  • 

    Tighten verification of text dimensions, TIFF tile dimensions and extend values.
    

    • 

  • 

    Improve code bundler support by resolving path to libvips binary.
    

    • 

  • 

    Increase default concurrency when use of MALLOC_ARENA_MAX is detected.
    

    • 

  • 

    Emit warning about binaries provided by Electron for use on Linux.
    

    • 

  • 

    Add hasAlpha property to output info.
#4500
    

    • 

  • 

    TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer.
#4520
@​Andarist
    

    • 

  • 

    Bound clahe width and height to avoid signed overflow.
#4551
@​metsw24-max
    

    • 

  • 

    Bound trim margin to avoid signed overflow.
#4552
@​metsw24-max
    

    • 

  • 

    Reject infinite values when validating numbers.
#4553
@​metsw24-max
    

    • 

  • 

    Bound extract region to libvips coordinate limit.
#4555
@​metsw24-max
    

    • 

  • 

    Verify background colour values are numbers.
#4556
@​metsw24-max
    

    • 

  • 

    Bound create and raw input dimensions to coordinate limit.
#4558
@​metsw24-max
    

    • 

  • 

    Tighten recomb and affine matrix verification.
#4560
@​chatman-media
    

    • 

  • 

    Verify cache memory limit to avoid overflow.
#4561
@​metsw24-max
    

    • 



v0.35.3-rc.2


    

  • Tighten verification of text dimensions, TIFF tile dimensions and extend values.
    • 






... (truncated)





Commits

    

  • 1018449 Release v0.35.3
    • 

  • ba303a7 Prerelease v0.35.3-rc.2
    • 

  • 4f94fc5 Upgrade to sharp-libvips v1.3.2
    • 

  • c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
    • 

  • 9a8d002 Docs: Add changelog entry and note about transferable #4520
    • 

  • 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBuffer (#4520)
    • 

  • e000d0b Prerelease v0.35.3-rc.1
    • 

  • 9554ca9 Prerelease v0.35.3-rc.0
    • 

  • 6a29fd5 Emit warning about native binaries on Linux Electron
    • 

  • 540d2ea Increase default concurrency when use of MALLOC_ARENA_MAX detected
    • 

  • Additional commits viewable in compare view
    • 







Updates svgo from 4.0.1 to 4.0.2



Release notes

Sourced from svgo's releases.




v4.0.2


What's Changed


Security



Bug Fixes



Performance



Other Changes








Commits

    

  • b2309cf chore: sync version with api
    • 

  • f529cfc Merge commit from fork
    • 

  • 581fe68 performance: speed up mergePath child node removal (#2216)
    • 

  • eb4c8b6 docs(removeAttributesBySelector): properly document and check types (#2215)
    • 

  • 6fd5872 fix(convertColors): skip convertCase on css custom properties (#2213)
    • 

  • 7414f73 fix: properly parse negative (or +) arc radii (#2205)
    • 

  • a8c19aa fix: only call encodeSVGDatauri once and add test case (#2053)
    • 

  • 65548f4 fix(convertPathData): properly handle consecutive t commands (#2156)
    • 

  • a41a7c1 fix(convertPathData): introducing isSafeToRemove (#2164)
    • 

  • 38625dd test: handle charm icons (#2203)
    • 

  • See full diff in compare view
    • 







Updates vite from 7.3.3 to 7.3.6



Release notes

Sourced from vite's releases.




v7.3.6


Please refer to CHANGELOG.md for details.


v7.3.5


Please refer to CHANGELOG.md for details.







Changelog

Sourced from vite's changelog.




7.3.6 (2026-06-25)


Features



7.3.5 (2026-06-01)


Bug Fixes



Miscellaneous Chores



7.3.4 (2026-06-01)


Bug Fixes








Commits





    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      
  dependencies

  Pull requests that update a dependency file

      
  javascript

  Pull requests that update javascript code

  labels


      Jul 28, 2026

    

  








      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          chore(deps): bump the npm_and_yarn group across 1 directory with 9 up…
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          caa000c
        
      

    

  

    

      
…dates

Bumps the npm_and_yarn group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@astrojs/rss](https://github.com/withastro/astro/tree/HEAD/packages/astro-rss) | `4.0.18` | `4.0.19` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `6.3.5` | `7.1.4` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.14` | `1.1.16` |
| [esbuild](https://github.com/evanw/esbuild) | `0.27.7` | `0.28.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.3` | `7.3.6` |
| [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.4` |
| [postcss](https://github.com/postcss/postcss) | `8.5.15` | `8.5.23` |



Updates `@astrojs/rss` from 4.0.18 to 4.0.19
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro-rss/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/rss@4.0.19/packages/astro-rss)

Updates `astro` from 6.3.5 to 7.1.4
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.4/packages/astro)

Updates `brace-expansion` from 1.1.14 to 1.1.16
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.16)

Updates `esbuild` from 0.27.7 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.27.7...v0.28.1)

Updates `vite` from 7.3.3 to 7.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.6/packages/vite)

Updates `fast-uri` from 3.1.2 to 3.1.4
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.4)

Updates `postcss` from 8.5.15 to 8.5.23
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.15...8.5.23)

Updates `sharp` from 0.34.5 to 0.35.3
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.3)

Updates `svgo` from 4.0.1 to 4.0.2
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v4.0.1...v4.0.2)

Updates `vite` from 7.3.3 to 7.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.6/packages/vite)

---
updated-dependencies:
- dependency-name: "@astrojs/rss"
  dependency-version: 4.0.19
  dependency-type: direct:production
- dependency-name: astro
  dependency-version: 7.1.4
  dependency-type: direct:production
- dependency-name: brace-expansion
  dependency-version: 1.1.16
  dependency-type: indirect
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
- dependency-name: fast-uri
  dependency-version: 3.1.4
  dependency-type: indirect
- dependency-name: postcss
  dependency-version: 8.5.23
  dependency-type: indirect
- dependency-name: sharp
  dependency-version: 0.35.3
  dependency-type: indirect
- dependency-name: svgo
  dependency-version: 4.0.2
  dependency-type: indirect
- dependency-name: vite
  dependency-version: 7.3.6
  dependency-type: indirect
- dependency-name: vite
  dependency-version: 7.3.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
          

  
  

  
    

        

              @dependabot


        

      

            dependabot
Bot

            force-pushed
    the
        
      
  dependabot/npm_and_yarn/npm_and_yarn-691e82af1d


    
 branch
    from
    40ea342    to
    caa000c      
    Compare
  



        July 28, 2026 05:36        
        
      

    










      

  
        

    

  
  

  
          ronggur
  

        added 2 commits
        July 28, 2026 12:45


  

      

  
  

  
          

  

    

      


  

        
          @ronggur
  




      

        
          fix(deps): bump vite override to ^8 for Astro 7 compatibility
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          d42f789
        
      

    

  

    

      
Astro 7 requires Vite 8; the ^7 override caused static builds to fail
with a misleading SSR rollupOptions.input error in CI.

    







      

  
  

  
          

  

    

      


  

        
          @ronggur
  




      

        
          fix(deps): regenerate lockfile with npm 10 for CI compatibility
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          05d258b
        
      

    

  

    

      
The lockfile was produced with npm 11 locally, which omitted entries that
npm 10 (bundled with Node 22 on GitHub Actions) requires for npm ci.

    







  








      

  
          

  
  

  
    

        

              @ronggur


        

      

            ronggur


              self-requested a review


        July 29, 2026 10:06        
        
      

    














  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










    
        

  

    
    

    

  

    Reviewers
  


    


      

          


  
      @ronggur
  
    ronggur


          Awaiting requested review from ronggur


      



        

      At least 1 approving review is required to merge this pull request.
  









  
      

  


      
  

    Assignees
  



        


    No one assigned







  
        


  


  

    Labels
  



    

      
    dependencies

  Pull requests that update a dependency file
  
    javascript

  Pull requests that update javascript code








  
        

  

    

        

    Projects
  


        




    None yet




  



  
        


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

  
  
        

  

    

      1 participant
    

    

        
          @ronggur