Skip to content

chore(deps): bump the npm-minor-and-patch group across 1 directory with 5 updates - #42

Merged
xinshoutw merged 1 commit into
devfrom
dependabot/npm_and_yarn/dev/npm-minor-and-patch-d0c17f5a22
Oct 11, 2026
Merged

xinshoutw merged 1 commit into
devfrom
dependabot/npm_and_yarn/dev/npm-minor-and-patch-d0c17f5a22

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 11, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 5 updates in the / directory:

Package From To
@astrojs/markdown-remark 7.3.1 7.3.2
@shikijs/transformers 4.4.3 4.5.0
astro 7.3.5 7.3.8
mermaid 12.0.0 12.1.0
puppeteer-core 25.12.0 25.13.0

Updates @astrojs/markdown-remark from 7.3.1 to 7.3.2

Release notes

Sourced from @​astrojs/markdown-remark's releases.

@​astrojs/markdown-remark@​7.3.2

Patch Changes

  • #18099 6987261 Thanks @​renovate! - Adds YAML parsing with timestamp and merge key support, and formats YAML errors consistently across Astro, Markdown, MDX, and Markdoc.

  • #18139 d047b5c Thanks @​breken-ai! - Fixes Markdown code blocks with languages ending in a symbol, such as c#, c++, and f#, being highlighted as c or f

  • Updated dependencies [6987261, 62b13ba]:

    • @​astrojs/internal-helpers@​0.12.0
Changelog

Sourced from @​astrojs/markdown-remark's changelog.

7.3.2

Patch Changes

  • #18099 6987261 Thanks @​renovate! - Adds YAML parsing with timestamp and merge key support, and formats YAML errors consistently across Astro, Markdown, MDX, and Markdoc.

  • #18139 d047b5c Thanks @​breken-ai! - Fixes Markdown code blocks with languages ending in a symbol, such as c#, c++, and f#, being highlighted as c or f

  • Updated dependencies [6987261, 62b13ba]:

    • @​astrojs/internal-helpers@​0.12.0
Commits

Updates @shikijs/transformers from 4.4.3 to 4.5.0

Release notes

Sourced from @​shikijs/transformers's releases.

v4.5.0

   🚀 Features

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub
Commits
  • f7d0167 chore: release v4.5.0
  • 63e6da8 fix(transformers): handle split # and -- comments in rose-pine theme (#1317)
  • d25ab2e fix(transformers): keep notations on content comment lines (#1308)
  • 02f0582 feat(transformers): add transformerRenderLineNumber (#1238)
  • 1e968d5 feat(transformers): add classActiveCode option to transformerNotationWordHigh...
  • See full diff in compare view

Updates astro from 7.3.5 to 7.3.8

Release notes

Sourced from astro's releases.

astro@7.3.8

Patch Changes

  • #18293 28e7410 Thanks @​astro-factory! - Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

  • #18298 0e9e857 Thanks @​matthewp! - Fixes astro add removing existing allowBuilds approvals from pnpm-workspace.yaml with pnpm v11.0–v11.22

  • #18263 882dd98 Thanks @​florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

  • #18290 31f13c3 Thanks @​astro-factory! - Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob such as !(drafts)/**/*.md

astro@7.3.7

Patch Changes

  • #18266 cba76cc Thanks @​astro-factory! - Fixes a build error when a Markdown content collection entry loaded with glob({ deferRender: true }) has a layout frontmatter property. layout is now ignored for content collection entries, as documented.

  • #18287 38f6793 Thanks @​astro-factory! - Fixes astro add cloudflare failing to install dependencies with pnpm v11+ by approving the workerd build script, and shows the package manager's error output when astro add fails to install dependencies

  • #18222 fcf6ed6 Thanks @​mingjunlu! - Fixes an issue where AVIF images were served as image/heif instead of image/avif in the dev server.

  • #18240 de4df06 Thanks @​astro-factory! - Fixes the cache() handler from astro/hono and astro/fetch throwing a TypeError when a cache provider is configured. It now registers the cache provider before rendering, so Astro.cache is available to downstream handlers like pages().

  • #18268 547b572 Thanks @​astro-factory! - Fixes security.checkOrigin rejecting cross-origin requests with non-form content types such as application/json. As documented, the check only applies to unsafe requests that have no content-type header or one of application/x-www-form-urlencoded, multipart/form-data, or text/plain.

astro@7.3.6

Patch Changes

  • #18166 5134d0f Thanks @​astro-factory! - Fixes an intermittent dev server crash when using astro:actions inside a server island with adapters that use a pre-bundled SSR environment (e.g. @astrojs/cloudflare)

  • #18076 8a2df66 Thanks @​astro-factory! - Fixes stale scoped styles during HMR when both markup and <style> are changed in a single save

  • #18252 2d29e7e Thanks @​astro-factory! - Fixes CSS from other pages leaking into a page's <head> in dev when the page imports a module such as astro:config/server.

  • #18000 6724575 Thanks @​barclayd! - Fixes a bug where server islands containing framework components rendered empty in the dev server when using a custom src/fetch.ts

  • #18241 7c5fd6f Thanks @​astro-factory! - Fixes the composable i18n() handler from astro/fetch and astro/hono returning an empty 404 for paths without a locale prefix. It now renders the custom 404 page, matching astro().

  • #18164 1a6997f Thanks @​astro-factory! - Fixes CSS Module HMR in dev when a component is rendered both with and without hydration on the same page. Astro now uses path-based class name hashing in dev mode so that editing CSS declarations no longer changes the generated selectors, allowing Vite's CSS HMR to update styles without a full page reload.

  • #18243 dd29d62 Thanks @​astro-factory! - Fixes context.props being null in middleware and endpoints when the composable astro/hono or astro/fetch actions() handler runs before middleware(), or when pages() runs without middleware()

  • #18193 95d5d16 Thanks @​astro-factory! - Fixes astro build failing on Windows with Node.js 25+ with ERR_INVALID_ARG_VALUE when clearing the output directory hits a transient EPERM error

  • #18220 d6c13a4 Thanks @​astro-factory! - Fixes type errors reported in Astro's built-in <Picture /> and <Font /> components when type-checking a project with tsc and @astrojs/ts-content-mapper

  • #18133 faac481 Thanks @​astro-factory! - Fixes lost request state when Vite discovers server dependencies during a request in Cloudflare dev mode

  • #18146 2af4516 Thanks @​astro-factory! - Fixes CSS imported from an injectScript('page') script being dropped during build

  • #18159 e5f8fe0 Thanks @​astro-factory! - Fixes a hang when a server:defer component is inside a slot of another component in an MDX content collection entry

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.8

Patch Changes

  • #18293 28e7410 Thanks @​astro-factory! - Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

  • #18298 0e9e857 Thanks @​matthewp! - Fixes astro add removing existing allowBuilds approvals from pnpm-workspace.yaml with pnpm v11.0–v11.22

  • #18263 882dd98 Thanks @​florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

  • #18290 31f13c3 Thanks @​astro-factory! - Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob such as !(drafts)/**/*.md

7.3.7

Patch Changes

  • #18266 cba76cc Thanks @​astro-factory! - Fixes a build error when a Markdown content collection entry loaded with glob({ deferRender: true }) has a layout frontmatter property. layout is now ignored for content collection entries, as documented.

  • #18287 38f6793 Thanks @​astro-factory! - Fixes astro add cloudflare failing to install dependencies with pnpm v11+ by approving the workerd build script, and shows the package manager's error output when astro add fails to install dependencies

  • #18222 fcf6ed6 Thanks @​mingjunlu! - Fixes an issue where AVIF images were served as image/heif instead of image/avif in the dev server.

  • #18240 de4df06 Thanks @​astro-factory! - Fixes the cache() handler from astro/hono and astro/fetch throwing a TypeError when a cache provider is configured. It now registers the cache provider before rendering, so Astro.cache is available to downstream handlers like pages().

  • #18268 547b572 Thanks @​astro-factory! - Fixes security.checkOrigin rejecting cross-origin requests with non-form content types such as application/json. As documented, the check only applies to unsafe requests that have no content-type header or one of application/x-www-form-urlencoded, multipart/form-data, or text/plain.

7.3.6

Patch Changes

  • #18166 5134d0f Thanks @​astro-factory! - Fixes an intermittent dev server crash when using astro:actions inside a server island with adapters that use a pre-bundled SSR environment (e.g. @astrojs/cloudflare)

  • #18076 8a2df66 Thanks @​astro-factory! - Fixes stale scoped styles during HMR when both markup and <style> are changed in a single save

  • #18252 2d29e7e Thanks @​astro-factory! - Fixes CSS from other pages leaking into a page's <head> in dev when the page imports a module such as astro:config/server.

  • #18000 6724575 Thanks @​barclayd! - Fixes a bug where server islands containing framework components rendered empty in the dev server when using a custom src/fetch.ts

  • #18241 7c5fd6f Thanks @​astro-factory! - Fixes the composable i18n() handler from astro/fetch and astro/hono returning an empty 404 for paths without a locale prefix. It now renders the custom 404 page, matching astro().

  • #18164 1a6997f Thanks @​astro-factory! - Fixes CSS Module HMR in dev when a component is rendered both with and without hydration on the same page. Astro now uses path-based class name hashing in dev mode so that editing CSS declarations no longer changes the generated selectors, allowing Vite's CSS HMR to update styles without a full page reload.

  • #18243 dd29d62 Thanks @​astro-factory! - Fixes context.props being null in middleware and endpoints when the composable astro/hono or astro/fetch actions() handler runs before middleware(), or when pages() runs without middleware()

  • #18193 95d5d16 Thanks @​astro-factory! - Fixes astro build failing on Windows with Node.js 25+ with ERR_INVALID_ARG_VALUE when clearing the output directory hits a transient EPERM error

  • #18220 d6c13a4 Thanks @​astro-factory! - Fixes type errors reported in Astro's built-in <Picture /> and <Font /> components when type-checking a project with tsc and @astrojs/ts-content-mapper

  • #18133 faac481 Thanks @​astro-factory! - Fixes lost request state when Vite discovers server dependencies during a request in Cloudflare dev mode

... (truncated)

Commits
  • 3571e2d [ci] release (#18292)
  • 0e9e857 Keep existing pnpm allowBuilds approvals in astro add (#18298)
  • 882dd98 Replace esbuild with Vite and Rolldown APIs (#18263)
  • 28e7410 fix(astro): provide Astro.cache when rendering error pages (#18293)
  • 31f13c3 Fix glob() loader watcher ignoring patterns starting with an extglob like `!(...
  • 25c19fa [ci] release (#18272)
  • 38f6793 fix(astro): approve workerd builds in astro add cloudflare for pnpm v11+ an...
  • 547b572 Restore content-type gate in security.checkOrigin so JSON requests are not bl...
  • fcf6ed6 fix(assets): return requested format from Sharp transform (#18222)
  • bec7d18 Ignore layout frontmatter in Markdown content collection entries with `defe...
  • Additional commits viewable in compare view

Updates mermaid from 12.0.0 to 12.1.0

Release notes

Sourced from mermaid's releases.

mermaid@12.1.0

Minor Changes

  • #8303 9140716 Thanks @​filipsajdak! - feat: add the elk.orientFeedbackEdges option, enabled by default. With the ELK layout, an edge from a node that a subgraph feeds back into that subgraph is now routed downstream instead of around the subgraph. This changes the layout of existing ELK diagrams that contain such edges; set elk.orientFeedbackEdges: false to keep the previous routing.

  • #8250 fd4f5f2 Thanks @​kartben! - feat: add a bitOrder option to packet diagrams. It defaults to ascending, which is the current behaviour, and descending mirrors every row so it reads from that row's highest bit down to its lowest. Fields are still declared lowest bit first and keep their width, so switching a diagram between the two conventions only means changing bitOrder.

Patch Changes

  • #8330 50c9e55 Thanks @​ashishjain0512! - fix: upgrade chevrotain to 13 so mermaid no longer pulls in vulnerable lodash-es@4.17.23

  • #8259 4c90f5c Thanks @​afonsojanu! - fix(sequence): allow whitespace between an actor name and its @{ ... } config object

    participant Bob@{ "type" : "database" } parsed fine, but adding a single space before the config object (participant Bob @{ "type" : "database" }) failed with a confusing parse error, even though the plain form without a config object tolerates trailing whitespace just fine.

  • #8339 c7fa1a5 Thanks @​ashishjain0512! - fix: keep ELK class-diagram cardinalities off namespace frames

  • #8334 d67331d Thanks @​ashishjain0512! - fix(class): place cardinality labels beside their relation ends on dagre's sides with ELK, centre dagre's end labels, and stop clipping their text

  • #8344 99a050b Thanks @​pbrolin47! - fix: with the ELK layout, an edge label could sit up to 16px beside its edge instead of centred on it, when the edge's terminal jog was straightened after the label's position was computed. The label is now re-projected onto the straightened route

  • #8276 3101c7d Thanks @​mir-ashiq! - fix(error): show the actual error message in the error diagram

    When a diagram fails to parse, the error diagram now draws the real error message below the "Syntax error in text" headline, wrapped to at most four lines. Hosts that only show the SVG (GitHub, GitLab, Obsidian, exported images) no longer hide what actually went wrong, e.g. that the flowchart edge limit was exceeded and maxEdges needs raising via mermaid.initialize.

  • #8296 aa29345 Thanks @​pentaoa! - fix: preserve explicit source relations on event modeling reset frames

  • #8297 967bbde Thanks @​pentaoa! - fix: reject duplicate event modeling frame IDs before rendering

  • #8337 147f343 Thanks @​knsv-bot! - fix: a flowchart that declares the same subgraph id more than once now renders as one merged subgraph with the ELK layout instead of producing NaN geometry. Classes and view: collapsed set on a repeated subgraph now apply to it, whichever declaration they follow.

  • #8203 40ef7b4 Thanks @​MFA-G! - perf(frontmatter): replace the quadratic front matter regex on hot paths

    frontMatterRegex backtracks polynomially on whitespace-heavy input, so a diagram well inside the default maxTextSize could stall parsing for over a second. detectType and extractFrontMatter now use a linear scanner that matches the regex result exactly, leaving no document stripped differently.

  • #8254 351d7d2 Thanks @​galshir! - fix: warn when a gantt task references an unknown after/until task id, or when its end value is neither a valid date nor a valid duration

  • #8249 b657a2c Thanks @​mir-ashiq! - fix(sequence): allow hyphenated actor and participant names when a config object is attached

... (truncated)

Commits
  • 21f72f0 Merge pull request #8360 from mermaid-js/changeset-release/master
  • 3f89f7b Version Packages
  • 4ef0218 Merge pull request #8358 from mermaid-js/release/12.0.1
  • f45c691 Fix error from build docs
  • d9cb282 Fix label overlap bug
  • 47fffa0 Merge pull request #8297 from pentaoa/fix/eventmodeling-duplicate-frame-ids
  • 12c280e Merge develop and preserve eventmodeling regression tests
  • c0f7052 Merge pull request #8296 from pentaoa/fix/eventmodeling-reset-explicit-relations
  • 4f6ac96 Merge pull request #8345 from mermaid-js/bug/8283_xychart-legend-clip-title-h...
  • 679093a Merge pull request #8344 from mermaid-js/pebr/issue-8292-elk-label
  • Additional commits viewable in compare view

Updates puppeteer-core from 25.12.0 to 25.13.0

Release notes

Sourced from puppeteer-core's releases.

puppeteer-core: v25.13.0

25.13.0 (2026-10-08)

🎉 Features

🛠️ Fixes

  • await browser process termination and run exit hooks after kill (#15522) (a281197)
  • cdp: disconnect the browser when the close callback fails (#15496) (e015f22)
  • cdp: extend emulateMediaFeatures to media features Chrome honors (#15495) (4758830)
  • cdp: settle worker evaluate and close when the script fails to load (#15501) (02c2a3d)
  • connect: preserve browserURL path prefixes (#15435) (8d816de)
  • launcher: remove the temporary profile when Firefox rejects pipes (#15499) (889a6b7)
  • remove injected scripts when clearing custom query handlers (#15507) (909853c)
  • use the shadow host when checking visibility of a text node in a shadow root (#15466) (d08c868)
  • webdriver: close the browser process when the BiDi close command fails (#15469) (9e5fefa)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​puppeteer/browsers bumped from 3.2.3 to 3.2.4
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…th 5 updates

Bumps the npm-minor-and-patch group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@astrojs/markdown-remark](https://github.com/withastro/astro/tree/HEAD/packages/markdown/remark) | `7.3.1` | `7.3.2` |
| [@shikijs/transformers](https://github.com/shikijs/shiki/tree/HEAD/packages/transformers) | `4.4.3` | `4.5.0` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.3.5` | `7.3.8` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `12.0.0` | `12.1.0` |
| [puppeteer-core](https://github.com/puppeteer/puppeteer) | `25.12.0` | `25.13.0` |



Updates `@astrojs/markdown-remark` from 7.3.1 to 7.3.2
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/markdown/remark/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/markdown-remark@7.3.2/packages/markdown/remark)

Updates `@shikijs/transformers` from 4.4.3 to 4.5.0
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.5.0/packages/transformers)

Updates `astro` from 7.3.5 to 7.3.8
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.3.8/packages/astro)

Updates `mermaid` from 12.0.0 to 12.1.0
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@12.0.0...mermaid@12.1.0)

Updates `puppeteer-core` from 25.12.0 to 25.13.0
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](puppeteer/puppeteer@puppeteer-core-v25.12.0...puppeteer-core-v25.13.0)

---
updated-dependencies:
- dependency-name: "@astrojs/markdown-remark"
  dependency-version: 7.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@shikijs/transformers"
  dependency-version: 4.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: astro
  dependency-version: 7.3.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: mermaid
  dependency-version: 12.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: puppeteer-core
  dependency-version: 25.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 11, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 11, 2026 •

Copy link
Copy Markdown

Deploying freshman with  Cloudflare Pages  Cloudflare Pages

Latest commit: 98d9253
Status: ✅  Deploy successful!
Preview URL: https://5f9f05bc.freshman-1i8.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-dev-g3ux.freshman-1i8.pages.dev

View logs

@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Oct 11, 2026
@greptile-apps

greptile-apps Bot commented Oct 11, 2026

Copy link
Copy Markdown

PR author is in the excluded authors list.

@coderabbitai

coderabbitai Bot commented Oct 11, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: feb2c30c-1ac4-49d4-8982-a55fd0960744

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@xinshoutw
xinshoutw merged commit 98e466e into dev Oct 11, 2026
3 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/dev/npm-minor-and-patch-d0c17f5a22 branch October 11, 2026 22:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant