Skip to content

Bump the site-security-and-maintenance group across 1 directory with 17 updates - #332

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/site/site-security-and-maintenance-c8b61f9b29
Open

Bump the site-security-and-maintenance group across 1 directory with 17 updates#332
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/site/site-security-and-maintenance-c8b61f9b29

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the site-security-and-maintenance group with 17 updates in the /site directory:

Package From To
@ai-sdk/react 4.0.130 4.0.169
@astrojs/react 7.0.0 7.1.4
@posthog/browser-common 0.9.11 0.10.7
@posthog/core 1.60.1 1.64.1
ai 7.0.127 7.0.165
astro 7.3.2 7.4.7
motion 14.9.0 14.10.1
pdfjs-dist 6.4.299 6.5.438
postgres 3.4.9 4.1.0
posthog-js-lite 4.13.1 4.13.3
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
@astrojs/check 0.9.10 0.9.12
playwright 1.64.1 1.65.0
posthog-js 1.438.12 1.447.3
purgecss 8.0.0 9.1.0
typescript 6.0.3 7.0.2

Updates @ai-sdk/react from 4.0.130 to 4.0.169

Changelog

Sourced from @​ai-sdk/react's changelog.

4.0.169

Patch Changes

  • Updated dependencies [dc0f7f2]
  • Updated dependencies [6400cf8]
  • Updated dependencies [f608c05]
  • Updated dependencies [883fcde]
  • Updated dependencies [cab9c1f]
  • Updated dependencies [6d21e8e]
  • Updated dependencies [c70adf6]
    • @​ai-sdk/mcp@​2.0.93
    • @​ai-sdk/provider-utils@​5.0.76
    • ai@7.0.165
    • @​ai-sdk/provider@​4.0.37

4.0.168

Patch Changes

  • Updated dependencies [ae13fce]
    • @​ai-sdk/mcp@​2.0.92
    • ai@7.0.164

4.0.167

Patch Changes

  • e0143b0: feat(ai): support provider-owned realtime transports

    Add an optional createTransport interface and provider connection capability.

  • Updated dependencies [5d18351]

  • Updated dependencies [8da48db]

  • Updated dependencies [fd7e8a7]

  • Updated dependencies [36802d4]

  • Updated dependencies [933dae3]

  • Updated dependencies [e0143b0]

  • Updated dependencies [934100c]

  • Updated dependencies [c389374]

  • Updated dependencies [892af4d]

  • Updated dependencies [892af4d]

  • Updated dependencies [89aff56]

  • Updated dependencies [1a1da8d]

  • Updated dependencies [41465fd]

  • Updated dependencies [9754014]

  • Updated dependencies [4bb73b0]

  • Updated dependencies [2e44144]

    • ai@7.0.163
    • @​ai-sdk/provider@​4.0.36

... (truncated)

Commits

Updates @astrojs/react from 7.0.0 to 7.1.4

Release notes

Sourced from @​astrojs/react's releases.

@​astrojs/react@​7.1.4

Patch Changes

  • Updated dependencies [7da442b]:
    • @​astrojs/internal-helpers@​0.13.1

@​astrojs/react@​7.1.3

Patch Changes

  • #18535 b21d724 Thanks @​praveen-kumary! - Preserves component-rendered resource links, including stylesheets, preloads, and modulepreloads, in React island output. Automatic React resource hints are also preserved so that authored links are not removed during server rendering.

@​astrojs/react@​7.1.2

Patch Changes

  • #18482 9c88994 Thanks @​wrostomMM! - Fixes duplicate React.useId() values across components when experimentalDisableStreaming is enabled
Changelog

Sourced from @​astrojs/react's changelog.

7.1.4

Patch Changes

  • Updated dependencies [7da442b]:
    • @​astrojs/internal-helpers@​0.13.1

7.1.3

Patch Changes

  • #18535 b21d724 Thanks @​praveen-kumary! - Preserves component-rendered resource links, including stylesheets, preloads, and modulepreloads, in React island output. Automatic React resource hints are also preserved so that authored links are not removed during server rendering.

7.1.2

Patch Changes

  • #18482 9c88994 Thanks @​wrostomMM! - Fixes duplicate React.useId() values across components when experimentalDisableStreaming is enabled

7.1.1

Patch Changes

7.1.0

Minor Changes

Patch Changes

  • Updated dependencies [b7a1bd9]:
    • @​astrojs/internal-helpers@​0.13.0

7.0.1

Patch Changes

Commits

Updates @posthog/browser-common from 0.9.11 to 0.10.7

Release notes

Sourced from @​posthog/browser-common's releases.

@​posthog/browser-common@​0.10.7

0.10.7

Patch Changes

  • #5544 8ddb57f Thanks @​marandaneto! - Fix tree shaking of unselected extensions and shared utilities when using the slim SDK. (2026-11-05)
  • Updated dependencies [8ddb57f]:
    • @​posthog/core@​1.63.2

@​posthog/browser-common@​0.10.6

0.10.6

Patch Changes

  • #5488 358a77e Thanks @​gustavohstrassburger! - A $feature_flag_called event that the client rate limit drops is now sent again at the next capture. Before, the flag was marked as reported and its exposure was lost. (2026-11-04)

@​posthog/browser-common@​0.10.5

0.10.5

Patch Changes

  • #5481 5764ddd Thanks @​gustavohstrassburger! - Feature flags read before the user opts in to capturing now send $feature_flag_called when the user opts in, without being read again. This fixes missing exposures from the React and React Native hooks, which read a flag once on mount. (2026-11-04)
  • Updated dependencies [5764ddd]:
    • @​posthog/core@​1.63.1

@​posthog/browser-common@​0.10.4

0.10.4

Patch Changes

  • #5503 89c3a6b Thanks @​abdullah129026! - Fix tab widget surveys ignoring the selected position. The popup is only centred next to the tab for the default right position or next to trigger; any other position picked in the survey appearance settings is now honoured. (2026-11-02)
  • Updated dependencies [3fbb667]:
    • @​posthog/core@​1.62.1

@​posthog/browser-common@​0.10.3

0.10.3

Patch Changes

Changelog

Sourced from @​posthog/browser-common's changelog.

0.10.7

Patch Changes

  • #5544 8ddb57f Thanks @​marandaneto! - Fix tree shaking of unselected extensions and shared utilities when using the slim SDK. (2026-11-05)
  • Updated dependencies [8ddb57f]:
    • @​posthog/core@​1.63.2

0.10.6

Patch Changes

  • #5488 358a77e Thanks @​gustavohstrassburger! - A $feature_flag_called event that the client rate limit drops is now sent again at the next capture. Before, the flag was marked as reported and its exposure was lost. (2026-11-04)

0.10.5

Patch Changes

  • #5481 5764ddd Thanks @​gustavohstrassburger! - Feature flags read before the user opts in to capturing now send $feature_flag_called when the user opts in, without being read again. This fixes missing exposures from the React and React Native hooks, which read a flag once on mount. (2026-11-04)
  • Updated dependencies [5764ddd]:
    • @​posthog/core@​1.63.1

0.10.4

Patch Changes

  • #5503 89c3a6b Thanks @​abdullah129026! - Fix tab widget surveys ignoring the selected position. The popup is only centred next to the tab for the default right position or next to trigger; any other position picked in the survey appearance settings is now honoured. (2026-11-02)
  • Updated dependencies [3fbb667]:
    • @​posthog/core@​1.62.1

0.10.3

Patch Changes

0.10.2

Patch Changes

  • #5341 de6b06f Thanks @​sebxt! - Keep the rest of the URL when masking personal data query params and a query value contains ? or the hash contains #. (2026-10-29)

0.10.1

... (truncated)

Commits
  • 6428f16 chore: update versions and lockfile [version bump]
  • 8ddb57f fix(browser): remove unused code from slim extension bundles (#5544)
  • cdefa2d chore: update versions and lockfile [version bump]
  • 358a77e fix(flags): resend flag exposures that the client rate limit drops (#5488)
  • 5ce520f chore: update versions and lockfile [version bump]
  • 5764ddd fix(flags): send flag exposures read before consent when the user opts in (#5...
  • 678b10f chore: update versions and lockfile [version bump]
  • 89c3a6b fix(surveys): respect the selected position for tab widget surveys (#5503)
  • 2dc13a1 chore: update versions and lockfile [version bump]
  • aedb488 fix(browser): sanitize survey description HTML (#5491)
  • Additional commits viewable in compare view

Updates @posthog/core from 1.60.1 to 1.64.1

Release notes

Sourced from @​posthog/core's releases.

@​posthog/core@​1.64.1

1.64.1

Patch Changes

  • #5545 28fe8c0 Thanks @​onmax! - Parse Node stack frames for functions named async without a leading parenthesis in the filename. (2026-11-06)

@​posthog/core@​1.64.0

1.64.0

Minor Changes

  • #5580 aa66d4c Thanks @​haacked! - metrics.histogram() accepts a bounds option that sets the histogram's bucket boundaries, and beforeSend sees and can change them. The first sample of a histogram (name and unit) fixes its bounds until the client resets. A later sample with different bounds is recorded in the fixed buckets and logs a warning, and a sample with invalid bounds is dropped. The experimental posthog.flags.request.duration histogram now uses the bounds [50, 75, 100, 150, 200, 300, 400, 500, 750, 1000, 1500, 2000, 3000, 5000, 10000] ms, so its p50 and p95 resolve between 50ms and 5s. This changes the metric's buckets, which its experimental status allows. (2026-11-05)

Patch Changes

  • Updated dependencies [aa66d4c]:
    • @​posthog/types@​1.421.0

@​posthog/core@​1.63.2

1.63.2

Patch Changes

  • #5544 8ddb57f Thanks @​marandaneto! - Fix tree shaking of unselected extensions and shared utilities when using the slim SDK. (2026-11-05)

@​posthog/core@​1.63.1

1.63.1

Patch Changes

  • #5481 5764ddd Thanks @​gustavohstrassburger! - Feature flags read before the user opts in to capturing now send $feature_flag_called when the user opts in, without being read again. This fixes missing exposures from the React and React Native hooks, which read a flag once on mount. (2026-11-04)

@​posthog/core@​1.63.0

1.63.0

Minor Changes

  • #5473 5c8f314 Thanks @​ablaszkiewicz! - feat: parsePostHogCookie and readPostHogCookie return the session's last activity and start timestamps (2026-11-03)

@​posthog/core@​1.62.1

1.62.1

Patch Changes

... (truncated)

Changelog

Sourced from @​posthog/core's changelog.

1.64.1

Patch Changes

  • #5545 28fe8c0 Thanks @​onmax! - Parse Node stack frames for functions named async without a leading parenthesis in the filename. (2026-11-06)

1.64.0

Minor Changes

  • #5580 aa66d4c Thanks @​haacked! - metrics.histogram() accepts a bounds option that sets the histogram's bucket boundaries, and beforeSend sees and can change them. The first sample of a histogram (name and unit) fixes its bounds until the client resets. A later sample with different bounds is recorded in the fixed buckets and logs a warning, and a sample with invalid bounds is dropped. The experimental posthog.flags.request.duration histogram now uses the bounds [50, 75, 100, 150, 200, 300, 400, 500, 750, 1000, 1500, 2000, 3000, 5000, 10000] ms, so its p50 and p95 resolve between 50ms and 5s. This changes the metric's buckets, which its experimental status allows. (2026-11-05)

Patch Changes

  • Updated dependencies [aa66d4c]:
    • @​posthog/types@​1.421.0

1.63.2

Patch Changes

  • #5544 8ddb57f Thanks @​marandaneto! - Fix tree shaking of unselected extensions and shared utilities when using the slim SDK. (2026-11-05)

1.63.1

Patch Changes

  • #5481 5764ddd Thanks @​gustavohstrassburger! - Feature flags read before the user opts in to capturing now send $feature_flag_called when the user opts in, without being read again. This fixes missing exposures from the React and React Native hooks, which read a flag once on mount. (2026-11-04)

1.63.0

Minor Changes

  • #5473 5c8f314 Thanks @​ablaszkiewicz! - feat: parsePostHogCookie and readPostHogCookie return the session's last activity and start timestamps (2026-11-03)

1.62.1

Patch Changes

  • #5505 3fbb667 Thanks @​majicmaj! - Recognize self-declared Lightpanda headless browsers in bot detection. (2026-11-02)

1.62.0

Minor Changes

... (truncated)

Commits
  • d2d8a26 chore: update versions and lockfile [version bump]
  • 28fe8c0 fix(node): parse stack frames for functions named async (#5545)
  • 9644778 chore: update versions and lockfile [version bump]
  • aa66d4c feat(metrics): give posthog.flags.request.duration finer buckets (#5580)
  • 6428f16 chore: update versions and lockfile [version bump]
  • 8ddb57f fix(browser): remove unused code from slim extension bundles (#5544)
  • 5ce520f chore: update versions and lockfile [version bump]
  • 5764ddd fix(flags): send flag exposures read before consent when the user opts in (#5...
  • 48f16d8 chore: update versions and lockfile [version bump]
  • 5c8f314 feat(next): tracing-header identity, request properties and a proxy wrapper f...
  • Additional commits viewable in compare view

Updates ai from 7.0.127 to 7.0.165

Changelog

Sourced from ai's changelog.

7.0.165

Patch Changes

  • 883fcde: remove transcription word timings from telemetry when recordOutputs is false
  • 6d21e8e: Sanitize provider request URLs before text generation results reach telemetry integrations and tracing subscribers, preventing endpoint credentials from being exposed.
  • Updated dependencies [6400cf8]
  • Updated dependencies [f608c05]
  • Updated dependencies [cab9c1f]
  • Updated dependencies [c70adf6]
    • @​ai-sdk/provider-utils@​5.0.76
    • @​ai-sdk/provider@​4.0.37
    • @​ai-sdk/gateway@​4.0.138

7.0.164

Patch Changes

  • Updated dependencies [bace553]
  • Updated dependencies [6737c77]
  • Updated dependencies [bb4e2d0]
    • @​ai-sdk/gateway@​4.0.137

7.0.163

Patch Changes

  • 5d18351: fix(ai): detect downloaded audio types from bytes when servers return a generic or non-audio content type such as application/octet-stream

  • 8da48db: Respect recordInputs and recordOutputs when delivering telemetry events to integrations and the ai:telemetry channel. Filter nested content and omit raw span results when content recording is disabled, while preserving application results.

  • fd7e8a7: Preserve the order of text and complete function calls in streamed Google responses, including standalone thought signatures on empty text or reasoning parts.

    Keep provider metadata on empty text parts when converting results to response messages so it can be passed back in subsequent requests.

    Omit foreign-provider empty signature text when replaying history through Anthropic or Bedrock, preserving Bedrock’s existing native reasoning-history handling.

  • 36802d4: Support native URL transcription with an optional provider capability, keeping existing file-generation contracts unchanged. Groq sends HTTP(S) audio URLs through its url parameter without downloading and re-uploading them, avoiding the attachment upload limit. Supplying a custom download function retains local download behavior.

    For telemetry integrations, TranscriptionEndEvent.audio.byteLength and audio.mediaType can now be undefined when a provider fetches the audio URL natively. Check for missing values before using them as a number or string. Downloaded and inline audio continue to report their metadata; streaming transcription metadata is unchanged.

    Strip media fragments before sending URLs to Groq. If Groq rejects a redirect, fall back to the existing secure local downloader and file upload rather than failing previously working URL inputs. Other provider errors are preserved.

  • 933dae3: fix (ai): download deprecated file-url and image-url tool result content

    Tool result content parts that use the deprecated file-url and image-url types were converted to file parts with { type: 'url' } data, but they were never passed to the download function. When the model does not support the URL, the provider received a bare URL instead of the file contents, even though the replacement file part with { type: 'url' } data was downloaded and inlined.

    Downloaded legacy URL parts now use the same media type normalization as file

... (truncated)

Commits
  • 0f3a85f Version Packages (#24672)
  • 6d21e8e fix(ai): sanitize request URLs before telemetry observes provider results (#2...
  • f608c05 fix(provider-utils): reject HTTPS download downgrades (#24680)
  • 883fcde fix(ai): hide transcription words from telemetry when recordOutputs is false ...
  • c70adf6 fix(typesafe-ai): align decision API with OpenAPI (#24627)
  • 9ae0c49 Version Packages (#24580)
  • 68a5001 chore(tsconfig): centralize lib option in base config (#24558)
  • bdc3f91 Version Packages (#24424)
  • 892af4d feat (provider): server-side realtime extensions for RealtimeModelV4 (#16137)
  • 9754014 feat(anthropic): forward streaming ping events by introducing new stream part...
  • Additional commits viewable in compare view

Updates astro from 7.3.2 to 7.4.7

Release notes

Sourced from astro's releases.

astro@7.4.7

Patch Changes

  • 7da442b Thanks @​matthewp! - Fixes the image endpoint treating directories whose names differ only by letter case as being inside the build output directory on case-sensitive filesystems
  • Updated dependencies [7da442b]:
    • @​astrojs/internal-helpers@​0.13.1
    • @​astrojs/markdown-satteri@​0.4.7

astro@7.4.6

Patch Changes

  • #18565 cd09986 Thanks @​praveen-kumary! - Avoids attributing client-only components or scripts to unrelated pages importing astro:i18n by bounding top-level page graph traversal at virtual page entries

  • #18608 babd96d Thanks @​umeraamir69! - Fixes an extra page reload on the first page load after starting astro dev without an existing .astro directory

  • #18589 402c0fa Thanks @​astro-factory! - Fixes astro check exiting with code 0 when @astrojs/check or typescript is not installed. The command now exits with code 1 so CI fails instead of silently skipping type checking.

  • #18503 54fcdd5 Thanks @​SwastikTripathi! - Preserves the last-modified date of cached font files and unchanged public files when copying them into the build output. Public-file timestamp preservation respects the resolved public-directory configuration, follows source symlinks, and avoids backdating files overwritten by build plugins.

  • #18605 76cd239 Thanks @​astro-factory! - Fixes the glob() loader adding files from a folder excluded with a negation pattern such as !_docs when they change during astro dev

  • #18432 ed60d82 Thanks @​alexmv! - Improves the MissingSharp error to include the reason Sharp failed to load, such as its prebuilt binaries not supporting the current CPU

  • #18474 59543c3 Thanks @​miottid! - Fixes i18n fallback for on-demand rendered pages. A locale-prefixed request for a page that only exists in the fallback locale (for example /de/about with fallback: { de: 'en' }) was answered with status 302 and no Location header. Such requests are now rewritten or redirected to the fallback locale according to i18n.routing.fallbackType, including encoded paths and sites with a configured base. Query strings are preserved, and explicit page statuses and redirects are left unchanged.

  • #18541 cfa2d2b Thanks @​ump45nose! - Fixes matchAllRoutes to consider fallbackRoutes, matching matchRoute and the production router. Dev-server i18n fallback requests now resolve to the source route's metadata instead of the 404 route, and SSR-only fallback candidates can fall through the prerender handler.

  • #18602 d856064 Thanks @​astro-factory! - Fixes astro check losing the end of its output, including the Result summary, when stdout is piped to a slow reader. When the reader closes the pipe early, for example astro check | head, astro check now exits with code 1 instead of crashing with an EPIPE stack trace.

  • #18574 da0f149 Thanks @​astro-factory! - Fixes an unnecessary full page reload in astro dev when a content loader calls store.clear() or store.delete() and the content store has no asset imports

  • #18570 e71c038 Thanks @​astro-factory! - Fixes pages using <ClientRouter /> briefly showing the top of the page on reload before jumping back to the previous scroll position. Full reloads now use the browser's native scroll restoration.

  • #18531 f75553b Thanks @​praveen-kumary! - Fixes an unhandled TypeError: Cannot convert undefined or null to object when calling route.generate() without arguments on static routes

astro@7.4.5

Patch Changes

  • #18558 fac3c50 Thanks @​astro-factory! - Fixes astro dev status and other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process

  • #18559 10dae2f Thanks @​astro-factory! - Fixes import.meta.env values containing $ sequences (such as $$ or $&) being corrupted in astro build when server code reads the import.meta.env object directly, for example with const { MY_SECRET } = import.meta.env

  • #18544 e3bec3d Thanks @​skezo! - Fixes request paths with invalid percent-encoding (e.g. /%C0%AF or a bare %) being logged as an Invalid URL encoding error and routed with the undecoded path. These requests now return a 400, the same as a path that is encoded too many times.

  • #18520 e023aba Thanks @​matthewp! - Makes rendering of string tag names stricter and consistent across .astro dynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as / or = can no longer change the generated markup. A string that does not start with a valid element name (for example '!--' or '') now throws an error instead of producing invalid HTML.

astro@7.4.4

Patch Changes

... (truncated)

Changelog

Sourced from astro's changelog.

7.4.7

Patch Changes

  • 7da442b Thanks @​matthewp! - Fixes the image endpoint treating directories whose names differ only by letter case as being inside the build output directory on case-sensitive filesystems
  • Updated dependencies [7da442b]:
    • @​astrojs/internal-helpers@​0.13.1
    • @​astrojs/markdown-satteri@​0.4.7

7.4.6

Patch Changes

  • #18565 cd09986 Thanks @​praveen-kumary! - Avoids attributing client-only components or scripts to unrelated pages importing astro:i18n by bounding top-level page graph traversal at virtual page entries

  • #18608 babd96d Thanks @​umeraamir69! - Fixes an extra page reload on the first page load after starting astro dev without an existing .astro directory

  • #18589 402c0fa Thanks @​astro-factory! - Fixes astro check exiting with code 0 when @astrojs/check or typescript is not installed. The command now exits with code 1 so CI fails instead of silently skipping type checking.

  • #18503 54fcdd5 Thanks @​SwastikTripathi! - Preserves the last-modified date of cached font files and unchanged public files when copying them into the build output. Public-file timestamp preservation respects the resolved public-directory configuration, follows source symlinks, and avoids backdating files overwritten by build plugins.

  • #18605 76cd239 Thanks @​astro-factory! - Fixes the glob() loader adding files from a folder excluded with a negation pattern such as !_docs when they change during astro dev

  • #18432 ed60d82 Thanks @​alexmv! - Improves the MissingSharp error to include the reason Sharp failed to load, such as its prebuilt binaries not supporting the current CPU

  • #18474 59543c3 Thanks @​miottid! - Fixes i18n fallback for on-demand rendered pages. A locale-prefixed request for a page that only exists in the fallback locale (for example /de/about with fallback: { de: 'en' }) was answered with status 302 and no Location header. Such requests are now rewritten or redirected to the fallback locale according to i18n.routing.fallbackType, including encoded paths and sites with a configured base. Query strings are preserved, and explicit page statuses and redirects are left unchanged.

  • #18541 cfa2d2b Thanks @​ump45nose! - Fixes matchAllRoutes to consider fallbackRoutes, matching matchRoute and the production router. Dev-server i18n fallback requests now resolve to the source route's metadata instead of the 404 route, and SSR-only fallback candidates can fall through the prerender handler.

  • #18602 d856064 Thanks @​astro-factory! - Fixes astro check losing the end of its output, including the Result summary, when stdout is piped to a slow reader. When the reader closes the pipe early, for example astro check | head, astro check now exits with code 1 instead of crashing with an EPIPE stack trace.

  • #18574 da0f149 Thanks @​astro-factory! - Fixes an unnecessary full page reload in astro dev when a content loader calls store.clear() or store.delete() and the content store has no asset imports

  • #18570 e71c038 Thanks @​astro-factory! - Fixes pages using <ClientRouter /> briefly showing the top of the page on reload before jumping back to the previous scroll position. Full reloads now use the browser's native scroll restoration.

  • #18531 f75553b Thanks @​praveen-kumary! - Fixes an unhandled TypeError: Cannot convert undefined or null to object when calling route.generate() without arguments on static routes

7.4.5

Patch Changes

  • #18558 fac3c50 Thanks @​astro-factory! - Fixes astro dev status and other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process

  • #18559 10dae2f Thanks @​astro-factory! - Fixes import.meta.env values containing $ sequences (such as $$ or $&) being corrupted in astro build when server code reads the import.meta.env object directly, for example with const { MY_SECRET } = import.meta.env

  • #18544 e3bec3d Thanks @​skezo! - Fixes request paths with invalid percent-encoding (e.g. /%C0%AF or a bare %) being logged as an Invalid URL encoding error and routed with the undecoded path. These requests now return a 400, the same as a path that is encoded too many times.

  • #18520 e023aba Thanks @​matthewp! - Makes rendering of string tag names stricter and consistent across .astro dynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as / or = can no longer change the generated markup. A string that does not start with a valid element name (for example '!--' or '') now throws an error instead of producing invalid HTML.

7.4.4

... (truncated)

Commits

@dependabot
Bump the site-security-and-maintenance group across 1 directory with …
0b6bb9c 
…17 updates

Bumps the site-security-and-maintenance group with 17 updates in the /site directory:

| Package | From | To |
| --- | --- | --- |
| [@ai-sdk/react](https://github.com/vercel/ai/tree/HEAD/packages/react) | `4.0.130` | `4.0.169` |
| [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react) | `7.0.0` | `7.1.4` |
| [@posthog/browser-common](https://github.com/PostHog/posthog-js/tree/HEAD/packages/browser-common) | `0.9.11` | `0.10.7` |
| [@posthog/core](https://github.com/PostHog/posthog-js/tree/HEAD/packages/core) | `1.60.1` | `1.64.1` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `7.0.127` | `7.0.165` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.3.2` | `7.4.7` |
| [motion](https://github.com/motiondivision/motion) | `14.9.0` | `14.10.1` |
| [pdfjs-dist](https://github.com/mozilla/pdf.js) | `6.4.299` | `6.5.438` |
| [postgres](https://github.com/porsager/postgres) | `3.4.9` | `4.1.0` |
| [posthog-js-lite](https://github.com/PostHog/posthog-js/tree/HEAD/packages/web) | `4.13.1` | `4.13.3` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check) | `0.9.10` | `0.9.12` |
| [playwright](https://github.com/microsoft/playwright) | `1.64.1` | `1.65.0` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.438.12` | `1.447.3` |
| [purgecss](https://github.com/FullHuman/purgecss) | `8.0.0` | `9.1.0` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |



Updates `@ai-sdk/react` from 4.0.130 to 4.0.169
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/@ai-sdk/react@4.0.169/packages/react)

Updates `@astrojs/react` from 7.0.0 to 7.1.4
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/react@7.1.4/packages/integrations/react)

Updates `@posthog/browser-common` from 0.9.11 to 0.10.7
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/browser-common/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/@posthog/browser-common@0.10.7/packages/browser-common)

Updates `@posthog/core` from 1.60.1 to 1.64.1
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/@posthog/core@1.64.1/packages/core)

Updates `ai` from 7.0.127 to 7.0.165
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@7.0.165/packages/ai)

Updates `astro` from 7.3.2 to 7.4.7
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.4.7/packages/astro)

Updates `motion` from 14.9.0 to 14.10.1
- [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md)
- [Commits](motiondivision/motion@v14.9.0...v14.10.1)

Updates `pdfjs-dist` from 6.4.299 to 6.5.438
- [Release notes](https://github.com/mozilla/pdf.js/releases)
- [Commits](mozilla/pdf.js@v6.4.299...v6.5.438)

Updates `postgres` from 3.4.9 to 4.1.0
- [Release notes](https://github.com/porsager/postgres/releases)
- [Changelog](https://github.com/porsager/postgres/blob/master/CHANGELOG.md)
- [Commits](porsager/postgres@v3.4.9...v4.1.0)

Updates `posthog-js-lite` from 4.13.1 to 4.13.3
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/web/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-js-lite@4.13.3/packages/web)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@astrojs/check` from 0.9.10 to 0.9.12
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/astro-check/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/check@0.9.12/packages/language-tools/astro-check)

Updates `playwright` from 1.64.1 to 1.65.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.64.1...v1.65.0)

Updates `posthog-js` from 1.438.12 to 1.447.3
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.438.12...posthog-js@1.447.3)

Updates `purgecss` from 8.0.0 to 9.1.0
- [Release notes](https://github.com/FullHuman/purgecss/releases)
- [Changelog](https://github.com/FullHuman/purgecss/blob/main/CHANGELOG.md)
- [Commits](FullHuman/purgecss@v8.0.0...v9.1.0)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v6.0.3...v7.0.2)

---
updated-dependencies:
- dependency-name: "@ai-sdk/react"
  dependency-version: 4.0.169
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: site-security-and-maintenance
- dependency-name: "@astrojs/react"
  dependency-version: 7.1.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: site-security-and-maintenance
- dependency-name: "@posthog/browser-common"
  dependency-version: 0.10.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: site-security-and-maintenance
- dependency-name: "@posthog/core"
  dependency-version: 1.64.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: site-security-and-maintenance
- dependency-name: ai
  dependency-version: 7.0.165
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: site-security-and-maintenance
- dependency-name: astro
  dependency-version: 7.4.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: site-security-and-maintenance
- dependency-name: motion
  dependency-version: 14.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: site-security-and-maintenance
- dependency-name: pdfjs-dist
  dependency-version: 6.5.438
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: site-security-and-maintenance
- dependency-name: postgres
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: site-security-and-maintenance
- dependency-name: posthog-js-lite
  dependency-version: 4.13.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: site-security-and-maintenance
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: site-security-and-maintenance
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: site-security-and-maintenance
- dependency-name: "@astrojs/check"
  dependency-version: 0.9.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: site-security-and-maintenance
- dependency-name: playwright
  dependency-version: 1.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: site-security-and-maintenance
- dependency-name: posthog-js
  dependency-version: 1.447.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: site-security-and-maintenance
- dependency-name: purgecss
  dependency-version: 9.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: site-security-and-maintenance
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: site-security-and-maintenance
...

Signed-off-by: dependabot[bot] <support@github.com>
@vercel

vercel Bot commented Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
landing Error Error Nov 12, 2026 12:23am UTC

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 12, 2026

This branch had an error being deployed

1 failed deployment
Preview — 0b6bb9cb Deployed Nov 12, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants