fix(deps): update @astrojs packages

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/node (source)	9.4.6 -> 9.5.0
@astrojs/react (source)	4.3.1 -> 4.4.1
@astrojs/rss (source)	4.0.12 -> 4.0.13
astro (source)	5.14.3 -> 5.15.3

---

Release Notes

withastro/astro (@​astrojs/node)

v9.5.0

Compare Source

Minor Changes

• #​14441 62ec8ea Thanks @​upsuper! - Updates redirect handling to be consistent across static and server output, aligning with the behavior of other adapters.

  Previously, the Node.js adapter used default HTML files with meta refresh tags when in static output. This often resulted in an extra flash of the page on redirect, while also not applying the proper status code for redirections. It's also likely less friendly to search engines.

  This update ensures that configured redirects are always handled as HTTP redirects regardless of output mode, and the default HTML files for the redirects are no longer generated in static output. It makes the Node.js adapter more consistent with the other official adapters.

  No change to your project is required to take advantage of this new adapter functionality. It is not expected to cause any breaking changes. However, if you relied on the previous redirecting behavior, you may need to handle your redirects differently now. Otherwise you should notice smoother redirects, with more accurate HTTP status codes, and may potentially see some SEO gains.

withastro/astro (@​astrojs/react)

v4.4.1

Compare Source

Patch Changes

• #​14621 e3175d9 Thanks @​GameRoMan! - Updates vite version to fix CVE

v4.4.0

Compare Source

Minor Changes

• #​14386 f75f446 Thanks @​yanthomasdev! - Stabilizes the formerly experimental getActionState() and withState() functions introduced in @astrojs/react v3.4.0 used to integrate Astro Actions with React 19's useActionState() hook.

  This example calls a like action that accepts a postId and returns the number of likes. Pass this action to the withState() function to apply progressive enhancement info, and apply to useActionState() to track the result:

  import { actions } from 'astro:actions';
  import { withState } from '@​astrojs/react/actions';
  import { useActionState } from 'react';
  
  export function Like({ postId }: { postId: string }) {
    const [state, action, pending] = useActionState(
      withState(actions.like),
      0, // initial likes
    );
  
    return (
      <form action={action}>
        <input type="hidden" name="postId" value={postId} />
        <button disabled={pending}>{state} ❤️</button>
      </form>
    );
  }
  

  You can also access the state stored by useActionState() from your action handler. Call getActionState() with the API context, and optionally apply a type to the result:

  import { defineAction } from 'astro:actions';
  import { z } from 'astro:schema';
  import { getActionState } from '@​astrojs/react/actions';
  
  export const server = {
    like: defineAction({
      input: z.object({
        postId: z.string(),
      }),
      handler: async ({ postId }, ctx) => {
        const currentLikes = getActionState<number>(ctx);
        // write to database
        return currentLikes + 1;
      },
    }),
  };
  

  If you were previously using this experimental feature, you will need to update your code to use the new stable exports:

  // src/components/Form.jsx
  import { actions } from 'astro:actions';
  -import { experimental_withState } from '@​astrojs/react/actions';
  +import { withState } from '@​astrojs/react/actions';
  import { useActionState } from "react";

  // src/actions/index.ts
  import { defineAction, type SafeResult } from 'astro:actions';
  import { z } from 'astro:schema';
  -import { experimental_getActionState } from '@​astrojs/react/actions';
  +import { getActionState } from '@​astrojs/react/actions';

withastro/astro (@​astrojs/rss)

v4.0.13

Compare Source

Patch Changes

• #​14598 7b45c65 Thanks @​delucis! - Reduces terminal text styling dependency size by switching from kleur to picocolors

withastro/astro (astro)

v5.15.3

Compare Source

Patch Changes

• #​14627 b368de0 Thanks @​matthewp! - Fixes skew protection support for images and font URLs

  Adapter-level query parameters (assetQueryParams) are now applied to all image and font asset URLs, including:

  • Dynamic optimized images via /_image endpoint
  • Static optimized image files
  • Font preload tags and font requests when using the experimental Fonts API

• #​14631 3ad33f9 Thanks @​KurtGokhan! - Adds the astro/jsx-dev-runtime export as an alias for astro/jsx-runtime

v5.15.2

Compare Source

Patch Changes

• #​14623 c5fe295 Thanks @​delucis! - Fixes a leak of server runtime code when importing SVGs in client-side code. Previously, when importing an SVG file in client code, Astro could end up adding code for rendering SVGs on the server to the client bundle.

• #​14621 e3175d9 Thanks @​GameRoMan! - Updates vite version to fix CVE

v5.15.1

Compare Source

Patch Changes

• #​14612 18552c7 Thanks @​ematipico! - Fixes a regression introduced in Astro v5.14.7 that caused ?url imports to not work correctly. This release reverts #​14142.

v5.15.0

Compare Source

Minor Changes

• #​14543 9b3241d Thanks @​matthewp! - Adds two new adapter configuration options assetQueryParams and internalFetchHeaders to the Adapter API.

  Official and community-built adapters can now use client.assetQueryParams to specify query parameters that should be appended to asset URLs (CSS, JavaScript, images, fonts, etc.). The query parameters are automatically appended to all generated asset URLs during the build process.

  Adapters can also use client.internalFetchHeaders to specify headers that should be included in Astro's internal fetch calls (Actions, View Transitions, Server Islands, Prefetch).

  This enables features like Netlify's skew protection, which requires the deploy ID to be sent with both internal requests and asset URLs to ensure client and server versions match during deployments.

• #​14489 add4277 Thanks @​dev-shetty! - Adds a new Copy to Clipboard button to the error overlay stack trace.

  When an error occurs in dev mode, you can now copy the stack trace with a single click to more easily share it in a bug report, a support thread, or with your favorite LLM.

• #​14564 5e7cebb Thanks @​florian-lefebvre! - Updates astro add cloudflare to scaffold more configuration files

  Running astro add cloudflare will now emit wrangler.jsonc and public/.assetsignore, allowing your Astro project to work out of the box as a worker.

Patch Changes

• #​14591 3e887ec Thanks @​matthewp! - Adds TypeScript support for the components prop on MDX Content component when using await render(). Developers now get proper IntelliSense and type checking when passing custom components to override default MDX element rendering.

• #​14598 7b45c65 Thanks @​delucis! - Reduces terminal text styling dependency size by switching from kleur to picocolors

• #​13826 8079482 Thanks @​florian-lefebvre! - Adds the option to specify in the preload directive which weights, styles, or subsets to preload for a given font family when using the experimental Fonts API:

  ---
  import { Font } from 'astro:assets';
  ---
  
  <Font
    cssVariable="--font-roboto"
    preload={[{ subset: 'latin', style: 'normal' }, { weight: '400' }]}
  />

  Variable weight font files will be preloaded if any weight within its range is requested. For example, a font file for font weight 100 900 will be included when 400 is specified in a preload object.

v5.14.8

Compare Source

Patch Changes

• #​14590 577d051 Thanks @​matthewp! - Fixes image path resolution in content layer collections to support bare filenames. The image() helper now normalizes bare filenames like "cover.jpg" to relative paths "./cover.jpg" for consistent resolution behavior between markdown frontmatter and JSON content collections.

v5.14.7

Compare Source

Patch Changes

• #​14582 7958c6b Thanks @​florian-lefebvre! - Fixes a regression that caused Actions to throw errors while loading

• #​14567 94500bb Thanks @​matthewp! - Fixes the actions endpoint to return 404 for non-existent actions instead of throwing an unhandled error

• #​14566 946fe68 Thanks @​matthewp! - Fixes handling malformed cookies gracefully by returning the unparsed value instead of throwing

  When a cookie with an invalid value is present (e.g., containing invalid URI sequences), Astro.cookies.get() now returns the raw cookie value instead of throwing a URIError. This aligns with the behavior of the underlying cookie package and prevents crashes when manually-set or corrupted cookies are encountered.

• #​14142 73c5de9 Thanks @​P4tt4te! - Updates handling of CSS for hydrated client components to prevent duplicates

• #​14576 2af62c6 Thanks @​aprici7y! - Fixes a regression that caused Astro.site to always be undefined in getStaticPaths()

v5.14.6

Compare Source

Patch Changes

• #​14562 722bba0 Thanks @​erbierc! - Fixes a bug where the behavior of the "muted" HTML attribute was inconsistent with that of other attributes.

• #​14538 51ebe6a Thanks @​florian-lefebvre! - Improves how Actions are implemented

• #​14548 6cdade4 Thanks @​ascorbic! - Removes support for the maxAge property in cacheHint objects returned by live loaders.

⚠️ Breaking change for experimental live content collections only

Feedback showed that this did not make sense to set at the loader level, since the loader does not know how long each individual entry should be cached for.

If your live loader returns cache hints with maxAge, you need to remove this property:

return {
  entries: [...],
  cacheHint: {
    tags: ['my-tag'],
-   maxAge: 60,
    lastModified: new Date(),
  },
};

The cacheHint object now only supports tags and lastModified properties. If you want to set the max age for a page, you can set the headers manually:

v5.14.5

Compare Source

Patch Changes

• #​14525 4f55781 Thanks @​penx! - Fixes defineLiveCollection() types

• #​14441 62ec8ea Thanks @​upsuper! - Updates redirect handling to be consistent across static and server output, aligning with the behavior of other adapters.

  Previously, the Node.js adapter used default HTML files with meta refresh tags when in static output. This often resulted in an extra flash of the page on redirect, while also not applying the proper status code for redirections. It's also likely less friendly to search engines.

  This update ensures that configured redirects are always handled as HTTP redirects regardless of output mode, and the default HTML files for the redirects are no longer generated in static output. It makes the Node.js adapter more consistent with the other official adapters.

  No change to your project is required to take advantage of this new adapter functionality. It is not expected to cause any breaking changes. However, if you relied on the previous redirecting behavior, you may need to handle your redirects differently now. Otherwise you should notice smoother redirects, with more accurate HTTP status codes, and may potentially see some SEO gains.

• #​14506 ec3cbe1 Thanks @​abdo-spices! - Updates the <Font /> component so that preload links are generated after the style tag, as recommended by capo.js

v5.14.4

Compare Source

Patch Changes

• #​14509 7e04caf Thanks @​ArmandPhilippot! - Fixes an error in the docs that specified an incorrect version for the security.allowedDomains release.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Astro Core (5.14.3 → 5.15.3):

• Security Fix: Vite version updated to address CVE vulnerabilities
• New Features: Added adapter-level query parameters for asset URLs, Copy to Clipboard button in error overlay, experimental Fonts API improvements
• Bug Fixes: Fixed skew protection for images/fonts, SVG import issues, Actions endpoint error handling, malformed cookies handling
• Improvements: TypeScript support for MDX components, better CSS handling for hydrated components

@astrojs/react (4.3.1 → 4.4.1):

• Security Fix: Vite version updated to fix CVE
• API Stabilization: getActionState() and withState() functions are now stable (previously experimental)
• Breaking Change for Experimental Users: Experimental users need to update import paths from experimental_* to stable exports

@astrojs/rss (4.0.12 → 4.0.13):

• Dependency Optimization: Switched from kleur to picocolors for smaller bundle size

@astrojs/node (9.4.6 → 9.5.0):

• Behavior Change: Updated redirect handling to be consistent across static and server output modes
• Improvement: HTTP redirects now used instead of meta refresh tags for better SEO and user experience

🎯 Impact Scope Investigation

Current Codebase Usage Analysis:

• @astrojs/react: Used in astro.config.ts:19 for React integration, with one React component (FormattedDate.tsx) - minimal usage
• @astrojs/rss: Used in RSS generation files (src/pages/index.xml.ts, category/tag RSS feeds) - standard RSS functionality
• @astrojs/node: Configured in astro.config.ts:62 as the deployment adapter with standalone mode
• Astro Core: Central framework for the entire static blog application

No Impact Areas Identified:

• No usage of experimental Actions API (astro:actions)
• No usage of experimental getActionState()/withState() functions
• No custom redirects configuration that would be affected by @astrojs/node changes
• Standard font loading through Google Fonts API, not affected by new Fonts API features
• Static output mode with minimal server-side functionality

💡 Recommended Actions

1. Immediate Merge: This update can be safely merged without any code changes required
2. Security Benefits: The Vite CVE fixes provide important security improvements
3. Performance Gains: Dependency size reduction from kleur to picocolors
4. Enhanced User Experience: Better redirect handling with proper HTTP status codes

No Manual Migration Required:

• All breaking changes are limited to experimental features not used in this codebase
• Configuration remains fully compatible
• Static site generation workflow unchanged
• Existing RSS feeds will continue working with the same API

🔗 Reference Links

• Astro 5.15.3 Release Notes
• @astrojs/react 4.4.1 Changelog
• @astrojs/node 9.5.0 Changelog
• @astrojs/rss 4.0.13 Changelog

Generated by koki-develop/claude-renovate-review

[github-actions]

🚀 Preview deployment ready!

✅ Preview URL: https://pr-1185---web-njpdbbjcea-an.a.run.app
📝 Commit SHA: 03fbd49 (view commit)

This comment was automatically generated by the deploy-preview workflow.