Repository navigation
fix(deps): update dependency astro to 7.3.8 (patch) - #1136
Merged
Merged
Conversation
|
PR author is in the excluded authors list. |
github-actions
Bot
added
documentation
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Contributor
🧪 🔥 E2E Smoke Tests ReportThis PR has been analyzed using lgtm-ci - our reusable test workflow. 📊 Status: ✅ PASSEDBuild: ✅ Tests passed 🧪 Test Results
📋 Run Details
Generated by 🔥 E2E Smoke Tests workflow |
Contributor
🧪 ♿ E2E Accessibility Tests ReportThis PR has been analyzed using lgtm-ci - our reusable test workflow. 📊 Status: ✅ PASSEDBuild: ✅ Tests passed 🧪 Test Results
📋 Run Details
Generated by ♿ E2E Accessibility Tests workflow |
Contributor
🧪 🎭 E2E Tests ReportThis PR has been analyzed using lgtm-ci - our reusable test workflow. 📊 Status: ✅ PASSEDBuild: ✅ Tests passed 🧪 Test Results
📋 Run Details
Generated by 🎭 E2E Tests workflow |
Contributor
🔐 Security Audit Report📊 Status: ✅ PASSED🔍 Checks Performed:
No security vulnerabilities found in dependencies. 🔇 Suppressed Vulnerabilities:
Generated by lgtm-ci security audit workflow |
Contributor
|
Coverage Report
|
Contributor
📊 Lighthouse CI Performance Report✅ Status: Performance Analysis CompleteBuild: ✅ Lighthouse CI passed 📈 Performance Scores
📋 View Full ReportsPublic Report: Or download from artifacts: Generated by Lighthouse CI | View workflow run |
Contributor
Lintro Code Quality AnalysisThis PR has been analyzed using lintro - our unified code quality tool. Checks run inside the pinned py-lintro container (same as the workflow quality job), so the summary reflects the full bundled toolchain. Status: ✅ PASSEDWorkflow:
Results:Generated by lintro analysis workflow |
renovate
Bot
force-pushed
the
renovate/npm-astro
branch
2 times, most recently
from
October 14, 2026 05:10
aaa247c to
7003b30
Compare
🔎 Lintro Review — 🟡 Nits onlySummaryBump astro from 7.3.3 to 7.3.8 and disable the astro-check lintro tool that is incompatible with TypeScript 7.
Why it's flaggedThe only open finding is F1, a P3 noting that astro-check is disabled without a tracked follow-up issue; both the lintro config and the pre-commit hook are internally consistent, and no P1 or P2 findings exist, so nothing blocks the merge. Findings · Round 3 ·
|
| Δ | Sev | Finding | Where | Since |
|---|---|---|---|---|
| ✔ fixed | 🟡 P3 | .lintro-config.yaml:178 |
round 2 |
🟡 1 P3 nit (not posted inline)
| Δ | Finding | Where |
|---|---|---|
| new | astro-check disabled with no tracked follow-up issue P3 because the code path is correct — disabling a tool that errors under TypeScript 7 is the right immediate fix — but the effect is that .astro files now ha…Fix: File a follow-up issue for 'Add @astrojs/ts-content-mapper and upgrade to TS 7.1+ to re-enable .astro type checking',… |
.lintro-config.yaml:179 |
💬 Notes and questions (1)
Not posted as threads and not counted in the verdict: findings below the inline confidence floor (medium) and open questions.
- ❓ question — Is the explicit esbuild root-devDep actually required? ·
package.json:228
astro 7.3.8 drops esbuild as a direct dependency (changelog: 'These packages no longer depend on esbuild directly'). This PR compensates by pinningesbuild: "0.28.2"in the rootdevDependencies. However, no file in the workspace directlyimports from'esbuild': the three Vite configs that reference it (vite.config.js,vite.css.config.js,vite.js.config.js) pass the string'esbuild'as a Viteminifyoption, which Vite resolves from its own bundled copy. If nothing in the workspace tree requires esbuild to be resolvable at the workspace root, the explicit pin creates an unnece…
Important
⚡ Fix-all prompt — 1 still-open finding (rounds 1–3)
Show prompt
Scope: the 1 finding still open on this PR after round 3 (not just the latest
review).
These are open findings from a lintro AI code review. Verify each one against
the current code. Fix only still-valid issues, skip the rest with a brief
reason, keep changes minimal, and validate with tests.
In `.lintro-config.yaml`:
- Line 179 — **astro-check disabled with no tracked follow-up issue** (P3 ·
test-gap):
P3 because the code path is correct — disabling a tool that errors under
TypeScript 7 is the right immediate fix — but the effect is that `.astro`
files now have no type-checking gate at any stage (pre-commit, CI, or
otherwise). The comment notes this was previously a silent no-op (exit 0
without checking), but the upgrade to 7.3.4+ turned the silent skip into a
hard error, forcing the explicit disable. The stated follow-up ('Type-checking
Astro files on TS 7.1+ needs @astrojs/ts-content-mapper') is documented only
in a code comment with no linked issue, so there is no automated way to ensure
it is acted on. P3 because no new behavior is broken — this only makes an
existing gap explicit — but a tracked issue would provide the accountability
that a comment alone cannot. astro >=7.3.4 refuses to run `astro check` under
TypeScript 7. The repo is on TS 7.0.2. `@astrojs/check` was never installed,
so the tool was already a no-op before this PR; the upgrade surfaced the
latent problem.
Fix: File a follow-up issue for 'Add @astrojs/ts-content-mapper and upgrade
to TS 7.1+ to re-enable .astro type checking', and reference it in the code
comment so the gap is tracked and can be closed.
Occurs at 2 locations — apply the equivalent fix at each and verify each one
still reproduces before changing it:
- .lintro-config.yaml:179
- .husky/pre-commit:34
Regenerated every run · covers exactly the open table above
This run
| model | transport | est. cost | tokens in / out | depth | files | checks | duration |
|---|---|---|---|---|---|---|---|
claude-sonnet-4-6 (env) |
cli · subscription | ~$0.8597 | ~14 / ~17,024 | 1 | 5 | 26 | 272s |
Cross-chunk synthesis found no cross-file inconsistencies.
Timings: total 4m32s — provider 3m51s (1 chunk, max parallel 1), synthesis 39.2s, context 1.0s, validation 0.0s, resume 0.0s, merge 0.0s, chunking 0.0s
🕘 History · 2 previous runs · 1 fixed · ~$2.6875 · ~49.9k tokens
Run-by-run history
| 🔴 blockers | 🟠 warnings | 🟡 nits | ✔ fixed |
|---|---|---|---|
| 0 | 0 | 1 | 1 |
Round 2 · 52523ca · 🟡 nits only · 0 fixed, 1 left open · ~$0.9110 · 243s
Bumps astro from 7.3.3 to 7.3.8 (patch), updates the lockfile, adds esbuild as an explicit root devDependency, and disables the astro-check lintro tool due to TypeScript 7 incompatibility.
| model | transport | est. cost | tokens in / out | depth | files | checks | duration |
|---|---|---|---|---|---|---|---|
claude-sonnet-4-6 |
cli · subscription | ~$0.9110 | ~15 / ~15,507 | 1 | 4 | 25 | 243s |
Round 1 · 7003b30 · ✅ ready · 0 fixed, 0 left open · ~$0.9168 · 266s
Bumps the astro dependency from 7.3.3 to 7.3.8 across the monorepo, updating the site package manifest, the root override, and the bun lockfile.
| model | transport | est. cost | tokens in / out | depth | files | checks | duration |
|---|---|---|---|---|---|---|---|
claude-sonnet-4-6 |
cli · subscription | ~$0.9168 | ~11 / ~17,289 | 1 | 3 | 25 | 266s |
🤖 lintro review · findings are commented inline · how to read this report
renovate
Bot
force-pushed
the
renovate/npm-astro
branch
from
October 14, 2026 05:20
7003b30 to
5043f72
Compare
renovate
Bot
force-pushed
the
renovate/npm-astro
branch
from
October 14, 2026 05:25
5043f72 to
d0422e2
Compare
auto-merge was automatically disabled
October 14, 2026 07:46
Pull request was converted to draft
astro 7.3.8 no longer depends on esbuild, so it left the root node_modules; vite's minify: 'esbuild' in vite.js.config.js, vite.config.js and vite.css.config.js needs it as a direct dep. Pinned to the existing override (0.28.2). astro 7.3.8 also refuses to run astro check on TypeScript 7. The check was a no-op before (@astrojs/check not installed), so disable it in lintro with the reason documented.
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
astro-check is disabled in lintro; remove its timeout from the pre-commit --tool-options and correct the version that added the TypeScript 7 refusal (7.3.4).
Contributor
Renovate merge record: astro 7.3.3 → 7.3.8The worker took this PR over and pushed to the Renovate branch, so Renovate will no longer rebase it. The PR was drafted on pickup to hold Renovate automerge. Supply chain
What broke on the Renovate head, and the fixes
Local verification (PR head + fixes)
ReviewsCodeRabbit is rate-limited and Greptile is not enabled for the org, so three reviews were used:
|
Contributor
AI Review (lintro-review bot) disposition, round 3 at 24ef30d
|
lgtm-ai-bot Bot
added a commit
that referenced
this pull request
Oct 14, 2026
Rebased onto main after #1136. Lock is bun's settled form: the top-level playwright-core (peer of @axe-core/playwright) now resolves to 1.64.0, the same copy playwright uses, instead of a stale 1.63.0.
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.3.3→7.3.8Release Notes
withastro/astro (astro)
v7.3.8Compare Source
Patch Changes
#18293
28e7410Thanks @astro-factory! - FixesAstro.cachebeingundefinedwhen a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export#18298
0e9e857Thanks @matthewp! - Fixesastro addremoving existingallowBuildsapprovals frompnpm-workspace.yamlwith pnpm v11.0–v11.22#18263
882dd98Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-basedtransformWithOxcand Rolldown instead of esbuild. These packages no longer depend on esbuild directly.#18290
31f13c3Thanks @astro-factory! - Fixes theglob()loader not reloading changed files in dev when the pattern starts with an extglob such as!(drafts)/**/*.mdv7.3.7Compare Source
Patch Changes
#18266
cba76ccThanks @astro-factory! - Fixes a build error when a Markdown content collection entry loaded withglob({ deferRender: true })has alayoutfrontmatter property.layoutis now ignored for content collection entries, as documented.#18287
38f6793Thanks @astro-factory! - Fixesastro add cloudflarefailing to install dependencies with pnpm v11+ by approving theworkerdbuild script, and shows the package manager's error output whenastro addfails to install dependencies#18222
fcf6ed6Thanks @mingjunlu! - Fixes an issue where AVIF images were served asimage/heifinstead ofimage/avifin the dev server.#18240
de4df06Thanks @astro-factory! - Fixes thecache()handler fromastro/honoandastro/fetchthrowing aTypeErrorwhen a cache provider is configured. It now registers the cache provider before rendering, soAstro.cacheis available to downstream handlers likepages().#18268
547b572Thanks @astro-factory! - Fixessecurity.checkOriginrejecting cross-origin requests with non-form content types such asapplication/json. As documented, the check only applies to unsafe requests that have nocontent-typeheader or one ofapplication/x-www-form-urlencoded,multipart/form-data, ortext/plain.v7.3.6Compare Source
Patch Changes
#18166
5134d0fThanks @astro-factory! - Fixes an intermittent dev server crash when usingastro:actionsinside a server island with adapters that use a pre-bundled SSR environment (e.g.@astrojs/cloudflare)#18076
8a2df66Thanks @astro-factory! - Fixes stale scoped styles during HMR when both markup and<style>are changed in a single save#18252
2d29e7eThanks @astro-factory! - Fixes CSS from other pages leaking into a page's<head>in dev when the page imports a module such asastro:config/server.#18000
6724575Thanks @barclayd! - Fixes a bug where server islands containing framework components rendered empty in the dev server when using a customsrc/fetch.ts#18241
7c5fd6fThanks @astro-factory! - Fixes the composablei18n()handler fromastro/fetchandastro/honoreturning an empty 404 for paths without a locale prefix. It now renders the custom 404 page, matchingastro().#18164
1a6997fThanks @astro-factory! - Fixes CSS Module HMR in dev when a component is rendered both with and without hydration on the same page. Astro now uses path-based class name hashing in dev mode so that editing CSS declarations no longer changes the generated selectors, allowing Vite's CSS HMR to update styles without a full page reload.#18243
dd29d62Thanks @astro-factory! - Fixescontext.propsbeingnullin middleware and endpoints when the composableastro/honoorastro/fetchactions()handler runs beforemiddleware(), or whenpages()runs withoutmiddleware()#18193
95d5d16Thanks @astro-factory! - Fixesastro buildfailing on Windows with Node.js 25+ withERR_INVALID_ARG_VALUEwhen clearing the output directory hits a transientEPERMerror#18220
d6c13a4Thanks @astro-factory! - Fixes type errors reported in Astro's built-in<Picture />and<Font />components when type-checking a project withtscand@astrojs/ts-content-mapper#18133
faac481Thanks @astro-factory! - Fixes lost request state when Vite discovers server dependencies during a request in Cloudflare dev mode#18146
2af4516Thanks @astro-factory! - Fixes CSS imported from aninjectScript('page')script being dropped during build#18159
e5f8fe0Thanks @astro-factory! - Fixes a hang when aserver:defercomponent is inside a slot of another component in an MDX content collection entry#18246
c3b42adThanks @astro-factory! - Fixes theglob()loader skipping content files whose paths contain#or?#18248
b97184eThanks @astro-factory! - Fixes a bug where page routes added withinjectRoute()returned a 404 wheni18n.routing.prefixDefaultLocalewastrueand the route path had no locale prefix#18251
3415263Thanks @astro-factory! - Fixes content collection changes being ignored inastro devafter the dev server restarts because of a config change#18226
ad54af0Thanks @imharjot! - FixesAstro.cookies.get()returningundefinedfor request cookies with empty values#18155
37ab0e4Thanks @astro-factory! - Fixes nondeterministic ordering of the server manifest'sassetsarray, ensuring builds with identical inputs produce byte-identical output#18099
6987261Thanks @renovate! - Adds YAML parsing with timestamp and merge key support, and formats YAML errors consistently across Astro, Markdown, MDX, and Markdoc.#15595
64e4039Thanks @qzio! - Improves CSRF protection by taking modern browsers headers into account#18215
941bd5eThanks @ump45nose! - Fixes a runtimeReferenceErrorfor inlined scripts that import a URL with/* @vite-ignore */.Astro now inlines scripts after Vite replaces its preload markers, so ignored dynamic imports can remain inline without shipping an unresolved
__VITE_PRELOAD__reference.#18179
6caa659Thanks @matthewp! - Fixes custom View Transition direction names that are not valid CSS identifiers, such as names starting with a digit or containing spaces. These directions now match their animations correctly.#18250
7eae39bThanks @astro-factory! - Fixes a 404 for a CSS file that a dynamic import preloads when the imported module uses a component that is also a hydrated island on the same page#18176
7c9d00dThanks @astro-factory! - Fixes duplicate CSS in production builds when a component is both server-rendered and used withclient:onlyon the same page#18245
492e95fThanks @astro-factory! - Fixes the composableastro/fetchandastro/honohandlers (trailingSlash(),redirects(),actions(),middleware(), andpages()) so they reject over-encoded request paths with a400 Bad Request, matchingastro(). For these requests,redirects()andactions()return the400response instead ofundefined, so no redirect is issued and no action runs.#18078
0a2ab10Thanks @manuelgruber! - FixesAstro.rewrite()andcontext.rewrite()selecting the wrong route inastro devwhen two dynamic routes match the same path#18210
62b13baThanks @edmundhung! - Allows Astro CLI commands to install tagged package versions#18069
d39eb97Thanks @astro-factory! - Fixes a dev server dependency scan failure when an.astrofile contains a literal<scriptin frontmatter or a template expression#18114
c17d920Thanks @matthewp! - Fixes Astro on StackBlitz and other WebContainer environments#18088
cb767f9Thanks @astro-factory! - Fixes aMODULE_LEVEL_DIRECTIVEwarning during build caused by a stale"use astro:head-inject"directive in content collection propagated asset modules#18247
2b3f73dThanks @astro-factory! - Fixes actions returning 500 for malformed JSON request bodies and undecodable action names. ASyntaxErrorfrom invalid JSON now returns 400 (BAD_REQUEST), and aURIErrorfrom a malformed percent-encoded action name now returns 404 (NOT_FOUND).1d9e910Thanks @matthewp! - Validates theHostheader againstsecurity.allowedDomainswhen using the Node adapter#18249
c7799a4Thanks @astro-factory! - Fixes thefontsourcefont provider to resolve variable fonts when using the "Variable" suffix in the font name (e.g."Inter Variable")#18163
e48da9dThanks @astro-factory! - Fixes<video muted>losing its muted state after a ClientRouter navigation in Chrome#18244
f67e7f7Thanks @astro-factory! - Fixes localized error pages such assrc/pages/pt/404.astroreturning a200status when rendered through thepages()handler fromastro/fetchorastro/hono#18242
c5275e3Thanks @astro-factory! - Fixesexperimental_AstroContaineroutput including dev toolbardata-astro-source-fileanddata-astro-source-locattributes when rendering components under VitestUpdated dependencies [
6987261,62b13ba]:v7.3.5Compare Source
Patch Changes
#17736
2b8b2e8Thanks @ematipico! - Adds a new container function calledrenderComponent(), which renders Astro components with inlined styles and scripts.Users must import the component with the new
?containerquery string:v7.3.4Compare Source
Patch Changes
#18063
40896acThanks @adamchal! - Fixes incremental builds repeatedly rendering unchanged pages when modules or compiled CSS reference bundled assets.#18053
cf5d72fThanks @Princesseuh! - Improves theastro checkerror shown for TypeScript 7. The command now explains that TypeScript 7 is not currently supported and provides instructions for experimentally type-checking Astro files with TypeScript 7.1 and@astrojs/ts-content-mapper.#18086
795a7e4Thanks @ump45nose! - Fix double-escaped ampersands in Markdown imagealtandtitleattributes. The__ASTRO_IMAGE_round-trip now decodes the numeric (&) and named (&) character references the Markdown processors emit, so an&in an alt or title is escaped exactly once in the final HTML instead of twice.#18074
0429805Thanks @SurefireStudios! - Fix three error names that did not match their documented reference.MissingLocale,MissingIndexForInternationalizationandNoManifestAvailablereported names ending inErrorin the dev overlay, while their error reference pages are published under the unsuffixed names, so the name shown to users could not be found in the docs.#18007
2245837Thanks @L4XB! - Fixes the dev server re-evaluating the whole server module graph on every request. Theastro:head-metadataplugin invalidated its component metadata virtual module from its owntransformhook, so each evaluation of that module scheduled the next one. Adapters that run requests outside Vite's module runner, such as@astrojs/cloudflare, paid for a full re-evaluation of the server graph on every request for the lifetime of the process.#18096
43657c4Thanks @matthewp! - Fixes domain-based i18n routing to respectsecurity.allowedDomainswhen selecting a locale from request host headers#18043
8a53a8bThanks @astro-factory! - Fixesimage.responsiveStylesemitting invalidobject-positionCSS values for same-axis keyword pairs (top bottom,left right, etc.)#18029
c08252dThanks @matthewp! - Runsastro devandastro previewin the foreground when an AI agent is detected on Windows, allowing the agent to manage the process lifetime. Pass--backgroundexplicitly to request an Astro-managed background process. Agent-inferred backgrounding remains enabled on other platforms.Updated dependencies [
3fd16ee,8358d59]:Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.