chore: bump the docs-site group in /docs with 5 updates

[dependabot]

Bumps the docs-site group in /docs with 5 updates:

Package	From	To
@astrojs/markdown-remark	7.2.4	7.3.0
@astrojs/sitemap	3.7.3	3.7.4
@astrojs/starlight	0.41.9	0.42.0
@expressive-code/core	0.44.1	0.44.2
astro	7.2.9	7.3.1

Updates @astrojs/markdown-remark from 7.2.4 to 7.3.0

Release notes

Sourced from @​astrojs/markdown-remark's releases.

@​astrojs/markdown-remark@​7.3.0

Minor Changes

• #17262 f8e9458 Thanks @​Princesseuh! - Adds MDX rendering to the unified() and satteri() processors.

  Both processors now compile .mdx files themselves. You still need to install @astrojs/mdx to add MDX support to your project.

• #17262 f8e9458 Thanks @​Princesseuh! - Adds a recmaPlugins option to unified() for adding recma (estree/JSX) plugins to the MDX compiler.

Patch Changes

• Updated dependencies [f8e9458]:
  • @​astrojs/internal-helpers@​0.11.0

Changelog

Sourced from @​astrojs/markdown-remark's changelog.

7.3.0

Minor Changes

• #17262 f8e9458 Thanks @​Princesseuh! - Adds MDX rendering to the unified() and satteri() processors.

  Both processors now compile .mdx files themselves. You still need to install @astrojs/mdx to add MDX support to your project.

• #17262 f8e9458 Thanks @​Princesseuh! - Adds a recmaPlugins option to unified() for adding recma (estree/JSX) plugins to the MDX compiler.

Patch Changes

• Updated dependencies [f8e9458]:
  • @​astrojs/internal-helpers@​0.11.0

Commits

• 2fdf731 [ci] release (#17849)
• f8e9458 feat: move MDX into the processors themselves (#17262)
• See full diff in compare view

Updates @astrojs/sitemap from 3.7.3 to 3.7.4

Release notes

Sourced from @​astrojs/sitemap's releases.

@​astrojs/sitemap@​3.7.4

Patch Changes

• #17851 52d3f56 Thanks @​astro-factory! - Fixes the sitemap outputting a URL with an empty path for the homepage (e.g. https://example.com instead of https://example.com/) when trailingSlash is set to "never" or build.format is set to "file"

Changelog

Sourced from @​astrojs/sitemap's changelog.

3.7.4

Patch Changes

• #17851 52d3f56 Thanks @​astro-factory! - Fixes the sitemap outputting a URL with an empty path for the homepage (e.g. https://example.com instead of https://example.com/) when trailingSlash is set to "never" or build.format is set to "file"

Commits

• 2fdf731 [ci] release (#17849)
• 52d3f56 fix(@​astrojs/sitemap): preserve root path / in sitemap URLs when trailingSl...
• 2bfb179 chore: simpler package.json types (#17229)
• See full diff in compare view

Updates @astrojs/starlight from 0.41.9 to 0.42.0

Release notes

Sourced from @​astrojs/starlight's releases.

@​astrojs/starlight@​0.42.0

Minor Changes

• #3572 292fb17 Thanks @​HiDeoo! - Distributes package as JavaScript files with dedicated type declaration files instead of TypeScript source files.

• #4121 2623ae6 Thanks @​delucis! - Simplifies markup for Starlight’s mobile menu toggle

  ⚠️ Potentially breaking change: If you use a theme plugin, custom styles, or component overrides targeting the MobileMenuToggle button or PageFrame components, you may need to adjust these for the new markup. The button is no longer wrapped in a <starlight-menu-button> custom element and no longer uses the aria-expanded attribute. Instead, you can use the .sl-menu-button class name to target the button and the :popover-open pseudo-class to style the menu open state specifically.

  In the following example, custom styles for the menu button are updated for the new approach:

  - starlight-menu-button button {
  + .sl-menu-button {
    color: var(--sl-color-text);
  }
  
  starlight-menu-button[aria-expanded='true'] button {
  
  
  .sl-menu-button:has(~ :popover-open) {
  color: var(--sl-color-text-accent-high);
  }

See MobileMenuToggle.astro and PageFrame.astro on GitHub for the full source code of the updated components.

#3572 292fb17 Thanks @​HiDeoo! - Removes the tagline configuration option, which was never used.

If your configuration included a tagline option, you can safely remove it without any replacement.

#4134 6135f01 Thanks @​HiDeoo! - Updates internal @astrojs/mdx, @astrojs/markdown-satteri, and satteri dependencies.

⚠️ BREAKING CHANGE: The following minimum versions are now required:

• astro v7.2.10 or later
• @astrojs/markdown-satteri 0.4.0 or later (if you use it)
• @astrojs/markdown-remark 7.3.0 or later (if you use it)

Please update Starlight and Astro together:

npx @astrojs/upgrade

#4121 2623ae6 Thanks @​delucis! - Refactors Starlight’s mobile menu toggle to work when JavaScript fails or is disabled

⚠️ BREAKING CHANGE: This release drops official support for Chromium-based browsers prior to version 116 (released August 2023), Safari-based browsers prior to version 17.0 (released September 2023), and Firefox prior to version 125 (released April 2024). You can find a list of currently supported browsers and their versions using this browserslist query.

This change also removes the data-mobile-menu-expanded attribute, which was previously added to <body> while the mobile menu is open. If you have custom code that was depending on this attribute, you will need to update it to use a new selector to check if the mobile menu is open.

In the following example, a custom background colour for the site header while the menu is open is updated for the new approach:

... (truncated)

Changelog

Sourced from @​astrojs/starlight's changelog.

0.42.0

Minor Changes

• #3572 292fb17 Thanks @​HiDeoo! - Distributes package as JavaScript files with dedicated type declaration files instead of TypeScript source files.

• #4121 2623ae6 Thanks @​delucis! - Simplifies markup for Starlight’s mobile menu toggle

  ⚠️ Potentially breaking change: If you use a theme plugin, custom styles, or component overrides targeting the MobileMenuToggle button or PageFrame components, you may need to adjust these for the new markup. The button is no longer wrapped in a <starlight-menu-button> custom element and no longer uses the aria-expanded attribute. Instead, you can use the .sl-menu-button class name to target the button and the :popover-open pseudo-class to style the menu open state specifically.

  In the following example, custom styles for the menu button are updated for the new approach:

  - starlight-menu-button button {
  + .sl-menu-button {
    color: var(--sl-color-text);
  }
  
  starlight-menu-button[aria-expanded='true'] button {
  
  
  .sl-menu-button:has(~ :popover-open) {
  color: var(--sl-color-text-accent-high);
  }

See MobileMenuToggle.astro and PageFrame.astro on GitHub for the full source code of the updated components.

#3572 292fb17 Thanks @​HiDeoo! - Removes the tagline configuration option, which was never used.

If your configuration included a tagline option, you can safely remove it without any replacement.

#4134 6135f01 Thanks @​HiDeoo! - Updates internal @astrojs/mdx, @astrojs/markdown-satteri, and satteri dependencies.

⚠️ BREAKING CHANGE: The following minimum versions are now required:

• astro v7.2.10 or later
• @astrojs/markdown-satteri 0.4.0 or later (if you use it)
• @astrojs/markdown-remark 7.3.0 or later (if you use it)

Please update Starlight and Astro together:

npx @astrojs/upgrade

#4121 2623ae6 Thanks @​delucis! - Refactors Starlight’s mobile menu toggle to work when JavaScript fails or is disabled

⚠️ BREAKING CHANGE: This release drops official support for Chromium-based browsers prior to version 116 (released August 2023), Safari-based browsers prior to version 17.0 (released September 2023), and Firefox prior to version 125 (released April 2024). You can find a list of currently supported browsers and their versions using this browserslist query.

This change also removes the data-mobile-menu-expanded attribute, which was previously added to <body> while the mobile menu is open. If you have custom code that was depending on this attribute, you will need to update it to use a new selector to check if the mobile menu is open.

... (truncated)

Commits

• 88ad3c2 [ci] release (#4172)
• 74cb3f1 Update dependencies (#4173)
• 6135f01 Use Sätteri 0.10 APIs (#4134)
• 2623ae6 Refactor mobile menu to use Popover API (#4121)
• 09af1c6 chore(deps): update magic-string to v1 (#4082)
• 292fb17 [i18nIgnore] Transpile Starlight packages (#3572)
• 0138f22 [ci] release (#4169)
• 32a5e29 Fix hidden heading anchor links (#4167)
• cdfafd8 perf: optimize route and sidebar lookups (#4148)
• dd7fb97 chore: add benchmarks (#4157)
• Additional commits viewable in compare view

Updates @expressive-code/core from 0.44.1 to 0.44.2

Release notes

Sourced from @​expressive-code/core's releases.

@​expressive-code/core@​0.44.2

No release notes provided.

Changelog

Sourced from @​expressive-code/core's changelog.

0.44.2

Commits

• 5c5b452 [CI] Release (#469)
• See full diff in compare view

Updates astro from 7.2.9 to 7.3.1

Release notes

Sourced from astro's releases.

astro@7.3.1

Patch Changes

• #17899 0389640 Thanks @​ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

astro@7.3.0

Minor Changes

• #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

  Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { LocalImageService } from 'astro';
  const service: LocalImageService = {
  // ...
  async transform(inputBuffer, transform, imageConfig, logger) {
  logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
  return { data: inputBuffer, format: 'png' };
  },
  };

  Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

  Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { CacheProvider } from 'astro';
  const provider: CacheProvider = {
  name: 'my-cache',
  async onRequest({ request, url, logger }, next) {
  logger.warn(Skipping cache for ${url.pathname} because the response sets a cookie.);
  return next();
  },
  // ...
  };

  Astro's built-in memoryCache() provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.

Patch Changes

• #17818 c0b6581 Thanks @​florian-lefebvre! - Updates Astro's remaining internal warnings and errors to be written through the configured logger instead of directly to the console, when possible

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.1

Patch Changes

• #17899 0389640 Thanks @​ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

7.3.0

Minor Changes

• #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

  Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { LocalImageService } from 'astro';
  const service: LocalImageService = {
  // ...
  async transform(inputBuffer, transform, imageConfig, logger) {
  logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
  return { data: inputBuffer, format: 'png' };
  },
  };

  Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

  Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { CacheProvider } from 'astro';
  const provider: CacheProvider = {
  name: 'my-cache',
  async onRequest({ request, url, logger }, next) {
  logger.warn(Skipping cache for ${url.pathname} because the response sets a cookie.);
  return next();
  },
  // ...
  };

  Astro's built-in memoryCache() provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.

Patch Changes

... (truncated)

Commits

• 92f23cc [ci] release (#17900)
• 0389640 fix: dont use internal paths (#17899)
• f800de1 [ci] release (#17881)
• 1e0b7e6 [ci] format
• 4671a5c chore(deps): update react to v19 in 0-css fixture (#17888)
• 31b886b Update bundled Zod to 4.5 (#17862)
• e747cba Skip unsupported Vary responses in the memory cache (#17886)
• fb5b0d0 [ci] format
• ce7c91f Add --ignore-lock flag support to astro preview (#17767)
• c0b6581 feat: use logger instead of console where possible (#17818)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[worktrunk-bot]

The lockfile bump itself is clean, but @astrojs/starlight 0.41.9 → 0.42.0 lands two breaking changes this repo is exposed to, and check-docs will go red on both. I reproduced all three failures locally against this PR's lockfile, and I'm pushing the fix to this branch so the PR can go green.

1. npm run check fails — Starlight now ships .d.ts instead of TS sources. docs/ has no tsconfig.json, so astro check resolves under the TypeScript default (node10) and can't see dist/**/*.d.astro.ts. Five ts(2307) errors: Head.astro, PageTitle.astro (×2), 404.astro, index.astro. Fix is a docs/tsconfig.json extending astro/tsconfigs/base, which is what the error message's "consider updating to bundler" asks for. (astro/tsconfigs/strict also passes with 0 errors today if you'd rather opt into strictness — I stayed with base to keep the change scoped to the bump.)

2. npm run test:site fails — the mobile menu toggle lost its custom element. The button is no longer wrapped in <starlight-menu-button> and no longer carries aria-expanded/aria-controls; it's now a popover invoker. Two tests in docs/tests/built-site.test.mjs assert the old markup and fail: build preserves the public route contract and mobile menu control is hidden until its script is available.

3. Dead code in Head.astro. Both of this repo's mobile-menu workarounds target markup 0.42.0 no longer emits — the starlight-menu-button:not(:defined) pre-hydration style, and the MutationObserver that mirrored aria-expanded from the host onto the inner button. Upstream's #4121 removed the reason for both: the menu is now driven by the popover API and works with JavaScript disabled, so nothing hydrates and the invoker gets its expanded state from the popover mapping rather than a hand-copied attribute. I'm deleting them rather than porting them to .sl-menu-button.

One thing I could not check: docs/tests/browser-site.test.mjs (WebKit mobile layout). Playwright's webkit needs host packages this sandbox can't install, so check-docs is the first place it runs against the new fixed-position menu button.

Verification and details

Ran against this PR's docs/package-lock.json (npm ci, assets fetched the way .github/actions/docs-build does):

• Before the fix: npm run check → 5 errors; node --test tests/built-site.test.mjs → 14 tests, 2 fail.
• After: npm run check → 0 errors / 22 files; npm test → 15 pass; node --test tests/built-site.test.mjs → 14 pass; npm run build → clean.

Old markup vs. 0.42.0, from a local build of this branch:

- <div id="starlight__sidebar" class="sidebar-pane">
- <button aria-expanded="false" aria-label="Menu" aria-controls="starlight__sidebar">  (inside <starlight-menu-button>)
+ <sl-sidebar-pane popover id="starlight__sidebar" class="sidebar-pane …">
+ <button popovertarget="starlight__sidebar" class="sl-menu-button …"><svg…/><svg…/><span class="sr-only">Menu</span></button>

The updated assertions follow that shape, and the repurposed test keeps a assert.doesNotMatch(faqPage, /starlight-menu-button/) guard so the deleted Head.astro workarounds can't quietly come back.

Things I checked that are not affected:

• docs/src/styles/custom.css — .sidebar-pane still matches (the class survives the div → sl-sidebar-pane swap), and nothing there keys on aria-expanded or the new --sl-menu-button-size. The new button rules read --sl-color-white/--sl-color-black, which this repo deliberately inverts for the warm palette; contrast still resolves correctly in both themes.
• hero.tagline in docs/src/pages/404.astro — 0.42.0 removed the top-level tagline config option, not the hero schema field.
• sitemapCompatibility() — unrelated to the @astrojs/sitemap 3.7.4 homepage fix, which only applies under trailingSlash: "never" or build.format: "file"; this site uses the defaults.
• The lockfile's removed @bruits/satteri-* entries are hoisting, not dropped platform binaries.
• @astrojs/markdown-remark 7.3.0's new MDX dependencies don't change the unified() processor path — build and all 15 plugin tests pass.

Also worth knowing: 0.42.0 drops official support for Chromium < 116, Safari < 17.0, and Firefox < 125.

[max-sixty]

fix the issues, @worktrunk-bot

[worktrunk-bot]

Green at 8679baa, including check-docs.

The Starlight 0.42 adaptation was already on the branch from my earlier review, so the outstanding problem was staleness: the branch was 49 commits behind main, and several of those commits (#4000, #4076, #4079) touch the exact files the adaptation changed — docs/src/components/Head.astro and docs/tests/built-site.test.mjs — so the green checks from 7 September no longer said anything about how the bump behaves against current main. I merged origin/main in and verified locally before pushing: the merge is clean, main's own lockfile bumps survive it (svgo 4.1.0, js-yaml 4.3.2 both still resolve and install), astro check reports 0 errors across 23 files, and npm test, npm run build, and tests/built-site.test.mjs all pass.

Worth noting because I flagged it as unverified last time: check-docs on this commit is the first run of docs/tests/browser-site.test.mjs against 0.42's fixed-position menu button, and it passed. WebKit needs host packages this sandbox can't install, so that leg is only reachable from CI — it's now confirmed rather than assumed.

One thing to decide before merging: because the branch carries a non-Dependabot commit, Dependabot has stopped maintaining it ("Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself"), so it is pinned to the versions in its description while the group has moved on — astro 7.3.1 → 7.3.2 and @astrojs/markdown-remark 7.3.0 → 7.3.1 are out. The other three are current. I left them alone so the diff still matches the PR's table; @dependabot rebase would pick them up but would also discard the 0.42 adaptation commit, so a manual bump on this branch is the safer route if you want them in. Happy to push that.