[dependabot]

Bumps astro from 7.3.7 to 7.3.8.

Release notes

Sourced from astro's releases.

astro@7.3.8

Patch Changes

• #18293 28e7410 Thanks @​astro-factory! - Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

• #18298 0e9e857 Thanks @​matthewp! - Fixes astro add removing existing allowBuilds approvals from pnpm-workspace.yaml with pnpm v11.0–v11.22

• #18263 882dd98 Thanks @​florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

• #18290 31f13c3 Thanks @​astro-factory! - Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob such as !(drafts)/**/*.md

Changelog

Sourced from astro's changelog.

7.3.8

Patch Changes

• #18293 28e7410 Thanks @​astro-factory! - Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

• #18298 0e9e857 Thanks @​matthewp! - Fixes astro add removing existing allowBuilds approvals from pnpm-workspace.yaml with pnpm v11.0–v11.22

• #18263 882dd98 Thanks @​florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

• #18290 31f13c3 Thanks @​astro-factory! - Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob such as !(drafts)/**/*.md

Commits

• 3571e2d [ci] release (#18292)
• 0e9e857 Keep existing pnpm allowBuilds approvals in astro add (#18298)
• 882dd98 Replace esbuild with Vite and Rolldown APIs (#18263)
• 28e7410 fix(astro): provide Astro.cache when rendering error pages (#18293)
• 31f13c3 Fix glob() loader watcher ignoring patterns starting with an extglob like `!(...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[shubham-bansal-jswone]

Verdict: Approve

Patch bump in the Website lane. The large lockfile deletion is only esbuild leaving the tree, and the build output is byte-identical to main.

Findings:

• apps/site/package-lock.json — nit — about 420 lines are deleted: esbuild 0.28.2 and its 26 @esbuild/* platform packages. Astro 7.3.8 moved its internal bundling to Vite's Oxc/Rolldown (Replace esbuild with Vite and Rolldown APIs withastro/astro#18263) and no longer depends on esbuild. Nothing in apps/site imports esbuild directly (checked with git grep). One more esbuild postinstall script is gone from npm ci.

Checks:

• Licence: astro 7.3.8 is MIT, unchanged.
• Upstream notes for 7.3.8: patch fixes (Astro.cache on error pages, astro add with pnpm allowBuilds, glob() extglob reload in dev) and the esbuild removal. No breaking changes and no security advisories.
• Base: 14 commits behind main, none in apps/site. The site CI job (build, check, a11y) passed.
• Ran in a throwaway worktree of the PR head: npm ci && npm run build && npm run check gave 0 errors, 0 warnings and 0 hints. node scripts/a11y.mjs with open-source Chromium reported 0 violations on every page, theme and width. npm audit found 0 vulnerabilities. diff -rq of dist/ against a build of main is empty.