revert: PR 16708#16801
Conversation
🦋 Changeset detectedLatest commit: ac8c970 The changes in this PR will be included in the next version bump. This PR includes changesets to release 36 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
| 📦 Package | 📏 Size |
|---|---|
| @opentelemetry/semantic-conventions@1.28.0 | 6.2 MB |
| @types/node@22.19.19 | -2.4 MB |
| @types/node@22.19.11 | 2.4 MB |
| @types/node@25.2.3 | 2.4 MB |
| @types/node@20.19.33 | 2.3 MB |
| @opentelemetry/core@1.30.1 | 908.7 kB |
| @opentelemetry/sdk-trace-base@1.30.1 | 796.3 kB |
| @opentelemetry/instrumentation@0.203.0 | 655.2 kB |
| @opentelemetry/resources@1.30.1 | 557.7 kB |
| @opentelemetry/api-logs@0.203.0 | 200.1 kB |
| @typescript-eslint/types@8.57.1 | 162.4 kB |
| resolve@1.22.11 | 154.2 kB |
| @opentelemetry/propagator-b3@1.30.1 | 145 kB |
| cjs-module-lexer@1.4.3 | 137.7 kB |
| @netlify/blobs@10.7.4 | 134.1 kB |
| import-in-the-middle@1.15.0 | 127.7 kB |
| @netlify/otel@5.1.5 | 82.8 kB |
| @opentelemetry/propagator-jaeger@1.30.1 | 81.4 kB |
| @opentelemetry/context-async-hooks@1.30.1 | 59.3 kB |
| @opentelemetry/sdk-trace-node@1.30.1 | 35.6 kB |
| require-in-the-middle@7.5.2 | 20 kB |
Total size change: 15.2 MB
⚠️ Package Trust Level Decreased
Caution
Decreased trust levels may indicate a higher risk of supply chain attacks. Please review these changes carefully.
| 📦 Package | 🔒 Before | 🔓 After |
|---|---|---|
| @opentelemetry/core | trusted-with-provenance | provenance |
| @opentelemetry/instrumentation | trusted-with-provenance | provenance |
| @opentelemetry/resources | trusted-with-provenance | provenance |
| @opentelemetry/sdk-trace-node | trusted-with-provenance | provenance |
| @opentelemetry/api-logs | trusted-with-provenance | provenance |
| @opentelemetry/context-async-hooks | trusted-with-provenance | provenance |
| @opentelemetry/semantic-conventions | trusted-with-provenance | provenance |
| require-in-the-middle | trusted-with-provenance | none |
| @opentelemetry/sdk-trace-base | trusted-with-provenance | provenance |
commit: |
|
We should maybe reopen #16248 as well |
|
Hopefully we can land a new variant of the fix. We ran into two separate symptoms with this: "Astro is not defined", and a failure to resolve virtual modules similar to the one in nicia-ai/typegraph#146 |
|
Here's the stack trace from the user report, which I was able to repro on the default EmDash blog template: |
Replaces the exact 13.5.1 pin with ^13.5.3, the upstream-shipped fix (withastro/astro#16801) that reverts the broken esbuild scan plugin from 13.5.2. The picomatch override is also no longer needed. The override was defending against a workspace-only dual-resolve (picomatch@4.0.3 and @4.0.4 both installed). With the catalog now on @cloudflare/vite-plugin ^1.36.3 and @astrojs/cloudflare 13.5.3, transitive consumers dedup cleanly to a single 4.0.4 and the workerd dev runtime no longer hits the unbundled CJS path. Temporarily exempts astro and @astrojs/cloudflare from minimumReleaseAge so the catalog can pick up the fix versions that are still inside the 24h supply-chain cooldown. The exclusions should be removed once the cooldown passes.
… 10.1.1 (#1116) * fix(templates): pin @astrojs/cloudflare to 13.5.1 13.5.2 introduced an astroFrontmatterScanPlugin that breaks any `virtual:*` module import inside .astro frontmatter (e.g. astro-iconset, astro-expressive-code). 13.5.0/13.5.1 also expose a cascade-reload bug in workerd that surfaces as "Astro is not defined" or "chunk-XXX.js does not exist" on the first request after a clean cache, unless every transitive dep is pre-bundled. 13.5.1 escapes both: no frontmatter scan, and its dep-resolution fixes keep the cascade quiet for the deps emdash actually uses. Pinning the catalog to exact `13.5.1` (no caret) propagates to all four `templates/*-cloudflare/package.json` files via the catalog sync, so `create-emdash` scaffolded sites install a known-good combination. 13.5.1 declares peerDependencies.astro: ^6.3.0, so bump the catalog astro range to ^6.3.0 to satisfy it. Add a picomatch override to ^4.0.4 so the workspace's transitive graph dedups to a single version. Without it, `@rollup/pluginutils` pulls picomatch@4.0.3 on a sibling path that the adapter's `astro > picomatch` pre-bundle doesn't cover, and workerd hits raw CJS at module load. End-user installs happened to dedup correctly, but local dev in this repo did not. * fix(playground): bind SESSION KV id for wrangler preview deploys @astrojs/cloudflare 13.2+ writes the auto-provisioned SESSION binding into both the top-level config and previews.kv_namespaces of the built wrangler.json, but with no id field. wrangler preview reads from previews.kv_namespaces and forwards namespace_id verbatim; unlike wrangler deploy it has no provisionBindings path. The API rejects the binding-without-id with error 10021. Declare the SESSION KV id explicitly in the playground's wrangler.jsonc at both locations so the adapter's customizer skips re-injecting and the user-supplied id propagates to both. Uses the existing emdash-playground-session namespace already bound to the production worker. * fix(deps): bump @astrojs/node catalog to ^10.1.1 @astrojs/node@10.0.0 calls app.getAdapterLogger() at server start, which doesn't exist on the new Astro v6 App class. Crashes any node adapter consumer (including fixtures/perf-site, used by the query- counts CI workflow): TypeError: app.getAdapterLogger is not a function at createAppHandler at createStandaloneHandler @astrojs/node@10.1.1 updates to the v6 Adapter API. The astro@^6.3.0 catalog bump that #1116 introduced (required by @astrojs/cloudflare 13.5.1) made this surface. * ci: update query-count snapshots * fix(deps): bump @astrojs/cloudflare to 13.5.3, drop picomatch override Replaces the exact 13.5.1 pin with ^13.5.3, the upstream-shipped fix (withastro/astro#16801) that reverts the broken esbuild scan plugin from 13.5.2. The picomatch override is also no longer needed. The override was defending against a workspace-only dual-resolve (picomatch@4.0.3 and @4.0.4 both installed). With the catalog now on @cloudflare/vite-plugin ^1.36.3 and @astrojs/cloudflare 13.5.3, transitive consumers dedup cleanly to a single 4.0.4 and the workerd dev runtime no longer hits the unbundled CJS path. Temporarily exempts astro and @astrojs/cloudflare from minimumReleaseAge so the catalog can pick up the fix versions that are still inside the 24h supply-chain cooldown. The exclusions should be removed once the cooldown passes. --------- Co-authored-by: emdashbot[bot] <emdashbot[bot]@users.noreply.github.com>
@astrojs/cloudflare 13.5.2 shipped withastro/astro#16708, which added an esbuild dep-scan plugin that incorrectly tried to bundle virtual: modules imported from .astro frontmatter. astro-expressive-code (pulled in by @astrojs/starlight) imports virtual:astro-expressive-code/{config,api}, so astro build fails with "Could not resolve" errors. Reverted upstream in withastro/astro#16801, released in 13.5.3. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Patrick Linnane <patrick@linnane.io>
…2 updates (#197) * chore(deps): bump the npm-dependencies group across 1 directory with 2 updates Bumps the npm-dependencies group with 2 updates in the /site directory: [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) and [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). Updates `@astrojs/cloudflare` from 13.5.1 to 13.5.2 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@13.5.2/packages/integrations/cloudflare) Updates `astro` from 6.3.3 to 6.3.5 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@6.3.5/packages/astro) --- updated-dependencies: - dependency-name: "@astrojs/cloudflare" dependency-version: 13.5.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: astro dependency-version: 6.3.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com> * fix(site): bump @astrojs/cloudflare to 13.5.5 to unbreak build @astrojs/cloudflare 13.5.2 shipped withastro/astro#16708, which added an esbuild dep-scan plugin that incorrectly tried to bundle virtual: modules imported from .astro frontmatter. astro-expressive-code (pulled in by @astrojs/starlight) imports virtual:astro-expressive-code/{config,api}, so astro build fails with "Could not resolve" errors. Reverted upstream in withastro/astro#16801, released in 13.5.3. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Patrick Linnane <patrick@linnane.io> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Patrick Linnane <patrick@linnane.io> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Patrick Linnane <patrick@linnane.io> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Changes
It seems that emdash-cms/emdash#1116 was caused by #16708
This PR reverts it
Testing
Preview release
Docs