Skip to content

build(deps): bump the npm group with 4 updates - #366

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-547e51a594
Nov 11, 2026
Merged

build(deps): bump the npm group with 4 updates#366
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-547e51a594

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 11, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm group with 4 updates: astro, @astrojs/check, lighthouse and prettier-plugin-astro.

Updates astro from 7.4.1 to 7.4.2

Release notes

Sourced from astro's releases.

astro@7.4.2

Patch Changes

  • #18430 dda9ec3 Thanks @​Abhirup-99! - Speeds up content sync with experimental.collectionStorage: "chunked" by computing each character's UTF-8 width from its code point instead of encoding every character through TextEncoder. On a store of ~44k entries this cuts the chunking step from about 60 seconds to well under a second, with byte-identical output.

  • #18438 5e0eaa4 Thanks @​astro-factory! - Fixes astro dev with @astrojs/cloudflare failing with Calling `require` for "node-fetch" when a server dependency such as cross-fetch requires node-fetch

  • #18376 a4e201d Thanks @​okxint! - Fixes astro dev treating a stale lock file containing a Linux thread ID as a running Astro server. A successful process lookup with no matching PID now marks the lock as stale, preventing astro dev stop and astro dev --force from killing the unrelated process that owns the thread.

  • #18467 d1fb7d3 Thanks @​astro-factory! - Fixes the defineConfig() types for i18n.defaultLocale, i18n.fallback, and i18n.domains so they accept a custom locale's path instead of its codes, matching how Astro validates and uses these values

  • #18475 cf27e70 Thanks @​ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

    This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

  • #18451 7a0ba6f Thanks @​DenisCDev! - Fixes astro sync, astro check and astro build replacing the optimized dependencies of a dev server running in the same project, which broke framework islands in that dev server until it was restarted with --force

  • #18336 e943003 Thanks @​astro-factory! - Fixes inline styles in dev so that framework-transformed CSS is used, such as scoped styles and v-bind() in Vue single-file components

  • #18399 829fc00 Thanks @​astro-factory! - Fixes a dev server error (Could not find server component name) for a server:defer island that imports astro:actions or astro:config/server, when its page was not the first island page loaded after starting the server

  • #18330 4db9e0d Thanks @​Samuteg! - Fixes the astro:env/server virtual module being generated with invalid JS in dev when any environment variable contains $ replacement patterns ($`, $&, $', $1, …). The inlined env JSON was passed as a string to String.replace, so e.g. the KITTY_PUBLIC_KEY value set by default in Kitty terminals corrupted the module and broke dev with Failed to parse source for import analysis

  • Updated dependencies [cf27e70]:

    • @​astrojs/telemetry@​3.4.1
    • @​astrojs/markdown-satteri@​0.4.5
Changelog

Sourced from astro's changelog.

7.4.10

Patch Changes

  • #18621 8a61493 Thanks @​marcalexiei! - Fixes the dev toolbar's audit freezing an image's CSS animations in Safari, by reading the image's size from the request that loaded it instead of fetching it again

  • #18691 f787792 Thanks @​ematipico! - Improves startup time of astro commands by loading SVGO only when svgoOptimizer() optimizes an SVG, instead of whenever astro/config is imported

  • #18678 ea63d76 Thanks @​astro-factory! - Fixes duplicate CSS loading for hydrated islands that share modules or are imported through a path alias. The client build no longer emits and preloads stylesheets that are already linked on the page by the server build.

  • Updated dependencies [57137ed]:

    • @​astrojs/internal-helpers@​0.13.2
    • @​astrojs/markdown-satteri@​0.4.8
    • @​astrojs/vite-plugin-astro@​0.1.1

7.4.9

Patch Changes

  • #18681 bf1828b Thanks @​astro-factory! - Fixes static builds skipping or failing on pages whose getStaticPaths() params contain characters like % or \, and warns when a prerendered page is skipped because it returned an empty error response

  • #18630 c904827 Thanks @​astro-factory! - Fixes bundled scripts and hydrated islands being blocked when security.csp.scriptDirective.strictDynamic is enabled. Astro now adds the hash of every bundled script to script-src and renders an import map with their integrity in the <head>.

  • #18611 f98e8a8 Thanks @​matthewp! - Fixes bundling of a <script src> that uses a root-relative path to a project file outside src/, such as /lib/analytics.ts. The error asking for is:inline is now shown only when the path points to a file in public/.

  • #18688 1999c84 Thanks @​astro-factory! - Fixes errors thrown after a page has started streaming bypassing the configured logger. They are now reported once through it, as one error record, in both production and astro dev

  • Updated dependencies [c904827, 5083c65, 1999c84, 5083c65, f98e8a8, f98e8a8]:

    • @​astrojs/runtime@​0.1.0
    • @​astrojs/vite-plugin-astro@​0.1.0

7.4.8

Patch Changes

7.4.7

Patch Changes

  • 7da442b Thanks @​matthewp! - Fixes the image endpoint treating directories whose names differ only by letter case as being inside the build output directory on case-sensitive filesystems
  • Updated dependencies [7da442b]:
    • @​astrojs/internal-helpers@​0.13.1
    • @​astrojs/markdown-satteri@​0.4.7

7.4.6

Patch Changes

  • #18565 cd09986 Thanks @​praveen-kumary! - Avoids attributing client-only components or scripts to unrelated pages importing astro:i18n by bounding top-level page graph traversal at virtual page entries

... (truncated)

Commits
  • 34c9535 [ci] release (#18459)
  • cf27e70 fix: minimal support node version (#18475)
  • 1efb9d6 Update dependency @​playwright/test to v1.64.1 (#18441)
  • 5e0eaa4 fix(astro): stop excluding node-fetch from server dep optimization in workerd...
  • a4e201d fix(dev): treat missing ps row as stale in lockfile process check (#18376)
  • 7a0ba6f Use a separate Vite cache for the temporary sync server (#18451)
  • d1fb7d3 fix(i18n): use locale path instead of codes in defineConfig i18n types (#18467)
  • dda9ec3 fix(content): compute UTF-8 width arithmetically in getChunkEnd (#18430)
  • 7af66fc Fix astro-check binary silently dropping the first two CLI arguments (#18455)
  • 829fc00 Skip server island manifest in CSS ensureModulesLoaded to fix late-discovery ...
  • Additional commits viewable in compare view

Updates @astrojs/check from 0.9.11 to 0.9.12

Release notes

Sourced from @​astrojs/check's releases.

@​astrojs/check@​0.9.12

Patch Changes

  • #18455 7af66fc Thanks @​astro-factory! - Fixes the astro-check binary ignoring its first two command-line arguments, so flags such as --help, --root, --watch, and --tsconfig are respected again. If your scripts padded the arguments to work around this (for example, astro-check -- -- --tsconfig ./tsconfig.app.json), remove the padding.
  • Updated dependencies [044148d]:
    • @​astrojs/language-server@​2.17.3
Changelog

Sourced from @​astrojs/check's changelog.

0.9.12

Patch Changes

  • #18455 7af66fc Thanks @​astro-factory! - Fixes the astro-check binary ignoring its first two command-line arguments, so flags such as --help, --root, --watch, and --tsconfig are respected again. If your scripts padded the arguments to work around this (for example, astro-check -- -- --tsconfig ./tsconfig.app.json), remove the padding.
  • Updated dependencies [044148d]:
    • @​astrojs/language-server@​2.17.3
Commits

Updates lighthouse from 13.5.0 to 13.6.0

Release notes

Sourced from lighthouse's releases.

v13.6.0

13.6.0 (2026-10-27)

Full Changelog

We expect this release to ship in the DevTools of Chrome 159, and to PageSpeed Insights within a week.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Notable Changes

  • CLI bulk URL auditing: The CLI now supports auditing multiple URLs sequentially in a single command—either by passing multiple URL arguments or via --url-file (with --fail-fast to abort on the first failure) (#17404). Default report filenames now include the URL pathname (<hostname>-<pathname>_<date>) to avoid collisions across pages on the same host (#17405, #17423).
  • Lantern simulation improvements: Upgraded trace_engine (0.0.66 and 0.0.67) and updated request/graph modeling to improve simulation accuracy (#17307, #17379):
    • Network & protocol modeling: Treated HTTP/3 connections as multiplexed, credited consumed H2 overflow bytes across simulation steps, excluded connectionless requests from active connection counts, and improved origin RTT/throughput estimation and redirect handling (#17415).
    • Dependency graph & metrics: Added v8.compileModule and v8.evaluateModule trace event attribution, used protocol renderBlocking status for render-blocking priority (#16869), used FCP graphs when text LCP occurs in the same frame as FCP, and fixed simulated LCP breakdown calculations (#17269) and trace-mode navigation/URL handling (#17431, #17433).
  • Agentic Resource Discovery (ARD) v0.91: Updated the ard-schema audit and gatherer to the ARD v0.91 specification (ard.json replacing ai-catalog.json), supporting discovery via Link HTTP headers, <link rel="ard">, and /.well-known/ard.json, warning on legacy ai-catalog locations, and displaying the ARD spec version in the report footer (#17258, #17259, #17260, #17448, #17452).
  • Performance insight numericValue: Performance insight audits now populate numericValue and numericUnit from estimated time or byte savings (#17346), and select the correct navigation when traces contain multiple navigations (#17174).
  • Memory and gathering optimizations: Reduced peak memory usage during runs by streaming traces (ReturnAsStream), reusing script sources from trace events, evicting decoded frame buffers in speedline, and releasing intermediate gatherer and trace engine state (#17286, #17289, #17290, #17407).

Core

  • fix cycle tracking and built-in type checks in deep-equals (#17422)
  • release retained gatherer and trace engine intermediate state (#17290)
  • populate numericValue on performance insight audits (#17346)
  • do not throw when robots.txt or llms.txt content is null (#17294)
  • fail robots-txt and llms-txt on HTTP 429 (#17295)
  • fix insight audits picking the wrong navigation's data (#17174)
  • ard: include ARD spec version in LHR credits and report footer (#17452)
  • ard: sync port with upstream f073b1e (#17448)
  • ard: make upstream sync check content-based (#17261)
  • ard: report legacy and unreachable discovery sources (#17260)
  • ard: discover manifests per spec §5.1 (#17259)
  • ard: port conformance test to ARD v0.91 (#17258)
  • baseline: link to developer.chrome.com docs (#17177)
  • baseline: show baseline_low_date for Widely Available features (#17337)
  • baseline: fix getLowDate for high features, move web-features to devDeps (#17283)
  • cdt: convert core/lib/cdt to ESM (#17340)
  • config: throw when module is missing from bundledModules in bundled env (#17398)
  • driver: skip clearDataForOrigin when origin is null (#17347)
  • full-page-screenshot: preserve emulated width during resize (#17330)
  • image-elements: skip source rules when HTML dimensions are explicit (#17287)
  • lantern-metric: use last main-frame navigation in trace mode (#17433)

... (truncated)

Changelog

Sourced from lighthouse's changelog.

13.6.0 (2026-10-27)

Full Changelog

We expect this release to ship in the DevTools of Chrome 159, and to PageSpeed Insights within a week.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Notable Changes

  • CLI bulk URL auditing: The CLI now supports auditing multiple URLs sequentially in a single command—either by passing multiple URL arguments or via --url-file (with --fail-fast to abort on the first failure) (#17404). Default report filenames now include the URL pathname (<hostname>-<pathname>_<date>) to avoid collisions across pages on the same host (#17405, #17423).
  • Lantern simulation improvements: Upgraded trace_engine (0.0.66 and 0.0.67) and updated request/graph modeling to improve simulation accuracy (#17307, #17379):
    • Network & protocol modeling: Treated HTTP/3 connections as multiplexed, credited consumed H2 overflow bytes across simulation steps, excluded connectionless requests from active connection counts, and improved origin RTT/throughput estimation and redirect handling (#17415).
    • Dependency graph & metrics: Added v8.compileModule and v8.evaluateModule trace event attribution, used protocol renderBlocking status for render-blocking priority (#16869), used FCP graphs when text LCP occurs in the same frame as FCP, and fixed simulated LCP breakdown calculations (#17269) and trace-mode navigation/URL handling (#17431, #17433).
  • Agentic Resource Discovery (ARD) v0.91: Updated the ard-schema audit and gatherer to the ARD v0.91 specification (ard.json replacing ai-catalog.json), supporting discovery via Link HTTP headers, <link rel="ard">, and /.well-known/ard.json, warning on legacy ai-catalog locations, and displaying the ARD spec version in the report footer (#17258, #17259, #17260, #17448, #17452).
  • Performance insight numericValue: Performance insight audits now populate numericValue and numericUnit from estimated time or byte savings (#17346), and select the correct navigation when traces contain multiple navigations (#17174).
  • Memory and gathering optimizations: Reduced peak memory usage during runs by streaming traces (ReturnAsStream), reusing script sources from trace events, evicting decoded frame buffers in speedline, and releasing intermediate gatherer and trace engine state (#17286, #17289, #17290, #17407).

Core

  • fix cycle tracking and built-in type checks in deep-equals (#17422)
  • release retained gatherer and trace engine intermediate state (#17290)
  • populate numericValue on performance insight audits (#17346)
  • do not throw when robots.txt or llms.txt content is null (#17294)
  • fail robots-txt and llms-txt on HTTP 429 (#17295)
  • fix insight audits picking the wrong navigation's data (#17174)
  • ard: include ARD spec version in LHR credits and report footer (#17452)
  • ard: sync port with upstream f073b1e (#17448)
  • ard: make upstream sync check content-based (#17261)
  • ard: report legacy and unreachable discovery sources (#17260)
  • ard: discover manifests per spec §5.1 (#17259)
  • ard: port conformance test to ARD v0.91 (#17258)
  • baseline: link to developer.chrome.com docs (#17177)
  • baseline: show baseline_low_date for Widely Available features (#17337)
  • baseline: fix getLowDate for high features, move web-features to devDeps (#17283)
  • cdt: convert core/lib/cdt to ESM (#17340)
  • config: throw when module is missing from bundledModules in bundled env (#17398)
  • driver: skip clearDataForOrigin when origin is null (#17347)
  • full-page-screenshot: preserve emulated width during resize (#17330)
  • image-elements: skip source rules when HTML dimensions are explicit (#17287)
  • lantern-metric: use last main-frame navigation in trace mode (#17433)
  • lcp-network-record: rename artifact, include Media requests (#17324)

... (truncated)

Commits

Updates prettier-plugin-astro from 1.1.1 to 1.1.2

Release notes

Sourced from prettier-plugin-astro's releases.

v1.1.2

Patch Changes

  • 98d4164: Updates the Astro compiler to the latest release
Changelog

Sourced from prettier-plugin-astro's changelog.

1.1.2

Patch Changes

  • 98d4164: Updates the Astro compiler to the latest release
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the npm group with 4 updates
1deca25 
Bumps the npm group with 4 updates: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro), [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check), [lighthouse](https://github.com/GoogleChrome/lighthouse) and [prettier-plugin-astro](https://github.com/withastro/prettier-plugin-astro).


Updates `astro` from 7.4.1 to 7.4.2
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.4.2/packages/astro)

Updates `@astrojs/check` from 0.9.11 to 0.9.12
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/astro-check/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/check@0.9.12/packages/language-tools/astro-check)

Updates `lighthouse` from 13.5.0 to 13.6.0
- [Release notes](https://github.com/GoogleChrome/lighthouse/releases)
- [Changelog](https://github.com/GoogleChrome/lighthouse/blob/main/changelog.md)
- [Commits](GoogleChrome/lighthouse@v13.5.0...v13.6.0)

Updates `prettier-plugin-astro` from 1.1.1 to 1.1.2
- [Release notes](https://github.com/withastro/prettier-plugin-astro/releases)
- [Changelog](https://github.com/withastro/prettier-plugin-astro/blob/main/CHANGELOG.md)
- [Commits](withastro/prettier-plugin-astro@v1.1.1...v1.1.2)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 7.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@astrojs/check"
  dependency-version: 0.9.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: lighthouse
  dependency-version: 13.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: prettier-plugin-astro
  dependency-version: 1.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 11, 2026
@github-actions
github-actions Bot merged commit b07332a into main Nov 11, 2026
1 check passed
@github-actions
github-actions Bot deleted the dependabot/npm_and_yarn/npm-547e51a594 branch November 11, 2026 02:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants