fix(deps): update npm-packages [skip ci]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@astrojs/starlight (source)	^0.38.1 → ^0.38.3
@hideoo/starlight-plugins-docs-components (source)	^0.4.0 → ^0.4.2
astro (source)	^6.0.4 → ^6.1.7
prettier (source)	3.8.1 → 3.8.3
sharp (source, changelog)	^0.33.5 → ^0.34.5
starlight-contributor-list (source)	^0.3.0 → ^0.4.0
starlight-links-validator (source)	^0.20.1 → ^0.23.0

---

Release Notes

withastro/starlight (@​astrojs/starlight)

v0.38.3

Compare Source

Patch Changes

• #​3799 313611b Thanks @​JosefJezek! - Improves Czech UI translations

• #​3770 6e7bed1 Thanks @​gameroman! - Adds examples to the inline documentation for title in the Starlight configuration object

• #​3801 fedd48b Thanks @​delucis! - Fixes missing draft content warning in dev on pages using the hero layout

v0.38.2

Compare Source

Patch Changes

• #​3759 f24ce99 Thanks @​MilesChou! - Fixes an issue where monolingual sites using a region-specific locale (e.g., zh-TW) as the default would incorrectly display base language translations (e.g., zh Simplified Chinese) instead of the region-specific ones (e.g., zh-TW Traditional Chinese).

• #​3768 a4c6c20 Thanks @​delucis! - Improves performance of sidebar generation for sites with very large sidebars

withastro/astro (astro)

v6.1.7

Compare Source

Patch Changes

• #​16027 c62516b Thanks @​fkatsuhiro! - Fixes a bug where remote image dimensions were not validated during static builds on Netlify.

• #​16311 94048f2 Thanks @​Arecsu! - Fixes --port flag being ignored after a Vite-triggered server restart (e.g. when a .env file changes)

• #​16316 0fcd04c Thanks @​ematipico! - Fixes the /_image endpoint accepting an arbitrary f=svg query parameter and serving non-SVG content as image/svg+xml. The endpoint now validates that the source is actually SVG before honoring f=svg, matching the same guard already enforced on the <Image> component path.

v6.1.6

Compare Source

Patch Changes

• #​16202 b5c2fba Thanks @​matthewp! - Fixes Actions failing with ActionsWithoutServerOutputError when using output: 'static' with an adapter

• #​16303 b06eabf Thanks @​matthewp! - Improves handling of special characters in inline <script> content

• #​14924 bb4586a Thanks @​aralroca! - Fixes SCSS and CSS module file changes triggering a full page reload instead of hot-updating styles in place during development

v6.1.5

Compare Source

Patch Changes

• #​16171 5bcd03c Thanks @​Desel72! - Fixes a build error that occurred when a pre-rendered page used the <Picture> component and another page called render() on content collection entries.

• #​16239 7c65c04 Thanks @​dataCenter430! - Fixes sync content inside <Fragment> not streaming to the browser until all async sibling expressions have resolved.

• #​16242 686c312 Thanks @​martrapp! - Revives UnoCSS in dev mode when used with the client router.

  This change partly reverts #​16089, which in hindsight turned out to be too general. Instead of automatically persisting all style sheets, we now do this only for styles from Vue components.

• #​16192 79d86b8 Thanks @​alexanderniebuhr! - Uses today’s date for Cloudflare compatibility_date in astro add cloudflare

  When creating new projects, astro add cloudflare now sets compatibility_date to the current date. Previously, this date was resolved from locally installed packages, which could be unreliable in some package manager environments. Using today’s date is simpler and more reliable across environments, and is supported by workerd.

• #​16259 34df955 Thanks @​gameroman! - Removed dlv dependency

v6.1.4

Compare Source

Patch Changes

• #​16197 21f9fe2 Thanks @​SchahinRohani! - Remove unused re-exports from assets/utils barrel file to fix Vite build warning

• #​16059 6d5469e Thanks @​matthewp! - Fixes Expected 'miniflare' to be defined errors and 404 responses in dev mode when using the Cloudflare adapter and the config file changes. Instead of creating a brand new Vite server on config changes, Astro now performs a Vite in-place restart, allowing the Cloudflare adapter to reuse its existing miniflare instance across restarts.

• #​16154 7610ba4 Thanks @​Desel72! - Fixes pages with dots in their filenames (e.g. hello.world.astro) returning 404 when accessed with a trailing slash in the dev server. The trailingSlashForPath function now only forces trailingSlash: 'never' for endpoints with file extensions, allowing pages to correctly respect the user's trailingSlash config.

• #​16193 23425e2 Thanks @​matthewp! - Fixes trailingSlash: "always" producing redirect HTML instead of the actual response for extensionless endpoints during static builds

v6.1.3

Compare Source

Patch Changes

• #​16161 b51f297 Thanks @​matthewp! - Fixes a dev rendering issue with the Cloudflare adapter where head metadata could be missing and dev CSS/scripts could be injected in the wrong place

• #​16110 de669f0 Thanks @​tmimmanuel! - Fixes skew protection query parameters not being appended to inter-chunk JavaScript imports in client bundles, which could cause version mismatches during rolling deployments on Vercel

• #​16162 a0a49e9 Thanks @​rururux! - Fixes an issue where HMR would not trigger when modifying files while using @​astrojs/cloudflare with prerenderEnvironment: 'node' enabled.

• #​16142 7454854 Thanks @​rururux! - Fixes HTML content being incorrectly escaped as plain text when rendering a MDX component using the AstroContainer APIs.

• #​16116 12602a9 Thanks @​riderx! - Fixes a bug where page-level CSS could leak between unrelated pages when traversing style parents across top-level route boundaries

• #​16178 a7e7567 Thanks @​matthewp! - Fixes SSR builds failing with "No matching renderer found" when a project only has injected routes and no src/pages/ directory

v6.1.2

Compare Source

Patch Changes

• #​16104 47a394d Thanks @​matthewp! - Fixes astro preview ignoring vite.preview.allowedHosts set in astro.config.mjs

• #​16047 711f837 Thanks @​matthewp! - Fixes catch-all routes incorrectly intercepting requests for static assets when using the @astrojs/node adapter in middleware mode.

• #​15981 a60cbb6 Thanks @​moktamd! - Fix Zod v4 validation error formatting to show human-readable messages instead of raw JSON

v6.1.1

Compare Source

Patch Changes

• #​16105 23d60de Thanks @​matthewp! - Fix dev toolbar audit crash when encountering the image ARIA role

• #​16089 999c875 Thanks @​martrapp! - Fixes an issue with the client router where Vue's :deep() notation was ignored in dev mode.

v6.1.0

Compare Source

Minor Changes

• #​15804 a5e7232 Thanks @​merlinnot! - Allows setting codec-specific defaults for Astro's built-in Sharp image service via image.service.config.

  You can now configure encoder-level options such as jpeg.mozjpeg, webp.effort, webp.alphaQuality, avif.effort, avif.chromaSubsampling, and png.compressionLevel when using astro/assets/services/sharp for compile-time image generation.

  These settings apply as defaults for the built-in Sharp pipeline, while per-image quality still takes precedence when set on <Image />, <Picture />, or getImage().

• #​15455 babf57f Thanks @​AhmadYasser1! - Adds fallbackRoutes to the IntegrationResolvedRoute type, exposing i18n fallback routes to integrations via the astro:routes:resolved hook for projects using fallbackType: 'rewrite'.

  This allows integrations such as the sitemap integration to properly include generated fallback routes in their output.

  {
    'astro:routes:resolved': ({ routes }) => {
      for (const route of routes) {
        for (const fallback of route.fallbackRoutes) {
          console.log(fallback.pathname) // e.g. /fr/about/
        }
      }
    }
  }

• #​15340 10a1a5a Thanks @​trueberryless! - Adds support for advanced configuration of SmartyPants in Markdown.

  You can now pass an options object to markdown.smartypants in your Astro configuration to fine-tune how punctuation, dashes, and quotes are transformed.

  This is helpful for projects that require specific typographic standards, such as "oldschool" dash handling or localized quotation marks.

  // astro.config.mjs
  export default defineConfig({
    markdown: {
      smartypants: {
        backticks: 'all',
        dashes: 'oldschool',
        ellipses: 'unspaced',
        openingQuotes: { double: '«', single: '‹' },
        closingQuotes: { double: '»', single: '›' },
        quotes: false,
      },
    },
  });

  See the retext-smartypants options for more information.

Patch Changes

• #​16025 a09f319 Thanks @​koji-1009! - Instructs the client router to skip view transition animations when the browser is already providing its own visual transition, such as a swipe gesture.

• #​16055 ccecb8f Thanks @​Gautam-Bharadwaj! - Fixes an issue where client:only components could have duplicate client:component-path attributes added in MDX in rare cases

• #​16081 44fc340 Thanks @​crazylogic03! - Fixes the emitFile() is not supported in serve mode warning that appears during astro dev when using integrations that inject before-hydration scripts (e.g. @astrojs/react)

• #​16068 31d733b Thanks @​Karthikeya1500! - Fixes the dev toolbar a11y audit incorrectly classifying menuitemradio as a non-interactive ARIA role.

• #​16080 e80ac73 Thanks @​ematipico! - Fixes experimental.queuedRendering incorrectly escaping the HTML output of .html page files, causing the page content to render as plain text instead of HTML in the browser.

• #​16048 13b9d56 Thanks @​matthewp! - Fixes a dev server crash (serverIslandNameMap.get is not a function) that occurred when navigating to a page with server:defer after first visiting a page without one, when using @astrojs/cloudflare

• #​16093 336e086 Thanks @​Snugug! - Fixes Zod meta not correctly being rendered on top-level schema when converted into JSON Schema

• #​16043 d402485 Thanks @​ematipico! - Fixes checkOrigin CSRF protection in astro dev behind a TLS-terminating reverse proxy. The dev server now reads X-Forwarded-Proto (gated on security.allowedDomains, matching production behaviour) so the constructed request origin matches the https:// origin the browser sends. Also ensures security.allowedDomains and security.checkOrigin are respected in dev.

• #​16064 ba58e0d Thanks @​ematipico! - Updates the dependency svgo to the latest, to fix a security issue.

• #​16007 2dcd8d5 Thanks @​florian-lefebvre! - Fixes a case where fonts files would unecessarily be copied several times during the build

• #​16017 b089b90 Thanks @​felmonon! - Fix the astro sync error message when getImage() is called while loading content collections.

• #​16014 fa73fbb Thanks @​matthewp! - Fixes a build error where using astro:config/client inside a <script> tag would cause Rollup to fail with "failed to resolve import virtual:astro:routes from virtual:astro:manifest"

• #​16054 f74465a Thanks @​seroperson! - Fixes an issue with the development server, where changes to the middleware weren't picked, and it required a full restart of the server.

• #​16033 198d31b Thanks @​adampage! - Fixes a bug where the the role image was incorrectly reported by audit tool bar.

• #​15935 278828c Thanks @​oliverlynch! - Fixes cached assets failing to revalidate due to redirect check mishandling Not Modified responses.

• #​16075 2c1ae85 Thanks @​florian-lefebvre! - Fixes a case where invalid URLs would be generated in development when using font families with an oblique style and angles

• #​16062 87fd6a4 Thanks @​matthewp! - Warns on dev server startup when Vite 8 is detected at the top level of the user's project, and automatically adds a "overrides": { "vite": "^7" } entry to package.json when running astro add cloudflare. This prevents a require_dist is not a function crash caused by a Vite version split between Astro (requires Vite 7) and packages like @tailwindcss/vite that hoist Vite 8.

• Updated dependencies [10a1a5a]:

  • @​astrojs/markdown-remark@​7.1.0

v6.0.8

Compare Source

Patch Changes

• #​15978 6d182fe Thanks @​seroperson! - Fixes a bug where Astro Actions didn't properly support nested object properties, causing problems when users used zod functions such as superRefine or discriminatedUnion.

• #​16011 e752170 Thanks @​matthewp! - Fixes a dev server hang on the first request when using the Cloudflare adapter

• #​15997 1fddff7 Thanks @​ematipico! - Fixes Astro.rewrite() failing when the target path contains duplicate slashes (e.g. //about). The duplicate slashes are now collapsed before URL parsing, preventing them from being interpreted as a protocol-relative URL.

v6.0.7

Compare Source

Patch Changes

• #​15950 acce5e8 Thanks @​matthewp! - Fixes a build regression in projects with multiple frontend integrations where server:defer server islands could fail at runtime when all pages are prerendered.

• #​15988 c93b4a0 Thanks @​ossaidqadri! - Fix styles from dynamically imported components not being injected on first dev server load.

• #​15968 3e7a9d5 Thanks @​chasemccoy! - Fixes renderMarkdown in custom content loaders not resolving images in markdown content. Images referenced in markdown processed by renderMarkdown are now correctly optimized, matching the behavior of the built-in glob() loader.

• #​15990 1e6017f Thanks @​ematipico! - Fixes an issue where Astro.currentLocale would always be the default locale instead of the actual one when using a dynamic route like [locale].astro or [locale]/index.astro. It now resolves to the correct locale from the URL.

• #​15990 1e6017f Thanks @​ematipico! - Fixes an issue where visiting an invalid locale URL (e.g. /asdf/) would show the content of a dynamic [locale] page with a 404 status code, instead of showing your custom 404 page. Now, the correct 404 page is rendered when the locale in the URL doesn't match any configured locale.

• #​15960 1d84020 Thanks @​matthewp! - Fixes Cloudflare dev server islands with prerenderEnvironment: 'node' by sharing the serialized manifest encryption key across dev environments and routing server island requests through the SSR runtime.

• #​15735 9685e2d Thanks @​fa-sharp! - Fixes an EventEmitter memory leak when serving static pages from Node.js middleware.

  When using the middleware handler, requests that were being passed on to Express / Fastify (e.g. static files / pre-rendered pages / etc.) weren't cleaning up socket listeners before calling next(), causing a memory leak warning. This fix makes sure to run the cleanup before calling next().

v6.0.6

Compare Source

Patch Changes

• #​15965 2dca307 Thanks @​matthewp! - Fixes client hydration for components imported through Node.js subpath imports (package.json#imports, e.g. #components/*), for example when using the Cloudflare adapter in development.

• #​15770 6102ca2 Thanks @​jpc-ae! - Updates the create astro welcome message to highlight the graceful dev/preview server quit command rather than the kill process shortcut

• #​15953 7eddf22 Thanks @​Desel72! - fix(hmr): eagerly recompile on style-only change to prevent stale slots render

• #​15916 5201ed4 Thanks @​trueberryless! - Fixes InferLoaderSchema type inference for content collections defined with a loader that includes a schema

• #​15864 d3c7de9 Thanks @​florian-lefebvre! - Removes temporary support for Node >=20.19.1 because Stackblitz now uses Node 22 by default

• #​15944 a5e1acd Thanks @​fkatsuhiro! - Fixes SSR dynamic routes with .html extension (e.g. [slug].html.astro) not working

• #​15937 d236245 Thanks @​ematipico! - Fixes an issue where HMR didn't correctly work on Windows when adding/changing/deleting routes in pages/.

• #​15931 98dfb61 Thanks @​Strernd! - Fix skew protection query params not being applied to island hydration component-url and renderer-url, and ensure query params are appended safely for asset URLs with existing search/hash parts.

• Updated dependencies []:

  • @​astrojs/markdown-remark@​7.0.1

v6.0.5

Compare Source

Patch Changes

• #​15891 b889231 Thanks @​matthewp! - Fix dev routing for server:defer islands when adapters opt into handling prerendered routes in Astro core. Server island requests are now treated as prerender-handler eligible so prerendered pages using prerenderEnvironment: 'node' can load island content without 400 errors.

• #​15890 765a887 Thanks @​matthewp! - Fixes astro:actions validation to check resolved routes, so projects using default static output with at least one prerender = false page or endpoint no longer fail during startup.

• #​15884 dcd2c8e Thanks @​matthewp! - Avoid a MaxListenersExceededWarning during astro dev startup by increasing the shared Vite watcher listener limit when attaching content server listeners.

• #​15904 23d5244 Thanks @​jlukic! - Emit the before-hydration script chunk for the client Vite environment. The chunk was only emitted for prerender and ssr environments, causing a 404 when browsers tried to load it. This broke hydration for any integration using injectScript('before-hydration', ...), including Lit SSR.

• #​15933 325901e Thanks @​ematipico! - Fixes an issue where <style> tags inside SVG components weren't correctly tracked when enabling CSP.

• #​15875 c43ef8a Thanks @​matthewp! - Ensure custom prerenderers are always torn down during build, even when getStaticPaths() throws.

• #​15887 1861fed Thanks @​ematipico! - Fixes an issue where the build incorrectly leaked server entrypoint into the client environment, causing adapters to emit warnings during the build.

• #​15888 925252e Thanks @​matthewp! - Fix a bug where server:defer could fail at runtime in prerendered pages for some adapters (including Cloudflare), causing errors like serverIslandMap?.get is not a function.

• #​15901 07c1002 Thanks @​delucis! - Fixes JSON schema generation for content collection schemas that have differences between their input and output shapes.

• #​15882 759f946 Thanks @​matthewp! - Fix Astro.url.pathname for the root page when using build.format: "file" so it resolves to /index.html instead of /.html during builds.

prettier/prettier (prettier)

v3.8.3

Compare Source

v3.8.2

Compare Source

lovell/sharp (sharp)

v0.34.5

Compare Source

• Upgrade to libvips v8.17.3 for upstream bug fixes.

• Add experimental support for prebuilt Linux RISC-V 64-bit binaries.

• Support building from source with npm v12+, deprecate --build-from-source flag.
  #​4458

• Add support for BigTIFF output.
  #​4459
  @​throwbi

• Improve error messaging when only warnings issued.
  #​4465

• Simplify ICC processing when retaining input profiles.
  #​4468

v0.34.4

Compare Source

• Upgrade to libvips v8.17.2 for upstream bug fixes.

• Ensure TIFF subifd and OpenSlide level input options are respected (regression in 0.34.3).

• Ensure autoOrient occurs before non-90 angle rotation.
  #​4425

• Ensure autoOrient removes existing metadata after shrink-on-load.
  #​4431

• TypeScript: Ensure KernelEnum includes linear.
  #​4441
  @​BayanBennett

• Ensure unlimited flag is passed upstream when reading TIFF images.
  #​4446

• Support Electron memory cage when reading XMP metadata (regression in 0.34.3).
  #​4451

• Add sharp-libvips rpath for yarn v5 support.
  #​4452
  @​arcanis

v0.34.3

Compare Source

v0.34.2

Compare Source

v0.34.1

Compare Source

v0.34.0

Compare Source

trueberryless-org/starlight-contributor-list (starlight-contributor-list)

v0.4.0

Compare Source

0.4.0

Minor Changes

• 0d1841f Thanks @​trueberryless! - Remove unnecessary dependencies, peer dependencies and dev dependencies

Patch Changes

• #​66 5014fc1 Thanks @​trueberryless! - Fine tune package metadata

HiDeoo/starlight-links-validator (starlight-links-validator)

v0.23.0

Compare Source

Minor Changes

• #​147 424b4c2 Thanks @​mvvmm! - Adds a new failOnError option to control whether link validation issues fail the build.

  • When set to true, validation issues fail the build.
  • When set to false, validation issues are still reported, but they do not fail the build.

• #​147 424b4c2 Thanks @​mvvmm! - Adds support for a JSON reporter.

  When enabled, validation errors are written to the .starlight-links-validator/errors.json file, which is only created when validation errors are found.

• #​147 424b4c2 Thanks @​mvvmm! - Adds a link_validation_failed step output to the GitHub Actions reporter.

Patch Changes

• #​155 045637e Thanks @​HiDeoo! - Fixes a regression in version 0.21.0 where some links were incorrectly reported as invalid or failed to match the exclude option.

v0.22.0

Compare Source

Minor Changes

• #​151 6f66387 Thanks @​HiDeoo! - Adds support for validating frontmatter links transformed by Starlight route data middleware.

v0.21.0

Compare Source

Minor Changes

• #​142 9ee77ad Thanks @​HiDeoo! - Refactors internal logic from a remark to a rehype plugin.

  This is an internal update and should not cause any user-facing changes, but it improves plugin performance and fixes some edge-case validation issues.

• #​144 b30aa17 Thanks @​HiDeoo! - Redesigns link validation error reporting to be more user-friendly and actionable.

  Most notably, error reporting now includes the following improvements:

  • Errors now include source line numbers.
  • In supported terminals and editors, links can open the source file at the relevant error location.
  • In supported terminals, error messages link to dedicated documentation pages with explanations and suggested fixes.

• #​145 82cb4d Thanks @​HiDeoo! - Adds support for a GitHub Actions reporter.

  When enabled and the plugin runs in GitHub Actions, validation errors are written to the job summary as a Markdown table.

• #​142 9ee77ad Thanks @​HiDeoo! - Adds support for validating links transformed by remark and rehype plugins.

  This change allows users to use portable Markdown links, author links that can be followed in an IDE and that are transformed by remark or rehype plugins into proper URLs at build time, while still being validated.

• #​144 b30aa17 Thanks @​HiDeoo! - Reduces terminal text styling dependency size by switching to Node.js built-in util.styleText().

Patch Changes

• #​142 9ee77ad Thanks @​HiDeoo! - Fixes an edge-case link validation issue related to Astro 6 Markdown heading ID generation changes.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5e70600

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

💥 An error occurred when fetching the changed packages and changesets in this PR

Some errors occurred when validating the changesets config:
The package or glob expression "@trueberryless-org/starlight-plugins-docs-components-docs" is specified in the `ignore` option but it is not found in the project. You may have misspelled the package name or provided an invalid glob expression. Note that glob expressions must be defined according to https://www.npmjs.com/package/micromatch.

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (1)

• [skip ci]

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}