Skip to content

fix(deps): update npm dependencies (major)#1024

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/major-npm-dependencies
Open

fix(deps): update npm dependencies (major)#1024
renovate[bot] wants to merge 1 commit intomainfrom
renovate/major-npm-dependencies

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Mar 11, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@astrojs/mdx (source) ^4.3.13 → ^5.0.1 age confidence
@astrojs/node (source) ^9.5.4 → ^10.0.2 age confidence
astro (source) ^5.18.0 → ^6.0.5 age confidence

Release Notes

withastro/astro (@​astrojs/mdx)

v5.0.1

Compare Source

Patch Changes

v5.0.0

Compare Source

Major Changes
Patch Changes

v4.3.14

Compare Source

Patch Changes
withastro/astro (@​astrojs/node)

v10.0.2

Compare Source

Patch Changes

v10.0.1

Compare Source

Patch Changes

v10.0.0

Compare Source

Major Changes

  • #​15654 a32aee6 Thanks @​florian-lefebvre! - Removes the experimentalErrorPageHost option

    This option allowed fetching a prerendered error page from a different host than the server is currently running on.

    However, there can be security implications with prefetching from other hosts, and often more customization was required to do this safely. This has now been removed as a built-in option so that you can implement your own secure solution as needed and appropriate for your project via middleware.

What should I do?

If you were previously using this feature, you must remove the option from your adapter configuration as it no longer exists:

// astro.config.mjs
import { defineConfig } from 'astro/config'
import node from '@​astrojs/node'

export default defineConfig({
  adapter: node({
    mode: 'standalone',
-    experimentalErrorPageHost: 'http://localhost:4321'
  })
})

You can replicate the previous behavior by checking the response status in a middleware and fetching the prerendered page yourself:

// src/middleware.ts
import { defineMiddleware } from 'astro:middleware';

export const onRequest = defineMiddleware(async (ctx, next) => {
  const response = await next();
  if (response.status === 404 || response.status === 500) {
    return fetch(`http://localhost:4321/${response.status}.html`);
  }
  return response;
});
Minor Changes

  • #​15258 d339a18 Thanks @​ematipico! - Stabilizes the adapter feature experimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:

    export default defineConfig({
  adapter: netlify({
-    experimentalStaticHeaders: true
+    staticHeaders: true
  })
})

  • #​15759 39ff2a5 Thanks @​matthewp! - Adds a new bodySizeLimit option to the @astrojs/node adapter

    You can now configure a maximum allowed request body size for your Node.js standalone server. The default limit is 1 GB. Set the value in bytes, or pass 0 to disable the limit entirely:

    import node from '@​astrojs/node';
import { defineConfig } from 'astro/config';

export default defineConfig({
  adapter: node({
    mode: 'standalone',
    bodySizeLimit: 1024 * 1024 * 100, // 100 MB
  }),
});

  • #​15006 f361730 Thanks @​florian-lefebvre! - Adds new session driver object shape

    For greater flexibility and improved consistency with other Astro code, session drivers are now specified as an object:

    -import { defineConfig } from 'astro/config'
+import { defineConfig, sessionDrivers } from 'astro/config'

export default defineConfig({
  session: {
-    driver: 'redis',
-    options: {
-      url: process.env.REDIS_URL
-    },
+    driver: sessionDrivers.redis({
+      url: process.env.REDIS_URL
+    }),
  }
})

    Specifying the session driver as a string has been deprecated, but will continue to work until this feature is removed completely in a future major version. The object shape is the current recommended and documented way to configure a session driver.

  • #​14946 95c40f7 Thanks @​ematipico! - Removes the experimental.csp flag and replaces it with a new configuration option security.csp - (v6 upgrade guidance)

Patch Changes

  • #​15473 d653b86 Thanks @​matthewp! - Improves error page loading to read from disk first before falling back to configured host

  • #​15562 e14a51d Thanks @​florian-lefebvre! - Updates to new Adapter API introduced in v6

  • #​15585 98ea30c Thanks @​matthewp! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.

  • #​15777 02e24d9 Thanks @​matthewp! - Fixes CSRF origin check mismatch by passing the actual server listening port to createRequest, ensuring the constructed URL origin includes the correct port (e.g., http://localhost:4321 instead of http://localhost). Also restricts X-Forwarded-Proto to only be trusted when allowedDomains is configured.

  • #​15714 9a2c949 Thanks @​ematipico! - Fixes an issue where static headers weren't correctly applied when the website uses base.

  • #​15763 1567e8c Thanks @​matthewp! - Normalizes static file paths before evaluating dotfile access rules for improved consistency

  • #​15164 54dc11d Thanks @​HiDeoo! - Fixes an issue where the Node.js adapter could fail to serve a 404 page matching a pre-rendered dynamic route pattern.

  • #​15745 20b05c0 Thanks @​matthewp! - Hardens static file handler path resolution to ensure resolved paths stay within the client directory

  • #​15495 5b99e90 Thanks @​leekeh! - Refactors to use middlewareMode adapter feature (set to classic)

  • #​15657 cb625b6 Thanks @​qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.

    This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.

    If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.

    // astro.config.mjs
export default defineConfig({
  security: {
    actionBodySizeLimit: 10 * 1024 * 1024, // set to 10 MB
  },
});

  • Updated dependencies [4ebc1e3, 4e7f3e8, a164c77, cf6ea6b, a18d727, 240c317, 745e632]:

v9.5.5

Compare Source

Patch Changes
withastro/astro (astro)

v6.0.5

Compare Source

Patch Changes

  • #​15891 b889231 Thanks @​matthewp! - Fix dev routing for server:defer islands when adapters opt into handling prerendered routes in Astro core. Server island requests are now treated as prerender-handler eligible so prerendered pages using prerenderEnvironment: 'node' can load island content without 400 errors.

  • #​15890 765a887 Thanks @​matthewp! - Fixes astro:actions validation to check resolved routes, so projects using default static output with at least one prerender = false page or endpoint no longer fail during startup.

  • #​15884 dcd2c8e Thanks @​matthewp! - Avoid a MaxListenersExceededWarning during astro dev startup by increasing the shared Vite watcher listener limit when attaching content server listeners.

  • #​15904 23d5244 Thanks @​jlukic! - Emit the before-hydration script chunk for the client Vite environment. The chunk was only emitted for prerender and ssr environments, causing a 404 when browsers tried to load it. This broke hydration for any integration using injectScript('before-hydration', ...), including Lit SSR.

  • #​15933 325901e Thanks @​ematipico! - Fixes an issue where <style> tags inside SVG components weren't correctly tracked when enabling CSP.

  • #​15875 c43ef8a Thanks @​matthewp! - Ensure custom prerenderers are always torn down during build, even when getStaticPaths() throws.

  • #​15887 1861fed Thanks @​ematipico! - Fixes an issue where the build incorrectly leaked server entrypoint into the client environment, causing adapters to emit warnings during the build.

  • #​15888 925252e Thanks @​matthewp! - Fix a bug where server:defer could fail at runtime in prerendered pages for some adapters (including Cloudflare), causing errors like serverIslandMap?.get is not a function.

  • #​15901 07c1002 Thanks @​delucis! - Fixes JSON schema generation for content collection schemas that have differences between their input and output shapes.

  • #​15882 759f946 Thanks @​matthewp! - Fix Astro.url.pathname for the root page when using build.format: "file" so it resolves to /index.html instead of /.html during builds.

v6.0.4

Compare Source

Patch Changes

  • #​15870 920f10b Thanks @​matthewp! - Prebundle astro/toolbar in dev when custom dev toolbar apps are registered, preventing re-optimization reloads that can hide or break the toolbar.

  • #​15876 f47ac53 Thanks @​ematipico! - Fixes redirectToDefaultLocale producing a protocol-relative URL (//locale) instead of an absolute path (/locale) when base is '/'.

  • #​15767 e0042f7 Thanks @​matthewp! - Fixes server islands (server:defer) not working when only used in prerendered pages with output: 'server'.

  • #​15873 35841ed Thanks @​matthewp! - Fix a dev server bug where newly created pages could miss layout-imported CSS until restart.

  • #​15874 ce0669d Thanks @​ematipico! - Fixes a warning when using prefetchAll

  • #​15754 58f1d63 Thanks @​rururux! - Fixes a bug where a directory at the project root sharing the same name as a page route would cause the dev server to return a 404 instead of serving the page.

  • #​15869 76b3a5e Thanks @​matthewp! - Update the unknown file extension error hint to recommend vite.resolve.noExternal, which is the correct Vite 7 config key.

v6.0.3

Compare Source

Patch Changes

  • #​15711 b2bd27b Thanks @​OliverSpeir! - Improves Astro core's dev environment handling for prerendered routes by ensuring route/CSS updates and prerender middleware behavior work correctly across both SSR and prerender environments.

    This enables integrations that use Astro's prerender dev environment (such as Cloudflare with prerenderEnvironment: 'node') to get consistent route matching and HMR behavior during development.

  • #​15852 1cdaf9f Thanks @​ematipico! - Fixes a regression where the the routes emitted by the astro:build:done hook didn't have the distURL array correctly populated.

  • #​15765 ca76ff1 Thanks @​matthewp! - Hardens server island POST endpoint validation to use own-property checks for improved consistency

v6.0.2

Compare Source

Patch Changes

v6.0.1

Compare Source

Patch Changes

v6.0.0

Compare Source

Major Changes
What should I do?

If you were using experimental CSP runtime utilities, you must now access methods conditionally:

-Astro.csp.insertDirective("default-src 'self'");
+Astro.csp?.insertDirective("default-src 'self'");
Minor Changes

  • #​14306 141c4a2 Thanks @​ematipico! - Adds new optional properties to setAdapter() for adapter entrypoint handling in the Adapter API

    Changes:

    • New optional properties:
      • entryType?: 'self' | 'legacy-dynamic' - determines if the adapter provides its own entrypoint ('self') or if Astro constructs one ('legacy-dynamic', default)

    Migration: Adapter authors can optionally add these properties to support custom dev entrypoints. If not specified, adapters will use the legacy behavior.

  • #​15700 4e7f3e8 Thanks @​ocavue! - Updates the internal logic during SSR by providing additional metadata for UI framework integrations.

  • #​15231 3928b87 Thanks @​rururux! - Adds a new optional getRemoteSize() method to the Image Service API.

    Previously, inferRemoteSize() had a fixed implementation that fetched the entire image to determine its dimensions.
    With this new helper function that extends inferRemoteSize(), you can now override or extend how remote image metadata is retrieved.

    This enables use cases such as:

    • Caching: Storing image dimensions in a database or local cache to avoid redundant network requests.
    • Provider APIs: Using a specific image provider's API (like Cloudinary or Vercel) to get dimensions without downloading the file.

    For example, you can add a simple cache layer to your existing image service:

    const cache = new Map();

const myService = {
  ...baseService,
  async getRemoteSize(url, imageConfig) {
    if (cache.has(url)) return cache.get(url);

    const result = await baseService.getRemoteSize(url, imageConfig);
    cache.set(url, result);
    return result;
  },
};

    See the Image Services API reference documentation for more information.

  • #​15077 a164c77 Thanks @​matthewp! - Updates the Integration API to add setPrerenderer() to the astro:build:start hook, allowing adapters to provide custom prerendering logic.

    The new API accepts either an AstroPrerenderer object directly, or a factory function that receives the default prerenderer:

    'astro:build:start': ({ setPrerenderer }) => {
  setPrerenderer((defaultPrerenderer) => ({
    name: 'my-prerenderer',
    async setup() {
      // Optional: called once before prerendering starts
    },
    async getStaticPaths() {
      // Returns array of { pathname: string, route: RouteData }
      return defaultPrerenderer.getStaticPaths();
    },
    async render(request, { routeData }) {
      // request: Request
      // routeData: RouteData
      // Returns: Response
    },
    async teardown() {
      // Optional: called after all pages are prerendered
    }
  }));
}

    Also adds the astro:static-paths virtual module, which exports a StaticPaths class for adapters to collect all prerenderable paths from within their target runtime. This is useful when implementing a custom prerenderer that runs in a non-Node environment:

    // In your adapter's request handler (running in target runtime)
import { App } from 'astro/app';
import { StaticPaths } from 'astro:static-paths';

export function createApp(manifest) {
  const app = new App(manifest);

  return {
    async fetch(request) {
      const { pathname } = new URL(request.url);

      // Expose endpoint for prerenderer to get static paths
      if (pathname === '/__astro_static_paths') {
        const staticPaths = new StaticPaths(app);
        const paths = await staticPaths.getAll();
        return new Response(JSON.stringify({ paths }));
      }

      // Normal request handling
      return app.render(request);
    },
  };
}

    See the adapter reference for more details on implementing a custom prerenderer.

  • #​15345 840fbf9 Thanks @​matthewp! - Adds a new emitClientAsset function to astro/assets/utils for integration authors. This function allows emitting assets that will be moved to the client directory during SSR builds, useful for assets referenced in server-rendered content that need to be available on the client.

    import { emitClientAsset } from 'astro/assets/utils';

// Inside a Vite plugin's transform or load hook
const handle = emitClientAsset(this, {
  type: 'asset',
  name: 'my-image.png',
  source: imageBuffer,
});

  • #​15460 ee7e53f Thanks @​florian-lefebvre! - Updates the Adapter API to allow providing a serverEntrypoint when using entryType: 'self'

    Astro 6 introduced a new powerful yet simple Adapter API for defining custom server entrypoints. You can now call setAdapter() with the entryType: 'self' option and specify your custom serverEntrypoint:

    export function myAdapter() {
  return {
    name: 'my-adapter',
    hooks: {
      'astro:config:done': ({ setAdapter }) => {
        setAdapter({
          name: 'my-adapter',
          entryType: 'self',
          serverEntrypoint: 'my-adapter/server.js',
          supportedAstroFeatures: {
            // ...
          },
        });
      },
    },
  };
}

    If you need further customization at the Vite level, you can omit serverEntrypoint and instead specify your custom server entrypoint with vite.build.rollupOptions.input.

  • [#​15

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Contributor Author

renovate bot commented Mar 11, 2026 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm warn Unknown env config "store". This will stop working in the next major version of npm.
npm warn ERESOLVE overriding peer dependency
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @astrojs/starlight@0.37.6
npm error Found: astro@6.0.5
npm error node_modules/astro
npm error   peer astro@"^5.0.0" from @astrojs/mdx@4.3.14
npm error   node_modules/@astrojs/starlight/node_modules/@astrojs/mdx
npm error     @astrojs/mdx@"^4.2.3" from @astrojs/starlight@0.37.6
npm error     node_modules/@astrojs/starlight
npm error       @astrojs/starlight@"^0.37.6" from the root project
npm error
npm error Could not resolve dependency:
npm error peer astro@"^5.5.0" from @astrojs/starlight@0.37.6
npm error node_modules/@astrojs/starlight
npm error   @astrojs/starlight@"^0.37.6" from the root project
npm error
npm error Conflicting peer dependency: astro@5.18.1
npm error node_modules/astro
npm error   peer astro@"^5.5.0" from @astrojs/starlight@0.37.6
npm error   node_modules/@astrojs/starlight
npm error     @astrojs/starlight@"^0.37.6" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-03-16T15_08_20_915Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-03-16T15_08_20_915Z-debug-0.log

@cla-assistant
Copy link

cla-assistant bot commented Mar 11, 2026

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@renovate renovate bot force-pushed the renovate/major-npm-dependencies branch 12 times, most recently from e5df538 to 68f4b89 Compare March 12, 2026 14:36
@renovate renovate bot changed the title Update npm dependencies (major) fix(deps): update npm dependencies (major) Mar 12, 2026
@renovate renovate bot force-pushed the renovate/major-npm-dependencies branch 5 times, most recently from 08d2611 to 4c6b52a Compare March 16, 2026 02:48
@renovate renovate bot changed the title fix(deps): update npm dependencies (major) Update npm dependencies (major) Mar 16, 2026
@renovate renovate bot force-pushed the renovate/major-npm-dependencies branch 4 times, most recently from e14f19e to 2984f01 Compare March 16, 2026 08:22
@renovate renovate bot changed the title Update npm dependencies (major) fix(deps): update npm dependencies (major) Mar 16, 2026
@renovate renovate bot force-pushed the renovate/major-npm-dependencies branch 2 times, most recently from b17452f to 64fd4f9 Compare March 16, 2026 14:13
@renovate renovate bot force-pushed the renovate/major-npm-dependencies branch from 64fd4f9 to 14e16c0 Compare March 16, 2026 15:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants