Skip to content

AstroEco is Contributing…

Display your GitHub pull requests using astro-loader-github-prs

withastro/astro

Fixes #18329.

Problem

In dev, getTemplates() inlines the full environment into the generated astro:env/server virtual module via:

server.replace('// @@GET_ENV@@', `return (${JSON.stringify(loadedEnv)})[key];`)

Because the replacement is a string, $ patterns ($`, $&, $', $1, …) in any env var value are interpreted as replacement patterns, injecting template text into the middle of the env JSON and producing an unterminated string literal. Dev then fails with Failed to parse source for import analysis … at astro:env/server:17:…. This hits e.g. every Kitty terminal user (KITTY_PUBLIC_KEY commonly contains $ + backtick) importing astro:env/server in dev.

Fix

One line: pass a replacer function, which is immune to $ patterns.

Test

Added works in dev when an env variable contains \$` replacement patternstopackages/astro/test/env-secret.test.ts, covering `` $ ``, $&, `$'` and `$1`. Verified it fails without the fix (dev returns 500) and passes with it. Full env suites green: `env-secret` (5/5), `env-public` (4/4), `astro-envs` (13/13).

Changeset

Patch bump for astro included.

withastro/astro

Changes

The @astrojs/cloudflare integration imports prismjs at runtime in its Prism Vite plugin (src/vite-plugin-prism.ts), but only declares it in devDependencies. With pnpm's global virtual store, consumers of the adapter cannot resolve prismjs, so the adapter fails to load (see issue #18319).

This moves prismjs from devDependencies to dependencies and updates the pnpm-lock.yaml importer accordingly.

Test scenarios

  • No runtime/test logic changed; dependency declaration + lockfile only.
  • CI will install with the updated lockfile and run the cloudflare integration tests.

Closes #18319

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
@cloudflare/workers-types ^5.20261005.1 → ^5.20261006.1 age confidence

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
vite (source) ^8.3.2 → ^8.3.3 age confidence
vite (source) ^8.3.1 → ^8.3.3 age confidence

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
@astrojs/language-server (source) ^2.17.0 → ^2.17.1 age confidence
@astrojs/language-server (source) ^2.16.7 → ^2.17.1 age confidence

Release Notes

withastro/astro (@​astrojs/language-server)

v2.17.1

Compare Source

Patch Changes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

Changes

  • Changes, for example ^7.4.1 to ^7.0.0

This means that if you have a minimum release age, pnpm will autmoatically use the newest that's within your policy.

This fixes a bug where, after we do a release, running create-astro causes a project to not start without manually changing versions.

Testing

  • Tests added

Docs

  • N/A
withastro/astro

Changes

  • Adds an issue-assign.yml workflow that assigns every newly opened issue to the next member of a fixed triage pool (matthewp, Princesseuh).
  • Rotation needs no stored state: the most recent pool-assigned issue acts as the pointer and each new issue goes to the next pool member. A manual pool assignment becomes the new pointer, and runs are queued (not cancelled) so simultaneously opened issues still alternate.

Testing

  • Workflows have no test suite, so the selection logic was validated locally against mock issue payloads: alternation in both directions, first-run bootstrap with no pool history, and exclusion of PRs and non-pool assignees. YAML and shell syntax checked.

Docs

  • No docs update needed — internal CI automation with no user-facing behavior.
withastro/astro

Changes

  • Factory preview releases now work for fixes in nested packages like packages/language-tools/* and packages/markdown/*. Before, the changed-package detection only knew about packages/integrations/, so a fix to @astrojs/language-server resolved to packages/language-tools and pkg-pr-new failed with "No packages" (seen on #18310).
  • Each changed file now walks up to its nearest package.json, so any nesting depth works. Private packages (test fixtures, packages/astro/performance) are skipped. The charset guard on the directory is kept because the publish step word-splits $DIRS.

Testing

  • No test changes. This is a CI workflow change.

Docs

  • No docs update needed. This is internal CI used only by the factory bot.
withastro/astro

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@types/react (source) ^18.3.31 → ^19.3.0 age confidence
@types/react-dom (source) ^18.3.7 → ^19.3.0 age confidence
react (source) ^18.3.1 → ^19.3.0 age confidence
react-dom (source) ^18.3.1 → ^19.3.0 age confidence

Release Notes

react/react (react)

v19.3.0

Compare Source

New React Features
New React DOM Features
  • browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #​37143, #​37241)
    • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #​37193)
Notable changes
All Changes
React
React DOM
React Server
React Server Components

v19.2.8: 19.2.8 (July 21st, 2026)

Compare Source

React Server Components

v19.2.7

Compare Source

React Server Components

v19.2.6

Compare Source

React Server Components

v19.2.5

Compare Source

React Server Components

v19.2.4

Compare Source

React Server Components

v19.2.3

Compare Source

React Server Components

v19.2.2

Compare Source

React Server Components

v19.2.1

Compare Source

React Server Components

v19.2.0

Compare Source

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.2 release post for more information.

New React Features
  • <Activity>: A new API to hide and restore the UI and internal state of its children.
  • useEffectEvent is a React Hook that lets you extract non-reactive logic into an Effect Event.
  • cacheSignal (for RSCs) lets your know when the cache() lifetime is over.
  • React Performance tracks appear on the Performance panel’s timeline in your browser developer tools
New React DOM Features
  • Added resume APIs for partial pre-rendering with Web Streams:
  • Added resume APIs for partial pre-rendering with Node Streams:
  • Updated prerender APIs to return a postponed state that can be passed to the resume APIs.
Notable changes
  • React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming <ViewTransition> Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics.
  • Add Node Web Streams (prerender, renderToReadableStream) to server-side-rendering APIs for Node.js
  • Use underscore instead of : IDs generated by useId
All Changes
React
React DOM
React Server Components
React Reconciler

v19.1.9: 19.1.9 (July 21st, 2026)

Compare Source

React Server Components

v19.1.8

Compare Source

React Server Components

[`v1

❗ Important

✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
@nanostores/preact ^1.1.0 → ^1.1.1 age confidence
@preact/signals (source) ^2.11.2 → ^2.11.3 age confidence
hono (source) ^4.13.11 → ^4.13.13 age confidence
sass ^1.105.0 → ^1.105.1 age confidence
vite (source) ^8.3.1 → ^8.3.3 age confidence
vitest (source) ^5.0.2 → ^5.0.3 age confidence

Release Notes

nanostores/preact (@​nanostores/preact)

v1.1.1

Compare Source

sass/dart-sass (sass)

v1.105.1

Compare Source

  • Improve error messages for @extends across different media queries.
vitejs/vite (vite)

v8.3.3

Compare Source

Bug Fixes
vitest-dev/vitest (vitest)

v5.0.3

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

Backport of #18112 from next to main.

Changes

  • Astro now uses Vite's resolved environment outDir values as the source of truth for build output. Generated assets, build hook dir values, and SSR manifest paths use the resolved client, server, and prerender directories, so integrations and Vite plugins can control where output is written.
  • Custom prerenderer factories receive the resolved directories through a new context argument: setPrerenderer((defaultPrerenderer, { outputDirectories }) => ...). The argument is additive, so existing factories keep working.
  • Cleanup of Vite's .vite manifests now waits until every buildApp hook has finished, so platform plugins can read the manifests.
  • The cherry-pick applied cleanly. The touched files are identical to next.

Testing

  • Adds test/resolved-vite-output-directories.test.ts. A Vite plugin changes the environment outDirs, and the test asserts that hooks, the SSR manifest, and custom prerenderers see the resolved values while the Astro config stays unchanged.
  • Updates units/build/generate.test.ts, units/build/preserve-build-client-dir.test.ts, and incremental-build-islands.test.ts to expect output paths from the resolved directories.

Docs

  • Integration authors are affected: the new prerenderer outputDirectories context is covered by the minor changeset. Docs for setPrerenderer may need a follow-up to document the context argument.
withastro/astro

This PR contains the following updates:

Package Change Age Confidence
mocha (source) ^12.0.2 → ^12.0.3 age confidence
prettier (source) ^3.9.6 → ^3.9.9 age confidence
rolldown (source) ^1.2.11 → ^1.2.12 age confidence
svelte (source) ^5.55.7 → ^5.57.1 age confidence
tsx (source) ^4.23.13 → ^4.23.15 age confidence
tsx (source) ^4.22.0 → ^4.23.15 age confidence
vscode-jsonrpc (source) ^9.0.1 → ^9.0.3 age confidence
vscode-languageserver-protocol (source) ^3.18.3 → ^3.18.4 age confidence
vscode-languageserver-textdocument (source) ^1.0.14 → ^1.0.15 age confidence
yargs (source) ^18.1.0 → ^18.2.0 age confidence

Release Notes

mochajs/mocha (mocha)

v12.0.3

Compare Source

🩹 Fixes
📚 Documentation
🧹 Chores
yargs/yargs (yargs)

v18.2.0

Compare Source

Features
Bug Fixes
  • completion: remove spurious single-quote in zsh loadautofunc detection (#​2548) (224e285)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
@vercel/functions (source) ^3.9.9 → ^3.9.11 age confidence
rolldown (source) ^1.2.11 → ^1.2.12 age confidence
vite (source) ^8.3.1 → ^8.3.3 age confidence

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
rolldown (source) ^1.2.11 → ^1.2.12 age confidence

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
@vitejs/plugin-react (source) ^6.1.1 → ^6.1.2 age confidence
oxc-transform-react (source) ^0.150.0 → ^0.153.0 age confidence
vite (source) ^8.3.0 → ^8.3.2 age confidence

Release Notes

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.1.2

Compare Source

Fix HMR for compound components (#​1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#​1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #​1478) (#​1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

oxc-project/oxc (oxc-transform-react)

v0.152.0

🚀 Features
  • 3255b89 transform-react: Add reportDiagnostics option to expose recoverable React Compiler diagnostics (#​26624) (Jack)
  • f585cb4 napi: Add threadless WASI builds (#​26898) (Boshen)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
@preact/signals (source) ^2.11.2 → ^2.11.3 age confidence
preact-render-to-string ^6.7.0 → ^6.8.0 age confidence
vite (source) ^8.3.0 → ^8.3.2 age confidence

Release Notes

preactjs/signals (@​preact/signals)

v2.11.3

Compare Source

Patch Changes
  • #​991 04445ba Thanks @​JoviDeCroock! - Don't re-run a useSignalEffect for a component that was unmounted by the same update. Preact 11 disposes it after paint, so the effect could otherwise run once more against an unmounted component.
preactjs/preact-render-to-string (preact-render-to-string)

v6.8.0

Compare Source

Minor Changes
  • #​472 2dff53d Thanks @​jacob-ebey! - Replaces the second context argument in our streaming functions with an options object, the context moves to the third position.

    Streaming is considered alpha so we're making this breaking change deliberately as part of a minor.

Patch Changes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

astro@7.3.8

Patch Changes

  • #18293 28e7410 Thanks @astro-factory! - Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

  • #18298 0e9e857 Thanks @matthewp! - Fixes astro add removing existing allowBuilds approvals from pnpm-workspace.yaml with pnpm v11.0–v11.22

  • #18263 882dd98 Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

  • #18290 31f13c3 Thanks @astro-factory! - Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob such as !(drafts)/**/*.md

create-astro@5.2.6

Patch Changes

  • #18263 882dd98 Thanks @florian-lefebvre! - Removes the automatic allowScripts and allowBuilds pre-approval from generated projects. Astro's dependencies no longer run install scripts, so the workaround is no longer needed.

@astrojs/markdoc@2.0.11

Patch Changes

  • #18263 882dd98 Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

@astrojs/netlify@8.2.9

Patch Changes

  • #18263 882dd98 Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.
  • Updated dependencies []:
    • @astrojs/underscore-redirects@1.0.4

@astrojs/vercel@11.0.13

Patch Changes

  • #18263 882dd98 Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

astro-vscode@2.17.2

Patch Changes

  • #18263 882dd98 Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.
withastro/astro

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@cloudflare/vite-plugin (source) ^1.53.0 → ^1.62.5 age confidence
@cloudflare/vitest-plugin (source) 1.2.2 → 1.3.6 age confidence
@cloudflare/workers-types ^5.20260820.1 → ^5.20261005.1 age confidence
@tailwindcss/vite (source) ^4.2.1 → ^4.3.3 age confidence
@types/react (source) ^19.0.0 → ^19.3.0 age confidence
@types/react-dom (source) ^19.0.0 → ^19.3.0 age confidence
@vitejs/plugin-vue (source) ^6.0.4 → ^6.0.9 age confidence
devalue ^5.8.1 → ^5.9.4 age confidence
hono (source) ^4.13.7 → ^4.13.13 age confidence
react (source) ^19.2.4 → ^19.3.0 age confidence
react (source) ^19.0.0 → ^19.3.0 age confidence
react-dom (source) ^19.2.4 → ^19.3.0 age confidence
react-dom (source) ^19.0.0 → ^19.3.0 age confidence
solid-js (source) ^1.9.11 → ^1.9.15 age confidence
svelte (source) ^5.55.7 → ^5.57.1 age confidence
tailwindcss (source) ^4.2.1 → ^4.3.3 age confidence
tinyglobby (source) ^0.2.15 → ^0.2.17 age confidence
vite (source) ^8.0.13 → ^8.3.2 age confidence
vue (source) ^3.5.29 → ^3.5.43 age confidence
wrangler (source) ^4.83.0 → ^4.147.0 age confidence
wrangler (source) ^4.125.0 → ^4.147.0 age confidence

Release Notes

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.62.5

Compare Source

Patch Changes

v1.62.4

Compare Source

Patch Changes

v1.62.3

Compare Source

Patch Changes

v1.62.2

Compare Source

Patch Changes

v1.62.1

Compare Source

Patch Changes

v1.62.0

Compare Source

Minor Changes
  • #​15914 7f0734c Thanks @​jamesopstad! - Use cf/config for cloudflare.config.ts authoring

    Experimental cloudflare.config.ts projects must now import defineConfig, bindings, triggers, and related helpers from cf/config. Generated declarations from Wrangler and the Vite plugin also reference this package, so projects using the experimental configuration flow must add cf as a dependency.

    The Vite plugin no longer exports @cloudflare/vite-plugin/experimental-config. wrangler/experimental-config remains available for defineWranglerConfig, but no longer re-exports Cloudflare configuration helpers.

Patch Changes
  • #​15878 e7915c1 Thanks @​dawNotPoi! - Keep dependency optimization caches stable on the first Vite dev server restart.

    The first dev server restart no longer re-optimizes unchanged dependencies, including in projects without Containers. Container images are still cleaned up when the server closes, even after a config reload removes the Cloudflare plugin.

  • Updated dependencies [7f0734c]:

    • wrangler@​4.143.0

v1.61.0

Compare Source

Minor Changes
  • #​15856 4c2993b Thanks @​Naapperas! - Support Workflows declared in exports on ctx.exports in local development

    A Workflow declared in a Worker's exports is now available on ctx.exports in wrangler dev, the Vite plugin and the Vitest plugin, with the same API as a Workflow binding:

    const instance = await ctx.exports.MyWorkflow.create({
      params: { name: "World" },
    });

    ctx.exports and workflows bindings with the same Workflow name share their instances, including instances created before the Workflow was declared in exports. Two Workers can't export the same Workflow name, and a binding to an exported Workflow must refer to the Worker and class that export it. getPlatformProxy() ignores Workflows declared in exports, since it doesn't run the Worker's code.

    wrangler workflows commands run with --local also work with Workflows declared only in exports, without a workflows binding.

    In the Vitest plugin, introspectWorkflow() and introspectWorkflowInstance() still need a Workflow binding, and now explain how to add one when passed a Workflow from ctx.exports. Instances created through ctx.exports are introspected too. A workflows binding whose script_name is the Worker's own name now resolves to the Worker itself again.

Patch Changes

v1.60.2

Compare Source

Patch Changes

v1.60.1

Compare Source

Patch Changes

v1.60.0

Compare Source

Minor Changes
  • #​15648 52c0e9f Thanks @​tpmmorris! - Advertise Local Explorer scheduled invocations to headless agents

    The Vite plugin's Local Explorer hint now documents how to invoke a Worker's scheduled handler and points agents to the OpenAPI schema for the complete request contract.

Patch Changes

v1.59.0

Compare Source

Minor Changes
  • #​15817 6e77c53 Thanks @​jamesopstad! - Allow framework commands to produce Preview Build Output with the experimental config

    When cf previews deploy invokes a framework build command, Preview intent is now preserved. Function-based cloudflare.config.ts files receive isPreview: true, and generated Build Output is marked as a Preview build.

Patch Changes

v1.58.0

Compare Source

Minor Changes
  • #​15778 cd7508c Thanks @​jamesopstad! - Generate types during development and supported builds with Vite's experimental.newConfig option or Wrangler's --experimental-new-config flag (and --experimental-cf-build-output for builds)

    When Wrangler's --experimental-new-config flag or Vite's experimental.newConfig option is enabled, inferred configuration and runtime declarations are now kept in .cloudflare/types/index.d.ts. Vite refreshes them during development and production builds. Wrangler refreshes them during development and when building with both --experimental-new-config and --experimental-cf-build-output. In the experimental wrangler.config.ts format, the types option is now top-level because it applies to both commands.

Patch Changes
  • #​15765 1bdb96d Thanks @​th0m! - Prepare the required egress sidecar for local Containers without configured images

    Wrangler dev and Vite dev/preview now pull the required sidecar for Durable Object-managed Containers that select their application image at start time. Previously, these Containers failed to start unless the sidecar image was already cached in Docker.

  • Updated dependencies [1bdb96d, cd7508c, f5605f5]:

    • wrangler@​4.137.0

v1.57.3

Compare Source

Patch Changes

v1.57.2

Compare Source

Patch Changes

v1.57.1

Compare Source

Patch Changes

v1.57.0

Compare Source

Minor Changes
  • #​15713 3c75cad Thanks @​jamesopstad! - Identify experimental Build Output resource configs by filename and location

    The root remains config.json, Worker configs are now worker.config.json, and Container configs are now container.config.json. Resource configs no longer contain top-level type discriminators, while settings and build context are stored together in the root config.

  • #​15713 3c75cad Thanks @​jamesopstad! - Define experimental Cloudflare configuration with a single default export

    Experimental cloudflare.config.ts files now define settings and resources together in a default-exported defineConfig() call. Add a Worker under worker, add Containers to the containers array, or omit both to provide settings only.

    import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
    
    export default defineConfig({
    	accountId: "...",
    	complianceRegion: "public",
    	worker: {
    		name: "my-worker",
    		compatibilityDate: "2026-09-18",
    		entrypoint,
    	},
    });
Patch Changes

v1.56.0

Compare Source

Minor Changes
  • #​15609 1f070c8 Thanks @​emily-shen! - Build Containers when emitting experimental Build Output

    Wrangler and the Cloudflare Vite plugin now build Dockerfile-backed Container images when experimental Build Output is enabled. Container configs are emitted under .cloudflare/output/v0/containers with local image references, while existing registry references pass through unchanged.

  • #​15329 c4c9b75 Thanks @​akshitsinha! - Evaluate Flagship flags locally during development

    Flagship bindings now use the local Miniflare store by default in Wrangler and the Vite plugin, keeping development offline and isolated from production flags. Set remote: true on a binding to continue using its remote app.

    Use wrangler flagship flags pull <APP_ID> to seed the store from a remote app. Flag management commands also accept --local to read and update the local store directly.

  • #​15701 643e5cc Thanks @​WillTaylorDev! - Pass Preview intent to defineWorker and upload its resolved configuration

    Preview builds now evaluate programmatic Worker configuration with ctx.isPreview set to true and record that intent in Build Output. The shared Preview uploader deploys the resolved bindings and settings while preserving configured Preview base values when it creates a Preview.

Patch Changes

v1.55.0

Compare Source

Minor Changes
  • #​15674 a939a6c Thanks @​ghostwriternr! - Support explicit named Container image selection in local development

    The Vite plugin builds or pulls named images from Wrangler configuration and exposes their local tags through ctx.container.images. Pass one of those references to ctx.container.start({ image }) to select the image.

    This extends the experimental Durable Object-managed Containers interface.

Patch Changes

v1.54.11

Compare Source

Patch Changes

v1.54.10

Compare Source

Patch Changes
  • #​14775 1be7b97 Thanks @​dario-piotrowicz! - Sync Local Explorer endpoint lists across agent hints

    The Local Explorer endpoint list is now consistent across the three places it appears: the AGENTS.md template in create-cloudflare, the runtime agent hint in wrangler dev, and the Vite plugin agent hint. All three now include the observability/clear endpoint, use the canonical /cdn-cgi/local/explorer path, and have cross-reference comments pointing to each other.

  • #​15399 982b806 Thanks @​tpmmorris! - Improve over-limit run_worker_first errors when duplicate rules are present

    The error now reports distinct and duplicate-entry counts and lists duplicated rules, making it clear when removing redundant entries can bring the configuration within the limit.

    Too many `run_worker_first` rules were provided; 105 rules provided (99 distinct, 6 duplicate entries) exceeds max of 100. Note: duplicate entries count towards the route limit. Ensure that no duplicate rules are present in your `run_worker_first` configuration.
    
    The duplicated rules found are:
    - "/rule/0"
    - "/rule/1"
    - "/rule/2"
    - "/rule/3"
    - "/rule/4"
    ...and 1 more duplicated rule.
    
  • Updated dependencies [1be7b97, b149147, 7db596c, 76c0ce6, a83d7ac, a0856da, e35c4a1, d3565a5, a83d7ac, cb0955f, fa79b26, 16d1310, ca71205, 1015cfb, 982b806, ffabe74, 7db596c, e03822a, a83d7ac, 641df47, c4a6279]:

v1.54.9

Compare Source

Patch Changes
  • #​15574 164e4fb Thanks @​RealBhupesh! - Ignore .wrangler persistence writes in Vite's file watcher

    Miniflare stores local D1, KV, R2, and observability state under .wrangler/state. Those writes were watched as source changes on Linux and Windows, which fired every plugin hotUpdate hook and could make page loads take seconds. The plugin now ignores **/.wrangler/** while preserving any server.watch.ignored patterns already set by the user.

  • Updated dependencies [8997652]:

v1.54.8

Compare Source

Patch Changes

v1.54.7

Compare Source

Patch Changes

v1.54.6

Compare Source

Patch Changes

v1.54.5

Compare Source

Patch Changes
  • #​15519 e004845 Thanks @​devaniketh! - Preserve HTTP/2 :authority header and non-default port in dev server requests

    When Vite runs over HTTPS with HTTP/2 enabled, browsers send authority via the :authority pseudo-header rather than Host. Previously, pseudo-headers were omitted when creating Fetch requests, causing non-default ports to be dropped from request.url and X-Forwarded-Host. Authority and scheme are now preserved from HTTP/2 pseudo-headers and request properties.

  • Updated dependencies [8bbcb9f, 2b42d6f, ea5634e, c0c6504, ffc7efd, 682cd44]:

v1.54.4

Compare Source

Patch Changes

v1.54.3

Compare Source

Patch Changes

v1.54.2

Compare Source

Patch Changes

v1.54.1

Compare Source

Patch Changes

v1.54.0

Compare Source

Minor Changes
  • #​15134 c66d2d5 Thanks @​gpanders! - Enable FUSE-capable local container development

    Miniflare now automatically passes the Docker privileges needed for FUSE to loc

❗ Important

✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
vite (source) ^8.3.0 → ^8.3.2 age confidence

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
rolldown (source) ^1.2.11 → ^1.2.12 age confidence

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
acorn ^8.18.0 → ^8.19.0 age confidence
es-module-lexer ^3.0.2 → ^3.0.3 age confidence
rolldown (source) ^1.2.11 → ^1.2.12 age confidence

Release Notes

acornjs/acorn (acorn)

v8.19.0

Compare Source

guybedford/es-module-lexer (es-module-lexer)

v3.0.3

Compare Source

What's Changed

Full Changelog: guybedford/es-module-lexer@3.0.2...3.0.3


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@changesets/cli (source) ^3.0.2 → ^3.0.3 age confidence
@codspeed/vitest-plugin (source) 5.2.0 → 5.7.1 age confidence
@earendil-works/pi-ai (source) ^0.83.0 → ^0.99.2 age confidence
@flue/runtime (source) ^2.0.3 → ^2.2.2 age confidence
bgproc ^0.2.0 → ^0.3.0 age confidence
eslint (source) ^10.4.0 → ^10.12.0 age confidence
eslint-plugin-regexp ^3.1.0 → ^3.3.1 age confidence
p-limit ^7.3.0 → ^7.3.3 age confidence
pkg-pr-new (source) ^0.0.71 → ^0.0.88 age confidence
pnpm (source) 11.27.0 → 11.28.4 age confidence
prettier (source) ^3.9.0 → ^3.9.9 age confidence
pretty-bytes ^7.1.0 → ^7.2.0 age confidence
publint (source) ^0.3.17 → ^0.3.25 age confidence
rolldown (source) ^1.2.11 → ^1.2.12 age confidence
tinyexec ^1.0.2 → ^1.3.1 age confidence
tinyglobby (source) ^0.2.16 → ^0.2.17 age confidence
tsx (source) ^4.22.0 → ^4.23.15 age confidence
turbo (source) ^2.10.2 → ^2.11.7 age confidence
typescript-eslint (source) ^8.59.1 → ^8.71.0 age confidence
valibot (source) ^1.2.0 → ^1.5.0 age confidence

Release Notes

changesets/changesets (@​changesets/cli)

v3.0.3

Compare Source

Patch Changes
CodSpeedHQ/codspeed-node (@​codspeed/vitest-plugin)

v5.7.1

Compare Source

What's Changed

Full Changelog: CodSpeedHQ/codspeed-node@v5.7.0...v5.7.1

v5.7.0

Compare Source

Highlights

  • Dump full inlining information for higher optimization tiers in walltime so we can show more functions on the profiler. To test it out, set CODSPEED_WALLTIME_PROFILER=samply env variable in the codspeed action.
  • Added support for tinybench v5 and v6 in @​codspeed/tinybench-plugin

What's Changed

Full Changelog: CodSpeedHQ/codspeed-node@v5.6.0...v5.7.0

v5.6.0

Compare Source

What's Changed

Full Changelog: CodSpeedHQ/codspeed-node@v5.5.0...v5.6.0

v5.5.0

Compare Source

Highlights

We are introducing @codspeed/playwright, for walltime benchmarking and profiling of end to end browser applications through playwright.

Here's an example usage, but head to the docs for more information

import { bench, type Page } from "@codspeed/playwright-plugin";
import electronExecutable from "electron";
import path from "node:path";
import { fileURLToPath } from "node:url";

const __dirname = path.dirname(fileURLToPath(import.meta.url));
const appRoot = path.resolve(__dirname, "..");

async function waitUntilSettled(page: Page): Promise<void> {
  await page.waitForFunction(() => {
    const main = document.getElementById("main");
    return !!main && !main.classList.contains("loading");
  });
}

await bench(
  "inbox-search-archive-threads",
  async ({ page }) => {
    await page.fill("#search", "update");
    await waitUntilSettled(page);

    await page.click("#select-visible-btn");
    await page.click("#archive-btn");
    await waitUntilSettled(page);

    await page.click('#sidebar nav button[data-view="threads"]');
    await waitUntilSettled(page);
  },
  {
    target: {
      kind: "electron",
      appPath: path.join(appRoot, "out/main/index.js"),
      cwd: appRoot,
    },
    beforeRound: async ({ page }) => {
      page.setDefaultTimeout(180_000);
      await page.waitForSelector("#main");
      await waitUntilSettled(page);
    },
  },
);

Note: this plugin is only compatible with the walltime instrument.

What's Changed

Full Changelog: CodSpeedHQ/codspeed-node@v5.4.0...v5.5.0

v5.4.0

Compare Source

What's Changed

This release adds first support for macOS walltime.

Please note that profiling and other instruments are not yet available on macOS and will come in a later update.

Full Changelog: CodSpeedHQ/codspeed-node@v5.3.0...v5.4.0

v5.3.0

Compare Source

What's Changed

We now collect buildtime and runtime environment data to warn users about differences in their runtime environment when comparing two runs against one another.

This data includes toolchain metadata like version and build options, as well as a list of dynamically loaded linked libraries.

Full Changelog: CodSpeedHQ/codspeed-node@v5.2.0...v5.3.0

earendil-works/pi (@​earendil-works/pi-ai)

v0.99.2

Compare Source

Added
  • Added the lightweight @earendil-works/pi-ai/models entry point for model collections and provider construction without loading TypeBox, built-in catalogs, or provider SDKs.
  • Added Anthropic workload identity federation from the Anthropic SDK environment variables ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID, and ANTHROPIC_IDENTITY_TOKEN_FILE (plus optional ANTHROPIC_SERVICE_ACCOUNT_ID and ANTHROPIC_WORKSPACE_ID). API keys and ANTHROPIC_AUTH_TOKEN take precedence (#​10177, #​10242 by @​philfreo)
Fixed
  • Fixed context overflow detection for Z.AI CN endpoint Prompt exceeds max length errors (#​10208)
  • Fixed Anthropic requests failing when a strict: "prefer" tool schema uses keywords Anthropic strict tool use rejects, such as minimum/maximum; such tools are now sent non-strict (#​9953)
  • Fixed provider retries firing immediately when a Retry-After header contains an unparseable date; they now use exponential backoff (#​9571)

v0.99.1

Compare Source

Added
  • Added GPT-6.1 Sol (gpt-6.1-sol) to the OpenAI, Azure OpenAI Responses, and OpenAI Codex providers.

v0.99.0

Compare Source

Breaking Changes
  • Unified image models into the regular Provider/Models surface. The separate ImagesModels collection is removed: createImagesModels(), createImagesProvider(), ImagesProvider, openrouterImagesProvider(), builtinImagesProviders(), and builtinImagesModels() are gone. Use builtinModels(), models.getModelOfType("image", ...), models.generateImages(), and createProvider({ models, images }) instead. Existing unqualified reads remain chat-only.
  • Image models are now ImageModel with a required type: "image" and share BaseModel with chat models. The old plural image type names (ImagesModel, ImagesApi, KnownImagesApi, KnownImagesProvider, and ImagesProviderId) are removed. generateImages() accepts only image models. Output modalities (output) remain on image models only.
  • Generated model data schema is now version 6: every entry carries type, operation-specific catalogs include chat, image, and classifier models, and one upstream ID may have separate entries per type. OpenRouter image models live in the openrouter-images api group of openrouter.json; image-models.generated.ts and scripts/generate-image-models.ts are removed. Run npm run hydrate:model-data.
Added
  • Added Models.generateImages() with provider-resolved auth, Provider.generateImages?, and createProvider({ images }) keyed by model.api. createProvider() models and fetchModels accept models of every type, and api is optional when images or classifiers is given.
  • Added an optional model type ("chat", "image", or "classifier"). Chat models may omit it, so existing chat models, providers, and stores keep working unchanged. Narrow mixed lists with the new isModelType() guard or read the effective type with getModelType().
  • Added getModelsOfType(), getModelOfType(), getAvailableOfType(), getAllModels(), and getAllAvailable() on Models; optional Provider.getAllModels() and Provider.filterAllModels(); corresponding generated-catalog accessors; and the AnyModel and ModelTypeMap types. hasApi(), calculateCost(), and modelsAreEqual() accept AnyModel.
  • Added support for models of every type in ModelsStoreEntry.models. Stored and fetched models of unknown types are dropped instead of failing a refresh.
  • Added classifier models and Models.classify() with a provider-neutral JEV-style choice/score/bool contract. The built-in TypeSafe provider exposes models.dev's jev-latest through the System One API and translates public bool questions to TypeSafe's noul wire format.
  • Added Jev classifier models on OpenRouter (typesafe/jev-1.13, ~typesafe/jev-latest) through its TypeSafe-compatible System One endpoint, and on Cloudflare Workers AI (typesafe/jev) through the new cloudflare-workers-ai-system-one classifier API.
  • Added Jev classifier models on Vercel AI Gateway (typesafe-ai/jev, generated from its evaluation model catalog) and OpenCode Zen (jev-1.13, jev-1.13-free) through their TypeSafe-compatible System One endpoints.
  • Added usage to ClassifierResult: System One classifications report token counts, priced from the model catalog like chat usage.
  • Added a runtime chat-model check to the Models stream entry points so non-chat models fail with a clear ModelsError instead of a missing-api stream error.
  • Added array-based models.all.json and providers/{id}.all.json variants to the generated and published JSON catalog, allowing the same upstream ID once per model type; the existing keyed models.json and providers/{id}.json stay chat-only for released clients.
  • Added onProviderStreamEvent to observe parsed provider stream events before normalization, including provider-specific fields not retained in assistant messages (#​9784, #​9901 by @​davidbrai).
  • Added Claude Sonnet 5.5 to the built-in Anthropic model catalog with adaptive thinking, mid-conversation effort, 1M context, and official pricing metadata.
  • Added Sign in with ChatGPT to the openai provider: an OAuth login that uses a ChatGPT subscription with the OpenAI API. Models.login() accepts LoginOptions with getDeviceId(), which supplies a stable installation ID to login flows that need one. Subscription usage-limit errors are not retried and link to the ChatGPT usage page; temporary usage errors are retried.
  • Added the llama-cpp-classify classifier API, which answers classifier questions from llama-server's next-token probabilities for single-token answer labels.
  • Added optional AssistantMessage.thinkingLevel, which records the thinking level the agent loop requested for a response.
Changed
  • Renamed the OpenAI Codex provider to "OpenAI Codex (legacy)"; Sign in with ChatGPT on the openai provider supersedes it.
  • Unified the Anthropic, OpenAI Codex, OpenRouter, and Radius browser sign-in callback servers into one shared implementation with the same browser pages. The OAuth page helpers are now available as @earendil-works/pi-ai/utils/oauth-page.
  • Changed Radius browser sign-in to exchange the authorization code before showing the browser page, so token exchange failures are shown in the browser.
Fixed
  • Fixed 1-hour Anthropic cache writes reported by Vercel AI Gateway in streaming deltas being priced at the 5-minute rate (#​9210).
  • Fixed model-level samplingParams being dropped by direct stream()/complete() calls on OpenAI-compatible APIs (#​9506).
  • Fixed Mistral GLM models producing empty text blocks and split thinking blocks from empty content deltas, which could make later requests fail with "Expected at most one leading ThinkChunk" (#​9674).
  • Fixed OpenAI Fast mode requests being priced at the standard rate when the response reports service_tier: "fast", as GPT-6 models do (#​10034).
  • Fixed Mistral reasoning models ignoring the requested thinking level: GLM 5.3 now uses reasoning_effort instead of prompt_mode, GLM 5.2 accepts max, and Mistral models only offer the effort levels the API supports (#​9678).
  • Fixed OpenCode Zen and OpenCode Go qwen3.8-flash thinking being replayed as plain text on later turns because the endpoint returns empty thinking signatures (#​10047).
  • Fixed OpenAI Responses streams returning unfinished tool calls as runnable, which made servers that omit output_index (such as llama.cpp) run mixed-up commands; such streams now end with an error (#​9974).
  • Fixed Anthropic and OpenAI Codex browser sign-in waiting indefinitely after the provider redirected with an authorization error; sign-in now fails with the provider's error description.
  • Fixed Anthropic browser sign-in failing when its callback port is in use; it now falls back to pasting the redirect URL.
  • Fixed GitHub Copilot Claude Opus 5.5 offering unsupported thinking levels when upstream model metadata is incomplete; it now offers low through max.

v0.87.1

Compare Source

Added
  • Added Claude Opus 5.5, GPT-6 Sol, and GPT-6 Luna to the GitHub Copilot catalog.
  • Added GPT-6 Sol and GPT-6 Luna for OpenAI API keys and OpenAI Codex subscriptions, with full reasoning-effort, prompt-caching, tool-search, long-context pricing, and official cost metadata.
  • Added Claude Opus 5.5 to the built-in Anthropic model catalog with adaptive thinking, 1M context, and official pricing metadata.
  • Added Grok 4.7 to the built-in xAI model catalog with long-context pricing metadata.
Fixed
  • Fixed image-only user messages being rejected by some OpenAI-compatible providers because they included an empty text part (#​9797)
  • Fixed Anthropic OAuth requests reporting an outdated Claude Code version.

v0.87.0

Compare Source

Added
  • Added model image-input limit and cache-safe resize metadata to the generated catalog (#​9631).
Fixed
  • Fixed unknown OpenAI-compatible Chat Completions endpoints receiving strict tool schemas unless they explicitly advertise support, while preserving strict tools for capable built-in models (#​9816).

v0.86.1

Compare Source

Added
  • Added Meta provider (Model API key and Muse subscription OAuth) with Muse Spark models (#​9096 by @​xl0).
Fixed
  • Fixed z.ai Prompt too long errors not being recognized as context overflow (#​9805).
  • Fixed Cerebras models advertising unsupported strict tool schemas, which caused HTTP 400 errors when strict and non-strict tools were mixed (#​9804 by @​EdenGottlieb).

v0.86.0

Compare Source

Breaking Changes
  • Changed provider-facing ProviderStreams and StreamFunction inputs from Context to normalized TranscriptContext values. System prompts and tool declarations now live in transcript system messages; custom providers must read them with getCurrentSystemPrompt() and getCurrentTools(). See System Messages.
  • Restricted ToolCall.arguments and ToolResultMessage.details to JSON-compatible values, changed ToolResultMessage into a conditional type, and made JsonValue arrays readonly.
Added
  • Added transcript-backed mid-conversation system prompt and tool changes, with native replay on supported models and automatic collapse for other providers. See System Messages (#​9548).
  • Added a generated public Radius model catalog for synchronous API lookup, with cached and live gateway catalogs overlaid at runtime.
  • Enabled native deferred tool loading for Fireworks Messages models. Use ToolSearch or tool_search as the loader name for prompt-prefix deferral (#​9323).
  • Added RetryPolicy.maxAgentDelayMs support to cap shared assistant retry backoff for summarization calls (#​8826).
  • Added Model.promptCache lifetime metadata for short and long retention tiers to support prompt-cache warming decisions (#​9668).
Fixed
  • Fixed GitHub Copilot GPT models, including GPT-6 Astra, using the Chat Completions adapter instead of the required Responses adapter (#​9253 by @​petrroll).
  • Fixed DeepSeek V4.1 thinking levels on OpenRouter and OpenCode Go preserving provider effort metadata (#​9485).
  • Fixed bodyless HTTP 400/413 errors from non-Cerebras providers being misclassified as context overflow (#​9482).
  • Fixed Vercel AI Gateway replaying unsigned thinking as assistant text (#​9676).
  • Fixed Google Generative AI and Vertex AI using unsupported thinking levels when reasoning is omitted or when model capabilities differ within a Gemini family (#​9455).
  • Fixed Anthropic-compatible relays breaking signed thinking replay when they report a different response model, while preserving fallback pricing (#​9188).
  • Fixed Amazon Bedrock one-hour cache writes being priced at the five-minute rate (#​9457).
  • Fixed quadratic CPU usage when draining buffered EventStream events (#​9055).
  • Fixed Mistral Medium reasoning requests to use reasoning_effort for all reasoning-capable mistral-medium-* model IDs instead of the unsupported prompt_mode (#​8700).
  • Fixed OpenCode and OpenCode Go requests to send x-opencode-session from sessionId across all supported API adapters (#​9326).
  • Fixed OpenAI Codex requests to send the model's Off reasoning effort instead of omitting it, while respecting unsupported Off mappings (#​9191).
  • Fixed Fireworks unsigned thinking replay and reasoning effort selection using catalog metadata, with verified DeepSeek V4 and Qwen3.8 fallbacks and removal of redundant GLM 5.2 and Kimi K3 effort aliases (#​9323).
  • Fixed OpenRouter requests to send x-session-id from sessionId for Chat Completions and Anthropic Messages models when prompt caching is enabled (#​9102).
  • Fixed the DeepSeek catalog to advertise deepseek-flash for DeepSeek V4.1 Flash instead of retired Flash aliases, and refreshed DeepSeek pricing metadata (#​9423).
  • Fixed Mistral-hosted GLM-5.2 reasoning requests to use reasoning_effort instead of the ignored prompt_mode (#​9375).
  • Fixed OpenAI-compatible Responses errors to identify the actual provider instead of always labeling them as OpenAI errors (#​9298).
  • Fixed Baseten requests to send session-affinity headers from sessionId for automatic prompt-cache routing (#​9629).
  • Fixed retry classification for Cloudflare 520 responses (#​9627).
  • Fixed retry classification for transient Azure peak-load capacity errors (#​9669).
Removed
  • Removed GPT-5.4 and GPT-5.4 mini from the OpenAI Codex catalog after they became unavailable to ChatGPT accounts (#​9394).

v0.85.1

Compare Source

Added
  • Added GPT-6 Astra for OpenAI API keys and OpenAI Codex subscriptions.
Fixed
  • Fixed long prompt-cache requests for GPT-5.6+ Responses models to use prompt_cache_options.ttl: "30m" instead of prompt_cache_retention: "24h".

v0.85.0

Compare Source

Breaking Changes
  • Replaced createGatewayBindingFetch() with createAiBindingFetch() for Cloudflare Workers AI bindings. Configure the model's Workers AI Gateway passthrough baseUrl directly; requests now pass through the binding unchanged (#​8287 by @​Maximo-Guk).
Added
  • Added compact, persistable assistant-message frames with AssistantMessageFrameEncoder and reduceAssistantMessageFrames().
  • Added the vllmPriority OpenAI-compatible model setting for forwarding scheduler priority to vLLM (#​9004 by @​AppleDannyClegg).
  • Added the supportsMaxOutputTokens OpenAI Responses compatibility setting (#​8941 by @​scturtle).
  • Added an optional timestamp argument to uuidv7() for follower IDs.
  • Added narrow api, providers, and utils subpath exports for direct imports without loading the package barrel.
  • Added Anthropic per-turn effort persistence, deterministic historical effort markers, and signed-thinking mismatch recovery for supported Claude models across Anthropic Messages transports, including OpenRouter.
  • Added Meta provider (Model API key and Muse subscription OAuth) with Muse Spark models.
Fixed
  • Removed the unavailable Grok Build 0.1 model from the built-in xAI catalog (#​9093 by @​Jaaneek).
  • Fixed assistant-message frames preserving the provider thinking level.
  • Fixed simple provider streams to consistently emit standard stream events and custom tool-call deltas.
  • Fixed the Qwen Token Plan Individual catalog to include Qwen3.8 Flash (#​9021).
  • Fixed Baseten GLM-5.2 models incorrectly advertising image input support (#​8293 by @​Panoplos).
  • Fixed Fireworks GLM models using the wrong API adapter.
  • Removed the unnecessary Chord dependency from pi-ai by defining its exported JsonValue type directly.
  • Fixed GitHub Copilot Claude Fable 5 requests to use the Anthropic Messages adapter so selected reasoning levels are sent (#​8961).
  • Fixed OpenAI Codex SSE parsing to process terminal events that are not followed by a blank line (#​9047).
  • Fixed NO_PROXY matching for both root domains and subdomains (#​8737 by @​MeiSiristhebest).

v0.84.4

Compare Source

Added
  • Added the experimental vision-capable deepseek-v4-flash-vision-exp model to the DeepSeek catalog.
Fixed
  • Fixed OpenAI-compatible Chat Completions ignoring an explicitly requested toolChoice when no tools are defined.
  • Fixed thinking signature serialization to run once after the signature is complete (#​8671).
  • Fixed fragmented Mistral tool calls splitting when continuation chunks omit the tool-call ID (#​8387).
  • Fixed OpenAI-compatible reasoning replay to merge consecutive streamed text and summary reasoning_details deltas.
  • Fixed the Cloudflare AI Gateway catalog to include supported workers-ai/* passthrough models omitted by models.dev.
  • Fixed OpenRouter reasoning controls by deriving off support and available effort levels from OpenRouter's model metadata, preventing reasoning-mandatory models from receiving effort: "none" (#​8614 by @​davidbrai).

v0.84.3

Compare Source

Breaking Changes
  • Renamed GoogleThinkingLevel to GoogleApiThinkingLevel and added ResolvedGoogleThinkingLevel for normalized adapter levels.
Added
  • Added provider-neutral toolChoice support to simple stream requests.
  • Added automatic Anthropic server-side refusal fallback for supported first-party models, including returned-model usage pricing (#​8017).
  • Added configurable OpenAI-compatible thinking-token budget fields for vLLM, Qwen/SGLang, and llama.cpp servers (#​8275 by @​bnsd55).
  • Added China-specific ZAI Coding Plan models, including GLM-4.6V vision support, and API-equivalent usage cost estimates for models with published PAYG prices (#​8220).
  • Added deepseek-v4-pro-0813 to the Qwen Token Plan Individual catalog (#​8194).
Changed
  • Changed built-in xAI models to use the Responses API with encrypted reasoning replay and made Grok 4.6 the default xAI model (#​8124 by @​Jaaneek).
  • Changed the Anthropic, Azure OpenAI, Google Generative AI, Google Vertex, Mistral, OpenAI Chat Completions, and OpenAI Responses adapters to send Pi's default User-Agent unless overridden (#​8305).
Fixed
  • Fixed OpenAI-compatible Chat Completions reasoning replay to preserve and resend assistant-level reasoning_details (reasoning.text, reasoning.summary, and reasoning.encrypted) verbatim and in order (#​7994).
  • Fixed Anthropic server-side fallback responses being priced with the requested model instead of the returned fallback model (#​8285).
  • Fixed GitHub Copilot login triggering model-policy rate limits by limiting policy updates, retrying model discovery once, and honoring server retry delays (#​7850).
  • Fixed Amazon Bedrock dropping and failing to replay opaque redacted reasoning from non-Anthropic models (#​8314 by @​seiji).
  • Fixed Z.AI Coding Plan models deriving incomplete reasoning-effort metadata, including missing GLM-5.3 low, high, and max levels (#​8336).
  • Fixed DeepSeek V4 Flash on OpenCode and OpenCode Go omitting its supported low thinking level (#​8181 by @​tianshuang).
  • Fixed Azure OpenAI Responses ignoring toolChoice in provider-specific stream requests.
  • Fixed Amazon Bedrock after_provider_response/onResponse to forward the raw response headers instead of only the synthesized request id header (#​8234).
  • Fixed Kimi OpenAI-compatible usage reporting so top-level cached_tokens count as cache reads instead of normal input tokens (#​8075).
  • Fixed Google Generative AI and Vertex AI custom models ignoring thinkingLevelMap, which dropped extended thinking controls (#​8135).
  • Fixed Xiaomi model catalog generation retaining shut-down MiMo V2 model names after models.dev marked them deprecated (#​8187).
  • Fixed OpenRouter reasoning controls by deriving off support and available effort levels from OpenRouter's model metadata, preventing reasoning-mandatory models from receiving effort: "none" (#​8454).

v0.84.2

Compare Source

Added
  • Added createGatewayBindingFetch() for routing Cloudflare AI Gateway requests through a Workers AI binding without an API token (#​7901 by @​Maximo-Guk).
  • Added AssistantMessage.endTurn to preserve OpenAI Codex's terminal end_turn signal for diagnostics (#​7766).
Changed
  • Changed Kimi Coding requests to use pi's runtime User-Agent header.
  • Automatically converted supported strict tool schemas to provider-compatible closed objects with required nullable optional fields while preserving original tool definitions, and treated null values for optional non-nullable tool arguments as omitted.
  • Changed OpenAI Responses deferred tool loading to prefer message-anchored additional_tools where supported while retaining tool-search and top-level fallbacks (#​7709).
  • Replaced the Mistral SDK transport with a native Chat Completions HTTP stream, eliminating its generated client and schema runtime overhead.
Fixed
  • Fixed GitHub Copilot login triggering API rate limits while enabling model policies by limiting concurrent policy updates (#​6187).
  • Fixed GitHub Copilot login still triggering API rate limits by updating only account models with unconfigured policies and honoring server retry delays (#​7850).
  • Fixed upstream request buffer limit failures to trigger automatic assistant retries.
  • Fixed OpenAI Responses function and custom tool calls to preserve namespaces during streaming, proxying, and replay (#​7709).
  • Fixed built-in and custom DeepSeek API models to send output limits through the supported max_tokens field.
  • Fixed Google Generative AI and Vertex AI responses with tool calls incorrectly treating output-limit or provider-error stops as normal tool use (#​8059).
  • Fixed Amazon Bedrock replay rejecting tool arguments that contain empty object keys while preserving all valid nested values (#​7882 by @​muyiyr).
  • Fixed DeepSeek compatibility detection for base URLs whose hostname contains uppercase letters (#​7933 by @​yearth).

v0.84.1

Compare Source

Added
  • Added Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog and the shared international QWEN_TOKEN_PLAN_API_KEY (#​7659 by @​arasovic).

v0.84.0

Compare Source

Breaking Changes
  • Renamed the exported ModelsStreamTransforms interface to ModelsRequestTransforms because its header transformation now applies to all authenticated provider requests.

  • Required dynamic model providers to accept a concrete RefreshModelsContext.signal; Models.refresh() remains unbounded when callers omit its optional signal.

  • Required provider login, API-key check/resolution, and OAuth refresh implementations to accept a concrete abort signal; public auth and credential operations remain unbounded when callers omit their optional signal.

  • Replaced raw RefreshModelsContext.store access with the read-only context.stored snapshot and generation-checked context.publish() transaction.

    createProvider({ fetchModels }): no catalog-publication migration is required. Before and after, return the fetched list; createProvider() restores stored models and publishes and persists refreshed models itself. signal is now guaranteed to be present.

    // Before
    const beforeProvider = createProvider({
      // ...
      fetchModels: async ({ signal }) => {
        const response = await fetch(catalogUrl, { signal });
        return parseModels(await response.json());
      },
    });
    
    // After: unchanged
    const afterProvider = createProvider({
      // ...
      fetchModels: async ({ signal }) => {
        const response = await fetch(catalogUrl, { signal });
        return parseModels(await response.json());
      },
    });

    Handwritten Provider.refreshModels(): replace direct store access and pre-publication mutation with generation-guarded publications.

    // Before
    refreshModels: async (context) => {
      const stored = await context.store.read();
      if (stored) currentModels = stored.models;
      if (!context.allowNetwork) return;
    
      const refreshed = await fetchModels(context.signal);
      currentModels = refreshed;
      await context.store.write({ models: refreshed, checkedAt: Date.now() });
    },
    
    // After
    refreshModels: async (context) => {
      if (context.stored) {
        const restored = context.stored.models;
        if (!(await context.publish({
          update: () => { currentModels = restored; },
        }))) return;
      }
      if (!context.allowNetwork) return;
    
      const refreshed = await fetchModels(context.signal);
      if (context.signal.aborted) return;
      await context.publish({
        persist: { models: refreshed, checkedAt: Date.now() },
        update: () => { currentModels = refreshed; },
      });
    },

    In publish(), omit persist to leave storage unchanged, pass a ModelsStoreEntry to write it, or pass persist: null to delete it. Omit update for metadata-only persistence; omit persist for an ephemeral in-memory publication.

Added
  • Added optional OAuthAuth.isSubscription metadata for distinguishing subscription-backed authentication from generic OAuth sign-in.
  • Added explicit TelemetryContext propagation across stream, deferred, and image request options using the vendor-neutral @earendil-works/pi-telemetry contract.
  • Added deferred provider request contracts, durable response handles, authenticated fetch/cancel dispatch, and faux-provider support for pending, ready, failed, and cancelled responses (#​7339 by @​davidbrai).
  • Added Baseten as a built-in OpenAI-compatible provider with models.dev catalog generation and native chat_template_args reasoning controls.
  • Added arbitrary OpenAI-compatible sampling parameters through Model.samplingParams and StreamOptions.samplingParams, including per-request overrides (#​7568 by @​mrexodia).
  • Added opt-in vLLM thinking_token_budget support for OpenAI-compatible models, reserving output tokens for the final answer (#​7638 by @​bnsd55).
  • Added OpenAICompletionsCompat.supportsFinishReason for providers that omit streamed finish_reason values, inferring normal and tool-use stops when the stream ends.
  • Added structured Amazon Bedrock failure diagnostics with HTTP status, modeled error code, and AWS request id when available (#​7286 by @​brianstanley).
Changed
  • Added optional cancellation to ModelsStore reads, writes, and deletions; catalog orchestration binds these waits to the provider refresh signal.
Fixed
  • Fixed GitHub Copilot Grok 4.5 requests to use the supported Responses API (#​7560).
  • Bounded OAuth token refreshes so stalled requests release the credential-store lock (#​7508).
  • Fixed tool argument validation to preserve values that already match an anyOf/oneOf union arm before attempting coercion, avoiding nullable unions converting null to another primitive value (#​7328).
  • Fixed cancellation of model catalog refreshes so callers stop waiting even when a custom provider ignores its abort signal (#​7027).
  • Fixed auth resolution, availability checks, OAuth refreshes, provider login, and in-memory credential queue waits to honor caller cancellation.
  • Fixed newer provider refreshes being blocked by or overwritten by an older stalled generation, including persisted catalog publication.
  • Updated GPT-5.6 Terra and Luna pricing across OpenAI and passthrough model catalogs.
  • Fixed Fireworks Kimi K3 models to use the OpenAI-compatible API with native reasoning-effort levels and deferred tools (#​7199, #​7230 by @​XBeg9).
  • Fixed Fireworks GLM 5.2 models sending the unsupported prompt_cache_retention field when long cache retention is enabled, and enabled session affinity for automatic prompt caching (#​7676).
  • Updated Groq's Qwen reasoning override for the replacement qwen/qwen3.6-27b model.
  • Fixed the OpenCode Go provider display name.
  • Fixed provider error normalization treating arrays and class instances as structured response bodies instead of preserving their original errors (#​7205 by @​erikogenvik).
  • Fixed Anthropic streams dropping text or thinking included in the initial content-block event (#​7358 by @​davidbrai).
  • Fixed Google history conversion dropping signed empty text and thinking blocks required for replay (#​7362 by @​jingtao-wisdomgraph).
  • Fixed OpenAI Codex cached WebSocket sessions being shared across different account credentials (#​7364).
  • Fixed transient Google Generative AI and Vertex AI provider errors bypassing automatic retries (#​7471 by @​vish-pr).
  • Fixed Gemini 3 tool call ids being discarded during history conversion, breaking signed multi-turn replay (#​7494 by @​muyiyr).
  • Fixed OpenAI Responses incomplete reasons so only max_output_tokens is treated as a length stop, and exposed bounded recovery detection for responses truncated below their intended output limit (#​7540 by @​davidbrai).
  • Restored GitHub Copilot models returned through account-specific policy responses (#​7672 by @​muyiyr).
  • Replaced the retired Qwen Token Plan qwen3.8-max-preview model with qwen3.8-max (#​7670 by @​QuintinShaw).
withastro/flue (@​flue/runtime)

v2.2.2

Compare Source

Patch Changes
  • 2cb57be: Fix Claude models on the cloudflare-ai-gateway provider failing with 404 not_found_error: model: claude-sonnet-4.6 was not found. Since Pi 0.84.3 the gateway catalog lists Claude models with dotted versions (claude-sonnet-4.6), but the gateway's native Anthropic endpoint forwards the model ID to Anthropic, which only accepts dashed IDs. Flue now registers these models under Anthropic's IDs (cloudflare-ai-gateway/claude-sonnet-4-6); dotted specifiers still resolve to them. The cloudflare binding provider, which uses Cloudflare's dotted catalog names, is unchanged.

v2.2.1

Compare Source

Patch Changes
  • 548937e: Fix model specifiers that stopped resolving after the Pi 0.87.1 up

❗ Important

✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
vite (source) ^8.3.0 → ^8.3.2 age confidence

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
package-manager-detector ^1.8.0 → ^1.9.0 age confidence

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

Changes

  • Fixes astro add wiping existing allowBuilds approvals in pnpm-workspace.yaml on pnpm v11.0–v11.22 when an integration needs a build script approved (currently workerd for Cloudflare), a regression from #18287. On those versions --allow-build replaces the whole map, so later installs fail with ERR_PNPM_IGNORED_BUILDS for previously approved packages.
  • The packages are now merged into the existing map before installing now

Testing

  • Updated test/units/cli/add-pnpm.test.ts

Docs

  • N/A, bug fix
withastro/astro

This PR contains the following updates:

Package Change Age Confidence
@types/hast (source) ^3.0.4 → ^3.0.5 age confidence
@types/picomatch (source) ^4.0.2 → ^4.0.3 age confidence
fast-xml-parser ^5.5.7 → ^5.11.2 age confidence
package-manager-detector ^1.6.0 → ^1.9.0 age confidence
picomatch ^4.0.4 → ^4.0.7 age confidence
shiki (source) ^4.0.2 → ^4.5.0 age confidence
smol-toml ^1.8.0 → ^1.9.0 age confidence
zod (source) ^4.5.4 → ^4.6.5 age confidence

Release Notes

NaturalIntelligence/fast-xml-parser (fast-xml-parser)

v5.11.2

Compare Source

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.1...v5.11.2

v5.11.1

Compare Source

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.0...v5.11.1

v5.11.0

Compare Source

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.0

v5.10.1

Compare Source

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1

v5.10.0

Compare Source

What's Changed

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.0

v5.9.3

Compare Source

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.2...v5.9.3

v5.9.2

Compare Source

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.1...v5.9.2

v5.9.1

Compare Source

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.0...v5.9.1

v5.9.0: update strnum, use is-unsafe

Compare Source

  • update strnum to 2.3.0
    • you can set hex, binary, enotation, infinity, unicode
  • validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.
antfu-collective/package-manager-detector (package-manager-detector)

v1.9.0

Compare Source

   🚀 Features
    View changes on GitHub

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
vite (source) ^8.3.0 → ^8.3.2 age confidence

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
@qwik.dev/partytown ^0.14.4 → ^0.14.5 age confidence

Release Notes

QwikDev/partytown (@​qwik.dev/partytown)

v0.14.5

Compare Source

Patch Changes
  • 🐞🩹 fall back right away when navigator.serviceWorker.register() fulfills without a registration (e.g. Playwright's serviceWorkers: 'block'), instead of throwing Cannot read properties of undefined (reading 'active') (by @​MFA-G in #​764)

  • 🐞🩹 read scroll offsets from the main thread instead of caching them, so scripts such as GA4 observe scrolling after their initial read. (by @​Niek in #​766)

  • 🐞🩹 define HTMLCollection in the web worker so x instanceof HTMLCollection no longer throws (e.g. gtag's user-provided-data DOM scan) (by @​gioboa in #​762)


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
@fastify/static ^10.1.4 → ^10.1.5 age confidence

Release Notes

fastify/fastify-static (@​fastify/static)

v10.1.5

Compare Source

What's Changed

New Contributors

Full Changelog: fastify/fastify-static@v10.1.4...v10.1.5


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

Changes

  • Astro.cache was undefined when the 404 or 500 page was rendered through renderDefaultError (production) or renderDevError (dev), because those handlers created a new FetchState without calling provideCache(). Any Astro.cache.set() in an error page or its shared layout would throw mid-stream, discarding the rendered body and returning Internal server error instead.
  • Both error handlers now call await provideCache(errorState), the same way the normal rendering pipeline does. With no cache provider configured, the disabled no-op shim is used. Error pages still do not go through handleCache, so cache.set() there sets no CDN headers.

Testing

  • Added packages/astro/test/units/cache/app-cache.test.ts covering the case where Astro.cache is present and non-undefined when a 404 is rendered via the error handler path (method-mismatch on an API route).

Docs

  • No docs update needed; this restores behavior that was already guaranteed by the non-optional cache: CacheLike type signature.

Closes #18275

withastro/astro

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

astro@7.3.8

Patch Changes

  • #18293 28e7410 Thanks @astro-factory! - Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

  • #18298 0e9e857 Thanks @matthewp! - Fixes astro add removing existing allowBuilds approvals from pnpm-workspace.yaml with pnpm v11.0–v11.22

  • #18263 882dd98 Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

  • #18290 31f13c3 Thanks @astro-factory! - Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob such as !(drafts)/**/*.md

create-astro@5.2.6

Patch Changes

  • #18263 882dd98 Thanks @florian-lefebvre! - Removes the automatic allowScripts and allowBuilds pre-approval from generated projects. Astro's dependencies no longer run install scripts, so the workaround is no longer needed.

@astrojs/markdoc@2.0.11

Patch Changes

  • #18263 882dd98 Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

@astrojs/netlify@8.2.9

Patch Changes

  • #18263 882dd98 Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.
  • Updated dependencies []:
    • @astrojs/underscore-redirects@1.0.4

@astrojs/vercel@11.0.13

Patch Changes

  • #18263 882dd98 Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

astro-vscode@2.17.2

Patch Changes

  • #18263 882dd98 Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.
withastro/astro

Changes

  • Workers Cache reports a refused purge, including one over the rate limit, as success: false in the result of cache.purge() (docs). The provider dropped that result, so cache.invalidate() resolved and the pages stayed cached with nothing logged. Workers Cache purges always use the Free-tier limit of 5 per minute per account, with a bucket of 25 (limits), which a site that purges on every content save can reach.
  • The provider throws when success is false, with Cloudflare's errors as the error's cause, as invalidate() already does on Netlify when its purge request fails. Successful purges are unchanged. Callers that await invalidate() after a write start seeing rejections; EmDash is guarding its calls in emdash-cms/emdash#3987.

Testing

  • New test/units/cache-purge.test.ts covers the purge step with a stand-in cache object, since cloudflare:workers does not load in Node: an accepted purge passes the tags through and resolves, a refused one rejects with the returned errors as cause.

Docs

  • None needed: the route caching guide does not describe what invalidate() does when a purge fails, for any provider.
withastro/astro

Changes

  • The dev-server watcher filter in the glob loader no longer misclassifies extglob patterns like !(hidden|_docs)/**/*.{md,mdx} as exclusions. Previously, any pattern starting with ! was treated as a negation, leaving positivePatterns empty and causing all change, add, and unlink events to be silently ignored. The fix mirrors tinyglobby's own rule: a pattern is an exclusion only when it starts with ! and the next character is not (. This restores live-reload for these patterns without affecting plain negations like !drafts/**.
  • First load was unaffected because tinyglobby already applied this distinction; only the watcher path was wrong.

Testing

  • New unit test added in packages/astro/test/units/content-layer/glob-loader.test.ts covering a glob collection configured with an extglob exclusion pattern; the test verifies that file-change events are forwarded to the loader. The test fails without the fix and passes with it.

Docs

  • No docs update needed — this is a bug fix restoring already-documented behaviour; the glob loader API itself is unchanged.

Closes #18289

withastro/astro

Fixes #18285

Changes

  • The header check in renderPage parsed as (inject && dest === 'header') || dest === 'adapter', so with cspDestination: 'adapter' (e.g. Vercel staticHeaders: true) the CSP header went out in astro dev too, where shouldInjectCspMetaTags is false. Its style-src has no hashes for Vite's inline styles, so pages rendered unstyled.
  • Added the parentheses so it matches the other branch a few lines up. Builds are unaffected, since there shouldInjectCspMetaTags is true.

Testing

Two unit tests in test/units/csp/rendering.test.ts: adapter still gets the header when CSP is injected, and gets none when it isn't (the dev case). The second fails on the old condition. The CSP unit file passes (28/28).

Docs

None, this makes dev match what the docs already say.

withastro/astro

Changes

  • astro add cloudflare now succeeds on the first run when using pnpm v11 or newer. pnpm v11+ enables strictDepBuilds by default, which causes pnpm add to exit with ERR_PNPM_IGNORED_BUILDS when a transitive dependency (workerd, via wrangler/miniflare) has an unapproved build script. The install was silently counted as failed and astro.config.* was never updated.
  • When pnpm v11+ is detected, astro add now appends --allow-build=workerd to the generated pnpm add command for the Cloudflare adapter. pnpm then writes workerd: true into allowBuilds in pnpm-workspace.yaml automatically. The install-failure log also now includes stderr so the real error is visible on the first failed run.

Testing

  • Added packages/astro/test/units/cli/add-pnpm.test.ts covering the --allow-build=workerd flag injection for the Cloudflare adapter under pnpm v11+, and confirming that older pnpm versions and other adapters are unaffected.

Docs

  • No docs update needed; this is a CLI behavior fix with no user-facing API change.

Closes #18286

withastro/starlight

Description

While reviewing and doing some tests for #4218, I noticed some Failed to resolve dependency warnings being logged when running the development server in projects using the Cloudflare adapter.

These dependencies were actually never dependencies of Expressive Code but of Starlight itself and were removed in #4134. This now causes the warning. I guess these directives were working previously due to pnpm hoisting behavior and Vite does not care about the exact path but if it can resolve the dependency or not.

To test, I ran:

  1. cd packages/starlight
  2. pnpm build && pnpm pack --out /tmp/sl-cloudflare-test.tgz

In a new directory, I then ran the following commands:

  1. pnpm create astro@latest . -- --template starlight --install --no-git
  2. pnpm astro add cloudflare
  3. pnpm add /tmp/sl-cloudflare-test.tgz
  4. pnpm dev

Here is a comparison before and after the changes:

Before After
SCR-20261007-153402@2x SCR-20261007-154011@2x
withastro/astro

Changes

  • Restores the Deno 2.9.5 pin for the integrations test suite. Renovate bumped deno-version to 2.9.6 in #18279, and Deno 2.9.6 dropped --allow-scripts from deno eval, which @netlify/edge-functions-dev passes to boot its dev server.
  • Ignores the deno dependency in .github/renovate.json5 so Renovate stops updating the deno-version input of denoland/setup-deno.
  • Made with AI

Testing

  • N/A

Docs

  • N/A
withastro/astro

This PR contains the following updates:

Package Change Age Confidence
@shikijs/rehype (source) ^4.0.2 → ^4.5.0 age confidence
@shikijs/twoslash (source) ^4.0.2 → ^4.5.0 age confidence
@types/estree (source) ^1.0.8 → ^1.0.9 age confidence
@types/hast (source) ^3.0.4 → ^3.0.5 age confidence
acorn ^8.16.0 → ^8.18.0 age confidence
linkedom ^0.18.12 → ^0.18.13 age confidence
preact (source) ^10.29.0 → ^10.29.8 age confidence
react (source) ^19.0.0 → ^19.3.0 age confidence
react-dom (source) ^19.0.0 → ^19.3.0 age confidence
rehype-pretty-code (source) ^0.14.3 → ^0.14.5 age confidence
remark-smartypants ^3.0.2 → ^3.0.3 age confidence
satteri ^0.10.3 → ^0.10.5 age confidence
shiki (source) ^4.0.0 → ^4.5.0 age confidence
shiki (source) ^4.0.2 → ^4.5.0 age confidence
source-map ^0.7.6 → ^0.8.0 age confidence
vite (source) ^8.0.13 → ^8.3.2 age confidence

Release Notes

shikijs/shiki (@​shikijs/rehype)

v4.5.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v4.4.3

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v4.4.2

Compare Source

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub

v4.4.1

Compare Source

   🚀 Features
    View changes on GitHub

v4.4.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v4.3.1

Compare Source

   🚀 Features
    View changes on GitHub

v4.3.0

Compare Source

   🚀 Features
    View changes on GitHub

v4.2.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v4.1.0

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
rehype-pretty/rehype-pretty-code (rehype-pretty-code)

v0.14.5

Compare Source

Patch Changes
  • fix: detect showLineNumbers wherever it appears in the meta string, not only before the highlight annotations, while ignoring the word when it is part of a character highlight such as /foo showLineNumbers bar/ (#​204)
  • fix: stop character-highlight ranges leaking across patterns, so an id-only annotation like /foo/#a no longer makes a later pattern inherit the previous pattern's range, and a range-ignored occurrence no longer consumes the whole token it lives in (#​169)

Range-excluded occurrences are counted without changing the token tree, so unhighlighted markup remains intact.

Partial highlights contained within a transformer-generated element preserve that surrounding semantic element instead of cloning it.

v0.14.4

Compare Source

Patch Changes
  • fix: prevent an infinite loop in inline character highlighting when a pattern matches text that spans multiple syntax tokens and occurs more than once on the same line (#​185)
silvenon/remark-smartypants (remark-smartypants)

v3.0.3

Compare Source

bruits/satteri (satteri)

v0.10.5

Compare Source

Patch changes
  • Updated dependencies: satteri-mdxjs (Cargo)@​0.3.13

v0.10.4

Compare Source

Patch changes
  • Updated dependencies: satteri-mdxjs (Cargo)@​0.3.13
mozilla/source-map (source-map)

v0.8.0

Compare Source


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Type Update Change Age Confidence
CodSpeedHQ/action action minor v5.2.1 → v5.4.0 age confidence
changesets/action action patch v2.1.1 → v2.1.2 age confidence
deno (source) uses-with patch v2.9.5 → 2.9.6 age confidence
node uses-with minor 24.15.0 → 24.21.0 age confidence
node uses-with minor 24.18.0 → 24.21.0 age confidence
pnpm/action-setup action minor v6.0.8 → v6.1.0 age confidence
zizmorcore/zizmor-action action minor v0.5.6 → v0.6.4 age confidence

Release Notes

CodSpeedHQ/action (CodSpeedHQ/action)

v5.4.0

Compare Source

Bumps the CodSpeed runner to v5.4.0, including v5.3.0 and v5.3.1.

The Memory instrument now tracks physical (resident) memory and captures allocation call stacks to build memory flamegraphs. Both are enabled by default and can be turned off with the new disable-memory-track-physical and disable-memory-capture-stack inputs. Serialization is also faster on large memory benchmarks.

The action now exposes the id of the CodSpeed run as a run-id output, and CodSpeed now works on non-Ubuntu/Debian distributions such as Arch Linux.

🚀 Features
  • Track physical memory and capture allocation call stacks for memory flamegraphs, both enabled by default by @​not-matthias in #​529, #​522 and #​553
  • Expose the run id as a GitHub Actions step output by @​moha-bekh in #​551
  • Add an --experimental-disable-pythonmalloc-override flag (CODSPEED_EXPERIMENTAL_DISABLE_PYTHONMALLOC_OVERRIDE) to stop overriding the Python allocator, which can break free-threaded Python in simulation mode, by @​not-matthias in #​539
  • Apply kernel memory tunables before memory-mode runs, and fail early when the kernel has no BTF by @​not-matthias in #​507 and #​524
  • Pause producers under ring buffer pressure in memory mode, and log process stops per reason by @​not-matthias in #​543
  • Log which authentication method the run uses by @​fargito in #​521
🐛 Bug Fixes
⚡ Performance
⚙️ Internals

Full Runner Changelog:
https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md

What's Changed

New Contributors

Full Changelog: CodSpeedHQ/action@v5.2.1...v5.4.0

changesets/action (changesets/action)

v2.1.2

Compare Source

Patch Changes
denoland/deno (deno)

v2.9.6

Compare Source

  • feat(compressible): add support for 'text/x-component' content type (#​36450)
  • feat(desktop): clipboard api (#​35750)
  • feat(desktop): support checked, icon, and tooltip on menu items (#​36649)
  • fix(bundle): isolate esbuild downloads from workspace registries (#​36467)
  • fix(cache): combine duplicate headers for Vary matching (#​36476)
  • fix(cli_parser): remove orphaned sync-types parser
  • fix(core): cap adaptive buffer initial allocations (#​36432)
  • fix(core): make Unix pipe fd ownership explicit (#​36353)
  • fix(core): make user timer waker state thread-safe (#​36495)
  • fix(coverage): compare a range against a line in V8's units (#​36613)
  • fix(crypto): preserve RSA-OAEP label bytes (#​36441)
  • fix(desktop): keep dots in the app name when resolving the runtime library
    (#​36006)
  • fix(desktop): keep the macOS bundle signature valid unless an update is
    applied (#​36574)
  • fix(desktop): never block the JS thread on the error-report dialog (#​36575)
  • fix(desktop): propagate deno.json version and license into packaged installers
    (#​36577)
  • fix(desktop): run Vite-based HMR dev servers inside the desktop runtime
    (#​36488)
  • fix(desktop): transport binding args and results as DesktopValue so Uint8Array
    survives (#​36573)
  • fix(ext/fetch): enforce permissions for proxy transports (#​36217)
  • fix(ext/fetch): only retry transport errors on pooled connections (#​36415)
  • fix(ext/fetch): raise default HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE to 256KB
    (#​36558)
  • fix(ext/http): keep request body readable after response is sent (#​36629)
  • fix(ext/http): route invalid async responses to onError (#​36437)
  • fix(ext/napi): don't invoke napi_wrap finalizer twice at teardown (#​36556)
  • fix(ext/napi): run JS-calling finalizers safely, NULL string result, and
    Float16Array (#​36572)
  • fix(ext/napi): surface OS error and path on addon load failure (#​36630)
  • fix(ext/napi): track pending finalizers by identity (#​36551)
  • fix(ext/napi): wake the event loop at the next uv_timer deadline (#​36559)
  • fix(ext/net): skip unsupported DNS records in ANY queries (#​36650)
  • fix(ext/node): accept string ports in dns.lookupService (#​36546)
  • fix(ext/node): build the proxied request target with the URL parser (#​36557)
  • fix(ext/node): do not resume client TLS sessions unless requested (#​36592)
  • fix(ext/node): fix perf_hooks detail.req.url proxied path duplication (#​36407)
  • fix(ext/node): handle readv short reads (#​36211)
  • fix(ext/node): require sys permission for inspector.open (#​36465)
  • fix(ext/node_sqlite): invalidate sessions on database close (#​36633)
  • fix(ext/tls): avoid panic for mismatched client certificate and key (#​36457)
  • fix(ext/web): clean up abort handlers when listeners are removed (#​36226)
  • fix(ext/web): close transfer MessagePort when a transferred readable is
    cancelled (#​36270)
  • fix(ext/web): snapshot SharedArrayBuffer input in TextDecoder.decode()
    (#​36611)
  • fix(fetch): require an initial multipart boundary (#​36470)
  • fix(ffi): validate struct return buffers (#​36373)
  • fix(fmt): honor .editorconfig when formatting from stdin (#​36267)
  • fix(fs): require write permission for creating opens (#​36497)
  • fix(fs): use a private FsFile constructor token (#​36439)
  • fix(glob): retain valid gitignore rules after parse errors (#​36478)
  • fix(http): preserve keep-alive after reading request body (#​36690)
  • fix(http): truncate streaming responses to content length (#​36496)
  • fix(lsp): restrict registry completion endpoint schemes (#​36477)
  • fix(node): check reads during require resolution (#​36461)
  • fix(node): match domain uncaught exception handling (#​36475)
  • fix(node): preserve v8 deserializer view offsets (#​36460)
  • fix(node): validate Brotli encoder operations (#​36530)
  • fix(node): validate raw outgoing HTTP headers (#​36471)
  • fix(node/crypto): preserve binary key export passphrases (#​36443)
  • fix(node_crypto): apply RFC 7748 scalar decoding for X448 (#​36466)
  • fix(node_crypto): size cipher updates by byte length (#​36459)
  • fix(node_shim): preserve explicit argument delimiters (#​36435)
  • fix(npm): flatten single-resolution peers when building package ids (#​36608)
  • fix(npm): match peer fallbacks when checking peer resolution cache (#​36607)
  • fix(npm): remove arrayref dependency (#​36653)
  • fix(npm): resolve bare npm specifier when latest is too new for min dependency
    age (#​36619)
  • fix(npm): use cached abbreviated metadata under --cached-only (#​36526)
  • fix(npm): validate tar paths before extraction (#​36468)
  • fix(os): serialize process environment updates (#​36074)
  • fix(permissions): check resolved IP against import deny list (#​36486)
  • fix(process): reject NULs in Windows arguments (#​36436)
  • fix(process): validate whitespace-only loader environment values (#​36431)
  • fix(publish): authenticate the package existence check so private packages
    work (#​36656)
  • fix(publish): memoize publish order depth (#​36215)
  • fix(publish): reject invalid JSR package names (#​36474)
  • fix(repl): skip regex literals when validating input (#​36375)
  • fix(runtime): unregister dropped signal resources (#​36213)
  • fix(web): keep MessagePort resource identifiers private (#​36440)
  • fix: bugs in primordials related to ObjectCreate and
    ObjectDefineProperties (#​36541)
  • fix: prevent threadpool starvation with concurrent file locks (#​32789)
  • perf(core): grow the op driver's future arena on demand (#​36678)
  • perf(core): uncontended-borrow fast path for AsyncRefCell (#​36679)
  • perf(core): use index-based SafeArrayIterator in primordials (#​36543)
  • perf(core): zero-copy snapshot rehydration, drop bincode (#​36680)
  • perf(ext/web): apply the base64url op design to standard base64 (#​36422)
  • perf(ext/websocket): shrink the op_ws_create future (#​36681)
actions/node-versions (node)

v24.21.0: 24.21.0

Compare Source

Node.js 24.21.0

v24.20.0: 24.20.0

Compare Source

Node.js 24.20.0

v24.19.0: 24.19.0

Compare Source

Node.js 24.19.0

v24.18.1: 24.18.1

Compare Source

Node.js 24.18.1

v24.18.0: 24.18.0

Compare Source

Node.js 24.18.0

v24.17.0: 24.17.0

Compare Source

Node.js 24.17.0

v24.16.0: 24.16.0

Compare Source

Node.js 24.16.0

pnpm/action-setup (pnpm/action-setup)

v6.1.0

Compare Source

What's Changed

Full Changelog: pnpm/action-setup@v6.0.10...v6.1.0

v6.0.10

Compare Source

What's Changed
New Contributors

Full Changelog: pnpm/action-setup@v6...v6.0.10

v6.0.9

Compare Source

What's Changed

Full Changelog: pnpm/action-setup@v6...v6.0.9

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.6.4

Compare Source

Sponsorship is appreciated!

zizmor 1.30.1 is now the default version.

Release notes: https://docs.zizmor.sh/release-notes/#​1301

v0.6.3

Compare Source

zizmor 1.30.0 is now the default version.

Release notes: https://docs.zizmor.sh/release-notes/#​1300

v0.6.2

Compare Source

zizmor 1.29.0 is now the default version.

v0.6.1

Compare Source

zizmor 1.28.0 is now the default version used by the action.

v0.6.0

Compare Source

zizmor 1.27.0 is now the default version used by the action.

What's Changed

New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0

v0.5.7

Compare Source

1.26.1 is now available via the action
1.26.1 is now the default version of zizmor used by the action


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
@sveltejs/vite-plugin-svelte (source) ^7.1.0 → ^7.3.1 age confidence
@testing-library/svelte (source) ^5.3.1 → ^5.4.2 age confidence
svelte (source) ^5.55.7 → ^5.57.1 age confidence
svelte2tsx (source) ^0.7.55 → ^0.7.61 age confidence
vite (source) ^8.0.13 → ^8.3.2 age confidence
vitefu ^1.1.2 → ^1.1.3 age confidence

Release Notes

sveltejs/vite-plugin-svelte (@​sveltejs/vite-plugin-svelte)

v7.3.1

Compare Source

Patch Changes
  • fix: inject the inspector into the client under Vite+ on pnpm, where the realpathed client module has no vite/ segment before dist/ (#​1373)

v7.3.0

Compare Source

Minor Changes
  • feat: pass environment to dynamicCompileOptions (#​1386)
Patch Changes
  • fix: don't log inline config when encountering unexpected options (#​1376)

v7.2.0

Compare Source

Minor Changes
  • feat(inspector): add a context menu with current component stack (#​1370)

v7.1.4

Compare Source

Patch Changes
  • fix: enforce ltr styles for inspector (#​1324)

v7.1.3

Compare Source

Patch Changes
  • fix: ensure the inspector is injected into the client correctly for Vite+ projects (#​1355)
testing-library/svelte-testing-library (@​testing-library/svelte)

v5.4.2

Compare Source

@​testing-library/svelte 5.4.2 (2026-06-23)

Bug Fixes
Dependencies

v5.4.1

Compare Source

@​testing-library/svelte 5.4.1 (2026-06-21)

Dependencies

v5.4.0

Compare Source

@​testing-library/svelte 5.4.0 (2026-06-20)

Features
Dependencies
sveltejs/language-tools (svelte2tsx)

v0.7.61

Compare Source

Patch Changes
  • fix: handle SvelteKit 3 changed imports for zero types feature (#​3106)

v0.7.60

Compare Source

Patch Changes
  • fix: remove type dependency on magic-string (#​3101)

v0.7.59

Compare Source

Patch Changes
  • fix: throw a friendly error for TypeScript 7 stable (#​3073)

v0.7.58

Compare Source

Patch Changes
  • feat: zero-config +error.svelte props (#​3076)

v0.7.57

Compare Source

Patch Changes
  • fix: don't crash on array binding holes in destructured exports (e.g. export let { d: [a, , c] } = obj) (#​3058)

v0.7.56

Compare Source

Patch Changes
  • fix: properly handle props with the name slot inside Svelte 5 snippets (#​3030)

  • fix: take into account component references when calculating snippet hoistabilty (#​3032)

  • fix: use local name for marking bindable props used (#​3017)

  • feat: support Svelte 5 declaration tags (#​3033)

  • fix: drop declarations emitted outside declarationDir (#​2965)


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

Changes

  • Raises the minimum supported Node.js version to 22.22.0 in all packages
  • Pins the floor to the latest Node.js 22 release that StackBlitz supports, so 22.22 instead of 22.23
  • Made with AI

Testing

  • N/A

Docs

  • Changeset
withastro/astro

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

astro@7.3.7

Patch Changes

  • #18266 cba76cc Thanks @astro-factory! - Fixes a build error when a Markdown content collection entry loaded with glob({ deferRender: true }) has a layout frontmatter property. layout is now ignored for content collection entries, as documented.

  • #18287 38f6793 Thanks @astro-factory! - Fixes astro add cloudflare failing to install dependencies with pnpm v11+ by approving the workerd build script, and shows the package manager's error output when astro add fails to install dependencies

  • #18222 fcf6ed6 Thanks @mingjunlu! - Fixes an issue where AVIF images were served as image/heif instead of image/avif in the dev server.

  • #18240 de4df06 Thanks @astro-factory! - Fixes the cache() handler from astro/hono and astro/fetch throwing a TypeError when a cache provider is configured. It now registers the cache provider before rendering, so Astro.cache is available to downstream handlers like pages().

  • #18268 547b572 Thanks @astro-factory! - Fixes security.checkOrigin rejecting cross-origin requests with non-form content types such as application/json. As documented, the check only applies to unsafe requests that have no content-type header or one of application/x-www-form-urlencoded, multipart/form-data, or text/plain.

@astrojs/netlify@8.2.8

Patch Changes

  • #18180 6fb83da Thanks @matthewp! - Fixes Netlify Image CDN patterns generated from image.remotePatterns pathnames ending in /** so they only match paths below that directory, consistent with Astro's own pattern matching. Previously, a pattern like /public/** also matched sibling paths sharing the prefix, such as /public-assets/.
  • Updated dependencies []:
    • @astrojs/underscore-redirects@1.0.4

@astrojs/language-server@2.17.2

Patch Changes

withastro/astro

Changes

Replaces the description for the sync command in astro help to match:

Testing

N/A

Docs

This is docs. I added a changeset as this kinda fix docs.

withastro/astro

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated.

⚠️⚠️⚠️⚠️⚠️⚠️

next is currently in pre mode so this branch has prereleases rather than normal releases. If you want to exit prereleases, run changeset pre exit on next.

⚠️⚠️⚠️⚠️⚠️⚠️

Releases

@astrojs/cloudflare@15.0.0-beta.2

Patch Changes

  • #18196 e6a2e90 Thanks @swissky! - Fails the build with a migration hint when a project has a wrangler.json, wrangler.jsonc, or wrangler.toml file but no cloudflare.config.ts. Previously the build succeeded and the Worker name, bindings, and entrypoint from the Wrangler file were silently ignored. Run npx cf migrate --bundler vite to generate cloudflare.config.ts from your existing Wrangler configuration.
withastro/astro

Changes

  • Restores the documented security.checkOrigin contract: isForbiddenCrossOriginRequest now skips the CSRF check when the request carries a non-form Content-Type (e.g. application/json). This was accidentally broken in 7.3.6 by #15595, which ported Go's CrossOriginProtection and dropped the content-type check entirely — causing any cross-origin JSON POST/PATCH/PUT/DELETE to receive a 403, contrary to docs.
  • The new Sec-Fetch-Site/Origin logic introduced in 7.3.6 is kept intact for requests with no Content-Type or a form-like one (application/x-www-form-urlencoded, multipart/form-data, text/plain). FORM_CONTENT_TYPES and hasFormLikeHeader, which were left with no callers after #15595, are now used again.

Testing

  • Extended packages/astro/test/units/app/csrf.test.ts with cases covering application/json, application/json; charset=utf-8, and Application/JSON (case-insensitive) — all should pass through, matching 7.3.5 behavior.
  • Existing cases for form-like content types and missing Content-Type are unchanged, confirming no regression.

Docs

  • No docs update needed; the existing security.checkOrigin JSDoc and configuration reference already describe the correct (form-only) scope that this fix restores.

Closes #18267

withastro/astro

Changes

  • Markdown files loaded through a content collection with deferRender: true no longer treat layout as a special frontmatter key. Previously, the ?astroPropagatedAssets wrapper imported the bare .md path, causing astro:markdown to emit an unresolvable import Layout from "<value>" — contradicting the documented behavior that layout is ignored inside content collections.
  • The assets wrapper now requests .md files with a ?astroMarkdownContentEntry query flag. astro:markdown skips layout processing when that flag is present, leaving Markdown pages and direct .md imports unaffected.

Testing

  • Added packages/astro/test/units/vite-plugin-markdown/layout.test.ts covering the case where a Markdown content entry with a layout frontmatter key and deferRender: true builds without error.

Docs

  • No docs update needed; the existing docs already state that layout is not a special property when using content collections.

Closes #18169

withastro/astro

Changes

  • When a Hono worker entry uses cf() + pages() without going through App.render, an unmatched request returned an empty 404 with an internal X-Astro-Error: true header instead of serving the prerendered 404.astro. This adds a new notFound() middleware to astro/hono (and its underlying fetch handler in astro/fetch) that calls renderErrorFromState with status: 404 when no route matched, mirroring what astro() (handleRequest) already does internally.
  • astro() now delegates to the same shared helper, so the behavior is consistent across both usage styles. Users with a custom cf() + pages() chain can add notFound() between them to serve the prerendered 404 page.

Testing

  • New unit tests in packages/astro/test/units/fetch/index.test.ts cover the notFound() handler returning the prerendered 404 through prerenderedErrorPageFetch and passing through when a route does match.
  • New unit tests in packages/astro/test/units/hono/index.test.ts cover the Hono notFound() middleware under the same conditions.

Docs

Closes #18232

withastro/astro

Changes

Replaces direct esbuild usage with Vite and Rolldown APIs and removes the esbuild dependency from the affected packages:

  • astro uses transformWithOxc for env replacement and Rolldown for client directive bundling.
  • @astrojs/netlify, @astrojs/vercel, and @astrojs/markdoc bundle with Rolldown.
  • astro-scripts and astro-vscode build with Rolldown.
  • create-astro no longer writes allowScripts or allowBuilds, and the example projects drop their stale entries.

Made with AI

Testing

  • pnpm run build:ci builds every package.
  • The astro unit suite and the affected integration suites pass.

Docs

Changesets

withastro/astro

Changes

  • Paths not in the static route table (e.g. /en/about rewritten by middleware to /about) no longer receive a forced status: 404 from Vercel's platform routing layer when the 404 page is server-rendered. Previously, the catch-all route in .vercel/output/config.json unconditionally included status: 404 regardless of destination, causing middleware-rewritten routes to return 404 even though the render function produced a valid 200 response.
  • status: 404 is now only set when the catch-all destination is the static /404.html (i.e. fourOhFourRoute.isPrerendered is true). When the 404 page is server-rendered, status is omitted so the function returns the real HTTP status — 200 for middleware-rewritten valid routes, 404 from 404.astro for genuinely missing pages.

Testing

  • Adds a test case in packages/integrations/vercel/test/server-rendered-error-pages.test.ts covering the catch-all route config emitted when the 404 page is server-rendered, asserting that status is absent from the route entry.

Docs

  • No docs update needed; this is a bug fix in generated Vercel routing config with no API surface change.

Closes #18134

withastro/astro

Changes

  • In dev mode, CSS from unrelated pages was leaking into a route's <head> whenever the route (or anything it imported) reached virtual:astro:manifest → virtual:astro:pages. That virtual module dynamically imports every page in the app, so the CSS graph walk continued into every other page's import graph and attached all of their styles.
  • Adds page-boundary checks to ensureModulesLoaded and collectCSSWithOrder in vite-plugin-css/index.ts, skipping modules whose ID starts with \0virtual:astro:page:. This mirrors the build-mode isBuildCssBoundary approach introduced for the same bug class in #16116, now applied to the dev pipeline.

Testing

  • No new automated test was added in this PR (sandbox infrastructure prevented fixture creation during triage). An integration test modelled on i18n-css-leak.test.ts — which covers the build-mode counterpart — should follow.

Docs

  • No docs update needed; this is a bug fix with no API or configuration changes.

Closes #18060

withastro/astro

Changes

  • Content collection edits are now picked up after a config-triggered dev server restart (Configuration file updated. Restarting...). Previously, viteServer.restart() replaced Vite's file watcher but the global ContentLayer was never re-initialized, leaving loaders subscribed to the closed watcher and ignoring all subsequent file changes.
  • After a successful in-place restart, handleChangeRestart now re-creates globalContentLayer with the new settings and the new Vite watcher, reuses the existing data store (exposed via a new store getter on ContentLayer), and re-runs watchContentConfig() and sync(). This restores the behavior that existed before the in-place restart path was introduced in #16059.

Testing

  • Added packages/astro/test/content-layer-dev-restart.test.ts, an integration test that starts the dev server, triggers an in-place config restart, then edits a content entry and asserts the change is reflected — covering the exact regression path.

Docs

  • No docs update needed; this is a bug fix restoring previously expected dev-server behavior with no API changes.

Closes #18216

withastro/astro

Changes

  • The fontsource() provider now accepts font family names with a " Variable" suffix (e.g. "Inter Variable"), matching the naming convention used on fontsource.org and in @fontsource-variable/* npm packages. Previously, specifying name: "Inter Variable" produced warnings and loaded no font because the fontsource API uses "Inter" as the canonical family name with no "Variable" suffix.
  • When a lookup returns no data, the provider retries with the " Variable" suffix stripped. This is safe because none of the ~2100 families in the fontsource API include "Variable" in their name.

Testing

  • Added a unit test in packages/astro/test/units/assets/fonts/e2e.test.ts (resolves fontsource fonts with "Variable" suffix (#18143)) that confirms name: "Inter Variable" resolves correctly through the provider pipeline.

Docs

  • No docs update needed; this is a bug fix restoring behavior that users already expected based on fontsource's own documentation.

Closes #18143

withastro/astro

Changes

  • When astro:rollup-plugin-build-css deletes a client CSS asset because the SSR/prerender build already bundled all of its CSS modules, the asset's filename was left in viteMetadata.importedCss of the chunks that import it. Vite's vite:build-import-analysis then wrote that deleted filename into __vite__mapDeps, causing the browser to preload a file that doesn't exist in dist/ (404).
  • At the end of generateBundle in plugin-css.ts, any CSS asset that was deleted and not restored is now also removed from every client chunk's importedCss set, matching the behavior already used by the inline-stylesheets plugin in the same file.

Testing

  • Extended the css-dangling-references integration test with a hydrated-island fixture page that exercises the exact scenario: a component is both a client:load island and reachable through a dynamic import on the same page. The test asserts that no CSS filename in any chunk's __vite__mapDeps is missing from dist/.
  • Also fixed the hash regex in that test (updated from [\da-f]{8} to match Vite 8's base64-like hashes) so the assertion can actually catch regressions.

Docs

  • No docs update needed; this is a build-output correctness fix with no user-facing API change.

Closes #18191

withastro/astro

Changes

  • Integration-injected page routes (tagged origin: 'external') no longer receive a 404 from finalizeI18n when i18n.routing.prefixDefaultLocale: true is set. Previously, I18nRouter.matchPrefixAlways returned notFound for any path without a locale segment, replacing the already-rendered page response with a 404.
  • The fix checks state.routeData?.origin === 'external' and skips the locale-prefix routing check (step 1) for those routes. The i18n fallback logic (step 2) still runs, so integrations that inject locale-aware routes retain their fallback handling. All project-owned routes are unaffected.

Testing

  • Added a unit test in packages/astro/test/units/i18n/i18n-middleware.test.ts covering an external-origin page route under prefixDefaultLocale: true, asserting it returns the rendered response instead of a 404.

Docs

  • No docs update needed. This restores expected behavior for an existing API (injectRoute) and does not introduce new configuration surface.

Closes #18223

withastro/astro

Changes

  • Malformed JSON request bodies and percent-encoded action names that cannot be decoded no longer produce a 500 error. They now return BAD_REQUEST (400) and NOT_FOUND (404) respectively, consistent with how the actions system already handles other invalid-request scenarios (unknown action → 404, wrong content type → 415).
  • The getAction catch block is extended to treat URIError (thrown by decodeURIComponent for malformed percent-encoding) as a NOT_FOUND, and the parseRequestBody catch block is extended to treat SyntaxError (thrown by JSON.parse/Request.json() for invalid JSON) as a BAD_REQUEST with a fixed message. This prevents adversarial or scanner-generated requests from polluting server error logs with unhandled exceptions.

Testing

  • Two new unit tests added to packages/astro/test/units/actions/actions-app.test.ts in a new "Actions malformed request handling" block: one covering a malformed JSON body returning 400, and one covering an undecodable action name returning 404 on both the RPC and form paths.

Docs

  • No docs update needed; this is an internal error-handling correction with no new user-facing API.

Closes #18142

withastro/astro

Changes

  • Content files with # or ? in their name or path are now loaded correctly by the glob loader. Previously, encodeURI left those characters unescaped, causing the WHATWG URL parser to treat them as hash/query delimiters and truncate the path — leading to an ENOENT error and a silently dropped collection entry.
  • Introduces a small resolveEntryUrl() helper that percent-encodes # and ? after encodeURI. All three affected call sites in glob.ts (generateIdDefault, syncData, isConfigFile) now use it, keeping the ./ prefix established by #17762 for : handling.

Testing

  • Added unit test cases in packages/astro/test/units/content-layer/glob-loader.test.ts covering files named with # and ? to ensure they resolve to the correct path and are not dropped from the collection.

Docs

  • No docs update needed; this is a bug fix restoring expected behavior for file naming that was already implicitly supported.

Closes #18199

withastro/astro

Changes

  • trailingSlash(), middleware(), and pages() now return an empty 400 for paths with too many layers of percent-encoding, matching the behaviour of astro(). Previously those handlers routed the partly-decoded path, producing a 404 and allowing user middleware to run on the invalid request.
  • A shared helper rejectInvalidEncoding(state) in core/routing/invalid-encoding.ts encapsulates the check. handleRequest, handleTrailingSlash, handleMiddlewareWithErrorFallback, and handlePagesWithErrorFallback each call it first, so the rejection holds regardless of how the pipeline is composed.

Testing

  • Extended packages/astro/test/units/fetch/index.test.ts to cover pages() and trailingSlash()+middleware()+pages() pipelines receiving a multi-level encoded path (/api/%2525252525252525252561dmin), asserting a 400 with an empty body and no middleware execution.

Docs

  • No docs update needed; this restores an existing security behaviour to composable handlers with no new public API.

Closes #18233

withastro/astro

Changes

  • Localized error routes (e.g. /pt/404, /pt/500) now return the correct HTTP status code when rendered through the composable pages() handler (astro/hono, astro/fetch). Previously, handlePagesWithErrorFallback never called getDefaultStatusCode, so FetchState.status stayed at its default of 200 and that value was copied onto the response. The fix calls getDefaultStatusCode in handlePagesWithErrorFallback before delegating to handlePages, matching what render() already does on the astro() path.
  • Root /404 and /500 were already handled by a hardcoded override in renderPage; this change extends correct status-code behavior to any locale-prefixed error route recognized by isLocalizedErrorRoute.

Testing

  • New unit tests added in packages/astro/test/units/fetch/index.test.ts covering pages() requests to localized error routes (e.g. /pt/404, /pt/500) and verifying the response carries the correct non-200 status code.

Docs

  • No docs update needed; this is a bug fix restoring already-documented behavior to a code path that was missing the call.

Closes #18230

withastro/astro

Changes

  • FetchState.getAPIContext() now defers caching the context object until after props are resolved. Calls made before getProps() returns still get a valid context, and the next call (after getProps()) fills in props on the same object. This means endpoints and middleware always see the resolved props value instead of the pre-computed null.
  • handlePagesWithErrorFallback now awaits getProps() before dispatching, so the pages() composable no longer exposes props: null to endpoints when middleware() is absent.

Testing

  • Extended packages/astro/test/units/fetch/index.test.ts with a case covering actions() mounted before middleware(), asserting that endpoints and middleware both see the resolved props instead of null.

Docs

  • No docs update needed; this is a bug fix restoring already-documented behavior of context.props.

Closes #18229

withastro/astro

Changes

  • annotateSourceFile is now disabled when Vite is running in test mode (viteConfig.mode === 'test'), preventing data-astro-source-file / data-astro-source-loc attributes from appearing in HTML rendered by experimental_AstroContainer under Vitest. These annotations are only useful for the dev toolbar in a browser context and have no value in test pipelines.
  • @astrojs/compiler-rs is bumped to ^0.5.1, which is the first version that actually implements annotateSourceFile; the regression was invisible on 0.5.0 because the option was a stub.

Testing

  • Added packages/astro/test/units/compile/annotate-source-file.test.ts, which asserts that the annotateSourceFile flag is false when viteConfig.mode is 'test' and true when it is 'development' with the dev toolbar enabled.

Docs

  • No docs update needed. The annotateSourceFile option is an internal compiler detail; the fix restores existing behavior for the experimental Container API with no API surface change.

Closes #18162

withastro/astro

Changes

  • The composable cache() handler from astro/hono and astro/fetch now calls provideCache(state) before handleCache, matching the behavior of the astro() path. Previously, state.resolve('cache') returned undefined when a cache provider was configured, causing applyCacheHeaders to throw Cannot use 'in' operator to search for 'Symbol(astro:cache:apply)' in undefined and a 500 response.
  • Adds a provideAndHandleCache() helper in packages/astro/src/core/cache/handler.ts that awaits provideCache(state) then runs handleCache. The public cache() composable delegates to it; the astro() path is unchanged.

Testing

  • New unit test in packages/astro/test/units/hono/index.test.ts covering the cache() composable with a configured cache provider, asserting that a successful response is returned instead of a 500.

Docs

  • No docs update needed; this is a bug fix restoring already-documented behavior for the cache() composable.

Closes #18227

withastro/starlight

The starlight-theme-large-print demo site moved from the workers.dev subdomain to its own domain: https://starlight.xianmi.co/

The old URL keeps serving the same site (both run on the same Worker), so nothing breaks — this PR only points the community themes listing at the new canonical address. Verified live: HTTP 200, valid TLS, same content as before.

Only the href of the Large Print entry is changed (en/de/ko/ru); titles, descriptions and preview images are untouched.

withastro/starlight

Description

  • Closes #
  • What does this PR change? Give us a brief description.
  • Did you change something visual? A before/after screenshot can be helpful.
withastro/astro

This PR contains the following updates:

Package Change Age Confidence
@netlify/blobs (source) ^11.1.1 → ^11.1.3 age confidence
@netlify/functions (source) ^6.0.0 → ^6.0.2 age confidence
vite (source) ^8.3.1 → ^8.3.2 age confidence

Release Notes

netlify/primitives (@​netlify/blobs)

v11.1.3

Compare Source

Bug Fixes
  • blobs: stop blaming builds for runtime write failures (#​793) (547f70b)
Dependencies

v11.1.2

Compare Source

Dependencies
netlify/primitives (@​netlify/functions)

v6.0.2

Compare Source

Dependencies
  • The following workspace dependencies were updated

v6.0.1

Compare Source

Dependencies
  • The following workspace dependencies were updated

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
@types/alpinejs (source) ^3.13.11 → ^3.17.0 age confidence
alpinejs (source) ^3.15.8 → ^3.17.4 age confidence
vite (source) ^8.0.13 → ^8.3.2 age confidence

Release Notes

vitejs/vite (vite)

v8.3.2

Compare Source

Bug Fixes
Performance Improvements
Documentation
  • fix dead og-image PNG links in vite6/vite7 changelog entries (#​23594) (1929b4c)
Miscellaneous Chores
Code Refactoring
Tests
  • bundled-dev: accept a rolldown dev runtime with no helper imports (#​23606) (634745d)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

Fixes #18234

What this changes

@astrojs/vercel could only target Node runtimes. getRuntime() read process.version, so under Bun it saw the Node-compat version, missed SUPPORTED_NODE_VERSIONS, warned, and fell back to nodejs24.x — the deployed function never ran on Bun. The Runtime type was `nodejs${string}.x`, so a Bun runtime was impossible by type, and there was no runtime option to override it.

  • Widen Runtime to `nodejs${string}.x` | `bun${string}.x`
  • Add a runtime option to VercelServerlessConfig to pin the runtime explicitly (nodejs22.x, nodejs24.x, bun1.x, bun1.4.x)
  • Add a Bun branch to getRuntime() that keeps the detected minor and pins it when Vercel can resolve it (bun1.4.x), falling back to bun1.x for unlisted minors so a newer Bun still builds
  • Validate explicit runtimes against a single VALID_RUNTIMES list, so detection and validation cannot drift

The Node path is unchanged.

Verification

  • tsc -b across the project graph: 0 errors (same as main)
  • prettier --check and eslint on the changed file: pass

Behavior matrix (.vc-config.json runtime), verified against the equivalent change applied to the published package:

Config Result
runtime: 'nodejs22.x' nodejs22.x
runtime: 'nodejs24.x' nodejs24.x
runtime: 'bun1.x' bun1.x
runtime: 'bun1.4.x' bun1.4.x
runtime: 'nodejs20.x' build fails
autodetect under Node 22 nodejs22.x
autodetect under Node 24 nodejs24.x
autodetect under Bun 1.3 bun1.x
autodetect under Bun 1.4 bun1.4.x
withastro/astro

Changes

Fixes #18225

Fixes Astro.cookies.get() returning undefined for an incoming cookie with an empty value. For Cookie: foo=, has('foo') already returns true, but get('foo') cannot read the value.

Empty values now go through the same decoding path as other request cookies, including a custom decoder.

Testing

  • Added four regression cases covering a single empty cookie, an empty value between other cookies, a custom decoder, and an endpoint reading the cookie.
  • All four fail without the source change; the other 25 tests in those two files pass.
  • All 59 cookie tests pass with the fix.
  • Full core unit suite: 3,586 passed, one existing skip.
  • Workspace build, formatting, pnpm lint:ai, and pnpm typecheck passed.
  • A local astro dev endpoint reproduced {"present":true} on unchanged source and {"present":true,"value":""} with the fix, both with HTTP 200.

Docs

No documentation change needed. This restores reading the raw value of an existing cookie. A patch changeset is included.

withastro/astro

Changes

  • Fixes an issue where AVIF images were served as image/heif instead of image/avif in the dev server
  • Root cause: Sharp reports AVIF output as heif (see: lovell/sharp#3053), and Astro used that as the response format
  • Closes #18214

Testing

  • Added a unit test for AVIF output format
  • Verified manually in the dev server

Docs

  • No docs needed, bug fix only.
withastro/astro

Fixes #18216

Alternative to #18217, which only covers restarts caused by a config change. Created after the triage bot's report on #18216 pointed out restarts that bypass Astro's restart handler.

Changes

  • Vite also restarts on .env edits, and plugins call server.restart() directly (actions, fonts). After any restart the content layer kept listening on the closed watcher.
  • A dev-only Vite plugin calls the new ContentLayer.rewatch() from configureServer, which runs on every server creation. It moves loaders to the new watcher and settings, then re-syncs.
  • stop() of the dev server disposes the content layer it created.

Not covered: after restarts Astro didn't initiate, the handlers attached by setupContainer() and attachContentServerListeners() also stay on the closed watcher. The same approach could fix that in a follow-up.

Testing

  • Integration test: content edits after a config restart and after an actions plugin restart. Both fail without the fix.
  • Unit tests for rewatch().

Docs

No docs needed, bug fix.

withastro/astro

Changes

  • Font.astro now imports componentDataByCssVariable from a new internal module (src/assets/fonts/component-data.ts) whose types are included in the published package, instead of from virtual:astro:assets/fonts/internal which was declared only in the unpublished dev-only.d.ts. This eliminates the TS2307 error consumers see when tsc follows the astro:assets re-export into node_modules.
  • Picture.astro now narrows with 'inferSize' in props before accessing the property, fixing TS2339 errors caused by reading a field that doesn't exist on every member of the LocalImageProps | RemoteImageProps union.

Testing

No new automated tests were added — the bug only surfaces when TypeScript 7.1 with @astrojs/ts-content-mapper type-checks the published .astro files, a workflow the monorepo doesn't exercise. The 33 existing tests in the fonts, fontsource, infersize, and picture emit-file suites continue to pass.

Docs

No docs update needed — this is a type-correctness fix with no user-facing API change.

Closes #18219

withastro/astro

Fixes #18216

Changes

  • Since #16059, config restarts use Vite's in-place viteServer.restart(), which replaces the file watcher. The content layer kept listening on the closed watcher, so content changes were ignored after a restart (a regression of #12976).
  • After a successful restart, the content layer is now re-initialized on the new watcher and settings, reusing the existing data store, and re-synced. Same as on initial astro dev startup.

Testing

Added content-layer-dev-restart.test.ts: it triggers a restart by editing astro.config.mjs, then edits a content entry and expects the update to be served. It fails without the fix ("Data store did not update within timeout") and passes with it.

Docs

No docs needed, bug fix.

withastro/astro

Changes

  • What does this change?

chunkHasDynamicImports only looked at output.dynamicImports and at getModuleInfo(id).dynamicallyImportedIds. Rolldown records neither for an import annotated with /* @vite-ignore */, which is the only way to import a URL that only exists at runtime (e.g. a file an integration copies into the output). Such a chunk was therefore inlined into the HTML with Vite's raw __VITE_PRELOAD__ helper reference still in it, throwing ReferenceError: __VITE_PRELOAD__ is not defined at runtime.

Vite injects its preload helper whenever the chunk has a dynamic import and leaves it in the chunk, so this adds output.moduleIds.includes('\0vite/preload-helper.js') as a third signal. That is exactly what was suggested in the older report of the same family (#17265), and it also covers the module-info gap the existing check still has.

  • Minimal repro from #18181 (src/pages/index.astro with await import(/* @vite-ignore */ "/external.js"), public/external.js): before, dist/index.html contains __VITE_PRELOAD__; after, the chunk is not inlined and the helper is replaced.
  • Fixes #18181. Changeset added.

Testing

Added it('detects dynamic imports skipped by \/* @vite-ignore */`')topackages/astro/test/units/build/plugin-scripts.test.ts, which asserts both chunkHasDynamicImportsandshouldInlineScriptChunk` for a chunk whose only trace is the preload helper.

Verified:

  • The new test fails on main with the reported symptom and passes with the fix (rebuilt dist between runs, since this suite imports from dist).
  • test/units/build/** — 37 suites, 135 tests pass.
  • test/units/** — 3584 tests, 3581 pass. The 2 failures (test/units/assets/fonts/e2e.test.ts: "works", "merges families when possible") are pre-existing: they fail identically with this change stashed, and they compare a fetched cdn.jsdelivr.net URL, so they are environment/network dependent and unrelated to script inlining.
  • pnpm build --filter=astro exits 0. biome format and biome ci --formatter-enabled=false report no issues on the changed files.
  • Not verified: an actual astro build + browser run of the repro, because that needs a pnpm-built workspace browser target I have no browser for here.

Docs

No docs change needed. This restores the documented meaning of inlined scripts rather than changing a documented behaviour; the bug is that a @vite-ignore script silently shipped broken HTML. If you disagree, flag it and I will add an entry.

withastro/astro

Changes

  • The Cloudflare adapter's globalThis.process ??= {}; globalThis.process.env ??= {}; banner is now set on the ssr and prerender Vite environments instead of the top-level vite.build.rolldownOptions.output. With Vite 8's multi-environment build, the top-level build config was inherited by the client environment, causing the banner to be prepended to every browser chunk and inlined <script>, adding unnecessary bytes to all client assets.
  • Only the worker environments (SSR and prerender) receive the banner, as intended. Client output is unaffected. If the user has already set a top-level banner, the adapter leaves it alone.

Testing

  • Added a test case in packages/integrations/cloudflare/test/static.test.ts that verifies client chunks do not contain the banner after a build, while server chunks still do.

Docs

  • No docs update needed; this is a bug fix with no new APIs or configuration options.

Closes #18182

withastro/astro

Changes

  • Adds the headingoffset and headingreset global attributes to HTMLAttributes in astro-jsx.d.ts
    • headingoffset accepts 0–8 (as a number or numeric string), matching the spec's allowed range
    • headingreset is typed like other boolean attributes such as inert
  • Adds headingreset to htmlBooleanAttributes, so dynamic values render as a boolean attribute:
    • headingreset={true} → headingreset (previously headingreset="true")
    • headingreset={false} → omitted (previously headingreset="false", which enabled the reset)

References:

Testing

Added headingreset cases (true, false, and empty string) to test/units/app/astro-attrs.test.ts, following the existing boolean attribute cases

Docs

No docs change needed
This only adds types for standard HTML attributes and renders headingreset like the other boolean attributes

withastro/astro

This is a follow-up to #18206.

While working on that PR, I noticed the existing parsing for package names with tags and assumed astro add @astrojs/cloudflare@beta would work. When I tested it after the release, I realized the validation added in #15419 rejects the full specifier before that parsing logic runs.

This updates the validation to accept an optional version or tag while continuing to reject invalid specifiers.

withastro/astro

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated.

⚠️⚠️⚠️⚠️⚠️⚠️

next is currently in pre mode so this branch has prereleases rather than normal releases. If you want to exit prereleases, run changeset pre exit on next.

⚠️⚠️⚠️⚠️⚠️⚠️

Releases

astro@7.4.0-beta.1

Minor Changes

  • #18206 db00242 Thanks @edmundhung! - Updates astro add @astrojs/cloudflare@beta to install cf, scaffold cloudflare.config.ts, and generate types with cf

@astrojs/cloudflare@15.0.0-beta.1

Patch Changes

  • #18205 7a519a7 Thanks @ematipico! - Upgrades the @cloudflare/vite-plugin to the latest.
  • Updated dependencies []:
    • @astrojs/underscore-redirects@1.0.4
withastro/astro

Changes

This updates astro add cloudflare to scaffold a Cloudflare config for cf.

Testing

Added unit coverage for beta adapter resolution.

Docs

No documentation changes. This updates the prerelease integration setup before it becomes stable.

withastro/astro

Changes

Closes #18194

Upgrade to the latest of the vite plugin

Testing

Green CI

Docs

N/A

withastro/astro

This PR contains the following updates:

Package Change Age Confidence
@nanostores/preact ^1.0.0 → ^1.1.0 age confidence
@preact/signals (source) ^2.8.1 → ^2.11.2 age confidence
@tailwindcss/vite (source) ^4.2.1 → ^4.3.3 age confidence
@types/alpinejs (source) ^3.13.11 → ^3.17.0 age confidence
@types/react (source) ^18.3.28 → ^18.3.31 age confidence
alpinejs (source) ^3.15.8 → ^3.17.4 age confidence
hono (source) ^4.13.7 → ^4.13.11 age confidence
nanostores ^1.1.1 → ^1.5.4 age confidence
preact (source) ^10.28.4 → ^10.29.8 age confidence
sass ^1.97.3 → ^1.105.0 age confidence
solid-js (source) ^1.9.11 → ^1.9.15 age confidence
svelte (source) ^5.55.7 → ^5.57.1 age confidence
tailwindcss (source) ^4.2.1 → ^4.3.3 age confidence
vite (source) ^8.0.13 → ^8.3.1 age confidence
vitest (source) ^5.0.0 → ^5.0.2 age confidence
vue (source) ^3.5.29 → ^3.5.43 age confidence

Release Notes

nanostores/preact (@​nanostores/preact)

v1.1.0

Compare Source

alpinejs/alpine (alpinejs)

v3.17.4

Compare Source

What's Changed

New Contributors

Full Changelog: alpinejs/alpine@v3.17.3...v3.17.4

v3.17.3

Compare Source

What's Changed

New Contributors

Full Changelog: alpinejs/alpine@v3.17.2...v3.17.3

v3.17.2

Compare Source

What's Changed

Full Changelog: alpinejs/alpine@v3.17.1...v3.17.2

v3.17.1

Compare Source

What's Changed

New Contributors

Full Changelog: alpinejs/alpine@v3.17.0...v3.17.1

v3.17.0

Compare Source

What's Changed

New Contributors

Full Changelog: alpinejs/alpine@v3.16.3...v3.17.0

v3.16.3

Compare Source

What's Changed
New Contributors

Full Changelog: alpinejs/alpine@v3.16.2...v3.16.3

v3.16.2

Compare Source

What's Changed
New Contributors

Full Changelog: alpinejs/alpine@v3.16.1...v3.16.2

v3.16.1

Compare Source

What's Changed

Full Changelog: alpinejs/alpine@v3.16.0...v3.16.1

v3.16.0

Compare Source

What's Changed

New Contributors

Full Changelog: alpinejs/alpine@v3.15.12...v3.16.0

v3.15.12

Compare Source

What's Changed

New Contributors

Full Changelog: alpinejs/alpine@v3.15.11...v3.15.12

v3.15.11

Compare Source

What's Changed

New Contributors

Full Changelog: alpinejs/alpine@v3.15.10...v3.15.11

v3.15.10

Compare Source

Fixed

  • Fix x-anchor crash during wire:navigate cleanup #​4790

v3.15.9

Compare Source

What's Changed

New Contributors

Full Changelog: alpinejs/alpine@v3.15.8...v3.15.9

nanostores/nanostores (nanostores)

v1.5.4

Compare Source

v1.5.3

Compare Source

v1.5.2

Compare Source

v1.5.1

Compare Source

v1.5.0

Compare Source

  • Added eq and eqKey for custom value comparison (by @​psd-coder).
  • Fixed calling other listeners if one of them throws (by @​psd-coder).
  • Fixed listenKeys deep paths on whole store set (by @​ankit1324).

v1.4.2

Compare Source

v1.4.1

Compare Source

v1.4.0

Compare Source

  • Added batch to run one re-render on many stores changes (by @​psd-coder).
  • Added listening base key for nested mutation to listenKeys (by @​ifo123).
  • Fixed getPath throwing on null intermediate values (by @​chatman-media).
  • Fixed listenKeys on the whole set changes (by @​LeSingh1).
  • Fixed resetting computed cache on cleanStores (by @​ATOM00blue).

v1.3.0

Compare Source

  • Added globalThis.nanostoresGlobal to sync stores in JS bundles (by @​afurm).

v1.2.0

Compare Source

  • Deprecated async computed in favor of @nanostores/async (by @​Fryuni).
  • Added Store#init to fix SSR (by @​jmurty).
vitest-dev/vitest (vitest)

v5.0.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v5.0.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@astrojs/compiler-rs (source) ^0.5.0 → ^0.5.1 age confidence
@capsizecss/unpack (source) ^4.0.0 → ^4.0.1 age confidence
@clack/prompts (source) ^1.1.0 → ^1.8.1 age confidence
@fontsource/monofett (source) 5.2.8 → 5.3.0 age confidence
@fontsource/montserrat (source) 5.2.8 → 5.3.0 age confidence
@playwright/test (source) 1.58.2 → 1.63.0 age confidence
@preact/signals (source) 2.8.2 → 2.11.2 age confidence
@tailwindcss/vite (source) ^4.2.2 → ^4.3.3 age confidence
@types/picomatch (source) ^4.0.2 → ^4.0.3 age confidence
@types/react (source) ^19.0.0 → ^19.3.0 age confidence
@types/react (source) ^18.3.28 → ^18.3.31 age confidence
@types/react-dom (source) ^19.0.0 → ^19.3.0 age confidence
@vitejs/plugin-vue (source) ^6.0.5 → ^6.0.9 age confidence
am-i-vibing (source) ^0.4.0 → ^0.5.0 age confidence
astro-embed (source) ^0.13.1 → ^0.14.0 age confidence
autoprefixer ^10.4.27 → ^10.6.1 age confidence
devalue ^5.8.1 → ^5.9.4 age confidence
expect-type ^1.3.0 → ^1.4.0 age confidence
fs-fixture ^2.13.0 → ^2.16.0 age confidence
get-tsconfig 5.0.0-beta.4 → 5.0.0-beta.6 age confidence
hono (source) ^4.12.14 → ^4.13.11 age confidence
lightningcss ^1.32.0 → ^1.33.0 age confidence
magic-string ^1.0.0 → ^1.4.2 age confidence
magicast ^0.5.2 → ^0.5.5 age confidence
node-mocks-http ^1.17.2 → ^1.18.1 age confidence
oxc-transform-react (source) ^0.145.0 → ^0.151.0 age confidence
p-limit ^7.3.0 → ^7.3.3 age confidence
p-queue ^9.1.0 → ^9.3.3 age confidence
package-manager-detector ^1.6.0 → ^1.8.0 age confidence
picomatch ^4.0.4 → ^4.0.7 age confidence
postcss (source) ^8.5.8 → ^8.5.28 age confidence
postcss-preset-env (source) ^11.2.0 → ^11.5.4 age confidence
preact (source) ^10.29.0 → ^10.29.8 age confidence
preact (source) ^10.28.2 → ^10.29.8 age confidence
react (source) ^19.0.0 → ^19.3.0 age confidence
react (source) ^19.2.4 → ^19.3.0 age confidence
react (source) 19.2.4 → 19.3.0 age confidence
react-dom (source) ^19.0.0 → ^19.3.0 age confidence
react-dom (source) ^19.2.4 → ^19.3.0 age confidence
react-dom (source) 19.2.4 → 19.3.0 age confidence
rolldown (source) ^1.2.10 → ^1.2.11 age confidence
sass ^1.98.0 → ^1.105.0 age confidence
shiki (source) ^4.0.2 → ^4.4.3 age confidence
smol-toml ^1.8.0 → ^1.9.0 age confidence
solid-js (source) ^1.9.11 → ^1.9.15 age confidence
svelte (source) ^5.55.7 → ^5.57.1 age confidence
svelte (source) ^5.54.0 → ^5.57.1 age confidence
tailwindcss (source) ^4.2.2 → ^4.3.3 age confidence
tinyclip ^1.0.1 → ^1.0.3 age confidence
tinyexec ^1.0.4 → ^1.3.1 age confidence
tinyglobby (source) ^0.2.15 → ^0.2.17 age confidence
ultrahtml ^1.6.0 → ^1.7.0 age confidence
undici (source) 7.29.1 → 7.30.0 age confidence
unifont ~0.7.5 → ~0.8.3 age confidence
verkit ^0.4.0 → ^0.5.0 age confidence
vite (source) ^8.0.13 → ^8.3.1 age confidence
vitefu ^1.1.2 → ^1.1.3 age confidence
vue (source) ^3.5.30 → ^3.5.43 age confidence
vue (source) ^3.5.0 → ^3.5.43 age confidence
zod (source) ^4.5.4 → ^4.6.5 age confidence

Release Notes

withastro/compiler-rs (@​astrojs/compiler-rs)

v0.5.1

Compare Source

Patch Changes
  • b48eac6: Fixes missing data-astro-source-file and data-astro-source-loc attributes when source annotation is enabled.
  • afa7276: Fixes a ReferenceError when a slot's name is computed inside a loop, e.g. {items.map((item, i) => <div slot={item-${i}}>{item}</div>)}. Computed slot names now render into their matching named slot.
  • afa7276: Removes a stray slot="…" attribute the compiler left on elements passed to a component with a computed slot name.
  • Updated dependencies [b48eac6]
seek-oss/capsize (@​capsizecss/unpack)

v4.0.1

Compare Source

Patch Changes
bombshell-dev/clack (@​clack/prompts)

v1.8.1

Compare Source

Patch Changes

v1.8.0

Compare Source

Minor Changes
  • #​592 caa32e8 Thanks @​gameroman! - Export CANCEL_SYMBOL constant from @clack/core and @clack/prompts

  • #​594 37fca4e Thanks @​dreyfus92! - Add tab-completion to the path prompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type / and Tab again). Powered by a new opt-in completeOnTab option on autocomplete, which also shows a Tab: complete hint in the instructions footer. Default autocomplete behavior is unchanged.

  • #​583 ae636dd Thanks @​43081j! - Add async validation support to prompts, and validation state rendering to text prompts.

Patch Changes
fontsource/font-files (@​fontsource/monofett)

v5.3.0

Compare Source

fontsource/font-files (@​fontsource/montserrat)

v5.3.0

Compare Source

microsoft/playwright (@​playwright/test)

v1.63.0

Compare Source

v1.62.1

Compare Source

v1.62.0

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a

gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates
to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) /
unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an
AbortSignal, letting you
cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot()
can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and locator.screenshot() also accept webp as a type,
where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before
reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded,
fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}
🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried. The default
'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end,
one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});
New APIs
Browser and Context
  • New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.
Actions
  • New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.
Network
Evaluation
Command line & MCP
Reporters
  • The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:
// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});
Announcements
  • ⚠️ Debian 11 is not supported anymore.
Browser Versions
  • Chromium 151.0.7922.34
  • Mozilla Firefox 153.0
  • WebKit 26.5

This version was also tested against the following stable channels:

  • Google Chrome 151
  • Microsoft Edge 151

v1.61.1

Compare Source

v1.61.0

Compare Source

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();

// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
  id: credentialId,
  userHandle,
  privateKey,
  publicKey,
});
await context.credentials.install();

const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();
New APIs
Network
Browser and Screencast
  • New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
  • New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
  • The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.
Test runner
  • The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
  • Supported expect.soft.poll(...).
  • New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
  • New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
  • testInfo.errors now lists each sub-error of an AggregateError as a separate entry.
  • New -G command line shorthand for --grep-invert.
🛠️ Other improvements
  • Playwright now supports Ubuntu 26.04.
  • HAR and trace recordings now include WebSocket requests.
Browser Versions
  • Chromium 149.0.7827.55
  • Mozilla Firefox 151.0
  • WebKit 26.5

This version was also tested against the following stable channels:

  • Google Chrome 149
  • Microsoft Edge 149

v1.60.0

Compare Source

🌐 HAR recording on Tracing

tracing.startHar() / tracing.stopHar() expose HAR recording as a first-class tracing API, with the same content, mode and urlFilter options as recordHar. The returned Disposable makes it easy to scope a recording with await using:

await using har = await context.tracing.startHar('trace.har');
const page = await context.newPage();
await page.goto('https://playwright.dev');
// HAR is finalized when `har` goes out of scope.

🪝 Drop API

New locator.drop() simulates an external drag-and-drop of files or clipboard-like data onto an element. Playwright dispatches dragenter, dragover, and drop with a synthetic [DataTransfer] in the page context — works cross-browser and is great for testing upload zones:

await page.locator('#dropzone').drop({
  files: { name: 'note.txt', mimeType: 'text/plain', buffer: Buffer.from('hello') },
});

await page.locator('#dropzone').drop({
  data: {
    'text/plain': 'hello world',
    'text/uri-list': 'https://example.com',
  },
});

🎯 Aria snapshots

🛑 test.abort()

New test.abort() aborts the currently running test from a fixture, hook, or route handler with an optional message. Use it when you have detected an unrecoverable misuse and want to fail the test right away:

test('does not publish to the shared page', async ({ page }) => {
  await page.route('**/publish', route => {
    test.abort('Tests must not publish to the shared page. Use the `clone` option.');
    return route.abort();
  });
  // ...
});

New APIs

Browser, Context and Page
Locators and Assertions
Network
  • webSocketRoute.protocols() returns the WebSocket subprotocols requested by the page.
  • New option noDefaults in browserType.connectOverCDP() disables Playwright's default overrides on the default context (download behavior, focus emulation, media emulation), so attaching to a user's daily-driver browser doesn't disturb its state.
Errors and Reporting
Test runner
  • New {testFileBaseName} token in testProject.snapshotPathTemplate — file name without extension.
  • Test runner now errors when a config tries to override a non-option fixture, and rejects workers: 0 or negative values.

🛠️ Other improvements

  • HTML reporter:
    • npx playwright show-report accepts .zip files directly — no need to unzip first.
    • Steps that contain attachments inside nested children show an indicator on the parent step.
    • The repeatEachIndex is shown in the test header when non-zero.
  • Trace Viewer adds a pretty-print toggle for JSON / form request and response bodies in the network details panel.

Breaking Changes ⚠️

  • Removed long-deprecated APIs:
    • Locator.ariaRef() — use the standard locator.ariaSnapshot() pipeline.
    • handle option on BrowserContext.exposeBinding and Page.exposeBinding.
    • logger option on BrowserType.connect and BrowserType.connectOverCDP — use tracing instead.
    • Context options videosPath / videoSize — use recordVideo instead.

Browser Versions

  • Chromium 148.0.7778.96
  • Mozilla Firefox 150.0.2
  • WebKit 26.4

This version was also tested against the following stable channels:

  • Google Chrome 147
  • Microsoft Edge 147

v1.59.1

Compare Source

Bug Fixes
  • [Windows] Reverted hiding console window when spawning browser processes, which caused regressions including broken codegen, --ui and show commands (#​39990)

v1.59.0

Compare Source

🎬 Screencast

New page.screencast API provides a unified interface for capturing page content with:

  • Screencast recordings
  • Action annotations
  • Visual overlays
  • Real-time frame capture
  • Agentic video receipts
Demo

Screencast recording — record video with precise start/stop control, as an alternative to the recordVideo option:

await page.screencast.start({ path: 'video.webm' });
// ... perform actions ...
await page.screencast.stop();

Action annotations — enable built-in visual annotations that highlight interacted elements and display action titles during recording:

await page.screencast.showActions({ position: 'top-right' });

screencast.showActions() accepts position ('top-left', 'top', 'top-right', 'bottom-left', 'bottom', 'bottom-right'), duration (ms per annotation), and fontSize (px). Returns a disposable to stop showing actions.

Action annotations can also be enabled in test fixtures via the video option:

// playwright.config.ts
export default defineConfig({
  use: {
    video: {
      mode: 'on',
      show: {
        actions: { position: 'top-left' },
        test: { position: 'top-right' },
      },
    },
  },
});

Visual overlays — add chapter titles and custom HTML overlays on top of the page for richer narration:

await page.screencast.showChapter('Adding TODOs', {
  description: 'Type and press enter for each TODO',
  duration: 1000,
});

await page.screencast.showOverlay('<div style="color: red">Recording</div>');

Real-time frame capture — stream JPEG-encoded frames for custom processing like thumbnails, live previews, AI vision, and more:

await page.screencast.start({
  onFrame: ({ data }) => sendToVisionModel(data),
  size: { width: 800, height: 600 },
});

Agentic video receipts — coding agents can produce video evidence of their work. After completing a task, an agent can record a walkthrough video with rich annotations for human review:

await page.screencast.start({ path: 'receipt.webm' });
await page.screencast.showActions({ position: 'top-right' });

await page.screencast.showChapter('Verifying checkout flow', {
  description: 'Added coupon code support per ticket #&#8203;1234',
});

// Agent performs the verification steps...
await page.locator('#coupon').fill('SAVE20');
await page.locator('#apply-coupon').click();
await expect(page.locator('.discount')).toContainText('20%');

await page.screencast.showChapter('Done', {
  description: 'Coupon applied, discount reflected in total',
});

await page.screencast.stop();

The resulting video serves as a receipt: chapter titles provide context, action annotations highlight each interaction, and the visual walkthrough is faster to review than text logs.

🔗 Interoperability

New browser.bind() API makes a launched browser available for playwright-cli, @playwright/mcp, and other clients to connect to.

Bind a browser — start a browser and bind it so others can connect:

const { endpoint } = await browser.bind('my-session', {
  workspaceDir: '/my/project',
});

Connect from playwright-cli — connect to the running browser from your favorite coding agent.

playwright-cli attach my-session
playwright-cli -s my-session snapshot

Connect from @​playwright/mcp — or point your MCP server to the running browser.

@playwright/mcp --endpoint=my-session

Connect from a Playwright client — use API to connect to the browser. Multiple clients at a time are supported!

const browser = await chromium.connect(endpoint);

Pass host and port options to bind over WebSocket instead of a named pipe:

const { endpoint } = await browser.bind('my-session', {
  host: 'localhost',
  port: 0,
});
// endpoint is a ws:// URL

Call browser.unbind() to stop accepting new connections.

📊 Observability

Run playwright-cli show to open the Dashboard that lists all the bound browsers, their statuses, and allows interacting with them:

  • See what your agent is doing on the background browsers
  • Click into the sessions for manual interventions
  • Open DevTools to inspect pages from the background browsers.
Demo - `playwright-cli` binds all of its browsers automatically, so you can see what your agents are doing. - Pass `PLAYWRIGHT_DASHBOARD=1` env variable to see all `@playwright/test` browsers in the dashboard.

🐛 CLI debugger for agents

Coding agents can now run npx playwright test --debug=cli to attach and debug tests over playwright-cli — perfect for automatically fixing tests in agentic workflows:

$ npx playwright test --debug=cli

### Debugging Instructions
- Run "playwright-cli attach tw-87b59e" to attach to this test

$ playwright-cli attach tw-87b59e

### Session `tw-87b59e` created, attached to `tw-87b59e`.
Run commands with: playwright-cli --session=tw-87b59e <command>

### Paused
- Navigate to "/" at output/tests/example.spec.ts:4

$ playwright-cli --session tw-87b59e step-over

### Page
- Page URL: https://playwright.dev/
- Page Title: Fast and reliable end-to-end testing for modern web apps | Playwright

### Paused
- Expect "toHaveTitle" at output/tests/example.spec.ts:7

📋 CLI trace analysis for agents

Coding agents can run npx playwright trace to explore Playwright Trace and understand failing or flaky tests from the command line:

$ npx playwright trace open test-results/example-has-title-chromium/trace.zip
  Title:        example.spec.ts:3 › has title

$ npx playwright trace actions --grep="expect"
     # Time       Action                                                  Duration
  ──── ─────────  ─────────────────────────────────────────────────────── ────────
    9. 0:00.859  Expect "toHaveTitle"                                        5.1s  ✗

$ npx playwright trace action 9
  Expect "toHaveTitle"
  Error: expect(page).toHaveTitle(expected) failed
    Expected pattern: /Wrong Title/
    Received string:  "Fast and reliable end-to-end testing for modern web apps | Playwright"
    Timeout: 5000ms
  Snapshots
    available: before, after
    usage:     npx playwright trace snapshot 9 --name <before|after>

$ npx playwright trace snapshot 9 --name after

### Page
- Page Title: Fast and reliable end-to-end testing for modern web apps | Playwright

$ npx playwright trace close

♻️ await using

Many APIs now return async disposables, enabling the await using syntax for automatic cleanup:

await using page = await context.newPage();
{
  await using route = await page.route('**/*', route => route.continue());
  await using script = await page.addInitScript('console.log("init script here")');
  await page.goto('https://playwright.dev');
  // do something
}
// route and init script have been removed at this point

🔍 Snapshots and Locators

❗ Important

✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

withastro/astro

Fixes #18199

Changes

  • glob() escapes # and ? in the entry path before resolving it against the base URL. This changes the same three lines #17776 touched for :. Before, c#-basics.md was read from .../blog/c and dropped with an ENOENT error. With this change it loads as c-basics, and f#/intro.md loads as f/intro.
  • MDX, Markdoc and deferRender entries are imported as modules, and Vite cuts module paths at #/?. Loading them would turn the dropped entry into a failed build (Rolldown failed to resolve import "astro:content-layer-deferred-module?..."). Those entries are still skipped, but the error now says why and asks to rename the file.
  • Added a changeset.

Testing

  • Added tests to glob-loader.test.ts: a # file and a # folder, a ? file (skipped on Windows like the colon test), and a module-backed # entry that is skipped with the new error.
  • Ran: pnpm -C packages/astro exec astro-scripts test "test/units/content-layer/glob-loader.test.ts" --strip-types. The hash test fails on main with Error reading c#-basics.md: ENOENT ... posts\c and passes with the fix.
  • Ran: pnpm -C packages/astro exec astro-scripts test "test/units/content-layer/**/*.test.ts" --strip-types: 119 tests, 0 failures.
  • Checked: built the repro with this loader plus an MDX and a deferRender collection. Both Markdown posts load and render, the # MDX and deferRender files are skipped with the new error, and the build completes.

Docs

No docs change. This makes file names load that should already work, and the remaining limitation shows up as a build error message.

withastro/astro

Changes

  • Root cause: the comparator in HostRoutes.add() in @astrojs/underscore-redirects only compares weights when both are truthy (if (a.weight && b.weight)). A weight of 0 is falsy, so any comparison involving it returns false and the definition is inserted before the existing ones. createRedirectsFromAstroRoutes() gives the /* 404 fallback a weight of 0 so that it ends up last, but it is inserted at the top instead, above the weight 2 rules. Definitions added after it can also land above higher weighted ones, because comparing against the weight 0 entry returns false too.
  • Fix: compare the weights whenever both are defined (!== undefined), so 0 is treated as the lowest weight. Definitions without a weight keep their current behavior.
  • Added a changeset.

Testing

Added a test in packages/underscore-redirects/test/weight.test.ts that adds definitions with weights 2, 0 and 1 and checks they are ordered 2, 1, 0. Before the fix it fails with the order ['/c', '/*', '/a']. After the fix it passes, along with the rest of the package tests.

Docs

No docs needed, this is a bug fix with no change to the API.

withastro/astro

Fixes #18195

Changes

  • @astrojs/cloudflare now fails in astro:config:setup when the project root has a wrangler.json, wrangler.jsonc, or wrangler.toml but no cloudflare.config.ts.
  • The error names the file it found and tells the user to run npx cf migrate --bundler vite.
  • Before this change, such a project built without any warning. The generated Worker config used the package.json name and lost the Wrangler file's compatibility date and flags, vars, bindings, and custom entrypoint. A follow-up cf deploy would publish that broken Worker.
  • Projects that already have cloudflare.config.ts, with or without a leftover Wrangler file, are unaffected.

Testing

  • Added unit tests in test/cloudflare-config.test.ts: each Wrangler file name without cloudflare.config.ts throws, a Wrangler file next to cloudflare.config.ts passes, and an empty root passes. With the check disabled, the three throw cases fail.
  • Ran the full @astrojs/cloudflare test suite: 387 passing, 0 failing. No adapter fixture has a Wrangler file without cloudflare.config.ts; vitest-actions has one but doesn't use the adapter.
  • Built the reproduction from #18195 with the patched adapter: it now stops with the migration message, and builds normally after adding a cloudflare.config.ts.

Docs

No docs change in this PR. The new Cloudflare adapter page from withastro/docs#14614 removes the wrangler.jsonc examples but doesn't mention cf migrate; a short upgrade note pointing to npx cf migrate --bundler vite would help. --bundler vite matters because cf migrate otherwise picks the Wrangler bundler for Astro projects, since @cloudflare/vite-plugin is only a transitive dependency.

/cc @withastro/maintainers-docs for feedback!

withastro/starlight

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@astrojs/starlight@0.42.6

Patch Changes

  • #4252 40a2584 Thanks @olafur-andri! - Adds Icelandic language support

  • #4229 e4a3d82 Thanks @HiDeoo! - Fixes a potential issue with icons being cut off in Firefox when pinch-zooming.

  • #4226 fb562dd Thanks @HiDeoo! - Fixes an issue where pages not importing components from @astrojs/starlight/components included styles of Starlight components used on other pages.

  • #4250 531af7d Thanks @HiDeoo! - Fixes Failed to resolve dependency warnings logged when running the development server in projects using the Cloudflare adapter.

  • #4229 e4a3d82 Thanks @HiDeoo! - Fixes the codePen and node icons slightly extending beyond their bounding box.

withastro/starlight

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@astrojs/starlight@0.42.5

Patch Changes

withastro/astro

Changes

  • The fixWinEPERMSync helper in packages/astro/src/core/fs/index.ts called fs.rmdirSync(p, options) with recursive: true as a fallback when fs.rmSync threw EPERM on Windows. Node.js 25 removed support for recursive on rmdirSync (DEP0147), so that fallback threw ERR_INVALID_ARG_VALUE instead of recovering, causing astro build to fail whenever another process briefly held a file in dist/. The directory branch now calls fs.rmSync(p, options), which accepts the same options and is the modern replacement.
  • The parameter type of fixWinEPERMSync changes from fs.RmDirOptions to fs.RmOptions to reflect the corrected API.

Testing

  • Added packages/astro/test/units/fs/empty-dir.test.ts, which fakes process.platform = 'win32', makes fs.rmSync throw EPERM once, and asserts that emptyDir still clears the directory. The test fails without the fix and passes with it on both Node 22 and Node 26.

Docs

  • No docs update needed; this is an internal Windows/Node compatibility fix with no user-facing API change.

Closes #18170


Last fetched:  | Scheduled refresh: Every Saturday

See Customizing GitHub Activity Pages to configure your own

Inspired by prs.atinux.com