AstroEco is Contributing…
Display your GitHub pull requests using astro-loader-github-prs

Fixes #18329.
Problem
In dev, getTemplates() inlines the full environment into the generated astro:env/server virtual module via:
server.replace('// @@GET_ENV@@', `return (${JSON.stringify(loadedEnv)})[key];`)Because the replacement is a string, $ patterns ($`, $&, $', $1, …) in any env var value are interpreted as replacement patterns, injecting template text into the middle of the env JSON and producing an unterminated string literal. Dev then fails with Failed to parse source for import analysis … at astro:env/server:17:…. This hits e.g. every Kitty terminal user (KITTY_PUBLIC_KEY commonly contains $ + backtick) importing astro:env/server in dev.
Fix
One line: pass a replacer function, which is immune to $ patterns.
Test
Added works in dev when an env variable contains \$` replacement patternstopackages/astro/test/env-secret.test.ts, covering `` $ ``, $&, `$'` and `$1`. Verified it fails without the fix (dev returns 500) and passes with it. Full env suites green: `env-secret` (5/5), `env-public` (4/4), `astro-envs` (13/13).
Changeset
Patch bump for astro included.

Changes
The @astrojs/cloudflare integration imports prismjs at runtime in its Prism Vite plugin (src/vite-plugin-prism.ts), but only declares it in devDependencies. With pnpm's global virtual store, consumers of the adapter cannot resolve prismjs, so the adapter fails to load (see issue #18319).
This moves prismjs from devDependencies to dependencies and updates the pnpm-lock.yaml importer accordingly.
Test scenarios
- No runtime/test logic changed; dependency declaration + lockfile only.
- CI will install with the updated lockfile and run the cloudflare integration tests.
Closes #18319

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| @cloudflare/workers-types | ^5.20261005.1 → ^5.20261006.1 |
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| vite (source) | ^8.3.2 → ^8.3.3 |
||
| vite (source) | ^8.3.1 → ^8.3.3 |
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| @astrojs/language-server (source) | ^2.17.0 → ^2.17.1 |
||
| @astrojs/language-server (source) | ^2.16.7 → ^2.17.1 |
Release Notes
withastro/astro (@astrojs/language-server)
v2.17.1
Patch Changes
- #17578
7cc0b00Thanks @renovate! - Fixes a case where rich content diagnostics and snippet edits would not work
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

Changes
- Changes, for example
^7.4.1to^7.0.0
This means that if you have a minimum release age, pnpm will autmoatically use the newest that's within your policy.
This fixes a bug where, after we do a release, running create-astro causes a project to not start without manually changing versions.
Testing
- Tests added
Docs
- N/A

Changes
- Adds an
issue-assign.ymlworkflow that assigns every newly opened issue to the next member of a fixed triage pool (matthewp,Princesseuh). - Rotation needs no stored state: the most recent pool-assigned issue acts as the pointer and each new issue goes to the next pool member. A manual pool assignment becomes the new pointer, and runs are queued (not cancelled) so simultaneously opened issues still alternate.
Testing
- Workflows have no test suite, so the selection logic was validated locally against mock issue payloads: alternation in both directions, first-run bootstrap with no pool history, and exclusion of PRs and non-pool assignees. YAML and shell syntax checked.
Docs
- No docs update needed — internal CI automation with no user-facing behavior.

Changes
- Factory preview releases now work for fixes in nested packages like
packages/language-tools/*andpackages/markdown/*. Before, the changed-package detection only knew aboutpackages/integrations/, so a fix to@astrojs/language-serverresolved topackages/language-toolsandpkg-pr-newfailed with "No packages" (seen on #18310). - Each changed file now walks up to its nearest
package.json, so any nesting depth works. Private packages (test fixtures,packages/astro/performance) are skipped. The charset guard on the directory is kept because the publish step word-splits$DIRS.
Testing
- No test changes. This is a CI workflow change.
Docs
- No docs update needed. This is internal CI used only by the factory bot.

ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| @types/react (source) | ^18.3.31 → ^19.3.0 |
||
| @types/react-dom (source) | ^18.3.7 → ^19.3.0 |
||
| react (source) | ^18.3.1 → ^19.3.0 |
||
| react-dom (source) | ^18.3.1 → ^19.3.0 |
Release Notes
react/react (react)
v19.3.0
New React Features
<ViewTransition />: Adds<ViewTransition />andaddTransitionTypeAPIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)- Fragment Refs: Add Refs to
<Fragment />to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)
New React DOM Features
browser(): a newreact-domAPI that returns a usable which errors during server rendering and resolves in the browser.use(browser())inside a<Suspense>boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)
Notable changes
- Enable Trusted Types API integration (@rickhanlonii #35816)
- Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)
- Added a DEV-only warning when a component appears to have been unblocked by calling
use()conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)
All Changes
React
- Fast Refresh Fixes
- Fix Fast Refresh to find and remount edits to components wrapped behind
lazy()(@sophiebits #36965) - Fix Fast Refresh so edits to a
memo()comparison function take effect (@sophiebits #36964) - Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)
- Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)
- Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)
- Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)
- Fix Fast Refresh to find and remount edits to components wrapped behind
- Performance Track Fixes
- Prevent crash when accessing
$$typeofin Performance Tracks (@eps1lon #35679) - Handle non-string function names in Performance Tracks (@eps1lon #35659)
- Use minus (
-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649) - Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)
- Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)
- Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)
- Clear potentially large performance measures in DEV (@hoxyq #34803)
- Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)
- Prevent crash when accessing
- Activity Fixes
- Fix
useSyncExternalStoremissing store mutations that happened while an Activity tree was hidden (@sophiebits #36947) - Hide portal contents when an Activity is hidden (@acdlite #35091)
- Prevent metadata hoisting in hidden
<Activity>trees (@ronnakamoto #34983) - Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)
- Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)
- Don't show internal
<Offscreen>component in error messages (@rickhanlonii #35763)
- Fix
- Warn in DEV when a component appears to have been unblocked by a conditional
use()(@hoxyq, @eps1lon: #37104, #37203, #37491) - Render transitions independently instead of entangling them into a single render (@acdlite #37290)
- Fix hang when updating a dehydrated boundary inside a hidden tree (@gaearon #37135)
- Don't reacquire Host Singletons during dev effect validation (@gnoff #37113)
- Only remove properties from Host Singletons on release (@gnoff #37112)
- Don't invoke effects on moved children in StrictMode (@sophiebits #36948)
- Throw a clearer error when a rejected Promise is incorrectly instrumented (@eps1lon #36328)
- Fix context propagation into Suspense fallbacks (@acdlite #36160)
- Fix context propagation through suspended Suspense boundaries (@acdlite #35839)
- Fix
useDeferredValuegetting stuck (@gaearon #36134) - Update
useActionStateerror message to say "action state" instead of "form state" (@rickhanlonii #35790) - Don't warn when rendering data block scripts (@eps1lon #35953)
- Treat fibers with alternates as mounted in
getNearestMountedFiber(@sebmarkbage #35578) - Always instrument the lazy initializer thenable (@gnoff #35521)
- Annotate cascading updates for DevTools performance tracks in DEV (@huntie #34961)
- Resolve the
.defaultexport of aReact.lazyas the canonical value (@sebmarkbage #34906) - Limit owner stacks to 10 frames (@eps1lon #34864)
- Ensure
useEffectEventreads latest values inforwardRefandmemo()components (@eps1lon #34831)
React DOM
- Copy
sourceonto the synthetictoggleevent (@lazerg #37389) - Update HTML parser rules for the new
<select>parser (@josepharhar #34804) - Update
defaultValuefortype="number"inputs to match other input types (@sophiebits #36980) - Avoid setting
innerHTMLwhen it hasn't changed (@sophiebits #36949) - Forward the
nonceoption inReactDOM.preloadModule()(@UditDewan #36851) - Support
fetchPriorityfor module resources (@TheAlexLichter #36835) - Track stylesheet preloads when explicitly preloaded to avoid unnecessary suspension (@gnoff #36386)
- Suggest correct casing for the misspelled
credentiallessiframe attribute (@vmx906 #36322) - Add
credentiallessas a recognized boolean attribute for iframes (@vmx906 #36148) - Prevent reentrant
finishedTaskfrom callingcompleteAllmultiple times (@gnoff #36287) - Update the CSS shorthand property list (@kidonng #35636)
- Support the
maskTypeSVG prop (@sleitor #35921) - Add support for
onFullscreenChangeandonFullscreenErrorevents (@chirokas #34621) - Include
submitterinsubmitevents (@eps1lon #35590) - Fire
onResetwhen automatically resetting forms (@eps1lon #35176) - Use the
FormDatasubmitterparameter (@jenseng #29028) - Fix form status reset when component state is updated (@eps1lon #34075)
- Batch updates from
resizeevents until the next frame (@eps1lon #35117)
React Server
- Add
nonceto rendered import maps (@mattcosta7 #37339) - Add an
onBrowserBailoutoption to observe subtrees that defer to the browser (@gnoff #37193) - Stop the caller's signal from retaining a finished render (@unstubbable #37315)
- Construct the render lifetime controller only when it is needed (@unstubbable #37357)
- Fix
react-dom/serverhanging on Deno (@fraidev #35235) - Extend stack overflow recovery to retries in SSR (@jackpope #36977)
- Fix false-positive hydration mismatch on
nonceattributes (@MaxwellCohen #37030) - Guard shell-error callbacks instead of nulling them out on the request (@eps1lon #36916)
- Stop firing
onAllReadyafter the shell errored (@eps1lon #36903) - Treat an incomplete tree as an error during error recovery (@acdlite #36911)
- Fix non-script
modulepreloadtracking (@fallintoplace #36564) - Finalize postponed
nextSegmentIdafter the prelude flush (@gaojude #36779) - Preserve
referrerPolicyin image preload headers (@ulises-jeremias #36803) - Allow pending work to specialize abort reasons (@gnoff #36586)
- Abort tasks that suspend after aborting during render (@gnoff #36585)
- Finish abort in a scheduled task (@gnoff #36580)
- Fix aborts during resumed rendering (@gnoff #36584)
- Track abort state on the request (@gnoff #36583)
- Model external work scheduling explicitly in the fb bundle (@gnoff #36576)
- Continue reporting aborted task errors after a fatal abort (@gnoff #36575)
- Disallow abort reentrancy (@gnoff #36574)
- Stop transpiling computed property names (@eps1lon #36542)
- Fix crash when capturing the callsite of a stalled
use()of a rejected Flight chunk (@lubieowoce #36544) - Double invoke effects in Strict Mode during hydration (@eps1lon #35961)
- Add additional task reentrancy protections in Fizz (@gnoff #36291)
- Don't outline Suspense boundaries with suspensey CSS during shell flush (@gnoff #35824)
- Push a stalled
use()to the owner stack and debug task (@eps1lon #35226) - Fix
useIdtracking on replay (@gnoff #35518) - Correctly handle replaying when hydrating (@gnoff #35494)
- Simplify the
createSuspenseBoundarypath (@sebmarkbage #35087) - Unify preamble-only fields to save a field on Suspense boundaries (@sebmarkbage #35068)
- Unify prerender-only fields to save a field on Suspense boundaries (@sebmarkbage #35067)
- Push halted awaits to the owner stack for late-arriving I/O info (@unstubbable #35019)
- Include all Node.js APIs in the Bun entrypoint for
react-dom/server(@RiskyMH #34193) - Detach a Suspense boundary after flushing its segment (@gnoff #34694)
React Server Components
- Keep an element pending while a referenced row is resolving (@unstubbable #37542)
- Fix
RangeErrorfrom exponential debug info growth (@unstubbable #37481) - Abort the cache signal when debug objects are retained (@unstubbable #37342)
- Transfer key validation of lazy nodes when they are unwrapped (@unstubbable #37258)
- Add
pending_weakto the Flight thenable protocol (@acdlite #37154) - Outline and dedupe repeated strings (@gaearon #37147)
- Port Reply Server traversal guards to the Flight Client (@eps1lon #37144)
- Define Flight chunk
.thenwithObject.defineProperty(@eps1lon #37109) - Support Turbopack's experimental array format for chunks (@sampoder #37095)
- Limit fake JSX call site stacks to 10 frames (@timneutkens #37086)
- Improve performance when decoding Flight replies (@gnoff #37090)
- Recognize Node 22+ V8 frames for
Promisestatics in debug info (@gaearon #36969) - Tailor the warning for binary data serialized through
toJSON(NodeBuffer) (@unstubbable #36873) - Resolve models before
JSON.stringifyfor faster serialization (@mhart #36795) - Prune debug info when chunks error (@gnoff #36782)
- Avoid main-thread stalls from large debug strings (@unstubbable #36570)
- Fix stranded row content under Node stream backpressure (@unstubbable #36516)
- Fix dropped
FormDataentries indecodeReplyFromBusboy(@unstubbable #36468) - Harden types and improve performance of Flight replies (@eps1lon #36425)
- Add more cycle protections to Flight replies (@eps1lon #36236)
- Transport
AggregateError.errors(@eps1lon #36156) - Bail out early when a backing entry for
Blobdeserialization is not aBlob(@eps1lon #36055) - Clear chunk reason after successful module initialization (@unstubbable #36024)
- Add support for transporting
Error.cause(@eps1lon #35810) - Walk parsed JSON instead of using a reviver for faster RSC payload parsing (@timneutkens #35776)
- Skip
transferReferencedDebugInfoduring debug info resolution (@unstubbable #35795) - Add
unstable_allowPartialStreamoption to Flight Client (@unstubbable #35731) - Fix
encodeReplyfor JSX with temporary references (@unstubbable #35730) - Fix debug channel flag in Node.js
renderToPipeableStream(@feedthejim #35724) - Fix stack overflow in
visitAsyncNodewith deep async chains (@unstubbable #35612) - Allow Server Components to render context providers from client modules (@rickhanlonii #35675)
- Allow overriding
request.timeOriginviaoptions.startTime(@lubieowoce #35598) - Warn once if
evalis disabled in the dev environment (@eps1lon #35661) - Restore original function name in dev server callstacks served with
unsafe-eval(@eps1lon #35650) - Fix
react-markuptypes for server references (@eps1lon #35634) - Add more DoS mitigations to Flight replies and harden Flight (@unstubbable #35632)
- Allow cyclic references to be serialized when unwrapping lazy elements (@unstubbable #35471)
- Improve cyclic thenable detection in Flight reply server (@cvan20191 #35369)
- Add extra loop protection to Flight reply server (@sebmarkbage #35351)
- Patch Promise cycles and
toStringon Server Functions (@sebmarkbage #35345) - Move
react-server-dom-webpack/*.unbundledto privatereact-server-dom-unbundled(@eps1lon #35290) - Never parse
thenfunctions in Flight replies (@sebmarkbage #35289) - Patch Flight reply server with fixes from Flight Client (@sebmarkbage #35277)
- Complete the list of Node.js internal Promise awaits (@eps1lon #35161)
- Reduce risk of maximum call stack exceeded when emitting async sequences (@eps1lon #35159)
- Fix pending chunks count for streams and async iterables in DEV (@unstubbable #35143)
- Fix broken byte stream parsing caused by buffer detachment (@unstubbable #35127)
- Fix
hasReadableflag in Node.js clients' debug channel (@unstubbable #35039) - Fix debug info filtering to include later resolved I/O (@unstubbable #35036)
- Cache the value when visiting the same I/O or Promise along different paths (@sebmarkbage #35005)
- Clone subsequent I/O nodes when resolved more than once (@sebmarkbage #35003)
- Fix hang after resolving cyclic references (@unstubbable #34988)
- Allow passing DEV-only
startTimeas an option (@sebmarkbage #34912) - Ignore bound-anonymous-fn resources as they're not considered I/O (@sebmarkbage #34911)
- Fix detached
ArrayBuffererror when streaming typed arrays (@unstubbable #34849) - Exclude RSC stream if the stream resolves in a task (@sebmarkbage #34838)
- Forward the current environment when forwarding I/O entries (@sebmarkbage #34836)
- Look for moved debug info when logging component performance track (@sebmarkbage #34839)
- Respect
displayNameof Promise instances on the server (@sebmarkbage #34825) - Avoid unnecessary indirection when serializing debug info (@unstubbable #34797)
- Fix preload
asattribute for stylesheets (@unstubbable #34760) - Don't serialize
toJSONin debug path and omit wide arrays (@sebmarkbage #34759) - Add support for
<Activity>(@eps1lon #34697)
v19.2.8: 19.2.8 (July 21st, 2026)
React Server Components
v19.2.7
React Server Components
- Fixed missing
FormDataentries in Server Actions which regressed in 19.2.6 (@unstubbable #36566)
v19.2.6
React Server Components
- Type hardening and performance improvements (@eps1lon, @unstubbable #36425)
v19.2.5
React Server Components
- Add more cycle protections (@eps1lon, @unstubbable #36236)
v19.2.4
React Server Components
- Add more DoS mitigations to Server Actions, and harden Server Components (@gnoff, @lubieowoce, @sebmarkbage, @unstubbable #35632)
v19.2.3
React Server Components
- Add extra loop protection to React Server Functions (@sebmarkbage #35351)
v19.2.2
React Server Components
- Move
react-server-dom-webpack/*.unbundledto privatereact-server-dom-unbundled(@eps1lon #35290) - Patch Promise cycles and toString on Server Functions (@sebmarkbage, @unstubbable #35289, #35345)
v19.2.1
React Server Components
- Bring React Server Component fixes to Server Actions (@sebmarkbage #35277)
v19.2.0
Below is a list of all new features, APIs, and bug fixes.
Read the React 19.2 release post for more information.
New React Features
<Activity>: A new API to hide and restore the UI and internal state of its children.useEffectEventis a React Hook that lets you extract non-reactive logic into an Effect Event.cacheSignal(for RSCs) lets your know when thecache()lifetime is over.- React Performance tracks appear on the Performance panel’s timeline in your browser developer tools
New React DOM Features
- Added resume APIs for partial pre-rendering with Web Streams:
resume: to resume a prerender to a stream.resumeAndPrerender: to resume a prerender to HTML.
- Added resume APIs for partial pre-rendering with Node Streams:
resumeToPipeableStream: to resume a prerender to a stream.resumeAndPrerenderToNodeStream: to resume a prerender to HTML.
- Updated
prerenderAPIs to return apostponedstate that can be passed to theresumeAPIs.
Notable changes
- React DOM now batches suspense boundary reveals, matching the behavior of client side rendering. This change is especially noticeable when animating the reveal of Suspense boundaries e.g. with the upcoming
<ViewTransition>Component. React will batch as much reveals as possible before the first paint while trying to hit popular first-contentful paint metrics. - Add Node Web Streams (
prerender,renderToReadableStream) to server-side-rendering APIs for Node.js - Use underscore instead of
:IDs generated by useId
All Changes
React
<Activity />was developed over many years, starting beforeClassComponent.setState(@acdlite @sebmarkbage and many others)- Stringify context as "SomeContext" instead of "SomeContext.Provider" (@kassens #33507)
- Include stack of cause of React instrumentation errors with
%oplaceholder (@eps1lon #34198) - Fix infinite
useDeferredValueloop in popstate event (@acdlite #32821) - Fix a bug when an initial value was passed to
useDeferredValue(@acdlite #34376) - Fix a crash when submitting forms with Client Actions (@sebmarkbage #33055)
- Hide/unhide the content of dehydrated suspense boundaries if they resuspend (@sebmarkbage #32900)
- Avoid stack overflow on wide trees during Hot Reload (@sophiebits #34145)
- Improve Owner and Component stacks in various places (@sebmarkbage, @eps1lon: #33629, #33724, #32735, #33723)
- Add
cacheSignal(@sebmarkbage #33557)
React DOM
- Block on Suspensey Fonts during reveal of server-side-rendered content (@sebmarkbage #33342)
- Use underscore instead of
:for IDs generated byuseId(@sebmarkbage, @eps1lon: #32001, facebook#33342#33099, #33422) - Stop warning when ARIA 1.3 attributes are used (@Abdul-Omira #34264)
- Allow
nonceto be used on hoistable styles (@Andarist #32461) - Warn for using a React owned node as a Container if it also has text content (@sebmarkbage #32774)
- s/HTML/text for for error messages if text hydration mismatches (@rickhanlonii #32763)
- Fix a bug with
React.useinsideReact.lazy-ed Component (@hi-ogawa #33941) - Enable the
progressiveChunkSizeoption for server-side-rendering APIs (@sebmarkbage #33027) - Fix a bug with deeply nested Suspense inside Suspense fallback when server-side-rendering (@gnoff #33467)
- Avoid hanging when suspending after aborting while rendering (@gnoff #34192)
- Add Node Web Streams to server-side-rendering APIs for Node.js (@sebmarkbage #33475)
React Server Components
- Preload
<img>and<link>using hints before they're rendered (@sebmarkbage #34604) - Log error if production elements are rendered during development (@eps1lon #34189)
- Fix a bug when returning a Temporary reference (e.g. a Client Reference) from Server Functions (@sebmarkbage #34084, @denk0403 #33761)
- Pass line/column to
filterStackFrame(@eps1lon #33707) - Support Async Modules in Turbopack Server References (@lubieowoce #34531)
- Add support for .mjs file extension in Webpack (@jennyscript #33028)
- Fix a wrong missing key warning (@unstubbable #34350)
- Make console log resolve in predictable order (@sebmarkbage #33665)
React Reconciler
- createContainer and createHydrationContainer had their parameter order adjusted after
on*handlers to account for upcoming experimental APIs
v19.1.9: 19.1.9 (July 21st, 2026)
React Server Components
v19.1.8
React Server Components
- Fixed missing
FormDataentries in Server Actions which regressed in 19.1.7 (@unstubbable #36567)
[`v1
❗ Important
✂ PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
Release Notes
vitest-dev/vitest (vitest)
v5.0.3
🐞 Bug Fixes
- Isolate
result.statusbetweenrepeatsruns - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in #11218 (5dbeb) - Don't print an interceptor warning in browser mode - by @sheremet-va in #11377 (15cc0)
- Don't retry when
test.failsexpectedly failed - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in #11219 (b2458) - Scope cache key generators to projects - by @ecoyoung in #11281 and #11301 (92ba7)
- browser:
- Delay server
listenuntil tests start running - by @sheremet-va in #11366 (7d8ed) - Check mock path boundaries - by @saryn17, Ryosei Sato and @sheremet-va in #11361 and #11362 (1c388)
- Keep config of browser-consumed environments - by @kasperpeulen and Claude in #11378 (aafc0)
- Ignore page crash while cancelling - by @sheremet-va in #11386 (7c367)
toMatchScreenshotuses wrong reference on retried tests - by @macarie in #11393 (c22ab)
- Delay server
- cache:
- Revalidate imports of cached modules - by @sheremet-va in #11381 (38f98)
- deps:
- Pin
why-is-node-runningto3.2.1to avoid users running intoERR_PNPM_TRUST_DOWNGRADE- by @AriPerkkio in #11403 (f6c9a)
- Pin
- expect:
- Pass current equality testers to
expect.extendasymmetric matchers - by @hi-ogawa, Hiroshi Ogawa and Claude in #11401 (3e794)
- Pass current equality testers to
- jsdom:
- Support Blob on jsdom 30.1 - by @sheremet-va in #11379 (6c49b)
- pool:
- ui:
- vitest:
- Remove root temp dir on close - by @abhinav-phi in #11248 (7c711)
- vm:
View changes on GitHub
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

Backport of #18112 from next to main.
Changes
- Astro now uses Vite's resolved environment
outDirvalues as the source of truth for build output. Generated assets, build hookdirvalues, and SSR manifest paths use the resolved client, server, and prerender directories, so integrations and Vite plugins can control where output is written. - Custom prerenderer factories receive the resolved directories through a new context argument:
setPrerenderer((defaultPrerenderer, { outputDirectories }) => ...). The argument is additive, so existing factories keep working. - Cleanup of Vite's
.vitemanifests now waits until everybuildApphook has finished, so platform plugins can read the manifests. - The cherry-pick applied cleanly. The touched files are identical to
next.
Testing
- Adds
test/resolved-vite-output-directories.test.ts. A Vite plugin changes the environmentoutDirs, and the test asserts that hooks, the SSR manifest, and custom prerenderers see the resolved values while the Astro config stays unchanged. - Updates
units/build/generate.test.ts,units/build/preserve-build-client-dir.test.ts, andincremental-build-islands.test.tsto expect output paths from the resolved directories.
Docs
- Integration authors are affected: the new prerenderer
outputDirectoriescontext is covered by the minor changeset. Docs forsetPrerenderermay need a follow-up to document the context argument.

This PR contains the following updates:
Release Notes
mochajs/mocha (mocha)
v12.0.3
🩹 Fixes
- keep watching when the last test file is removed (#6355) (921c161)
- show require() error on unsupported directory import (#6354) (a68344f)
- support
--Xone-char aliases (#6391) (1227939)
📚 Documentation
🧹 Chores
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| @vercel/functions (source) | ^3.9.9 → ^3.9.11 |
||
| rolldown (source) | ^1.2.11 → ^1.2.12 |
||
| vite (source) | ^8.3.1 → ^8.3.3 |
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| rolldown (source) | ^1.2.11 → ^1.2.12 |
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| @vitejs/plugin-react (source) | ^6.1.1 → ^6.1.2 |
||
| oxc-transform-react (source) | ^0.150.0 → ^0.153.0 |
||
| vite (source) | ^8.3.0 → ^8.3.2 |
Release Notes
vitejs/vite-plugin-react (@vitejs/plugin-react)
v6.1.2
Fix HMR for compound components (#1484)
Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.
Fix compiler.logDiagnostics option not working (#1483)
With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.
Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)
When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| @preact/signals (source) | ^2.11.2 → ^2.11.3 |
||
| preact-render-to-string | ^6.7.0 → ^6.8.0 |
||
| vite (source) | ^8.3.0 → ^8.3.2 |
Release Notes
preactjs/signals (@preact/signals)
v2.11.3
Patch Changes
- #991
04445baThanks @JoviDeCroock! - Don't re-run auseSignalEffectfor a component that was unmounted by the same update. Preact 11 disposes it after paint, so the effect could otherwise run once more against an unmounted component.
preactjs/preact-render-to-string (preact-render-to-string)
v6.8.0
Minor Changes
-
#472
2dff53dThanks @jacob-ebey! - Replaces the secondcontextargument in our streaming functions with anoptionsobject, thecontextmoves to the third position.Streaming is considered alpha so we're making this breaking change deliberately as part of a minor.
Patch Changes
-
#464
455daf5Thanks @JoviDeCroock! - Calloptions._rootbefore the render-to-string invocation -
#475
4e92059Thanks @JoviDeCroock! - Use Node'sWritabletype forrenderToPipeableStreamdestinations. -
#444
e5ff19fThanks @dsherret! - fix: use cjs types instead of esm for jsx export to fix default export from esm -
#477
4b80672Thanks @JoviDeCroock! - Preserve client-rendered content when delayed streaming chunks arrive after hydration. -
#471
0ce2b84Thanks @JoviDeCroock! - Keep Preact option hooks isolated for the lifetime of asynchronous renders. -
#476
5b1d509Thanks @JoviDeCroock! - Replace streamed Suspense fallbacks when the resolved content is empty.
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
astro@7.3.8
Patch Changes
-
#18293
28e7410Thanks @astro-factory! - FixesAstro.cachebeingundefinedwhen a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export -
#18298
0e9e857Thanks @matthewp! - Fixesastro addremoving existingallowBuildsapprovals frompnpm-workspace.yamlwith pnpm v11.0–v11.22 -
#18263
882dd98Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-basedtransformWithOxcand Rolldown instead of esbuild. These packages no longer depend on esbuild directly. -
#18290
31f13c3Thanks @astro-factory! - Fixes theglob()loader not reloading changed files in dev when the pattern starts with an extglob such as!(drafts)/**/*.md
create-astro@5.2.6
Patch Changes
- #18263
882dd98Thanks @florian-lefebvre! - Removes the automaticallowScriptsandallowBuildspre-approval from generated projects. Astro's dependencies no longer run install scripts, so the workaround is no longer needed.
@astrojs/markdoc@2.0.11
Patch Changes
- #18263
882dd98Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-basedtransformWithOxcand Rolldown instead of esbuild. These packages no longer depend on esbuild directly.
@astrojs/netlify@8.2.9
Patch Changes
- #18263
882dd98Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-basedtransformWithOxcand Rolldown instead of esbuild. These packages no longer depend on esbuild directly. - Updated dependencies []:
- @astrojs/underscore-redirects@1.0.4
@astrojs/vercel@11.0.13
Patch Changes
- #18263
882dd98Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-basedtransformWithOxcand Rolldown instead of esbuild. These packages no longer depend on esbuild directly.
astro-vscode@2.17.2
Patch Changes
- #18263
882dd98Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-basedtransformWithOxcand Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
Release Notes
cloudflare/workers-sdk (@cloudflare/vite-plugin)
v1.62.5
Patch Changes
- Updated dependencies [
7f700ef,90e6a1b,7f57b1c,6a4b0fe]:- wrangler@4.147.0
- miniflare@5.20261001.0-alpha
v1.62.4
Patch Changes
- Updated dependencies [
b8e7cc3,b00ef4f,9d7b08e,464a582,aee2842,efd67e6]:- wrangler@4.146.0
- miniflare@5.20261001.0-alpha
v1.62.3
Patch Changes
- Updated dependencies [
b9f1cdc,ddaa558,8468487,a0712e5,a0712e5]:- miniflare@5.20260930.0-alpha
- wrangler@4.145.0
v1.62.2
Patch Changes
- Updated dependencies [
91a3606,2a15ae2]:- wrangler@4.144.0
- miniflare@5.20260926.1-alpha
v1.62.1
Patch Changes
-
#15938
62fd03aThanks @dieub! - Resolve the affected Undici dependency in new Wrangler and Vite plugin installsUndici 7.29.1 fixes GHSA-3wwx-pv8p-q78v. Update the shared dependency catalog and matching types used by Miniflare and Wrangler so downstream installs can resolve the patched runtime without an application-level override. A published release is still required for consumers; this changeset does not alter already published package metadata.
-
Updated dependencies [
7bb6eae,60ccdbd,62fd03a,06ed9c8,86211fe,c2bb4c8,eb1efe0,485cfb3]:- wrangler@4.143.1
- miniflare@5.20260926.1-alpha
v1.62.0
Minor Changes
-
#15914
7f0734cThanks @jamesopstad! - Usecf/configforcloudflare.config.tsauthoringExperimental
cloudflare.config.tsprojects must now importdefineConfig, bindings, triggers, and related helpers fromcf/config. Generated declarations from Wrangler and the Vite plugin also reference this package, so projects using the experimental configuration flow must addcfas a dependency.The Vite plugin no longer exports
@cloudflare/vite-plugin/experimental-config.wrangler/experimental-configremains available fordefineWranglerConfig, but no longer re-exports Cloudflare configuration helpers.
Patch Changes
-
#15878
e7915c1Thanks @dawNotPoi! - Keep dependency optimization caches stable on the first Vite dev server restart.The first dev server restart no longer re-optimizes unchanged dependencies, including in projects without Containers. Container images are still cleaned up when the server closes, even after a config reload removes the Cloudflare plugin.
-
Updated dependencies [
7f0734c]:- wrangler@4.143.0
v1.61.0
Minor Changes
-
#15856
4c2993bThanks @Naapperas! - Support Workflows declared inexportsonctx.exportsin local developmentA Workflow declared in a Worker's
exportsis now available onctx.exportsinwrangler dev, the Vite plugin and the Vitest plugin, with the same API as a Workflow binding:const instance = await ctx.exports.MyWorkflow.create({ params: { name: "World" }, });
ctx.exportsandworkflowsbindings with the same Workflownameshare their instances, including instances created before the Workflow was declared inexports. Two Workers can't export the same Workflow name, and a binding to an exported Workflow must refer to the Worker and class that export it.getPlatformProxy()ignores Workflows declared inexports, since it doesn't run the Worker's code.wrangler workflowscommands run with--localalso work with Workflows declared only inexports, without aworkflowsbinding.In the Vitest plugin,
introspectWorkflow()andintrospectWorkflowInstance()still need a Workflow binding, and now explain how to add one when passed a Workflow fromctx.exports. Instances created throughctx.exportsare introspected too. Aworkflowsbinding whosescript_nameis the Worker's own name now resolves to the Worker itself again.
Patch Changes
- Updated dependencies [
8dc53ae,4c2993b]:- miniflare@5.20260926.0-alpha
- wrangler@4.142.0
v1.60.2
Patch Changes
- Updated dependencies [
ee2b200,c91279b,8280086,bd56b98,805af2f]:- miniflare@5.20260925.0-alpha
- wrangler@4.141.0
v1.60.1
Patch Changes
- Updated dependencies [
8f7916c]:- wrangler@4.140.0
- miniflare@5.20260923.0-alpha
v1.60.0
Minor Changes
-
#15648
52c0e9fThanks @tpmmorris! - Advertise Local Explorer scheduled invocations to headless agentsThe Vite plugin's Local Explorer hint now documents how to invoke a Worker's scheduled handler and points agents to the OpenAPI schema for the complete request contract.
Patch Changes
- Updated dependencies [
52c0e9f,44f5295,be72815,479e1e8,940c692,52c0e9f,cd60c9c,15799d4,bdda4c3,fc3cbaa]:- miniflare@5.20260923.0-alpha
- wrangler@4.139.0
v1.59.0
Minor Changes
-
#15817
6e77c53Thanks @jamesopstad! - Allow framework commands to produce Preview Build Output with the experimental configWhen
cf previews deployinvokes a framework build command, Preview intent is now preserved. Function-basedcloudflare.config.tsfiles receiveisPreview: true, and generated Build Output is marked as a Preview build.
Patch Changes
-
#15806
8fade73Thanks @NuroDev! - Standardize Zod validation error outputFormat validation errors with Zod's built-in
prettifyError()helper so Miniflare, Wrangler, the Vite plugin, and the Vitest plugin show consistent messages and property paths. -
Updated dependencies [
a71237a,b03f960,8fade73,6e77c53]:- miniflare@5.20260921.1-alpha
- wrangler@4.138.0
v1.58.0
Minor Changes
-
#15778
cd7508cThanks @jamesopstad! - Generate types during development and supported builds with Vite'sexperimental.newConfigoption or Wrangler's--experimental-new-configflag (and--experimental-cf-build-outputfor builds)When Wrangler's
--experimental-new-configflag or Vite'sexperimental.newConfigoption is enabled, inferred configuration and runtime declarations are now kept in.cloudflare/types/index.d.ts. Vite refreshes them during development and production builds. Wrangler refreshes them during development and when building with both--experimental-new-configand--experimental-cf-build-output. In the experimentalwrangler.config.tsformat, thetypesoption is now top-level because it applies to both commands.
Patch Changes
-
#15765
1bdb96dThanks @th0m! - Prepare the required egress sidecar for local Containers without configured imagesWrangler dev and Vite dev/preview now pull the required sidecar for Durable Object-managed Containers that select their application image at start time. Previously, these Containers failed to start unless the sidecar image was already cached in Docker.
-
Updated dependencies [
1bdb96d,cd7508c,f5605f5]:- wrangler@4.137.0
v1.57.3
Patch Changes
- Updated dependencies [
59267fc,6906bf0,354ebdb]:- wrangler@4.136.3
- miniflare@5.20260921.0-alpha
v1.57.2
Patch Changes
- Updated dependencies [
ad20547,02c1d83,275184d,bd59eca]:- wrangler@4.136.2
- miniflare@5.20260921.0-alpha
v1.57.1
Patch Changes
- Updated dependencies [
0ed4c54,703922d,14d946d]:- wrangler@4.136.1
- @cloudflare/unenv-preset@2.16.2
v1.57.0
Minor Changes
-
#15713
3c75cadThanks @jamesopstad! - Identify experimental Build Output resource configs by filename and locationThe root remains
config.json, Worker configs are nowworker.config.json, and Container configs are nowcontainer.config.json. Resource configs no longer contain top-leveltypediscriminators, while settings and build context are stored together in the root config. -
#15713
3c75cadThanks @jamesopstad! - Define experimental Cloudflare configuration with a single default exportExperimental
cloudflare.config.tsfiles now define settings and resources together in a default-exporteddefineConfig()call. Add a Worker underworker, add Containers to thecontainersarray, or omit both to provide settings only.import * as entrypoint from "./src/index.ts" with { type: "cf-worker" }; export default defineConfig({ accountId: "...", complianceRegion: "public", worker: { name: "my-worker", compatibilityDate: "2026-09-18", entrypoint, }, });
Patch Changes
-
#15711
91e2f86Thanks @ghostwriternr! - Allow local Container images without exposed portsWrangler and the Cloudflare Vite plugin no longer reject images that omit Docker
EXPOSEmetadata. Local Containers can run command-only workloads or serve traffic through workerd without declaring an unused image port. -
Updated dependencies [
3c75cad,3c75cad,91e2f86,c5913a6,35668d7,3c75cad,45b3b81,8235e6a,0751490,43b1f85,731a2ee]:- wrangler@4.136.0
- miniflare@5.20260921.0-alpha
v1.56.0
Minor Changes
-
#15609
1f070c8Thanks @emily-shen! - Build Containers when emitting experimental Build OutputWrangler and the Cloudflare Vite plugin now build Dockerfile-backed Container images when experimental Build Output is enabled. Container configs are emitted under
.cloudflare/output/v0/containerswith local image references, while existing registry references pass through unchanged. -
#15329
c4c9b75Thanks @akshitsinha! - Evaluate Flagship flags locally during developmentFlagship bindings now use the local Miniflare store by default in Wrangler and the Vite plugin, keeping development offline and isolated from production flags. Set
remote: trueon a binding to continue using its remote app.Use
wrangler flagship flags pull <APP_ID>to seed the store from a remote app. Flag management commands also accept--localto read and update the local store directly. -
#15701
643e5ccThanks @WillTaylorDev! - Pass Preview intent todefineWorkerand upload its resolved configurationPreview builds now evaluate programmatic Worker configuration with
ctx.isPreviewset totrueand record that intent in Build Output. The shared Preview uploader deploys the resolved bindings and settings while preserving configured Preview base values when it creates a Preview.
Patch Changes
- Updated dependencies [
1f070c8,a0485d5,629ddef,c4c9b75,643e5cc]:- wrangler@4.135.0
- miniflare@5.20260918.0-alpha
v1.55.0
Minor Changes
-
#15674
a939a6cThanks @ghostwriternr! - Support explicit named Container image selection in local developmentThe Vite plugin builds or pulls named images from Wrangler configuration and exposes their local tags through
ctx.container.images. Pass one of those references toctx.container.start({ image })to select the image.This extends the experimental Durable Object-managed Containers interface.
Patch Changes
- Updated dependencies [
6874aa9,2298cf1,d96b319,876eea1,2b39fc2]:- wrangler@4.134.0
- miniflare@5.20260917.0-alpha
v1.54.11
Patch Changes
- Updated dependencies [
71b6f10,ad23e6e,bac0c6a,be2437a,bac0c6a,6f3d7b5]:- miniflare@5.20260916.0-alpha
- wrangler@4.133.0
v1.54.10
Patch Changes
-
#14775
1be7b97Thanks @dario-piotrowicz! - Sync Local Explorer endpoint lists across agent hintsThe Local Explorer endpoint list is now consistent across the three places it appears: the AGENTS.md template in
create-cloudflare, the runtime agent hint inwrangler dev, and the Vite plugin agent hint. All three now include theobservability/clearendpoint, use the canonical/cdn-cgi/local/explorerpath, and have cross-reference comments pointing to each other. -
#15399
982b806Thanks @tpmmorris! - Improve over-limitrun_worker_firsterrors when duplicate rules are presentThe error now reports distinct and duplicate-entry counts and lists duplicated rules, making it clear when removing redundant entries can bring the configuration within the limit.
Too many `run_worker_first` rules were provided; 105 rules provided (99 distinct, 6 duplicate entries) exceeds max of 100. Note: duplicate entries count towards the route limit. Ensure that no duplicate rules are present in your `run_worker_first` configuration. The duplicated rules found are: - "/rule/0" - "/rule/1" - "/rule/2" - "/rule/3" - "/rule/4" ...and 1 more duplicated rule. -
Updated dependencies [
1be7b97,b149147,7db596c,76c0ce6,a83d7ac,a0856da,e35c4a1,d3565a5,a83d7ac,cb0955f,fa79b26,16d1310,ca71205,1015cfb,982b806,ffabe74,7db596c,e03822a,a83d7ac,641df47,c4a6279]:- wrangler@4.132.0
- miniflare@5.20260915.0-alpha
v1.54.9
Patch Changes
-
#15574
164e4fbThanks @RealBhupesh! - Ignore.wranglerpersistence writes in Vite's file watcherMiniflare stores local D1, KV, R2, and observability state under
.wrangler/state. Those writes were watched as source changes on Linux and Windows, which fired every pluginhotUpdatehook and could make page loads take seconds. The plugin now ignores**/.wrangler/**while preserving anyserver.watch.ignoredpatterns already set by the user. -
Updated dependencies [
8997652]:- miniflare@5.20260911.1-alpha
- wrangler@4.131.2
v1.54.8
Patch Changes
- Updated dependencies [
945aaa3,945aaa3,47d906f,c2699bf,945aaa3,945aaa3]:- wrangler@4.131.1
- miniflare@5.20260911.0-alpha
v1.54.7
Patch Changes
-
#15432
f45b596Thanks @razethion! - Prevent delayed internal errors from fetch-only remote bindingsFetch-only remote bindings such as D1 and R2 previously opened an unused WebSocket RPC session. RPC sessions are now created only when an RPC method is called.
-
Updated dependencies [
0b43395,9d75006,b605aa6,f45b596,f69f95a,a549e58,36aed7f,493e635,bff525d,dbb3ff4,fea3cd0,96688b3,6bd7b6c,15cd6e1,be1caec,ed5797a,dbc9506,128235a,f8aea7e,24ef86b]:- wrangler@4.131.0
- miniflare@5.20260910.0-alpha
v1.54.6
Patch Changes
- Updated dependencies [
edb3631,dbf6aad,bcebf08,e20df20,e20df20,63c7ff1,a4e41df]:- miniflare@5.20260908.0-alpha
- wrangler@4.130.0
v1.54.5
Patch Changes
-
#15519
e004845Thanks @devaniketh! - Preserve HTTP/2:authorityheader and non-default port in dev server requestsWhen Vite runs over HTTPS with HTTP/2 enabled, browsers send authority via the
:authoritypseudo-header rather thanHost. Previously, pseudo-headers were omitted when creating Fetch requests, causing non-default ports to be dropped fromrequest.urlandX-Forwarded-Host. Authority and scheme are now preserved from HTTP/2 pseudo-headers and request properties. -
Updated dependencies [
8bbcb9f,2b42d6f,ea5634e,c0c6504,ffc7efd,682cd44]:- miniflare@5.20260907.0-alpha
- wrangler@4.129.1
v1.54.4
Patch Changes
-
#15407
7662118Thanks @xgame92! - Surface Worker export type fetch errors during developmentThe Vite plugin now reports the Worker name, HTTP status, and response body when fetching export types fails. This preserves the underlying error instead of replacing it with a JSON parsing error.
-
Updated dependencies [
00a9f2f,1dba24a,d40a634,7c1b2a6,93d72a5,f6fb347,f6fb347,dc24057,d2d8eea]:- miniflare@5.20260903.0-alpha
- wrangler@4.129.0
v1.54.3
Patch Changes
- Updated dependencies [
dbbb795,200780f,b3f2628,87a7acf,1809c5e,ea28cc3,b3fb2bf,707cb6f]:- wrangler@4.128.0
- miniflare@5.20260831.0-alpha
v1.54.2
Patch Changes
- Updated dependencies [
eb01850,e1df91a,b23de74,015550a,015550a,015550a,3650d29,b23de74]:- miniflare@5.20260828.0-alpha
- wrangler@4.127.1
v1.54.1
Patch Changes
- Updated dependencies [
71b6f10,ad23e6e,bac0c6a,be2437a,bac0c6a,6f3d7b5]:- miniflare@5.20260916.0-alpha
- wrangler@4.133.0
v1.54.0
Minor Changes
-
#15134
c66d2d5Thanks @gpanders! - Enable FUSE-capable local container developmentMiniflare now automatically passes the Docker privileges needed for FUSE to loc
❗ Important
✂ PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| vite (source) | ^8.3.0 → ^8.3.2 |
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| rolldown (source) | ^1.2.11 → ^1.2.12 |
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| acorn | ^8.18.0 → ^8.19.0 |
||
| es-module-lexer | ^3.0.2 → ^3.0.3 |
||
| rolldown (source) | ^1.2.11 → ^1.2.12 |
Release Notes
guybedford/es-module-lexer (es-module-lexer)
v3.0.3
What's Changed
- fix: handle TypeScript generic commas in exported bindings by @BridgeAR in #254
- fix: ASI and repeated non-null assertions in TypeScript export bindings by @guybedford in #257
Full Changelog: guybedford/es-module-lexer@3.0.2...3.0.3
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
Release Notes
changesets/changesets (@changesets/cli)
v3.0.3
Patch Changes
-
#2297
3f163daThanks @Andarist! - Fixed semver ranges (such as>=1.0.0 <2.0.0) getting cut off (>=2.0.0) when updating internal dependencies. -
#2276
ca9d110Thanks @Andarist! - Fixed pnpm 10 compatibility with npm 12 when reading registry information, packing, and publishing packages. -
Updated dependencies [
3f163da,bfe9050,e522996]:- @changesets/apply-release-plan@8.1.1
- @changesets/config@4.0.1
CodSpeedHQ/codspeed-node (@codspeed/vitest-plugin)
v5.7.1
What's Changed
- fix: emit perf maps when not parsing the full inlining logs from V8 by @GuillaumeLagrange in #85
Full Changelog: CodSpeedHQ/codspeed-node@v5.7.0...v5.7.1
v5.7.0
Highlights
- Dump full inlining information for higher optimization tiers in walltime so we can show more functions on the profiler. To test it out, set
CODSPEED_WALLTIME_PROFILER=samplyenv variable in the codspeed action. - Added support for tinybench v5 and v6 in @codspeed/tinybench-plugin
What's Changed
- Add necessary flags to dump optimized inlining info and fix walltime marker placement by @GuillaumeLagrange in #83
Full Changelog: CodSpeedHQ/codspeed-node@v5.6.0...v5.7.0
v5.6.0
What's Changed
- feat: add MacOS support by @not-matthias in #81
Full Changelog: CodSpeedHQ/codspeed-node@v5.5.0...v5.6.0
v5.5.0
Highlights
We are introducing @codspeed/playwright, for walltime benchmarking and profiling of end to end browser applications through playwright.
Here's an example usage, but head to the docs for more information
import { bench, type Page } from "@codspeed/playwright-plugin";
import electronExecutable from "electron";
import path from "node:path";
import { fileURLToPath } from "node:url";
const __dirname = path.dirname(fileURLToPath(import.meta.url));
const appRoot = path.resolve(__dirname, "..");
async function waitUntilSettled(page: Page): Promise<void> {
await page.waitForFunction(() => {
const main = document.getElementById("main");
return !!main && !main.classList.contains("loading");
});
}
await bench(
"inbox-search-archive-threads",
async ({ page }) => {
await page.fill("#search", "update");
await waitUntilSettled(page);
await page.click("#select-visible-btn");
await page.click("#archive-btn");
await waitUntilSettled(page);
await page.click('#sidebar nav button[data-view="threads"]');
await waitUntilSettled(page);
},
{
target: {
kind: "electron",
appPath: path.join(appRoot, "out/main/index.js"),
cwd: appRoot,
},
beforeRound: async ({ page }) => {
page.setDefaultTimeout(180_000);
await page.waitForSelector("#main");
await waitUntilSettled(page);
},
},
);Note: this plugin is only compatible with the walltime instrument.
What's Changed
- Add playwright profiling package by @GuillaumeLagrange in #80
Full Changelog: CodSpeedHQ/codspeed-node@v5.4.0...v5.5.0
v5.4.0
What's Changed
This release adds first support for macOS walltime.
Please note that profiling and other instruments are not yet available on macOS and will come in a later update.
- Support macos walltime without profiling in codspeed-node by @GuillaumeLagrange in #79
Full Changelog: CodSpeedHQ/codspeed-node@v5.3.0...v5.4.0
v5.3.0
What's Changed
We now collect buildtime and runtime environment data to warn users about differences in their runtime environment when comparing two runs against one another.
This data includes toolchain metadata like version and build options, as well as a list of dynamically loaded linked libraries.
- feat(fi): add memory profiling by @not-matthias in #73
- feat: dump node process information when running by @GuillaumeLagrange in #77
- chore: bump instrument-hooks to dump linked libraries by @GuillaumeLagrange in #78
Full Changelog: CodSpeedHQ/codspeed-node@v5.2.0...v5.3.0
earendil-works/pi (@earendil-works/pi-ai)
v0.99.2
Added
- Added the lightweight
@earendil-works/pi-ai/modelsentry point for model collections and provider construction without loading TypeBox, built-in catalogs, or provider SDKs. - Added Anthropic workload identity federation from the Anthropic SDK environment variables
ANTHROPIC_FEDERATION_RULE_ID,ANTHROPIC_ORGANIZATION_ID, andANTHROPIC_IDENTITY_TOKEN_FILE(plus optionalANTHROPIC_SERVICE_ACCOUNT_IDandANTHROPIC_WORKSPACE_ID). API keys andANTHROPIC_AUTH_TOKENtake precedence (#10177, #10242 by @philfreo)
Fixed
- Fixed context overflow detection for Z.AI CN endpoint
Prompt exceeds max lengtherrors (#10208) - Fixed Anthropic requests failing when a
strict: "prefer"tool schema uses keywords Anthropic strict tool use rejects, such asminimum/maximum; such tools are now sent non-strict (#9953) - Fixed provider retries firing immediately when a
Retry-Afterheader contains an unparseable date; they now use exponential backoff (#9571)
v0.99.1
Added
- Added GPT-6.1 Sol (
gpt-6.1-sol) to the OpenAI, Azure OpenAI Responses, and OpenAI Codex providers.
v0.99.0
Breaking Changes
- Unified image models into the regular
Provider/Modelssurface. The separateImagesModelscollection is removed:createImagesModels(),createImagesProvider(),ImagesProvider,openrouterImagesProvider(),builtinImagesProviders(), andbuiltinImagesModels()are gone. UsebuiltinModels(),models.getModelOfType("image", ...),models.generateImages(), andcreateProvider({ models, images })instead. Existing unqualified reads remain chat-only. - Image models are now
ImageModelwith a requiredtype: "image"and shareBaseModelwith chat models. The old plural image type names (ImagesModel,ImagesApi,KnownImagesApi,KnownImagesProvider, andImagesProviderId) are removed.generateImages()accepts only image models. Output modalities (output) remain on image models only. - Generated model data schema is now version 6: every entry carries
type, operation-specific catalogs include chat, image, and classifier models, and one upstream ID may have separate entries per type. OpenRouter image models live in theopenrouter-imagesapi group ofopenrouter.json;image-models.generated.tsandscripts/generate-image-models.tsare removed. Runnpm run hydrate:model-data.
Added
- Added
Models.generateImages()with provider-resolved auth,Provider.generateImages?, andcreateProvider({ images })keyed bymodel.api.createProvider()modelsandfetchModelsaccept models of every type, andapiis optional whenimagesorclassifiersis given. - Added an optional model
type("chat","image", or"classifier"). Chat models may omit it, so existing chat models, providers, and stores keep working unchanged. Narrow mixed lists with the newisModelType()guard or read the effective type withgetModelType(). - Added
getModelsOfType(),getModelOfType(),getAvailableOfType(),getAllModels(), andgetAllAvailable()onModels; optionalProvider.getAllModels()andProvider.filterAllModels(); corresponding generated-catalog accessors; and theAnyModelandModelTypeMaptypes.hasApi(),calculateCost(), andmodelsAreEqual()acceptAnyModel. - Added support for models of every type in
ModelsStoreEntry.models. Stored and fetched models of unknown types are dropped instead of failing a refresh. - Added classifier models and
Models.classify()with a provider-neutral JEV-stylechoice/score/boolcontract. The built-in TypeSafe provider exposes models.dev'sjev-latestthrough the System One API and translates publicboolquestions to TypeSafe'snoulwire format. - Added Jev classifier models on OpenRouter (
typesafe/jev-1.13,~typesafe/jev-latest) through its TypeSafe-compatible System One endpoint, and on Cloudflare Workers AI (typesafe/jev) through the newcloudflare-workers-ai-system-oneclassifier API. - Added Jev classifier models on Vercel AI Gateway (
typesafe-ai/jev, generated from its evaluation model catalog) and OpenCode Zen (jev-1.13,jev-1.13-free) through their TypeSafe-compatible System One endpoints. - Added
usagetoClassifierResult: System One classifications report token counts, priced from the model catalog like chat usage. - Added a runtime chat-model check to the
Modelsstream entry points so non-chat models fail with a clearModelsErrorinstead of a missing-api stream error. - Added array-based
models.all.jsonandproviders/{id}.all.jsonvariants to the generated and published JSON catalog, allowing the same upstream ID once per model type; the existing keyedmodels.jsonandproviders/{id}.jsonstay chat-only for released clients. - Added
onProviderStreamEventto observe parsed provider stream events before normalization, including provider-specific fields not retained in assistant messages (#9784, #9901 by @davidbrai). - Added Claude Sonnet 5.5 to the built-in Anthropic model catalog with adaptive thinking, mid-conversation effort, 1M context, and official pricing metadata.
- Added Sign in with ChatGPT to the
openaiprovider: an OAuth login that uses a ChatGPT subscription with the OpenAI API.Models.login()acceptsLoginOptionswithgetDeviceId(), which supplies a stable installation ID to login flows that need one. Subscription usage-limit errors are not retried and link to the ChatGPT usage page; temporary usage errors are retried. - Added the
llama-cpp-classifyclassifier API, which answers classifier questions from llama-server's next-token probabilities for single-token answer labels. - Added optional
AssistantMessage.thinkingLevel, which records the thinking level the agent loop requested for a response.
Changed
- Renamed the OpenAI Codex provider to "OpenAI Codex (legacy)"; Sign in with ChatGPT on the
openaiprovider supersedes it. - Unified the Anthropic, OpenAI Codex, OpenRouter, and Radius browser sign-in callback servers into one shared implementation with the same browser pages. The OAuth page helpers are now available as
@earendil-works/pi-ai/utils/oauth-page. - Changed Radius browser sign-in to exchange the authorization code before showing the browser page, so token exchange failures are shown in the browser.
Fixed
- Fixed 1-hour Anthropic cache writes reported by Vercel AI Gateway in streaming deltas being priced at the 5-minute rate (#9210).
- Fixed model-level
samplingParamsbeing dropped by directstream()/complete()calls on OpenAI-compatible APIs (#9506). - Fixed Mistral GLM models producing empty text blocks and split thinking blocks from empty content deltas, which could make later requests fail with "Expected at most one leading ThinkChunk" (#9674).
- Fixed OpenAI Fast mode requests being priced at the standard rate when the response reports
service_tier: "fast", as GPT-6 models do (#10034). - Fixed Mistral reasoning models ignoring the requested thinking level: GLM 5.3 now uses
reasoning_effortinstead ofprompt_mode, GLM 5.2 acceptsmax, and Mistral models only offer the effort levels the API supports (#9678). - Fixed OpenCode Zen and OpenCode Go
qwen3.8-flashthinking being replayed as plain text on later turns because the endpoint returns empty thinking signatures (#10047). - Fixed OpenAI Responses streams returning unfinished tool calls as runnable, which made servers that omit
output_index(such as llama.cpp) run mixed-up commands; such streams now end with an error (#9974). - Fixed Anthropic and OpenAI Codex browser sign-in waiting indefinitely after the provider redirected with an authorization error; sign-in now fails with the provider's error description.
- Fixed Anthropic browser sign-in failing when its callback port is in use; it now falls back to pasting the redirect URL.
- Fixed GitHub Copilot Claude Opus 5.5 offering unsupported thinking levels when upstream model metadata is incomplete; it now offers low through max.
v0.87.1
Added
- Added Claude Opus 5.5, GPT-6 Sol, and GPT-6 Luna to the GitHub Copilot catalog.
- Added GPT-6 Sol and GPT-6 Luna for OpenAI API keys and OpenAI Codex subscriptions, with full reasoning-effort, prompt-caching, tool-search, long-context pricing, and official cost metadata.
- Added Claude Opus 5.5 to the built-in Anthropic model catalog with adaptive thinking, 1M context, and official pricing metadata.
- Added Grok 4.7 to the built-in xAI model catalog with long-context pricing metadata.
Fixed
- Fixed image-only user messages being rejected by some OpenAI-compatible providers because they included an empty text part (#9797)
- Fixed Anthropic OAuth requests reporting an outdated Claude Code version.
v0.87.0
Added
- Added model image-input limit and cache-safe resize metadata to the generated catalog (#9631).
Fixed
- Fixed unknown OpenAI-compatible Chat Completions endpoints receiving strict tool schemas unless they explicitly advertise support, while preserving strict tools for capable built-in models (#9816).
v0.86.1
Added
- Added Meta provider (Model API key and Muse subscription OAuth) with Muse Spark models (#9096 by @xl0).
Fixed
- Fixed z.ai
Prompt too longerrors not being recognized as context overflow (#9805). - Fixed Cerebras models advertising unsupported strict tool schemas, which caused HTTP 400 errors when strict and non-strict tools were mixed (#9804 by @EdenGottlieb).
v0.86.0
Breaking Changes
- Changed provider-facing
ProviderStreamsandStreamFunctioninputs fromContextto normalizedTranscriptContextvalues. System prompts and tool declarations now live in transcript system messages; custom providers must read them withgetCurrentSystemPrompt()andgetCurrentTools(). See System Messages. - Restricted
ToolCall.argumentsandToolResultMessage.detailsto JSON-compatible values, changedToolResultMessageinto a conditional type, and madeJsonValuearrays readonly.
Added
- Added transcript-backed mid-conversation system prompt and tool changes, with native replay on supported models and automatic collapse for other providers. See System Messages (#9548).
- Added a generated public Radius model catalog for synchronous API lookup, with cached and live gateway catalogs overlaid at runtime.
- Enabled native deferred tool loading for Fireworks Messages models. Use
ToolSearchortool_searchas the loader name for prompt-prefix deferral (#9323). - Added
RetryPolicy.maxAgentDelayMssupport to cap shared assistant retry backoff for summarization calls (#8826). - Added
Model.promptCachelifetime metadata for short and long retention tiers to support prompt-cache warming decisions (#9668).
Fixed
- Fixed GitHub Copilot GPT models, including GPT-6 Astra, using the Chat Completions adapter instead of the required Responses adapter (#9253 by @petrroll).
- Fixed DeepSeek V4.1 thinking levels on OpenRouter and OpenCode Go preserving provider effort metadata (#9485).
- Fixed bodyless HTTP 400/413 errors from non-Cerebras providers being misclassified as context overflow (#9482).
- Fixed Vercel AI Gateway replaying unsigned thinking as assistant text (#9676).
- Fixed Google Generative AI and Vertex AI using unsupported thinking levels when reasoning is omitted or when model capabilities differ within a Gemini family (#9455).
- Fixed Anthropic-compatible relays breaking signed thinking replay when they report a different response model, while preserving fallback pricing (#9188).
- Fixed Amazon Bedrock one-hour cache writes being priced at the five-minute rate (#9457).
- Fixed quadratic CPU usage when draining buffered
EventStreamevents (#9055). - Fixed Mistral Medium reasoning requests to use
reasoning_effortfor all reasoning-capablemistral-medium-*model IDs instead of the unsupportedprompt_mode(#8700). - Fixed OpenCode and OpenCode Go requests to send
x-opencode-sessionfromsessionIdacross all supported API adapters (#9326). - Fixed OpenAI Codex requests to send the model's Off reasoning effort instead of omitting it, while respecting unsupported Off mappings (#9191).
- Fixed Fireworks unsigned thinking replay and reasoning effort selection using catalog metadata, with verified DeepSeek V4 and Qwen3.8 fallbacks and removal of redundant GLM 5.2 and Kimi K3 effort aliases (#9323).
- Fixed OpenRouter requests to send
x-session-idfromsessionIdfor Chat Completions and Anthropic Messages models when prompt caching is enabled (#9102). - Fixed the DeepSeek catalog to advertise
deepseek-flashfor DeepSeek V4.1 Flash instead of retired Flash aliases, and refreshed DeepSeek pricing metadata (#9423). - Fixed Mistral-hosted GLM-5.2 reasoning requests to use
reasoning_effortinstead of the ignoredprompt_mode(#9375). - Fixed OpenAI-compatible Responses errors to identify the actual provider instead of always labeling them as OpenAI errors (#9298).
- Fixed Baseten requests to send session-affinity headers from
sessionIdfor automatic prompt-cache routing (#9629). - Fixed retry classification for Cloudflare 520 responses (#9627).
- Fixed retry classification for transient Azure peak-load capacity errors (#9669).
Removed
- Removed GPT-5.4 and GPT-5.4 mini from the OpenAI Codex catalog after they became unavailable to ChatGPT accounts (#9394).
v0.85.1
Added
- Added GPT-6 Astra for OpenAI API keys and OpenAI Codex subscriptions.
Fixed
- Fixed long prompt-cache requests for GPT-5.6+ Responses models to use
prompt_cache_options.ttl: "30m"instead ofprompt_cache_retention: "24h".
v0.85.0
Breaking Changes
- Replaced
createGatewayBindingFetch()withcreateAiBindingFetch()for Cloudflare Workers AI bindings. Configure the model's Workers AI Gateway passthroughbaseUrldirectly; requests now pass through the binding unchanged (#8287 by @Maximo-Guk).
Added
- Added compact, persistable assistant-message frames with
AssistantMessageFrameEncoderandreduceAssistantMessageFrames(). - Added the
vllmPriorityOpenAI-compatible model setting for forwarding scheduler priority to vLLM (#9004 by @AppleDannyClegg). - Added the
supportsMaxOutputTokensOpenAI Responses compatibility setting (#8941 by @scturtle). - Added an optional timestamp argument to
uuidv7()for follower IDs. - Added narrow
api,providers, andutilssubpath exports for direct imports without loading the package barrel. - Added Anthropic per-turn effort persistence, deterministic historical effort markers, and signed-thinking mismatch recovery for supported Claude models across Anthropic Messages transports, including OpenRouter.
- Added Meta provider (Model API key and Muse subscription OAuth) with Muse Spark models.
Fixed
- Removed the unavailable Grok Build 0.1 model from the built-in xAI catalog (#9093 by @Jaaneek).
- Fixed assistant-message frames preserving the provider thinking level.
- Fixed simple provider streams to consistently emit standard stream events and custom tool-call deltas.
- Fixed the Qwen Token Plan Individual catalog to include Qwen3.8 Flash (#9021).
- Fixed Baseten GLM-5.2 models incorrectly advertising image input support (#8293 by @Panoplos).
- Fixed Fireworks GLM models using the wrong API adapter.
- Removed the unnecessary Chord dependency from pi-ai by defining its exported
JsonValuetype directly. - Fixed GitHub Copilot Claude Fable 5 requests to use the Anthropic Messages adapter so selected reasoning levels are sent (#8961).
- Fixed OpenAI Codex SSE parsing to process terminal events that are not followed by a blank line (#9047).
- Fixed
NO_PROXYmatching for both root domains and subdomains (#8737 by @MeiSiristhebest).
v0.84.4
Added
- Added the experimental vision-capable
deepseek-v4-flash-vision-expmodel to the DeepSeek catalog.
Fixed
- Fixed OpenAI-compatible Chat Completions ignoring an explicitly requested
toolChoicewhen no tools are defined. - Fixed thinking signature serialization to run once after the signature is complete (#8671).
- Fixed fragmented Mistral tool calls splitting when continuation chunks omit the tool-call ID (#8387).
- Fixed OpenAI-compatible reasoning replay to merge consecutive streamed text and summary
reasoning_detailsdeltas. - Fixed the Cloudflare AI Gateway catalog to include supported
workers-ai/*passthrough models omitted by models.dev. - Fixed OpenRouter reasoning controls by deriving
offsupport and available effort levels from OpenRouter's model metadata, preventing reasoning-mandatory models from receivingeffort: "none"(#8614 by @davidbrai).
v0.84.3
Breaking Changes
- Renamed
GoogleThinkingLeveltoGoogleApiThinkingLeveland addedResolvedGoogleThinkingLevelfor normalized adapter levels.
Added
- Added provider-neutral
toolChoicesupport to simple stream requests. - Added automatic Anthropic server-side refusal fallback for supported first-party models, including returned-model usage pricing (#8017).
- Added configurable OpenAI-compatible thinking-token budget fields for vLLM, Qwen/SGLang, and llama.cpp servers (#8275 by @bnsd55).
- Added China-specific ZAI Coding Plan models, including GLM-4.6V vision support, and API-equivalent usage cost estimates for models with published PAYG prices (#8220).
- Added
deepseek-v4-pro-0813to the Qwen Token Plan Individual catalog (#8194).
Changed
- Changed built-in xAI models to use the Responses API with encrypted reasoning replay and made Grok 4.6 the default xAI model (#8124 by @Jaaneek).
- Changed the Anthropic, Azure OpenAI, Google Generative AI, Google Vertex, Mistral, OpenAI Chat Completions, and OpenAI Responses adapters to send Pi's default
User-Agentunless overridden (#8305).
Fixed
- Fixed OpenAI-compatible Chat Completions reasoning replay to preserve and resend assistant-level
reasoning_details(reasoning.text,reasoning.summary, andreasoning.encrypted) verbatim and in order (#7994). - Fixed Anthropic server-side fallback responses being priced with the requested model instead of the returned fallback model (#8285).
- Fixed GitHub Copilot login triggering model-policy rate limits by limiting policy updates, retrying model discovery once, and honoring server retry delays (#7850).
- Fixed Amazon Bedrock dropping and failing to replay opaque redacted reasoning from non-Anthropic models (#8314 by @seiji).
- Fixed Z.AI Coding Plan models deriving incomplete reasoning-effort metadata, including missing GLM-5.3 low, high, and max levels (#8336).
- Fixed DeepSeek V4 Flash on OpenCode and OpenCode Go omitting its supported low thinking level (#8181 by @tianshuang).
- Fixed Azure OpenAI Responses ignoring
toolChoicein provider-specific stream requests. - Fixed Amazon Bedrock
after_provider_response/onResponseto forward the raw response headers instead of only the synthesized request id header (#8234). - Fixed Kimi OpenAI-compatible usage reporting so top-level
cached_tokenscount as cache reads instead of normal input tokens (#8075). - Fixed Google Generative AI and Vertex AI custom models ignoring
thinkingLevelMap, which dropped extended thinking controls (#8135). - Fixed Xiaomi model catalog generation retaining shut-down MiMo V2 model names after models.dev marked them deprecated (#8187).
- Fixed OpenRouter reasoning controls by deriving
offsupport and available effort levels from OpenRouter's model metadata, preventing reasoning-mandatory models from receivingeffort: "none"(#8454).
v0.84.2
Added
- Added
createGatewayBindingFetch()for routing Cloudflare AI Gateway requests through a Workers AI binding without an API token (#7901 by @Maximo-Guk). - Added
AssistantMessage.endTurnto preserve OpenAI Codex's terminalend_turnsignal for diagnostics (#7766).
Changed
- Changed Kimi Coding requests to use pi's runtime
User-Agentheader. - Automatically converted supported strict tool schemas to provider-compatible closed objects with required nullable optional fields while preserving original tool definitions, and treated
nullvalues for optional non-nullable tool arguments as omitted. - Changed OpenAI Responses deferred tool loading to prefer message-anchored
additional_toolswhere supported while retaining tool-search and top-level fallbacks (#7709). - Replaced the Mistral SDK transport with a native Chat Completions HTTP stream, eliminating its generated client and schema runtime overhead.
Fixed
- Fixed GitHub Copilot login triggering API rate limits while enabling model policies by limiting concurrent policy updates (#6187).
- Fixed GitHub Copilot login still triggering API rate limits by updating only account models with unconfigured policies and honoring server retry delays (#7850).
- Fixed upstream request buffer limit failures to trigger automatic assistant retries.
- Fixed OpenAI Responses function and custom tool calls to preserve namespaces during streaming, proxying, and replay (#7709).
- Fixed built-in and custom DeepSeek API models to send output limits through the supported
max_tokensfield. - Fixed Google Generative AI and Vertex AI responses with tool calls incorrectly treating output-limit or provider-error stops as normal tool use (#8059).
- Fixed Amazon Bedrock replay rejecting tool arguments that contain empty object keys while preserving all valid nested values (#7882 by @muyiyr).
- Fixed DeepSeek compatibility detection for base URLs whose hostname contains uppercase letters (#7933 by @yearth).
v0.84.1
Added
- Added Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog and the shared international
QWEN_TOKEN_PLAN_API_KEY(#7659 by @arasovic).
v0.84.0
Breaking Changes
-
Renamed the exported
ModelsStreamTransformsinterface toModelsRequestTransformsbecause its header transformation now applies to all authenticated provider requests. -
Required dynamic model providers to accept a concrete
RefreshModelsContext.signal;Models.refresh()remains unbounded when callers omit its optional signal. -
Required provider login, API-key check/resolution, and OAuth refresh implementations to accept a concrete abort signal; public auth and credential operations remain unbounded when callers omit their optional signal.
-
Replaced raw
RefreshModelsContext.storeaccess with the read-onlycontext.storedsnapshot and generation-checkedcontext.publish()transaction.createProvider({ fetchModels }): no catalog-publication migration is required. Before and after, return the fetched list;createProvider()restores stored models and publishes and persists refreshed models itself.signalis now guaranteed to be present.// Before const beforeProvider = createProvider({ // ... fetchModels: async ({ signal }) => { const response = await fetch(catalogUrl, { signal }); return parseModels(await response.json()); }, }); // After: unchanged const afterProvider = createProvider({ // ... fetchModels: async ({ signal }) => { const response = await fetch(catalogUrl, { signal }); return parseModels(await response.json()); }, });
Handwritten
Provider.refreshModels(): replace direct store access and pre-publication mutation with generation-guarded publications.// Before refreshModels: async (context) => { const stored = await context.store.read(); if (stored) currentModels = stored.models; if (!context.allowNetwork) return; const refreshed = await fetchModels(context.signal); currentModels = refreshed; await context.store.write({ models: refreshed, checkedAt: Date.now() }); }, // After refreshModels: async (context) => { if (context.stored) { const restored = context.stored.models; if (!(await context.publish({ update: () => { currentModels = restored; }, }))) return; } if (!context.allowNetwork) return; const refreshed = await fetchModels(context.signal); if (context.signal.aborted) return; await context.publish({ persist: { models: refreshed, checkedAt: Date.now() }, update: () => { currentModels = refreshed; }, }); },
In
publish(), omitpersistto leave storage unchanged, pass aModelsStoreEntryto write it, or passpersist: nullto delete it. Omitupdatefor metadata-only persistence; omitpersistfor an ephemeral in-memory publication.
Added
- Added optional
OAuthAuth.isSubscriptionmetadata for distinguishing subscription-backed authentication from generic OAuth sign-in. - Added explicit
TelemetryContextpropagation across stream, deferred, and image request options using the vendor-neutral@earendil-works/pi-telemetrycontract. - Added deferred provider request contracts, durable response handles, authenticated fetch/cancel dispatch, and faux-provider support for pending, ready, failed, and cancelled responses (#7339 by @davidbrai).
- Added Baseten as a built-in OpenAI-compatible provider with models.dev catalog generation and native
chat_template_argsreasoning controls. - Added arbitrary OpenAI-compatible sampling parameters through
Model.samplingParamsandStreamOptions.samplingParams, including per-request overrides (#7568 by @mrexodia). - Added opt-in vLLM
thinking_token_budgetsupport for OpenAI-compatible models, reserving output tokens for the final answer (#7638 by @bnsd55). - Added
OpenAICompletionsCompat.supportsFinishReasonfor providers that omit streamedfinish_reasonvalues, inferring normal and tool-use stops when the stream ends. - Added structured Amazon Bedrock failure diagnostics with HTTP status, modeled error code, and AWS request id when available (#7286 by @brianstanley).
Changed
- Added optional cancellation to
ModelsStorereads, writes, and deletions; catalog orchestration binds these waits to the provider refresh signal.
Fixed
- Fixed GitHub Copilot Grok 4.5 requests to use the supported Responses API (#7560).
- Bounded OAuth token refreshes so stalled requests release the credential-store lock (#7508).
- Fixed tool argument validation to preserve values that already match an
anyOf/oneOfunion arm before attempting coercion, avoiding nullable unions convertingnullto another primitive value (#7328). - Fixed cancellation of model catalog refreshes so callers stop waiting even when a custom provider ignores its abort signal (#7027).
- Fixed auth resolution, availability checks, OAuth refreshes, provider login, and in-memory credential queue waits to honor caller cancellation.
- Fixed newer provider refreshes being blocked by or overwritten by an older stalled generation, including persisted catalog publication.
- Updated GPT-5.6 Terra and Luna pricing across OpenAI and passthrough model catalogs.
- Fixed Fireworks Kimi K3 models to use the OpenAI-compatible API with native reasoning-effort levels and deferred tools (#7199, #7230 by @XBeg9).
- Fixed Fireworks GLM 5.2 models sending the unsupported
prompt_cache_retentionfield when long cache retention is enabled, and enabled session affinity for automatic prompt caching (#7676). - Updated Groq's Qwen reasoning override for the replacement
qwen/qwen3.6-27bmodel. - Fixed the OpenCode Go provider display name.
- Fixed provider error normalization treating arrays and class instances as structured response bodies instead of preserving their original errors (#7205 by @erikogenvik).
- Fixed Anthropic streams dropping text or thinking included in the initial content-block event (#7358 by @davidbrai).
- Fixed Google history conversion dropping signed empty text and thinking blocks required for replay (#7362 by @jingtao-wisdomgraph).
- Fixed OpenAI Codex cached WebSocket sessions being shared across different account credentials (#7364).
- Fixed transient Google Generative AI and Vertex AI provider errors bypassing automatic retries (#7471 by @vish-pr).
- Fixed Gemini 3 tool call ids being discarded during history conversion, breaking signed multi-turn replay (#7494 by @muyiyr).
- Fixed OpenAI Responses incomplete reasons so only
max_output_tokensis treated as a length stop, and exposed bounded recovery detection for responses truncated below their intended output limit (#7540 by @davidbrai). - Restored GitHub Copilot models returned through account-specific policy responses (#7672 by @muyiyr).
- Replaced the retired Qwen Token Plan
qwen3.8-max-previewmodel withqwen3.8-max(#7670 by @QuintinShaw).
withastro/flue (@flue/runtime)
v2.2.2
Patch Changes
2cb57be: Fix Claude models on thecloudflare-ai-gatewayprovider failing with404 not_found_error: model: claude-sonnet-4.6 was not found. Since Pi 0.84.3 the gateway catalog lists Claude models with dotted versions (claude-sonnet-4.6), but the gateway's native Anthropic endpoint forwards the model ID to Anthropic, which only accepts dashed IDs. Flue now registers these models under Anthropic's IDs (cloudflare-ai-gateway/claude-sonnet-4-6); dotted specifiers still resolve to them. Thecloudflarebinding provider, which uses Cloudflare's dotted catalog names, is unchanged.
v2.2.1
Patch Changes
548937e: Fix model specifiers that stopped resolving after the Pi 0.87.1 up
❗ Important
✂ PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| vite (source) | ^8.3.0 → ^8.3.2 |
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| package-manager-detector | ^1.8.0 → ^1.9.0 |
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

Changes
- Fixes
astro addwiping existingallowBuildsapprovals inpnpm-workspace.yamlon pnpm v11.0–v11.22 when an integration needs a build script approved (currentlyworkerdfor Cloudflare), a regression from #18287. On those versions--allow-buildreplaces the whole map, so later installs fail withERR_PNPM_IGNORED_BUILDSfor previously approved packages. - The packages are now merged into the existing map before installing now
Testing
- Updated
test/units/cli/add-pnpm.test.ts
Docs
- N/A, bug fix

This PR contains the following updates:
Release Notes
NaturalIntelligence/fast-xml-parser (fast-xml-parser)
v5.11.2
What's Changed
- fix: decode Uint8Array XML input as UTF-8 by @emme1t in #875
- fix: type EntityDecoderOptions.setXmlVersion's version as a number by @YevheniiKotyrlo in #880
New Contributors
- @emme1t made their first contribution in #875
- @YevheniiKotyrlo made their first contribution in #880
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.1...v5.11.2
v5.11.1
What's Changed
- Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #858
- Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by @dependabot[bot] in #856
- Bump actions/setup-node from 6.4.0 to 7.0.0 by @dependabot[bot] in #854
- docs: fix two 404 documentation links by @rajanpanth in #862
New Contributors
- @rajanpanth made their first contribution in #862
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.0...v5.11.1
v5.11.0
What's Changed
- add support for endIndex in node metadata (5.x edition) by @Wain-PC in #850
- fix: don't crash on a closing tag with no matching opening tag by @hdimer in #861
New Contributors
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.0
v5.10.1
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1
v5.10.0
What's Changed
- Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #849
- Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @dependabot[bot] in #848
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.0
v5.9.3
What's Changed
- Harden GitHub Actions workflows by @martincostello in #841
- GitHub Actions workflow fixes by @martincostello in #844
New Contributors
- @martincostello made their first contribution in #841
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.2...v5.9.3
v5.9.2
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.1...v5.9.2
v5.9.1
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.0...v5.9.1
v5.9.0: update strnum, use is-unsafe
- update strnum to 2.3.0
- you can set hex, binary, enotation, infinity, unicode
- validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.
antfu-collective/package-manager-detector (package-manager-detector)
v1.9.0
🚀 Features
- Add
ignoreWorkspaceRootCheckoption for pnpm/yarn v1 - by @danielroe in #83 (8bb98) - Why command - by @himynameisdave and @antfu in #79 (d52fb)
- Add support for upm package manager - by @iiio2, Claude Opus 5.5 and @antfu in #80 (bff26)
- Prefix bare package names with npm: for deno add - by @antfubot in #84 (55b09)
- Expose agent construction logic - by @josh-hemphill and @antfubot in #65 (03a5e)
- Add
minimumReleaseAgeoption toresolveCommand- by @antfubot in #85 (3106c)
View changes on GitHub
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| vite (source) | ^8.3.0 → ^8.3.2 |
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| @qwik.dev/partytown | ^0.14.4 → ^0.14.5 |
Release Notes
QwikDev/partytown (@qwik.dev/partytown)
v0.14.5
Patch Changes
-
🐞🩹 fall back right away when
navigator.serviceWorker.register()fulfills without a registration (e.g. Playwright'sserviceWorkers: 'block'), instead of throwingCannot read properties of undefined (reading 'active')(by @MFA-G in #764) -
🐞🩹 read scroll offsets from the main thread instead of caching them, so scripts such as GA4 observe scrolling after their initial read. (by @Niek in #766)
-
🐞🩹 define
HTMLCollectionin the web worker sox instanceof HTMLCollectionno longer throws (e.g. gtag's user-provided-data DOM scan) (by @gioboa in #762)
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| @fastify/static | ^10.1.4 → ^10.1.5 |
Release Notes
fastify/fastify-static (@fastify/static)
v10.1.5
What's Changed
New Contributors
Full Changelog: fastify/fastify-static@v10.1.4...v10.1.5
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

Changes
Astro.cachewasundefinedwhen the 404 or 500 page was rendered throughrenderDefaultError(production) orrenderDevError(dev), because those handlers created a newFetchStatewithout callingprovideCache(). AnyAstro.cache.set()in an error page or its shared layout would throw mid-stream, discarding the rendered body and returningInternal server errorinstead.- Both error handlers now call
await provideCache(errorState), the same way the normal rendering pipeline does. With no cache provider configured, the disabled no-op shim is used. Error pages still do not go throughhandleCache, socache.set()there sets no CDN headers.
Testing
- Added
packages/astro/test/units/cache/app-cache.test.tscovering the case whereAstro.cacheis present and non-undefined when a 404 is rendered via the error handler path (method-mismatch on an API route).
Docs
- No docs update needed; this restores behavior that was already guaranteed by the non-optional
cache: CacheLiketype signature.
Closes #18275

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
astro@7.3.8
Patch Changes
-
#18293
28e7410Thanks @astro-factory! - FixesAstro.cachebeingundefinedwhen a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export -
#18298
0e9e857Thanks @matthewp! - Fixesastro addremoving existingallowBuildsapprovals frompnpm-workspace.yamlwith pnpm v11.0–v11.22 -
#18263
882dd98Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-basedtransformWithOxcand Rolldown instead of esbuild. These packages no longer depend on esbuild directly. -
#18290
31f13c3Thanks @astro-factory! - Fixes theglob()loader not reloading changed files in dev when the pattern starts with an extglob such as!(drafts)/**/*.md
create-astro@5.2.6
Patch Changes
- #18263
882dd98Thanks @florian-lefebvre! - Removes the automaticallowScriptsandallowBuildspre-approval from generated projects. Astro's dependencies no longer run install scripts, so the workaround is no longer needed.
@astrojs/markdoc@2.0.11
Patch Changes
- #18263
882dd98Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-basedtransformWithOxcand Rolldown instead of esbuild. These packages no longer depend on esbuild directly.
@astrojs/netlify@8.2.9
Patch Changes
- #18263
882dd98Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-basedtransformWithOxcand Rolldown instead of esbuild. These packages no longer depend on esbuild directly. - Updated dependencies []:
- @astrojs/underscore-redirects@1.0.4
@astrojs/vercel@11.0.13
Patch Changes
- #18263
882dd98Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-basedtransformWithOxcand Rolldown instead of esbuild. These packages no longer depend on esbuild directly.
astro-vscode@2.17.2
Patch Changes
- #18263
882dd98Thanks @florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-basedtransformWithOxcand Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

Changes
- Workers Cache reports a refused purge, including one over the rate limit, as
success: falsein the result ofcache.purge()(docs). The provider dropped that result, socache.invalidate()resolved and the pages stayed cached with nothing logged. Workers Cache purges always use the Free-tier limit of 5 per minute per account, with a bucket of 25 (limits), which a site that purges on every content save can reach. - The provider throws when
successisfalse, with Cloudflare'serrorsas the error'scause, asinvalidate()already does on Netlify when its purge request fails. Successful purges are unchanged. Callers that awaitinvalidate()after a write start seeing rejections; EmDash is guarding its calls in emdash-cms/emdash#3987.
Testing
- New
test/units/cache-purge.test.tscovers the purge step with a stand-incacheobject, sincecloudflare:workersdoes not load in Node: an accepted purge passes the tags through and resolves, a refused one rejects with the returned errors ascause.
Docs
- None needed: the route caching guide does not describe what
invalidate()does when a purge fails, for any provider.

Changes
- The dev-server watcher filter in the glob loader no longer misclassifies extglob patterns like
!(hidden|_docs)/**/*.{md,mdx}as exclusions. Previously, any pattern starting with!was treated as a negation, leavingpositivePatternsempty and causing allchange,add, andunlinkevents to be silently ignored. The fix mirrors tinyglobby's own rule: a pattern is an exclusion only when it starts with!and the next character is not(. This restores live-reload for these patterns without affecting plain negations like!drafts/**. - First load was unaffected because tinyglobby already applied this distinction; only the watcher path was wrong.
Testing
- New unit test added in
packages/astro/test/units/content-layer/glob-loader.test.tscovering a glob collection configured with an extglob exclusion pattern; the test verifies that file-change events are forwarded to the loader. The test fails without the fix and passes with it.
Docs
- No docs update needed — this is a bug fix restoring already-documented behaviour; the glob loader API itself is unchanged.
Closes #18289

Fixes #18285
Changes
- The header check in
renderPageparsed as(inject && dest === 'header') || dest === 'adapter', so withcspDestination: 'adapter'(e.g. VercelstaticHeaders: true) the CSP header went out inastro devtoo, whereshouldInjectCspMetaTagsis false. Itsstyle-srchas no hashes for Vite's inline styles, so pages rendered unstyled. - Added the parentheses so it matches the other branch a few lines up. Builds are unaffected, since there
shouldInjectCspMetaTagsis true.
Testing
Two unit tests in test/units/csp/rendering.test.ts: adapter still gets the header when CSP is injected, and gets none when it isn't (the dev case). The second fails on the old condition. The CSP unit file passes (28/28).
Docs
None, this makes dev match what the docs already say.

Changes
astro add cloudflarenow succeeds on the first run when using pnpm v11 or newer. pnpm v11+ enablesstrictDepBuildsby default, which causespnpm addto exit withERR_PNPM_IGNORED_BUILDSwhen a transitive dependency (workerd, via wrangler/miniflare) has an unapproved build script. The install was silently counted as failed andastro.config.*was never updated.- When pnpm v11+ is detected,
astro addnow appends--allow-build=workerdto the generatedpnpm addcommand for the Cloudflare adapter. pnpm then writesworkerd: trueintoallowBuildsinpnpm-workspace.yamlautomatically. The install-failure log also now includes stderr so the real error is visible on the first failed run.
Testing
- Added
packages/astro/test/units/cli/add-pnpm.test.tscovering the--allow-build=workerdflag injection for the Cloudflare adapter under pnpm v11+, and confirming that older pnpm versions and other adapters are unaffected.
Docs
- No docs update needed; this is a CLI behavior fix with no user-facing API change.
Closes #18286
Description
While reviewing and doing some tests for #4218, I noticed some Failed to resolve dependency warnings being logged when running the development server in projects using the Cloudflare adapter.
These dependencies were actually never dependencies of Expressive Code but of Starlight itself and were removed in #4134. This now causes the warning. I guess these directives were working previously due to pnpm hoisting behavior and Vite does not care about the exact path but if it can resolve the dependency or not.
To test, I ran:
cd packages/starlightpnpm build && pnpm pack --out /tmp/sl-cloudflare-test.tgz
In a new directory, I then ran the following commands:
pnpm create astro@latest . -- --template starlight --install --no-gitpnpm astro add cloudflarepnpm add /tmp/sl-cloudflare-test.tgzpnpm dev
Here is a comparison before and after the changes:
| Before | After |
|---|---|
![]() |
![]() |

Changes
- Restores the Deno 2.9.5 pin for the integrations test suite. Renovate bumped
deno-versionto 2.9.6 in #18279, and Deno 2.9.6 dropped--allow-scriptsfromdeno eval, which@netlify/edge-functions-devpasses to boot its dev server. - Ignores the
denodependency in.github/renovate.json5so Renovate stops updating thedeno-versioninput ofdenoland/setup-deno. - Made with AI
Testing
- N/A
Docs
- N/A

This PR contains the following updates:
Release Notes
shikijs/shiki (@shikijs/rehype)
v4.5.0
🚀 Features
- Emit an explicit color level from codeToANSI - by @EvanProgramming in #1320 (b968e)
- transformers:
- Add classActiveCode option to transformerNotationWordHighlight - by @curiouscoder-cmd in #1201 (1e968)
- Add transformerRenderLineNumber - by @Divyapahuja31 and DIVYA PAHUJA in #1238 (02f05)
🐞 Bug Fixes
- cli:
- Fall back to 'text' when file/URL has no extension and no -… - by @VeerShah41 in #1248 (c00e5)
- Fall back to plaintext for unknown languages - by @Jinjiang and @antfubot in #1319 (4eb7c)
- primitive:
- Dispose wasm memory for lazily embedded langs - by @rgodha24 in #1322 (b5423)
- Dedupe grammar injections on repeated language loads - by @antlio and @antfubot in #1318 (33678)
- stream:
- Compile Solid renderer with babel-preset-solid - by @BetterAndBetterII and @antfu in #1309 (8724e)
- transformers:
- Keep notations on content comment lines - by @tianrking in #1308 (d25ab)
- Handle split
#and--comments in rose-pine theme - by @anandghegde in #1317 (63e6d)
- twoslash:
- Avoid crash when @errors nodes land past EOF - by @Yahiro025, @cursoragent and @antfubot in #1316 (5c919)
🏎 Performance
- engine-js: Reuse each regex's last search while tokenizing a line - by @issacgerges and @antfu in #1314 (2ef5e)
- stream: Group tokens by line in the React renderer - by @CNSeniorious000 in #1311 (81200)
- vitepress-twoslash: Replace lz-string with lz-string-es - by @antfubot in #1324 (2e170)
View changes on GitHub
v4.4.3
🚀 Features
🐞 Bug Fixes
- vitepress-twoslash: Delay twoslash tooltip show by 200ms - by @antfubot in #1306 (9f2aa)
View changes on GitHub
v4.4.2
🐞 Bug Fixes
- Unbreak CI after vite 8 bump and grammar/deps updates - by @antfubot in #1300 (c5d31)
🏎 Performance
View changes on GitHub
v4.4.1
🚀 Features
View changes on GitHub
v4.4.0
🚀 Features
🐞 Bug Fixes
- core: Guess yaml from frontmatter segments - by @antfubot in #1299 (1b8b6)
View changes on GitHub
v4.3.1
🚀 Features
View changes on GitHub
v4.3.0
🚀 Features
- stream: Add svelte renderer - by @CNSeniorious000 and Anthony Fu (via agent) in #1291 (2d18a)
View changes on GitHub
v4.2.0
🚀 Features
- Add @shikijs/stream and @shikijs/magic-move packages - by @antfu in #1283 (d031f)
🐞 Bug Fixes
- transformers: Handle YAML comment prefixes correctly for v3 - by @AkaHarshit in #1266 (f694a)
- vitepress-twoslash: Scroll blocking on mobile viewports - by @micaiguai in #1262 (9e0e8)
View changes on GitHub
v4.1.0
🐞 Bug Fixes
- twoslash: Forward
tsModuletocreateTwoslasher- by @arthurfiorette in #1271 (be89a)
View changes on GitHub
rehype-pretty/rehype-pretty-code (rehype-pretty-code)
v0.14.5
Patch Changes
- fix: detect
showLineNumberswherever it appears in the meta string, not only before the highlight annotations, while ignoring the word when it is part of a character highlight such as/foo showLineNumbers bar/(#204) - fix: stop character-highlight ranges leaking across patterns, so an id-only annotation like
/foo/#ano longer makes a later pattern inherit the previous pattern's range, and a range-ignored occurrence no longer consumes the whole token it lives in (#169)
Range-excluded occurrences are counted without changing the token tree, so unhighlighted markup remains intact.
Partial highlights contained within a transformer-generated element preserve that surrounding semantic element instead of cloning it.
v0.14.4
Patch Changes
- fix: prevent an infinite loop in inline character highlighting when a pattern matches text that spans multiple syntax tokens and occurs more than once on the same line (#185)
silvenon/remark-smartypants (remark-smartypants)
v3.0.3
- Fix quote direction at the start of headings and table cells by @geraschenko in #103
bruits/satteri (satteri)
v0.10.5
Patch changes
- Updated dependencies: satteri-mdxjs (Cargo)@0.3.13
v0.10.4
Patch changes
- Updated dependencies: satteri-mdxjs (Cargo)@0.3.13
mozilla/source-map (source-map)
v0.8.0
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Type | Update | Change | Age | Confidence |
|---|---|---|---|---|---|
| CodSpeedHQ/action | action | minor | v5.2.1 → v5.4.0 |
||
| changesets/action | action | patch | v2.1.1 → v2.1.2 |
||
| deno (source) | uses-with | patch | v2.9.5 → 2.9.6 |
||
| node | uses-with | minor | 24.15.0 → 24.21.0 |
||
| node | uses-with | minor | 24.18.0 → 24.21.0 |
||
| pnpm/action-setup | action | minor | v6.0.8 → v6.1.0 |
||
| zizmorcore/zizmor-action | action | minor | v0.5.6 → v0.6.4 |
Release Notes
CodSpeedHQ/action (CodSpeedHQ/action)
v5.4.0
Bumps the CodSpeed runner to v5.4.0, including v5.3.0 and v5.3.1.
The Memory instrument now tracks physical (resident) memory and captures allocation call stacks to build memory flamegraphs. Both are enabled by default and can be turned off with the new disable-memory-track-physical and disable-memory-capture-stack inputs. Serialization is also faster on large memory benchmarks.
The action now exposes the id of the CodSpeed run as a run-id output, and CodSpeed now works on non-Ubuntu/Debian distributions such as Arch Linux.
🚀 Features
- Track physical memory and capture allocation call stacks for memory flamegraphs, both enabled by default by @not-matthias in #529, #522 and #553
- Expose the run id as a GitHub Actions step output by @moha-bekh in #551
- Add an
--experimental-disable-pythonmalloc-overrideflag (CODSPEED_EXPERIMENTAL_DISABLE_PYTHONMALLOC_OVERRIDE) to stop overriding the Python allocator, which can break free-threaded Python in simulation mode, by @not-matthias in #539 - Apply kernel memory tunables before memory-mode runs, and fail early when the kernel has no BTF by @not-matthias in #507 and #524
- Pause producers under ring buffer pressure in memory mode, and log process stops per reason by @not-matthias in #543
- Log which authentication method the run uses by @fargito in #521
🐛 Bug Fixes
- Support distributions CodSpeed publishes no valgrind package for (Arch, rolling releases) by @moha-bekh in #525
- Error out when the profile archive exceeds the upload size limit by @lvaroqui in #557
- Detect free-threaded Python from venv and uv before setting
PYTHONMALLOCby @not-matthias in #539 - Honor deprecated experimental flags, including their falsey values, instead of ignoring them by @not-matthias in #532 and #553
- Fix memory tracking edge cases: reused pids, stack-ring overflow, BPF links held by forked processes, and allocator symbols aliased at an attached offset by @not-matthias in #522 and #543
- Attach memory tracking hooks without
perf_event_openby @GuillaumeLagrange in #536 - Restore profiling sysctls in walltime mode by @not-matthias in #507
⚡ Performance
- Speed up memory serialization and reduce the tracker's memory usage on large memory benchmarks by @not-matthias in #522, #537, #548, #558 and #560
⚙️ Internals
- Pin memtrack to 1.6.0, through 1.5.0 and 1.5.1, by @adriencaccia in #530, #541 and #561
- Keep mmap/munmap/brk as deprecated memtrack artifact variants by @GuillaumeLagrange in #538
Full Runner Changelog:
https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md
What's Changed
- chore: bump runner version to 5.3.0 by @github-actions[bot] in #239
- feat: add memory-track-physical experimental input by @not-matthias in #238
- chore: bump runner version to 5.3.1 by @github-actions[bot] in #240
- feat: add a run-id output by @moha-bekh in #243
- chore: bump runner version to 5.4.0 by @github-actions[bot] in #244
- feat: add disable-memory-capture-stack and disable-memory-track-physical inputs by @not-matthias in #242
New Contributors
- @moha-bekh made their first contribution in #243
Full Changelog: CodSpeedHQ/action@v5.2.1...v5.4.0
changesets/action (changesets/action)
v2.1.2
Patch Changes
denoland/deno (deno)
v2.9.6
- feat(compressible): add support for 'text/x-component' content type (#36450)
- feat(desktop): clipboard api (#35750)
- feat(desktop): support checked, icon, and tooltip on menu items (#36649)
- fix(bundle): isolate esbuild downloads from workspace registries (#36467)
- fix(cache): combine duplicate headers for Vary matching (#36476)
- fix(cli_parser): remove orphaned sync-types parser
- fix(core): cap adaptive buffer initial allocations (#36432)
- fix(core): make Unix pipe fd ownership explicit (#36353)
- fix(core): make user timer waker state thread-safe (#36495)
- fix(coverage): compare a range against a line in V8's units (#36613)
- fix(crypto): preserve RSA-OAEP label bytes (#36441)
- fix(desktop): keep dots in the app name when resolving the runtime library
(#36006) - fix(desktop): keep the macOS bundle signature valid unless an update is
applied (#36574) - fix(desktop): never block the JS thread on the error-report dialog (#36575)
- fix(desktop): propagate deno.json version and license into packaged installers
(#36577) - fix(desktop): run Vite-based HMR dev servers inside the desktop runtime
(#36488) - fix(desktop): transport binding args and results as DesktopValue so Uint8Array
survives (#36573) - fix(ext/fetch): enforce permissions for proxy transports (#36217)
- fix(ext/fetch): only retry transport errors on pooled connections (#36415)
- fix(ext/fetch): raise default HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE to 256KB
(#36558) - fix(ext/http): keep request body readable after response is sent (#36629)
- fix(ext/http): route invalid async responses to onError (#36437)
- fix(ext/napi): don't invoke napi_wrap finalizer twice at teardown (#36556)
- fix(ext/napi): run JS-calling finalizers safely, NULL string result, and
Float16Array (#36572) - fix(ext/napi): surface OS error and path on addon load failure (#36630)
- fix(ext/napi): track pending finalizers by identity (#36551)
- fix(ext/napi): wake the event loop at the next uv_timer deadline (#36559)
- fix(ext/net): skip unsupported DNS records in ANY queries (#36650)
- fix(ext/node): accept string ports in dns.lookupService (#36546)
- fix(ext/node): build the proxied request target with the URL parser (#36557)
- fix(ext/node): do not resume client TLS sessions unless requested (#36592)
- fix(ext/node): fix perf_hooks detail.req.url proxied path duplication (#36407)
- fix(ext/node): handle readv short reads (#36211)
- fix(ext/node): require sys permission for inspector.open (#36465)
- fix(ext/node_sqlite): invalidate sessions on database close (#36633)
- fix(ext/tls): avoid panic for mismatched client certificate and key (#36457)
- fix(ext/web): clean up abort handlers when listeners are removed (#36226)
- fix(ext/web): close transfer MessagePort when a transferred readable is
cancelled (#36270) - fix(ext/web): snapshot SharedArrayBuffer input in TextDecoder.decode()
(#36611) - fix(fetch): require an initial multipart boundary (#36470)
- fix(ffi): validate struct return buffers (#36373)
- fix(fmt): honor .editorconfig when formatting from stdin (#36267)
- fix(fs): require write permission for creating opens (#36497)
- fix(fs): use a private FsFile constructor token (#36439)
- fix(glob): retain valid gitignore rules after parse errors (#36478)
- fix(http): preserve keep-alive after reading request body (#36690)
- fix(http): truncate streaming responses to content length (#36496)
- fix(lsp): restrict registry completion endpoint schemes (#36477)
- fix(node): check reads during require resolution (#36461)
- fix(node): match domain uncaught exception handling (#36475)
- fix(node): preserve v8 deserializer view offsets (#36460)
- fix(node): validate Brotli encoder operations (#36530)
- fix(node): validate raw outgoing HTTP headers (#36471)
- fix(node/crypto): preserve binary key export passphrases (#36443)
- fix(node_crypto): apply RFC 7748 scalar decoding for X448 (#36466)
- fix(node_crypto): size cipher updates by byte length (#36459)
- fix(node_shim): preserve explicit argument delimiters (#36435)
- fix(npm): flatten single-resolution peers when building package ids (#36608)
- fix(npm): match peer fallbacks when checking peer resolution cache (#36607)
- fix(npm): remove arrayref dependency (#36653)
- fix(npm): resolve bare npm specifier when latest is too new for min dependency
age (#36619) - fix(npm): use cached abbreviated metadata under --cached-only (#36526)
- fix(npm): validate tar paths before extraction (#36468)
- fix(os): serialize process environment updates (#36074)
- fix(permissions): check resolved IP against import deny list (#36486)
- fix(process): reject NULs in Windows arguments (#36436)
- fix(process): validate whitespace-only loader environment values (#36431)
- fix(publish): authenticate the package existence check so private packages
work (#36656) - fix(publish): memoize publish order depth (#36215)
- fix(publish): reject invalid JSR package names (#36474)
- fix(repl): skip regex literals when validating input (#36375)
- fix(runtime): unregister dropped signal resources (#36213)
- fix(web): keep MessagePort resource identifiers private (#36440)
- fix: bugs in primordials related to
ObjectCreateand
ObjectDefineProperties(#36541) - fix: prevent threadpool starvation with concurrent file locks (#32789)
- perf(core): grow the op driver's future arena on demand (#36678)
- perf(core): uncontended-borrow fast path for AsyncRefCell (#36679)
- perf(core): use index-based
SafeArrayIteratorin primordials (#36543) - perf(core): zero-copy snapshot rehydration, drop bincode (#36680)
- perf(ext/web): apply the base64url op design to standard base64 (#36422)
- perf(ext/websocket): shrink the op_ws_create future (#36681)
actions/node-versions (node)
v24.21.0: 24.21.0
Node.js 24.21.0
v24.20.0: 24.20.0
Node.js 24.20.0
v24.19.0: 24.19.0
Node.js 24.19.0
v24.18.1: 24.18.1
Node.js 24.18.1
v24.18.0: 24.18.0
Node.js 24.18.0
v24.17.0: 24.17.0
Node.js 24.17.0
v24.16.0: 24.16.0
Node.js 24.16.0
pnpm/action-setup (pnpm/action-setup)
v6.1.0
What's Changed
Full Changelog: pnpm/action-setup@v6.0.10...v6.1.0
v6.0.10
What's Changed
- docs(README): point users to the successor pnpm/setup action by @BlackHole1 in #282
- refactor: introduce restore keys for cache by @SukkaW in #280
- ci: use pnpm 11 for
pr-checkby @jamietanna in #284 - fix: update pnpm to v11.19.0 by @jamietanna in #283
- docs: update README to include devEngines.packageManager by @nemchik in #273
New Contributors
- @jamietanna made their first contribution in #284
- @nemchik made their first contribution in #273
Full Changelog: pnpm/action-setup@v6...v6.0.10
v6.0.9
What's Changed
Full Changelog: pnpm/action-setup@v6...v6.0.9
zizmorcore/zizmor-action (zizmorcore/zizmor-action)
v0.6.4
zizmor 1.30.1 is now the default version.
Release notes: https://docs.zizmor.sh/release-notes/#1301
v0.6.3
zizmor 1.30.0 is now the default version.
Release notes: https://docs.zizmor.sh/release-notes/#1300
v0.6.2
zizmor 1.29.0 is now the default version.
v0.6.1
zizmor 1.28.0 is now the default version used by the action.
v0.6.0
zizmor 1.27.0 is now the default version used by the action.
What's Changed
- Fold Docker image pull output into a collapsed Actions log group by @woodruffw with @Copilot in #132
- Readme: document missing inputs by @staabm in #130
- ci: block version sync workflow on forks by @shaanmajid in #129
- Sync zizmor versions by @github-actions[bot] in #137
- Add
collectinput by @woodruffw in #139
New Contributors
- @woodruffw with @Copilot made their first contribution in #132
- @staabm made their first contribution in #130
- @shaanmajid made their first contribution in #129
Full Changelog: zizmorcore/zizmor-action@v0.5.7...v0.6.0
v0.5.7
1.26.1 is now available via the action
1.26.1 is now the default version of zizmor used by the action
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
Release Notes
sveltejs/vite-plugin-svelte (@sveltejs/vite-plugin-svelte)
v7.3.1
Patch Changes
- fix: inject the inspector into the client under Vite+ on pnpm, where the realpathed client module has no
vite/segment beforedist/(#1373)
v7.3.0
Minor Changes
- feat: pass environment to
dynamicCompileOptions(#1386)
Patch Changes
- fix: don't log inline config when encountering unexpected options (#1376)
v7.2.0
Minor Changes
- feat(inspector): add a context menu with current component stack (#1370)
v7.1.4
Patch Changes
- fix: enforce ltr styles for inspector (#1324)
v7.1.3
Patch Changes
- fix: ensure the inspector is injected into the client correctly for Vite+ projects (#1355)
testing-library/svelte-testing-library (@testing-library/svelte)
v5.4.2
@testing-library/svelte 5.4.2 (2026-06-23)
Bug Fixes
Dependencies
- @testing-library/svelte-core: upgraded to 1.1.3
v5.4.1
@testing-library/svelte 5.4.1 (2026-06-21)
Dependencies
- @testing-library/svelte-core: upgraded to 1.1.2
v5.4.0
@testing-library/svelte 5.4.0 (2026-06-20)
Features
Dependencies
- @testing-library/svelte-core: upgraded to 1.1.0
sveltejs/language-tools (svelte2tsx)
v0.7.61
Patch Changes
- fix: handle SvelteKit 3 changed imports for zero types feature (#3106)
v0.7.60
Patch Changes
- fix: remove type dependency on
magic-string(#3101)
v0.7.59
Patch Changes
- fix: throw a friendly error for TypeScript 7 stable (#3073)
v0.7.58
Patch Changes
- feat: zero-config
+error.svelteprops (#3076)
v0.7.57
Patch Changes
- fix: don't crash on array binding holes in destructured exports (e.g.
export let { d: [a, , c] } = obj) (#3058)
v0.7.56
Patch Changes
-
fix: properly handle props with the name
slotinside Svelte 5 snippets (#3030) -
fix: take into account component references when calculating snippet hoistabilty (#3032)
-
fix: use local name for marking bindable props used (#3017)
-
feat: support Svelte 5 declaration tags (#3033)
-
fix: drop declarations emitted outside declarationDir (#2965)
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

Changes
- Raises the minimum supported Node.js version to 22.22.0 in all packages
- Pins the floor to the latest Node.js 22 release that StackBlitz supports, so 22.22 instead of 22.23
- Made with AI
Testing
- N/A
Docs
- Changeset

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
astro@7.3.7
Patch Changes
-
#18266
cba76ccThanks @astro-factory! - Fixes a build error when a Markdown content collection entry loaded withglob({ deferRender: true })has alayoutfrontmatter property.layoutis now ignored for content collection entries, as documented. -
#18287
38f6793Thanks @astro-factory! - Fixesastro add cloudflarefailing to install dependencies with pnpm v11+ by approving theworkerdbuild script, and shows the package manager's error output whenastro addfails to install dependencies -
#18222
fcf6ed6Thanks @mingjunlu! - Fixes an issue where AVIF images were served asimage/heifinstead ofimage/avifin the dev server. -
#18240
de4df06Thanks @astro-factory! - Fixes thecache()handler fromastro/honoandastro/fetchthrowing aTypeErrorwhen a cache provider is configured. It now registers the cache provider before rendering, soAstro.cacheis available to downstream handlers likepages(). -
#18268
547b572Thanks @astro-factory! - Fixessecurity.checkOriginrejecting cross-origin requests with non-form content types such asapplication/json. As documented, the check only applies to unsafe requests that have nocontent-typeheader or one ofapplication/x-www-form-urlencoded,multipart/form-data, ortext/plain.
@astrojs/netlify@8.2.8
Patch Changes
- #18180
6fb83daThanks @matthewp! - Fixes Netlify Image CDN patterns generated fromimage.remotePatternspathnames ending in/**so they only match paths below that directory, consistent with Astro's own pattern matching. Previously, a pattern like/public/**also matched sibling paths sharing the prefix, such as/public-assets/. - Updated dependencies []:
- @astrojs/underscore-redirects@1.0.4
@astrojs/language-server@2.17.2
Patch Changes
- #18110
ffdf774Thanks @Princesseuh! - Fix organize imports for Astro files whose frontmatter ends with imports.

Changes
Replaces the description for the sync command in astro help to match:
- the description of its help flag
- what we currently have in docs: the CLI reference (third code snippet) and the
syncdescription
Testing
N/A
Docs
This is docs. I added a changeset as this kinda fix docs.

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated.
next is currently in pre mode so this branch has prereleases rather than normal releases. If you want to exit prereleases, run changeset pre exit on next.
Releases
@astrojs/cloudflare@15.0.0-beta.2
Patch Changes
- #18196
e6a2e90Thanks @swissky! - Fails the build with a migration hint when a project has awrangler.json,wrangler.jsonc, orwrangler.tomlfile but nocloudflare.config.ts. Previously the build succeeded and the Worker name, bindings, and entrypoint from the Wrangler file were silently ignored. Runnpx cf migrate --bundler viteto generatecloudflare.config.tsfrom your existing Wrangler configuration.

Changes
- Restores the documented
security.checkOrigincontract:isForbiddenCrossOriginRequestnow skips the CSRF check when the request carries a non-formContent-Type(e.g.application/json). This was accidentally broken in 7.3.6 by #15595, which ported Go'sCrossOriginProtectionand dropped thecontent-typecheck entirely — causing any cross-origin JSONPOST/PATCH/PUT/DELETEto receive a403, contrary to docs. - The new
Sec-Fetch-Site/Originlogic introduced in 7.3.6 is kept intact for requests with noContent-Typeor a form-like one (application/x-www-form-urlencoded,multipart/form-data,text/plain).FORM_CONTENT_TYPESandhasFormLikeHeader, which were left with no callers after #15595, are now used again.
Testing
- Extended
packages/astro/test/units/app/csrf.test.tswith cases coveringapplication/json,application/json; charset=utf-8, andApplication/JSON(case-insensitive) — all should pass through, matching 7.3.5 behavior. - Existing cases for form-like content types and missing
Content-Typeare unchanged, confirming no regression.
Docs
- No docs update needed; the existing
security.checkOriginJSDoc and configuration reference already describe the correct (form-only) scope that this fix restores.
Closes #18267

Changes
- Markdown files loaded through a content collection with
deferRender: trueno longer treatlayoutas a special frontmatter key. Previously, the?astroPropagatedAssetswrapper imported the bare.mdpath, causingastro:markdownto emit an unresolvableimport Layout from "<value>"— contradicting the documented behavior thatlayoutis ignored inside content collections. - The assets wrapper now requests
.mdfiles with a?astroMarkdownContentEntryquery flag.astro:markdownskipslayoutprocessing when that flag is present, leaving Markdown pages and direct.mdimports unaffected.
Testing
- Added
packages/astro/test/units/vite-plugin-markdown/layout.test.tscovering the case where a Markdown content entry with alayoutfrontmatter key anddeferRender: truebuilds without error.
Docs
- No docs update needed; the existing docs already state that
layoutis not a special property when using content collections.
Closes #18169

Changes
- When a Hono worker entry uses
cf()+pages()without going throughApp.render, an unmatched request returned an empty 404 with an internalX-Astro-Error: trueheader instead of serving the prerendered404.astro. This adds a newnotFound()middleware toastro/hono(and its underlying fetch handler inastro/fetch) that callsrenderErrorFromStatewithstatus: 404when no route matched, mirroring whatastro()(handleRequest) already does internally. astro()now delegates to the same shared helper, so the behavior is consistent across both usage styles. Users with a customcf()+pages()chain can addnotFound()between them to serve the prerendered 404 page.
Testing
- New unit tests in
packages/astro/test/units/fetch/index.test.tscover thenotFound()handler returning the prerendered 404 throughprerenderedErrorPageFetchand passing through when a route does match. - New unit tests in
packages/astro/test/units/hono/index.test.tscover the HononotFound()middleware under the same conditions.
Docs
Closes #18232

Changes
Replaces direct esbuild usage with Vite and Rolldown APIs and removes the esbuild dependency from the affected packages:
astrousestransformWithOxcfor env replacement and Rolldown for client directive bundling.@astrojs/netlify,@astrojs/vercel, and@astrojs/markdocbundle with Rolldown.astro-scriptsandastro-vscodebuild with Rolldown.create-astrono longer writesallowScriptsorallowBuilds, and the example projects drop their stale entries.
Made with AI
Testing
pnpm run build:cibuilds every package.- The
astrounit suite and the affected integration suites pass.
Docs
Changesets

Changes
- Paths not in the static route table (e.g.
/en/aboutrewritten by middleware to/about) no longer receive a forcedstatus: 404from Vercel's platform routing layer when the 404 page is server-rendered. Previously, the catch-all route in.vercel/output/config.jsonunconditionally includedstatus: 404regardless of destination, causing middleware-rewritten routes to return 404 even though the render function produced a valid 200 response. status: 404is now only set when the catch-all destination is the static/404.html(i.e.fourOhFourRoute.isPrerenderedis true). When the 404 page is server-rendered,statusis omitted so the function returns the real HTTP status — 200 for middleware-rewritten valid routes, 404 from404.astrofor genuinely missing pages.
Testing
- Adds a test case in
packages/integrations/vercel/test/server-rendered-error-pages.test.tscovering the catch-all route config emitted when the 404 page is server-rendered, asserting thatstatusis absent from the route entry.
Docs
- No docs update needed; this is a bug fix in generated Vercel routing config with no API surface change.
Closes #18134

Changes
- In dev mode, CSS from unrelated pages was leaking into a route's
<head>whenever the route (or anything it imported) reachedvirtual:astro:manifest→virtual:astro:pages. That virtual module dynamically imports every page in the app, so the CSS graph walk continued into every other page's import graph and attached all of their styles. - Adds page-boundary checks to
ensureModulesLoadedandcollectCSSWithOrderinvite-plugin-css/index.ts, skipping modules whose ID starts with\0virtual:astro:page:. This mirrors the build-modeisBuildCssBoundaryapproach introduced for the same bug class in #16116, now applied to the dev pipeline.
Testing
- No new automated test was added in this PR (sandbox infrastructure prevented fixture creation during triage). An integration test modelled on
i18n-css-leak.test.ts— which covers the build-mode counterpart — should follow.
Docs
- No docs update needed; this is a bug fix with no API or configuration changes.
Closes #18060

Changes
- Content collection edits are now picked up after a config-triggered dev server restart (
Configuration file updated. Restarting...). Previously,viteServer.restart()replaced Vite's file watcher but the globalContentLayerwas never re-initialized, leaving loaders subscribed to the closed watcher and ignoring all subsequent file changes. - After a successful in-place restart,
handleChangeRestartnow re-createsglobalContentLayerwith the new settings and the new Vite watcher, reuses the existing data store (exposed via a newstoregetter onContentLayer), and re-runswatchContentConfig()andsync(). This restores the behavior that existed before the in-place restart path was introduced in #16059.
Testing
- Added
packages/astro/test/content-layer-dev-restart.test.ts, an integration test that starts the dev server, triggers an in-place config restart, then edits a content entry and asserts the change is reflected — covering the exact regression path.
Docs
- No docs update needed; this is a bug fix restoring previously expected dev-server behavior with no API changes.
Closes #18216

Changes
- The
fontsource()provider now accepts font family names with a " Variable" suffix (e.g."Inter Variable"), matching the naming convention used on fontsource.org and in@fontsource-variable/*npm packages. Previously, specifyingname: "Inter Variable"produced warnings and loaded no font because the fontsource API uses"Inter"as the canonical family name with no "Variable" suffix. - When a lookup returns no data, the provider retries with the " Variable" suffix stripped. This is safe because none of the ~2100 families in the fontsource API include "Variable" in their name.
Testing
- Added a unit test in
packages/astro/test/units/assets/fonts/e2e.test.ts(resolves fontsource fonts with "Variable" suffix (#18143)) that confirmsname: "Inter Variable"resolves correctly through the provider pipeline.
Docs
- No docs update needed; this is a bug fix restoring behavior that users already expected based on fontsource's own documentation.
Closes #18143

Changes
- When
astro:rollup-plugin-build-cssdeletes a client CSS asset because the SSR/prerender build already bundled all of its CSS modules, the asset's filename was left inviteMetadata.importedCssof the chunks that import it. Vite'svite:build-import-analysisthen wrote that deleted filename into__vite__mapDeps, causing the browser to preload a file that doesn't exist indist/(404). - At the end of
generateBundleinplugin-css.ts, any CSS asset that was deleted and not restored is now also removed from every client chunk'simportedCssset, matching the behavior already used by the inline-stylesheets plugin in the same file.
Testing
- Extended the
css-dangling-referencesintegration test with ahydrated-islandfixture page that exercises the exact scenario: a component is both aclient:loadisland and reachable through a dynamic import on the same page. The test asserts that no CSS filename in any chunk's__vite__mapDepsis missing fromdist/. - Also fixed the hash regex in that test (updated from
[\da-f]{8}to match Vite 8's base64-like hashes) so the assertion can actually catch regressions.
Docs
- No docs update needed; this is a build-output correctness fix with no user-facing API change.
Closes #18191

Changes
- Integration-injected page routes (tagged
origin: 'external') no longer receive a 404 fromfinalizeI18nwheni18n.routing.prefixDefaultLocale: trueis set. Previously,I18nRouter.matchPrefixAlwaysreturnednotFoundfor any path without a locale segment, replacing the already-rendered page response with a 404. - The fix checks
state.routeData?.origin === 'external'and skips the locale-prefix routing check (step 1) for those routes. The i18n fallback logic (step 2) still runs, so integrations that inject locale-aware routes retain their fallback handling. All project-owned routes are unaffected.
Testing
- Added a unit test in
packages/astro/test/units/i18n/i18n-middleware.test.tscovering anexternal-origin page route underprefixDefaultLocale: true, asserting it returns the rendered response instead of a 404.
Docs
- No docs update needed. This restores expected behavior for an existing API (
injectRoute) and does not introduce new configuration surface.
Closes #18223

Changes
- Malformed JSON request bodies and percent-encoded action names that cannot be decoded no longer produce a 500 error. They now return
BAD_REQUEST(400) andNOT_FOUND(404) respectively, consistent with how the actions system already handles other invalid-request scenarios (unknown action → 404, wrong content type → 415). - The
getActioncatch block is extended to treatURIError(thrown bydecodeURIComponentfor malformed percent-encoding) as aNOT_FOUND, and theparseRequestBodycatch block is extended to treatSyntaxError(thrown byJSON.parse/Request.json()for invalid JSON) as aBAD_REQUESTwith a fixed message. This prevents adversarial or scanner-generated requests from polluting server error logs with unhandled exceptions.
Testing
- Two new unit tests added to
packages/astro/test/units/actions/actions-app.test.tsin a new "Actions malformed request handling" block: one covering a malformed JSON body returning 400, and one covering an undecodable action name returning 404 on both the RPC and form paths.
Docs
- No docs update needed; this is an internal error-handling correction with no new user-facing API.
Closes #18142

Changes
- Content files with
#or?in their name or path are now loaded correctly by the glob loader. Previously,encodeURIleft those characters unescaped, causing the WHATWG URL parser to treat them as hash/query delimiters and truncate the path — leading to anENOENTerror and a silently dropped collection entry. - Introduces a small
resolveEntryUrl()helper that percent-encodes#and?afterencodeURI. All three affected call sites inglob.ts(generateIdDefault,syncData,isConfigFile) now use it, keeping the./prefix established by #17762 for:handling.
Testing
- Added unit test cases in
packages/astro/test/units/content-layer/glob-loader.test.tscovering files named with#and?to ensure they resolve to the correct path and are not dropped from the collection.
Docs
- No docs update needed; this is a bug fix restoring expected behavior for file naming that was already implicitly supported.
Closes #18199

Changes
trailingSlash(),middleware(), andpages()now return an empty 400 for paths with too many layers of percent-encoding, matching the behaviour ofastro(). Previously those handlers routed the partly-decoded path, producing a 404 and allowing user middleware to run on the invalid request.- A shared helper
rejectInvalidEncoding(state)incore/routing/invalid-encoding.tsencapsulates the check.handleRequest,handleTrailingSlash,handleMiddlewareWithErrorFallback, andhandlePagesWithErrorFallbackeach call it first, so the rejection holds regardless of how the pipeline is composed.
Testing
- Extended
packages/astro/test/units/fetch/index.test.tsto coverpages()andtrailingSlash()+middleware()+pages()pipelines receiving a multi-level encoded path (/api/%2525252525252525252561dmin), asserting a 400 with an empty body and no middleware execution.
Docs
- No docs update needed; this restores an existing security behaviour to composable handlers with no new public API.
Closes #18233

Changes
- Localized error routes (e.g.
/pt/404,/pt/500) now return the correct HTTP status code when rendered through the composablepages()handler (astro/hono,astro/fetch). Previously,handlePagesWithErrorFallbacknever calledgetDefaultStatusCode, soFetchState.statusstayed at its default of200and that value was copied onto the response. The fix callsgetDefaultStatusCodeinhandlePagesWithErrorFallbackbefore delegating tohandlePages, matching whatrender()already does on theastro()path. - Root
/404and/500were already handled by a hardcoded override inrenderPage; this change extends correct status-code behavior to any locale-prefixed error route recognized byisLocalizedErrorRoute.
Testing
- New unit tests added in
packages/astro/test/units/fetch/index.test.tscoveringpages()requests to localized error routes (e.g./pt/404,/pt/500) and verifying the response carries the correct non-200 status code.
Docs
- No docs update needed; this is a bug fix restoring already-documented behavior to a code path that was missing the call.
Closes #18230

Changes
FetchState.getAPIContext()now defers caching the context object until after props are resolved. Calls made beforegetProps()returns still get a valid context, and the next call (aftergetProps()) fills inpropson the same object. This means endpoints and middleware always see the resolvedpropsvalue instead of the pre-computednull.handlePagesWithErrorFallbacknow awaitsgetProps()before dispatching, so thepages()composable no longer exposesprops: nullto endpoints whenmiddleware()is absent.
Testing
- Extended
packages/astro/test/units/fetch/index.test.tswith a case coveringactions()mounted beforemiddleware(), asserting that endpoints and middleware both see the resolved props instead ofnull.
Docs
- No docs update needed; this is a bug fix restoring already-documented behavior of
context.props.
Closes #18229

Changes
annotateSourceFileis now disabled when Vite is running in test mode (viteConfig.mode === 'test'), preventingdata-astro-source-file/data-astro-source-locattributes from appearing in HTML rendered byexperimental_AstroContainerunder Vitest. These annotations are only useful for the dev toolbar in a browser context and have no value in test pipelines.@astrojs/compiler-rsis bumped to^0.5.1, which is the first version that actually implementsannotateSourceFile; the regression was invisible on0.5.0because the option was a stub.
Testing
- Added
packages/astro/test/units/compile/annotate-source-file.test.ts, which asserts that theannotateSourceFileflag isfalsewhenviteConfig.modeis'test'andtruewhen it is'development'with the dev toolbar enabled.
Docs
- No docs update needed. The
annotateSourceFileoption is an internal compiler detail; the fix restores existing behavior for the experimental Container API with no API surface change.
Closes #18162

Changes
- The composable
cache()handler fromastro/honoandastro/fetchnow callsprovideCache(state)beforehandleCache, matching the behavior of theastro()path. Previously,state.resolve('cache')returnedundefinedwhen a cache provider was configured, causingapplyCacheHeadersto throwCannot use 'in' operator to search for 'Symbol(astro:cache:apply)' in undefinedand a 500 response. - Adds a
provideAndHandleCache()helper inpackages/astro/src/core/cache/handler.tsthat awaitsprovideCache(state)then runshandleCache. The publiccache()composable delegates to it; theastro()path is unchanged.
Testing
- New unit test in
packages/astro/test/units/hono/index.test.tscovering thecache()composable with a configured cache provider, asserting that a successful response is returned instead of a 500.
Docs
- No docs update needed; this is a bug fix restoring already-documented behavior for the
cache()composable.
Closes #18227
The starlight-theme-large-print demo site moved from the workers.dev subdomain to its own domain: https://starlight.xianmi.co/
The old URL keeps serving the same site (both run on the same Worker), so nothing breaks — this PR only points the community themes listing at the new canonical address. Verified live: HTTP 200, valid TLS, same content as before.
Only the href of the Large Print entry is changed (en/de/ko/ru); titles, descriptions and preview images are untouched.
Description
- Closes #
- What does this PR change? Give us a brief description.
- Did you change something visual? A before/after screenshot can be helpful.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| @netlify/blobs (source) | ^11.1.1 → ^11.1.3 |
||
| @netlify/functions (source) | ^6.0.0 → ^6.0.2 |
||
| vite (source) | ^8.3.1 → ^8.3.2 |
Release Notes
netlify/primitives (@netlify/blobs)
v11.1.3
Bug Fixes
Dependencies
- The following workspace dependencies were updated
- dependencies
- @netlify/dev-utils bumped from 6.0.2 to 6.0.3
- @netlify/otel bumped from ^7.0.3 to ^7.0.4
- dependencies
v11.1.2
Dependencies
- The following workspace dependencies were updated
- dependencies
- @netlify/dev-utils bumped from 6.0.1 to 6.0.2
- @netlify/otel bumped from ^7.0.2 to ^7.0.3
- dependencies
netlify/primitives (@netlify/functions)
v6.0.2
Dependencies
- The following workspace dependencies were updated
- dependencies
- @netlify/types bumped from 3.1.0 to 3.2.0
- dependencies
v6.0.1
Dependencies
- The following workspace dependencies were updated
- dependencies
- @netlify/types bumped from 3.0.0 to 3.1.0
- dependencies
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates:
| Package | Change | Age | Confidence |
|---|---|---|---|
| @types/alpinejs (source) | ^3.13.11 → ^3.17.0 |
||
| alpinejs (source) | ^3.15.8 → ^3.17.4 |
||
| vite (source) | ^8.0.13 → ^8.3.2 |
Release Notes
vitejs/vite (vite)
v8.3.2
Bug Fixes
- build: preload CSS correctly when
renderBuiltUrlreturns URLs with queries (#23611) (64e0a21) - bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
- bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
- deps: update all non-major dependencies (#23601) (9944fa6)
- deps: update rolldown-related dependencies (#23602) (88c1741)
- html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
- limit size of object and array printing via
forwardConsole(#23565) (e64a587) - merge
build.rolldownOptions.output.minifycorrectly (#23536) (bba3bb8) - optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
- optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
- pass queries to
renderBuiltUrl(#23586) (744269e) - server: handle file watcher errors without crashing (#23503) (6894f5c)
- server: release previous environments after initialization (#23499) (5a3a010)
- ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
- worker: align worker urls in client and server when using terser (#23614) (24bd331)
Performance Improvements
- avoid encoding intermediate source maps (#23461) (89574f6)
- build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
- only register time middleware when debug logging is enabled (#23621) (94d0080)
Documentation
Miscellaneous Chores
Code Refactoring
Tests
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

Fixes #18234
What this changes
@astrojs/vercel could only target Node runtimes. getRuntime() read process.version, so under Bun it saw the Node-compat version, missed SUPPORTED_NODE_VERSIONS, warned, and fell back to nodejs24.x — the deployed function never ran on Bun. The Runtime type was `nodejs${string}.x`, so a Bun runtime was impossible by type, and there was no runtime option to override it.
- Widen
Runtimeto`nodejs${string}.x` | `bun${string}.x` - Add a
runtimeoption toVercelServerlessConfigto pin the runtime explicitly (nodejs22.x,nodejs24.x,bun1.x,bun1.4.x) - Add a Bun branch to
getRuntime()that keeps the detected minor and pins it when Vercel can resolve it (bun1.4.x), falling back tobun1.xfor unlisted minors so a newer Bun still builds - Validate explicit runtimes against a single
VALID_RUNTIMESlist, so detection and validation cannot drift
The Node path is unchanged.
Verification
tsc -bacross the project graph: 0 errors (same asmain)prettier --checkandeslinton the changed file: pass
Behavior matrix (.vc-config.json runtime), verified against the equivalent change applied to the published package:
| Config | Result |
|---|---|
runtime: 'nodejs22.x' |
nodejs22.x |
runtime: 'nodejs24.x' |
nodejs24.x |
runtime: 'bun1.x' |
bun1.x |
runtime: 'bun1.4.x' |
bun1.4.x |
runtime: 'nodejs20.x' |
build fails |
| autodetect under Node 22 | nodejs22.x |
| autodetect under Node 24 | nodejs24.x |
| autodetect under Bun 1.3 | bun1.x |
| autodetect under Bun 1.4 | bun1.4.x |

Changes
Fixes #18225
Fixes Astro.cookies.get() returning undefined for an incoming cookie with an empty value. For Cookie: foo=, has('foo') already returns true, but get('foo') cannot read the value.
Empty values now go through the same decoding path as other request cookies, including a custom decoder.
Testing
- Added four regression cases covering a single empty cookie, an empty value between other cookies, a custom decoder, and an endpoint reading the cookie.
- All four fail without the source change; the other 25 tests in those two files pass.
- All 59 cookie tests pass with the fix.
- Full core unit suite: 3,586 passed, one existing skip.
- Workspace build, formatting,
pnpm lint:ai, andpnpm typecheckpassed. - A local
astro devendpoint reproduced{"present":true}on unchanged source and{"present":true,"value":""}with the fix, both with HTTP 200.
Docs
No documentation change needed. This restores reading the raw value of an existing cookie. A patch changeset is included.

Changes
- Fixes an issue where AVIF images were served as
image/heifinstead ofimage/avifin the dev server - Root cause: Sharp reports AVIF output as
heif(see: lovell/sharp#3053), and Astro used that as the response format - Closes #18214
Testing
- Added a unit test for AVIF output format
- Verified manually in the dev server
Docs
- No docs needed, bug fix only.

Fixes #18216
Alternative to #18217, which only covers restarts caused by a config change. Created after the triage bot's report on #18216 pointed out restarts that bypass Astro's restart handler.
Changes
- Vite also restarts on
.envedits, and plugins callserver.restart()directly (actions, fonts). After any restart the content layer kept listening on the closed watcher. - A dev-only Vite plugin calls the new
ContentLayer.rewatch()fromconfigureServer, which runs on every server creation. It moves loaders to the new watcher and settings, then re-syncs. stop()of the dev server disposes the content layer it created.
Not covered: after restarts Astro didn't initiate, the handlers attached by setupContainer() and attachContentServerListeners() also stay on the closed watcher. The same approach could fix that in a follow-up.
Testing
- Integration test: content edits after a config restart and after an actions plugin restart. Both fail without the fix.
- Unit tests for
rewatch().
Docs
No docs needed, bug fix.

Changes
Font.astronow importscomponentDataByCssVariablefrom a new internal module (src/assets/fonts/component-data.ts) whose types are included in the published package, instead of fromvirtual:astro:assets/fonts/internalwhich was declared only in the unpublisheddev-only.d.ts. This eliminates the TS2307 error consumers see whentscfollows theastro:assetsre-export intonode_modules.Picture.astronow narrows with'inferSize' in propsbefore accessing the property, fixing TS2339 errors caused by reading a field that doesn't exist on every member of theLocalImageProps | RemoteImagePropsunion.
Testing
No new automated tests were added — the bug only surfaces when TypeScript 7.1 with @astrojs/ts-content-mapper type-checks the published .astro files, a workflow the monorepo doesn't exercise. The 33 existing tests in the fonts, fontsource, infersize, and picture emit-file suites continue to pass.
Docs
No docs update needed — this is a type-correctness fix with no user-facing API change.
Closes #18219

Fixes #18216
Changes
- Since #16059, config restarts use Vite's in-place
viteServer.restart(), which replaces the file watcher. The content layer kept listening on the closed watcher, so content changes were ignored after a restart (a regression of #12976). - After a successful restart, the content layer is now re-initialized on the new watcher and settings, reusing the existing data store, and re-synced. Same as on initial
astro devstartup.
Testing
Added content-layer-dev-restart.test.ts: it triggers a restart by editing astro.config.mjs, then edits a content entry and expects the update to be served. It fails without the fix ("Data store did not update within timeout") and passes with it.
Docs
No docs needed, bug fix.

Changes
- What does this change?
chunkHasDynamicImports only looked at output.dynamicImports and at getModuleInfo(id).dynamicallyImportedIds. Rolldown records neither for an import annotated with /* @vite-ignore */, which is the only way to import a URL that only exists at runtime (e.g. a file an integration copies into the output). Such a chunk was therefore inlined into the HTML with Vite's raw __VITE_PRELOAD__ helper reference still in it, throwing ReferenceError: __VITE_PRELOAD__ is not defined at runtime.
Vite injects its preload helper whenever the chunk has a dynamic import and leaves it in the chunk, so this adds output.moduleIds.includes('\0vite/preload-helper.js') as a third signal. That is exactly what was suggested in the older report of the same family (#17265), and it also covers the module-info gap the existing check still has.
- Minimal repro from #18181 (
src/pages/index.astrowithawait import(/* @vite-ignore */ "/external.js"),public/external.js): before,dist/index.htmlcontains__VITE_PRELOAD__; after, the chunk is not inlined and the helper is replaced. - Fixes #18181. Changeset added.
Testing
Added it('detects dynamic imports skipped by \/* @vite-ignore */`')topackages/astro/test/units/build/plugin-scripts.test.ts, which asserts both chunkHasDynamicImportsandshouldInlineScriptChunk` for a chunk whose only trace is the preload helper.
Verified:
- The new test fails on
mainwith the reported symptom and passes with the fix (rebuiltdistbetween runs, since this suite imports fromdist). test/units/build/**— 37 suites, 135 tests pass.test/units/**— 3584 tests, 3581 pass. The 2 failures (test/units/assets/fonts/e2e.test.ts: "works", "merges families when possible") are pre-existing: they fail identically with this change stashed, and they compare a fetchedcdn.jsdelivr.netURL, so they are environment/network dependent and unrelated to script inlining.pnpm build --filter=astroexits 0.biome formatandbiome ci --formatter-enabled=falsereport no issues on the changed files.- Not verified: an actual
astro build+ browser run of the repro, because that needs a pnpm-built workspace browser target I have no browser for here.
Docs
No docs change needed. This restores the documented meaning of inlined scripts rather than changing a documented behaviour; the bug is that a @vite-ignore script silently shipped broken HTML. If you disagree, flag it and I will add an entry.

Changes
- The Cloudflare adapter's
globalThis.process ??= {}; globalThis.process.env ??= {};banner is now set on thessrandprerenderVite environments instead of the top-levelvite.build.rolldownOptions.output. With Vite 8's multi-environment build, the top-levelbuildconfig was inherited by theclientenvironment, causing the banner to be prepended to every browser chunk and inlined<script>, adding unnecessary bytes to all client assets. - Only the worker environments (SSR and prerender) receive the banner, as intended. Client output is unaffected. If the user has already set a top-level banner, the adapter leaves it alone.
Testing
- Added a test case in
packages/integrations/cloudflare/test/static.test.tsthat verifies client chunks do not contain the banner after a build, while server chunks still do.
Docs
- No docs update needed; this is a bug fix with no new APIs or configuration options.
Closes #18182

Changes
- Adds the
headingoffsetandheadingresetglobal attributes toHTMLAttributesinastro-jsx.d.tsheadingoffsetaccepts0–8(as a number or numeric string), matching the spec's allowed rangeheadingresetis typed like other boolean attributes such asinert
- Adds
headingresettohtmlBooleanAttributes, so dynamic values render as a boolean attribute:headingreset={true}→headingreset(previouslyheadingreset="true")headingreset={false}→ omitted (previouslyheadingreset="false", which enabled the reset)
References:
- Spec: https://html.spec.whatwg.org/multipage/sections.html#heading-levels-&-offsets
- WHATWG PR: whatwg/html#11086
- MDN: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/headingoffset
- MDN: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/headingreset
Testing
Added headingreset cases (true, false, and empty string) to test/units/app/astro-attrs.test.ts, following the existing boolean attribute cases
Docs
No docs change needed
This only adds types for standard HTML attributes and renders headingreset like the other boolean attributes

This is a follow-up to #18206.
While working on that PR, I noticed the existing parsing for package names with tags and assumed astro add @astrojs/cloudflare@beta would work. When I tested it after the release, I realized the validation added in #15419 rejects the full specifier before that parsing logic runs.
This updates the validation to accept an optional version or tag while continuing to reject invalid specifiers.

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated.
next is currently in pre mode so this branch has prereleases rather than normal releases. If you want to exit prereleases, run changeset pre exit on next.
Releases
astro@7.4.0-beta.1
Minor Changes
- #18206
db00242Thanks @edmundhung! - Updatesastro add @astrojs/cloudflare@betato installcf, scaffoldcloudflare.config.ts, and generate types withcf
@astrojs/cloudflare@15.0.0-beta.1
Patch Changes
- #18205
7a519a7Thanks @ematipico! - Upgrades the@cloudflare/vite-pluginto the latest. - Updated dependencies []:
- @astrojs/underscore-redirects@1.0.4

Changes
This updates astro add cloudflare to scaffold a Cloudflare config for cf.
Testing
Added unit coverage for beta adapter resolution.
Docs
No documentation changes. This updates the prerelease integration setup before it becomes stable.


This PR contains the following updates:
Release Notes
alpinejs/alpine (alpinejs)
v3.17.4
What's Changed
- Fix mutation observer recovery after errors by @BillyNoyes in #4908
- Add viewport modifier to resize plugin by @BillyNoyes in #4910
New Contributors
- @BillyNoyes made their first contribution in #4908
Full Changelog: alpinejs/alpine@v3.17.3...v3.17.4
v3.17.3
What's Changed
- Bump js-yaml from 3.14.1 to 3.15.2 by @dependabot[bot] in #4896
- Change x-for to allow loops like
(foo)in(bar)by @ColonelThirtyTwo in #4897 - Fix(CspParser): accept reserved words as property/method names and object keys by @MaxencePaulin in #4905
- Fix:
$watchandx-modelablecan fire after being unwatched/released by @MaxencePaulin in #4903 - Fix: skip init() in x-data during clone, matching x-init behavior by @MaxencePaulin in #4901
- Bump @vitest/mocker and vitest by @dependabot[bot] in #4898
- Stop x-on and x-model's own modifiers from being read as key names by @dylanpulver in #4891
- Fix CI compatibility after the Vitest 5 upgrade by @calebporzio in #4906
New Contributors
- @ColonelThirtyTwo made their first contribution in #4897
- @MaxencePaulin made their first contribution in #4905
- @dylanpulver made their first contribution in #4891
Full Changelog: alpinejs/alpine@v3.17.2...v3.17.3
v3.17.2
What's Changed
- Fix decode-uri-component Dependabot alert by @calebporzio in #4889
- Bump browserslist from 4.21.5 to 4.28.8 by @dependabot[bot] in #4890
- Fix CSP initialization in sandboxed iframes by @calebporzio in #4893
Full Changelog: alpinejs/alpine@v3.17.1...v3.17.2
v3.17.1
What's Changed
- Add dwell timing to the intersect plugin by @cyppe in #4884
- Bump brace-expansion from 1.1.11 to 1.1.18 by @dependabot[bot] in #4882
- Docs: clarify how Alpine effects track reactive dependencies by @MuslumYilmaz in #4883
New Contributors
- @cyppe made their first contribution in #4884
- @MuslumYilmaz made their first contribution in #4883
Full Changelog: alpinejs/alpine@v3.17.0...v3.17.1
v3.17.0
What's Changed
- Fix Unicode escapes in CSP string literals by @dawNotPoi in #4881
- Add Alpine.deferInit() — suspend a tree until an async prerequisite settles by @calebporzio in #4887
New Contributors
- @dawNotPoi made their first contribution in #4881
Full Changelog: alpinejs/alpine@v3.16.3...v3.17.0
v3.16.3
What's Changed
- docs: clarify x-modelable value support by @pooridev in #4880
- Fix
x-maskattribute changes onx-modelinputs by @joshhanley in #4852 - Bump postcss from 8.5.6 to 8.5.26 by @dependabot[bot] in #4871
New Contributors
- @pooridev made their first contribution in #4880
Full Changelog: alpinejs/alpine@v3.16.2...v3.16.3
v3.16.2
What's Changed
- Fix fallback storage returning undefined for missing keys by @hamdyelbatal122 in #4867
- fix(persist): don't persist undefined values by @Xuepoo in #4876
- Run structural effects before dependent effects by @calebporzio in #4878
- Upgrade
@vue/reactivityto Vue 3.5 by @oddvalue in #4861
New Contributors
- @hamdyelbatal122 made their first contribution in #4867
- @Xuepoo made their first contribution in #4876
- @oddvalue made their first contribution in #4861
Full Changelog: alpinejs/alpine@v3.16.1...v3.16.2
v3.16.1
What's Changed
- Fix Persist compatibility with older Alpine versions by @calebporzio in #4875
Full Changelog: alpinejs/alpine@v3.16.0...v3.16.1
v3.16.0
What's Changed
- Fix data loss when binding objects to regular attributes by @daftspunk in #4826
- Fix mask resurrecting key in object when it is cleared by @danharrin in #4812
- Fix x-if and x-for content duplicating during morph by @ganyicz in #4785
- fix: sync x-model select value after x-for renders options by @ljk0071 in #4769
- Fix
x-bind:valueon<option>losing attribute when value is an empty string by @joshhanley in #4831 - Fix
:valuebindings not updating custom elements when bound object data mutates by @joshhanley in #4833 - Add
.parentmodifier forx-intersectby @kevinruscoe in #4839 - Upgrade Cypress by @joshhanley in #4849
- Preserve x-data scope when its expression changes by @calebporzio in #4868
- Fix persisted single-value stores by @joshhanley in #4859
- Pass cleanup callback to direct store interceptors by @calebporzio in #4869
- Split draft and npm release workflows by @calebporzio in #4870
- Use Node 24 for release workflows by @calebporzio in #4872
New Contributors
- @daftspunk made their first contribution in #4826
- @ljk0071 made their first contribution in #4769
- @kevinruscoe made their first contribution in #4839
Full Changelog: alpinejs/alpine@v3.15.12...v3.16.0
v3.15.12
What's Changed
- Add .fixed positioning modifier to x-anchor by @nicolagianelli in #4773
- fix(csp): support MemberExpression assignments in evaluator by @dasm in #4807
- Fix
x-forcrashing on null-prototype objects likeObject.groupBy()results by @joshhanley in #4825 - Fix
&&and||not short-circuiting in CSP evaluator by @joshhanley in #4823 - Fix
x-sortcrash when container has a<template>with no.contentby @joshhanley in #4819 - Add minified ESM build output for each package by @joshhanley in #4820
- Fix
x-idevaluation order so$idresolves consistently insidex-databy @joshhanley in #4821 - Fix
@teleportleaking detached nodes on every Livewire render by @joshhanley in #4822
New Contributors
Full Changelog: alpinejs/alpine@v3.15.11...v3.15.12
v3.15.11
What's Changed
- fix(csp): skip sharedStorage when enumerating globalThis properties by @PierreBultez in #4787
- Fix x-trap.noscroll layout shift conflict with scrollbar-gutter by @dotfrag in #4512
- Add support for [x-sort:handle] attributes defined in template tags by @SimoTod in #4483
- Add
x-anchor.noflipmodifier by @calebporzio in #4791 - Warn when x-for template has multiple root elements by @calebporzio in #4752
- Fix $refs unavailable during morph (v3.15.9 regression) by @calebporzio in #4793
New Contributors
- @PierreBultez made their first contribution in #4787
- @dotfrag made their first contribution in #4512
Full Changelog: alpinejs/alpine@v3.15.10...v3.15.11
v3.15.10
Fixed
- Fix x-anchor crash during wire:navigate cleanup #4790
v3.15.9
What's Changed
- fix(morph): close dialogs properly when removing open attribute by @calebporzio in #4739
- Update
tabbableandfocus-trapdependencies in focus plugin by @joshhanley in #4737 - feat(x-anchor): allow dynamic reference to be used with x-anchor by @maximbelyayev in #4735
- Handle all types of whitespace in class lists, not just spaces by @calebporzio in #4743
- docs: clearer variable name in x-bind example by @calebporzio in #4742
- Fix
x-model.parentwhen inside ofx-teleportby @willrowe in #4676 - feat:
x-on.passive.falsemodifier by @hirasso in #4610 - Add support for Set objects in x-for loop function by @alfanzain in #4672
- Add support for custom options and cancelable
$dispatchby @nicolagianelli in #4608 - Fix how
x-htmlhandlesundefinedby @willrowe in #4555 - move dependencies from monorepo root to correct packages by @Igloczek in #4550
- Don't assign the normalEvaluator per default by @JeroenBoersma in #4548
- Fix class setters invocation on nested
x-databy @helio3197 in #4528 - 🐛 Masks model updates by @ekwoka in #4175
- Allow debouncing/throttling x-model when using x-modelable by @Spitfire972 in #4186
- UI x-radio: fix keyboard navigation when value of first/last radio option is null by @gdebrauwer in #4308
- Improve handling of autocomplete values in X-Mask by @robertmarney in #4260
- ⚡ Improves x-for performance by @ekwoka in #4361
- Fix x-ref crash during child-element morph by @calebporzio in #4748
- Fix $watch oldValue for objects by @calebporzio in #4749
- Escape attribute values in morph
setAttributepatch by @joshhanley in #4770 - Fix x-model setting .value instead of .checked on checkboxes by @ganyicz in #4779
- Fix
x-model.blurcrash when input is removed from a form by @joshhanley in #4783
New Contributors
- @maximbelyayev made their first contribution in #4735
- @hirasso made their first contribution in #4610
- @alfanzain made their first contribution in #4672
- @nicolagianelli made their first contribution in #4608
- @Igloczek made their first contribution in #4550
- @JeroenBoersma made their first contribution in #4548
- @helio3197 made their first contribution in #4528
- @Spitfire972 made their first contribution in #4186
- @robertmarney made their first contribution in #4260
Full Changelog: alpinejs/alpine@v3.15.8...v3.15.9
nanostores/nanostores (nanostores)
v1.5.4
- Fixed
listenKeysfordeepMap(by @tiagovilasboas). - Fixed listener calls lost after unbind and inside
batch()(by @psd-coder). - Fixed tasks during cleaning up (by @lprnmns).
- Fixed
listenKeyswith non-string map keys (by @lprnmns). - Fixed
listenKeysto useObject.is(by @lprnmns). - Fixed
effect()on an error during subscription (by @lprnmns).
v1.5.3
- Fixed using
Store#eqincomputed(by @lprnmns). - Throw an error on
Object.prototypekeys inmapCreator(by @lprnmns). - Fixed
batch()inside a listener (by @lenamonj). - Fixed calling unbind twice (by @lenamonj).
- Fixed
cleanTasks()for completions tasks (by @lenamonj).
v1.5.2
- Fixed types (by @edloidas).
v1.5.1
- Fixed types (by @edloidas).
- Fixed
listenKeyswhen old value is not available (by @edloidas).
v1.5.0
- Added
eqandeqKeyfor custom value comparison (by @psd-coder). - Fixed calling other listeners if one of them throws (by @psd-coder).
- Fixed
listenKeysdeep paths on whole store set (by @ankit1324).
v1.4.2
- Fixed
batch()conflict with builder (by @psd-coder). - Added new tools to docs (by @firatciftci & @alexcarpenter).
v1.4.1
- Fixed
task()for synchronous callbacks (by @rajanpanth). - Fixed docs (by @maxtaran2010 & @VdustR).
v1.4.0
- Added
batchto run one re-render on many stores changes (by @psd-coder). - Added listening base key for nested mutation to
listenKeys(by @ifo123). - Fixed
getPaththrowing onnullintermediate values (by @chatman-media). - Fixed
listenKeyson the whole set changes (by @LeSingh1). - Fixed resetting
computedcache oncleanStores(by @ATOM00blue).
v1.3.0
- Added
globalThis.nanostoresGlobalto sync stores in JS bundles (by @afurm).
v1.2.0
vitest-dev/vitest (vitest)
v5.0.2
🐞 Bug Fixes
- Bind
processin case global is overwritten - by @AriPerkkio in #11343 (0b792) - detect-async-leaks:
- Ignore
process.stdiohandles - by @AriPerkkio in #11333 (0fd6b)
- Ignore
- expect:
- Fix
toMatchObjectwith asymmetric matchers - by @ShreeBohara, Claude Opus 5, @hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in #11100 (42523)
- Fix
- jsdom:
- Fix
RequestwithBlobbody on jsdom 28+ - by @harshit-d3v in #11295 (d1c3e)
- Fix
- reporter:
agentto respect--silent- by @Raj4478 and @AriPerkkio in #11271 (5b95e)
- reporters:
- spy:
- ui:
- Persist authentication cookie beyond current browser session - by @hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #11066 (f8819)
View changes on GitHub
v5.0.1
🚀 Features
- ui:
- Move trace attempts selector to viewer header - by @hi-ogawa, Hiroshi Ogawa and Codex in #11189 (5dc4b)
- Add focused trace view layout mode - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in #11190 (376dc)
🐞 Bug Fixes
- Exit 1 when vitest list fails collection - by @hamed-bavar in #11145 and #11146 (6108b)
- Keep parse error details in static collection - by @hamed-bavar in #11150 and #11151 (7c818)
- Avoid recursive prototype in automocking - by @sheremet-va in #11195 (99fc5)
- Prevent false Vitest import resolution - by @sheremet-va in #11196 (b426c)
- Keep metadata file when clearing the cache - by @sheremet-va in #11199 (73614)
- Correct typos in error message and comments - by @shinji00222 and Shinji in #11187 (115c3)
- Resolve ResolvedConfig exactOptionalPropertyTypes errors - by @LukeAbby in #11175 (498fb)
- Share the server on self-referencing
extends- by @sheremet-va in #11034 (23dda) - Warn when deprecated
deps.optimizer.webis used - by @im10furry in #11214 (2ce29) - browser:
- Avoid double quotes in
config.define- by @sheremet-va in #11198 (972e2)
- Avoid double quotes in
- doctor:
- Measure vm pools for custom environments - by @sheremet-va in #11212 (91ab1)
- expect:
- Correct return value in
toMatchAriaSnapshot- by @sheremet-va in #11208 (c119b)
- Correct return value in
- fakeTimers:
- Force
queueMicrotaskandnextTickintoNotFake- by @kingmakeruix, kingmakeruix, Hiroshi Ogawa, Codex and @hi-ogawa in #11261 (a47d7)
- Force
- snapshot:
- Report obsolete keys next to skipped tests - by @hamed-bavar, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #11157 and #11158 (17e2b)
- types:
- Make public declarations self-contained - by @ZoeySigel in #11141 (45546)
- ui:
- Fix collapse/expand suite with file name search - by @hi-ogawa, Hiroshi Ogawa and Codex in #11260 (0a712)
- Fix explorer file summary count - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in #11125 (05982)
- utils:
- Fix
deepMergeto handle prototype - by @hi-ogawa, Hiroshi Ogawa and Codex in #11215 (4944c)
- Fix
View changes on GitHub
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

ℹ️ Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
Release Notes
withastro/compiler-rs (@astrojs/compiler-rs)
v0.5.1
Patch Changes
b48eac6: Fixes missingdata-astro-source-fileanddata-astro-source-locattributes when source annotation is enabled.afa7276: Fixes aReferenceErrorwhen a slot's name is computed inside a loop, e.g.{items.map((item, i) => <div slot={item-${i}}>{item}</div>)}. Computed slot names now render into their matching named slot.afa7276: Removes a strayslot="…"attribute the compiler left on elements passed to a component with a computed slot name.- Updated dependencies [
b48eac6]
seek-oss/capsize (@capsizecss/unpack)
v4.0.1
Patch Changes
- #262
640357cThanks @michaeltaranto! - unpack: EnsurefromUrlandfromBlobwork in the browser
bombshell-dev/clack (@clack/prompts)
v1.8.1
Patch Changes
-
8bd9129Thanks @gameroman! - Return type for prompts now correctly specifiesCANCEL_SYMBOLinstead ofsymbol -
Updated dependencies [
8bd9129]:- @clack/core@1.5.1
v1.8.0
Minor Changes
-
#592
caa32e8Thanks @gameroman! - ExportCANCEL_SYMBOLconstant from@clack/coreand@clack/prompts -
#594
37fca4eThanks @dreyfus92! - Add tab-completion to thepathprompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type/and Tab again). Powered by a new opt-incompleteOnTaboption onautocomplete, which also shows aTab: completehint in the instructions footer. Defaultautocompletebehavior is unchanged. -
#583
ae636ddThanks @43081j! - Add async validation support to prompts, and validation state rendering to text prompts.
Patch Changes
-
#588
6506135Thanks @danielroe! - Style the guide bar rendered bybox({ withGuide: true })in grey so it matches the gutter drawn bylog,noteand the spinner -
#599
0547d6fThanks @43081j! - Fixes a withGuide rendering issue leaving extra spaces in text prompts. -
Updated dependencies [
227583e,caa32e8,37fca4e,ae636dd,b20fa2b]:- @clack/core@1.5.0
microsoft/playwright (@playwright/test)
v1.63.0
v1.62.1
v1.62.0
🧱 New component testing model
Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a
gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates
to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:
test('click should expand', async ({ mount }) => {
const component = await mount('components/Expandable/Stateful');
await component.getByRole('button').click();
await expect(component.getByTestId('expanded')).toHaveValue('true');
});Pass a story type as a template argument to type-check its props, and use update(props) /
unmount() on the returned locator to re-render or tear down within a test.
🛑 Cancel operations with AbortSignal
Most operations and web-first assertions now accept a signal option that takes an
AbortSignal, letting you
cancel long-running actions, navigations, waits, and assertions:
const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.
🖼️ WebP screenshots
expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot()
can now store snapshots in the WebP format — just give the snapshot a .webp name:
// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });page.screenshot() and locator.screenshot() also accept webp as a type,
where quality 100 (the default) is lossless and lower values use lossy compression.
🧩 Custom test filtering with Reporter.preprocess()
New reporter.preprocess() hook runs after the configuration is resolved and before
reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded,
fixed, or failing through a TestRun object:
class MyReporter {
async preprocess({ config, suite, testRun }) {
for (const test of suite.allTests()) {
if (shouldSkip(test))
testRun.skip(test);
}
}
}🔁 Isolated retries
New testConfig.retryStrategy controls when failed tests are retried. The default
'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end,
one by one in a single worker, to minimize interference with the rest of the suite:
// playwright.config.ts
export default defineConfig({
retries: 2,
retryStrategy: 'isolated',
});New APIs
Browser and Context
- New option
credentialsincludes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.
Actions
- New
scrolloption ("auto"|"none") on actions to opt out of Playwright's automatic scroll-into-view.
Network
- New apiResponse.timing() returns resource timing information for an API response.
Evaluation
- New locator.waitForFunction() waits until a function — called with the matching element — returns a truthy value.
- page.evaluate() and related methods now accept functions as evaluate arguments.
- page.addInitScript() / browserContext.addInitScript() now accept functions as init-script arguments.
Command line & MCP
- Playwright now bundles the Playwright MCP server and
playwright-cli, runnable vianpx playwright mcpandnpx playwright cli.
Reporters
- The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new
mergeFilesreporter option:
// playwright.config.ts
export default defineConfig({
reporter: [['html', { mergeFiles: true }]],
});Announcements
⚠️ Debian 11 is not supported anymore.
Browser Versions
- Chromium 151.0.7922.34
- Mozilla Firefox 153.0
- WebKit 26.5
This version was also tested against the following stable channels:
- Google Chrome 151
- Microsoft Edge 151
v1.61.1
v1.61.0
🔑 WebAuthn passkeys
New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:
const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.
🗃️ Web Storage
New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:
await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();New APIs
Network
- apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().
Browser and Screencast
- New option
artifactsDirin browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser. - New option
cursorin screencast.showActions() controls the cursor decoration rendered for pointer actions. - The
onFramecallback in screencast.start() now receives atimestampof when the frame was presented by the browser.
Test runner
- The testOptions.video option now supports the same set of modes as
trace: new'on-all-retries','retain-on-first-failure'and'retain-on-failure-and-retries'values. See the video modes table for which runs are recorded and kept in each mode. - Supported
expect.soft.poll(...). - New fullConfig.argv — a snapshot of
process.argvfrom the runner process, handy for reading custom arguments passed after the--separator. - New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
- testInfo.errors now lists each sub-error of an
AggregateErroras a separate entry. - New
-Gcommand line shorthand for--grep-invert.
🛠️ Other improvements
- Playwright now supports Ubuntu 26.04.
- HAR and trace recordings now include WebSocket requests.
Browser Versions
- Chromium 149.0.7827.55
- Mozilla Firefox 151.0
- WebKit 26.5
This version was also tested against the following stable channels:
- Google Chrome 149
- Microsoft Edge 149
v1.60.0
🌐 HAR recording on Tracing
tracing.startHar() / tracing.stopHar() expose HAR recording as a first-class tracing API, with the same content, mode and urlFilter options as recordHar. The returned Disposable makes it easy to scope a recording with await using:
await using har = await context.tracing.startHar('trace.har');
const page = await context.newPage();
await page.goto('https://playwright.dev');
// HAR is finalized when `har` goes out of scope.🪝 Drop API
New locator.drop() simulates an external drag-and-drop of files or clipboard-like data onto an element. Playwright dispatches dragenter, dragover, and drop with a synthetic [DataTransfer] in the page context — works cross-browser and is great for testing upload zones:
await page.locator('#dropzone').drop({
files: { name: 'note.txt', mimeType: 'text/plain', buffer: Buffer.from('hello') },
});
await page.locator('#dropzone').drop({
data: {
'text/plain': 'hello world',
'text/uri-list': 'https://example.com',
},
});🎯 Aria snapshots
- expect(page).toMatchAriaSnapshot() now works on a Page, in addition to a Locator — equivalent to asserting against
page.locator('body'). - New
boxesoption on locator.ariaSnapshot() / page.ariaSnapshot() appends each element's bounding box as[box=x,y,width,height], useful for AI consumption.
🛑 test.abort()
New test.abort() aborts the currently running test from a fixture, hook, or route handler with an optional message. Use it when you have detected an unrecoverable misuse and want to fail the test right away:
test('does not publish to the shared page', async ({ page }) => {
await page.route('**/publish', route => {
test.abort('Tests must not publish to the shared page. Use the `clone` option.');
return route.abort();
});
// ...
});New APIs
Browser, Context and Page
- Event browser.on('context') — fired when a new context is created on the browser.
- BrowserContext now mirrors lifecycle events from its pages: browserContext.on('download'), browserContext.on('frameattached'), browserContext.on('framedetached'), browserContext.on('framenavigated'), browserContext.on('pageclose'), browserContext.on('pageload').
Locators and Assertions
- New option
descriptionin page.getByRole() / locator.getByRole() / frame.getByRole() / frameLocator.getByRole() for matching the accessible description. - New option
pseudoin expect(locator).toHaveCSS() reads computed styles from::beforeor::after. - New option
stylein locator.highlight() applies extra inline CSS to the highlight overlay, plus new page.hideHighlight() to clear all highlights.
Network
- webSocketRoute.protocols() returns the WebSocket subprotocols requested by the page.
- New option
noDefaultsin browserType.connectOverCDP() disables Playwright's default overrides on the default context (download behavior, focus emulation, media emulation), so attaching to a user's daily-driver browser doesn't disturb its state.
Errors and Reporting
- New webError.location() mirrors consoleMessage.location().
- consoleMessage.location() now exposes
line/columnproperties (lineNumber/columnNumberare deprecated). - New testInfoError.errorContext surfaces additional diagnostic context, such as the aria snapshot of the receiver at the time of an
expect(...)matcher failure. - reporter.onError() now receives a
workerInfoargument with details about the worker for fixture teardown errors.
Test runner
- New
{testFileBaseName}token in testProject.snapshotPathTemplate — file name without extension. - Test runner now errors when a config tries to override a non-option fixture, and rejects
workers: 0or negative values.
🛠️ Other improvements
- HTML reporter:
npx playwright show-reportaccepts.zipfiles directly — no need to unzip first.- Steps that contain attachments inside nested children show an indicator on the parent step.
- The
repeatEachIndexis shown in the test header when non-zero.
- Trace Viewer adds a pretty-print toggle for JSON / form request and response bodies in the network details panel.
Breaking Changes ⚠️
- Removed long-deprecated APIs:
Locator.ariaRef()— use the standard locator.ariaSnapshot() pipeline.handleoption onBrowserContext.exposeBindingandPage.exposeBinding.loggeroption onBrowserType.connectandBrowserType.connectOverCDP— use tracing instead.- Context options
videosPath/videoSize— userecordVideoinstead.
Browser Versions
- Chromium 148.0.7778.96
- Mozilla Firefox 150.0.2
- WebKit 26.4
This version was also tested against the following stable channels:
- Google Chrome 147
- Microsoft Edge 147
v1.59.1
Bug Fixes
- [Windows] Reverted hiding console window when spawning browser processes, which caused regressions including broken
codegen,--uiandshowcommands (#39990)
v1.59.0
🎬 Screencast
New page.screencast API provides a unified interface for capturing page content with:
- Screencast recordings
- Action annotations
- Visual overlays
- Real-time frame capture
- Agentic video receipts
Screencast recording — record video with precise start/stop control, as an alternative to the recordVideo option:
await page.screencast.start({ path: 'video.webm' });
// ... perform actions ...
await page.screencast.stop();Action annotations — enable built-in visual annotations that highlight interacted elements and display action titles during recording:
await page.screencast.showActions({ position: 'top-right' });screencast.showActions() accepts position ('top-left', 'top', 'top-right', 'bottom-left', 'bottom', 'bottom-right'), duration (ms per annotation), and fontSize (px). Returns a disposable to stop showing actions.
Action annotations can also be enabled in test fixtures via the video option:
// playwright.config.ts
export default defineConfig({
use: {
video: {
mode: 'on',
show: {
actions: { position: 'top-left' },
test: { position: 'top-right' },
},
},
},
});Visual overlays — add chapter titles and custom HTML overlays on top of the page for richer narration:
await page.screencast.showChapter('Adding TODOs', {
description: 'Type and press enter for each TODO',
duration: 1000,
});
await page.screencast.showOverlay('<div style="color: red">Recording</div>');Real-time frame capture — stream JPEG-encoded frames for custom processing like thumbnails, live previews, AI vision, and more:
await page.screencast.start({
onFrame: ({ data }) => sendToVisionModel(data),
size: { width: 800, height: 600 },
});Agentic video receipts — coding agents can produce video evidence of their work. After completing a task, an agent can record a walkthrough video with rich annotations for human review:
await page.screencast.start({ path: 'receipt.webm' });
await page.screencast.showActions({ position: 'top-right' });
await page.screencast.showChapter('Verifying checkout flow', {
description: 'Added coupon code support per ticket #​1234',
});
// Agent performs the verification steps...
await page.locator('#coupon').fill('SAVE20');
await page.locator('#apply-coupon').click();
await expect(page.locator('.discount')).toContainText('20%');
await page.screencast.showChapter('Done', {
description: 'Coupon applied, discount reflected in total',
});
await page.screencast.stop();The resulting video serves as a receipt: chapter titles provide context, action annotations highlight each interaction, and the visual walkthrough is faster to review than text logs.
🔗 Interoperability
New browser.bind() API makes a launched browser available for playwright-cli, @playwright/mcp, and other clients to connect to.
Bind a browser — start a browser and bind it so others can connect:
const { endpoint } = await browser.bind('my-session', {
workspaceDir: '/my/project',
});Connect from playwright-cli — connect to the running browser from your favorite coding agent.
playwright-cli attach my-session
playwright-cli -s my-session snapshotConnect from @playwright/mcp — or point your MCP server to the running browser.
@playwright/mcp --endpoint=my-sessionConnect from a Playwright client — use API to connect to the browser. Multiple clients at a time are supported!
const browser = await chromium.connect(endpoint);Pass host and port options to bind over WebSocket instead of a named pipe:
const { endpoint } = await browser.bind('my-session', {
host: 'localhost',
port: 0,
});
// endpoint is a ws:// URLCall browser.unbind() to stop accepting new connections.
📊 Observability
Run playwright-cli show to open the Dashboard that lists all the bound browsers, their statuses, and allows interacting with them:
- See what your agent is doing on the background browsers
- Click into the sessions for manual interventions
- Open DevTools to inspect pages from the background browsers.
- `playwright-cli` binds all of its browsers automatically, so you can see what your agents are doing.
- Pass `PLAYWRIGHT_DASHBOARD=1` env variable to see all `@playwright/test` browsers in the dashboard.
🐛 CLI debugger for agents
Coding agents can now run npx playwright test --debug=cli to attach and debug tests over playwright-cli — perfect for automatically fixing tests in agentic workflows:
$ npx playwright test --debug=cli
### Debugging Instructions
- Run "playwright-cli attach tw-87b59e" to attach to this test
$ playwright-cli attach tw-87b59e
### Session `tw-87b59e` created, attached to `tw-87b59e`.
Run commands with: playwright-cli --session=tw-87b59e <command>
### Paused
- Navigate to "/" at output/tests/example.spec.ts:4
$ playwright-cli --session tw-87b59e step-over
### Page
- Page URL: https://playwright.dev/
- Page Title: Fast and reliable end-to-end testing for modern web apps | Playwright
### Paused
- Expect "toHaveTitle" at output/tests/example.spec.ts:7📋 CLI trace analysis for agents
Coding agents can run npx playwright trace to explore Playwright Trace and understand failing or flaky tests from the command line:
$ npx playwright trace open test-results/example-has-title-chromium/trace.zip
Title: example.spec.ts:3 › has title
$ npx playwright trace actions --grep="expect"
# Time Action Duration
──── ───────── ─────────────────────────────────────────────────────── ────────
9. 0:00.859 Expect "toHaveTitle" 5.1s ✗
$ npx playwright trace action 9
Expect "toHaveTitle"
Error: expect(page).toHaveTitle(expected) failed
Expected pattern: /Wrong Title/
Received string: "Fast and reliable end-to-end testing for modern web apps | Playwright"
Timeout: 5000ms
Snapshots
available: before, after
usage: npx playwright trace snapshot 9 --name <before|after>
$ npx playwright trace snapshot 9 --name after
### Page
- Page Title: Fast and reliable end-to-end testing for modern web apps | Playwright
$ npx playwright trace close♻️ await using
Many APIs now return async disposables, enabling the await using syntax for automatic cleanup:
await using page = await context.newPage();
{
await using route = await page.route('**/*', route => route.continue());
await using script = await page.addInitScript('console.log("init script here")');
await page.goto('https://playwright.dev');
// do something
}
// route and init script have been removed at this point🔍 Snapshots and Locators
❗ Important
✂ PR body was truncated to here.
Configuration
📅 Schedule: (UTC)
- Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (
* 0-3 * * 1)
- Between 12:00 AM and 03:59 AM, only on Monday (
- Automerge
- At any time (no schedule defined)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.

Fixes #18199
Changes
glob()escapes#and?in the entry path before resolving it against the base URL. This changes the same three lines #17776 touched for:. Before,c#-basics.mdwas read from.../blog/cand dropped with an ENOENT error. With this change it loads asc-basics, andf#/intro.mdloads asf/intro.- MDX, Markdoc and
deferRenderentries are imported as modules, and Vite cuts module paths at#/?. Loading them would turn the dropped entry into a failed build (Rolldown failed to resolve import "astro:content-layer-deferred-module?..."). Those entries are still skipped, but the error now says why and asks to rename the file. - Added a changeset.
Testing
- Added tests to
glob-loader.test.ts: a#file and a#folder, a?file (skipped on Windows like the colon test), and a module-backed#entry that is skipped with the new error. - Ran:
pnpm -C packages/astro exec astro-scripts test "test/units/content-layer/glob-loader.test.ts" --strip-types. The hash test fails on main withError reading c#-basics.md: ENOENT ... posts\cand passes with the fix. - Ran:
pnpm -C packages/astro exec astro-scripts test "test/units/content-layer/**/*.test.ts" --strip-types: 119 tests, 0 failures. - Checked: built the repro with this loader plus an MDX and a
deferRendercollection. Both Markdown posts load and render, the#MDX anddeferRenderfiles are skipped with the new error, and the build completes.
Docs
No docs change. This makes file names load that should already work, and the remaining limitation shows up as a build error message.

Changes
- Root cause: the comparator in
HostRoutes.add()in@astrojs/underscore-redirectsonly compares weights when both are truthy (if (a.weight && b.weight)). A weight of0is falsy, so any comparison involving it returnsfalseand the definition is inserted before the existing ones.createRedirectsFromAstroRoutes()gives the/*404 fallback a weight of0so that it ends up last, but it is inserted at the top instead, above the weight 2 rules. Definitions added after it can also land above higher weighted ones, because comparing against the weight 0 entry returnsfalsetoo. - Fix: compare the weights whenever both are defined (
!== undefined), so0is treated as the lowest weight. Definitions without a weight keep their current behavior. - Added a changeset.
Testing
Added a test in packages/underscore-redirects/test/weight.test.ts that adds definitions with weights 2, 0 and 1 and checks they are ordered 2, 1, 0. Before the fix it fails with the order ['/c', '/*', '/a']. After the fix it passes, along with the rest of the package tests.
Docs
No docs needed, this is a bug fix with no change to the API.

Fixes #18195
Changes
@astrojs/cloudflarenow fails inastro:config:setupwhen the project root has awrangler.json,wrangler.jsonc, orwrangler.tomlbut nocloudflare.config.ts.- The error names the file it found and tells the user to run
npx cf migrate --bundler vite. - Before this change, such a project built without any warning. The generated Worker config used the
package.jsonname and lost the Wrangler file's compatibility date and flags, vars, bindings, and custom entrypoint. A follow-upcf deploywould publish that broken Worker. - Projects that already have
cloudflare.config.ts, with or without a leftover Wrangler file, are unaffected.
Testing
- Added unit tests in
test/cloudflare-config.test.ts: each Wrangler file name withoutcloudflare.config.tsthrows, a Wrangler file next tocloudflare.config.tspasses, and an empty root passes. With the check disabled, the three throw cases fail. - Ran the full
@astrojs/cloudflaretest suite: 387 passing, 0 failing. No adapter fixture has a Wrangler file withoutcloudflare.config.ts;vitest-actionshas one but doesn't use the adapter. - Built the reproduction from #18195 with the patched adapter: it now stops with the migration message, and builds normally after adding a
cloudflare.config.ts.
Docs
No docs change in this PR. The new Cloudflare adapter page from withastro/docs#14614 removes the wrangler.jsonc examples but doesn't mention cf migrate; a short upgrade note pointing to npx cf migrate --bundler vite would help. --bundler vite matters because cf migrate otherwise picks the Wrangler bundler for Astro projects, since @cloudflare/vite-plugin is only a transitive dependency.
/cc @withastro/maintainers-docs for feedback!
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
@astrojs/starlight@0.42.6
Patch Changes
-
#4252
40a2584Thanks @olafur-andri! - Adds Icelandic language support -
#4229
e4a3d82Thanks @HiDeoo! - Fixes a potential issue with icons being cut off in Firefox when pinch-zooming. -
#4226
fb562ddThanks @HiDeoo! - Fixes an issue where pages not importing components from@astrojs/starlight/componentsincluded styles of Starlight components used on other pages. -
#4250
531af7dThanks @HiDeoo! - FixesFailed to resolve dependencywarnings logged when running the development server in projects using the Cloudflare adapter. -
#4229
e4a3d82Thanks @HiDeoo! - Fixes thecodePenandnodeicons slightly extending beyond their bounding box.
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
@astrojs/starlight@0.42.5
Patch Changes

Changes
- The
fixWinEPERMSynchelper inpackages/astro/src/core/fs/index.tscalledfs.rmdirSync(p, options)withrecursive: trueas a fallback whenfs.rmSyncthrew EPERM on Windows. Node.js 25 removed support forrecursiveonrmdirSync(DEP0147), so that fallback threwERR_INVALID_ARG_VALUEinstead of recovering, causingastro buildto fail whenever another process briefly held a file indist/. The directory branch now callsfs.rmSync(p, options), which accepts the same options and is the modern replacement. - The parameter type of
fixWinEPERMSyncchanges fromfs.RmDirOptionstofs.RmOptionsto reflect the corrected API.
Testing
- Added
packages/astro/test/units/fs/empty-dir.test.ts, which fakesprocess.platform = 'win32', makesfs.rmSyncthrow EPERM once, and asserts thatemptyDirstill clears the directory. The test fails without the fix and passes with it on both Node 22 and Node 26.
Docs
- No docs update needed; this is an internal Windows/Node compatibility fix with no user-facing API change.
Closes #18170
Last fetched: | Scheduled refresh: Every Saturday
See Customizing GitHub Activity Pages to configure your own
Inspired by prs.atinux.com

