Repository navigation
deps: bump astro from 7.1.6 to 7.2.8 - #571
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
github-actions
Bot
added
documentation
This was referenced Sep 9, 2026
Member
|
Heads up on why this one is red across the board, and why a rebase won't clear it. All five failing jobs come from a single step —
Superseded by #579, which bumps to astro 7.2.10 (published 2026-08-31, already past cooldown) with a lockfile pnpm resolved itself — |
Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 7.1.6 to 7.2.8. - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.2.8/packages/astro) --- updated-dependencies: - dependency-name: astro dependency-version: 7.2.8 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/astro-7.2.8
branch
from
September 9, 2026 12:59
2492e2e to
14afd50
Compare
EricAndrechek
added a commit
that referenced
this pull request
Sep 9, 2026
## Summary Replaces Dependabot's #571 (`astro` 7.1.6 → 7.2.8), whose generated lockfile cannot be installed under this repo's supply-chain policy. Bumps to **astro 7.2.10** with a lockfile resolved by pnpm itself, so it satisfies `minimumReleaseAge`. Supersedes #571 — once `main` carries astro 7.2.10, Dependabot closes that PR itself (its 7.2.8 target is already satisfied). No manual close needed. ## Why #571 could not be rebased `pnpm install --frozen-lockfile` — the install every Node-touching CI job runs — rejected #571's lockfile outright: ``` ✗ Lockfile failed supply-chain policy check (1126 entries in 2.1s) [ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION] 21 lockfile entries failed verification: @clack/core@1.5.0 was published at 2026-09-07T20:12:19.000Z, within the minimumReleaseAge cutoff rolldown@1.2.7 ... postcss@8.5.28 ... tinyexec@1.3.1 ... undici@8.10.2 ... ``` That one `pnpm-install` target — reached via `make verify` (Lint), `make build-docs` → check-docs (Docs build), `make test-ts` (Unit tests), `make test-e2e` → build-ts (E2E tests), and invoked directly by the workflow (Coverage) — failed all five at once, printing no reason for any of them (#578). Integration tests, the one suite that never installs, stayed green on the same lockfile. `@dependabot rebase` / `recreate` cannot fix it: Dependabot resolves with a resolver that does not read `minimumReleaseAge` from `pnpm-workspace.yaml`, so it regenerates the same violating tree. This is #441. Note `astro@7.2.8` itself was **not** the problem — published 2026-08-26, 14 days old and well past the 7-day cooldown. All 21 violations were transitive: `rolldown@1.2.7` plus its 15 platform bindings (09-02), `postcss@8.5.28` / `tinyexec@1.3.1` (09-03), `undici@8.10.2` (09-04), `@clack/core` + `@clack/prompts` (09-07). A Dependabot `cooldown:` setting would not have prevented it, since that gates only the direct dependency. ## What this does instead Bump the manifest and let pnpm resolve. Its resolver *does* honor `minimumReleaseAge`, so it backs off to age-eligible versions on its own: ``` docs/package.json: "astro": "^7.1.1" -> "^7.2.10" pnpm install ``` Resolves `astro@7.2.10` (published 2026-08-31, already past cooldown) with `rolldown@1.2.2`, `postcss@8.5.25`, `undici@8.10.1`, `vite@8.2.0`. One further manifest change rides along, surfaced by pre-push review: - **Declare `@astrojs/markdown-remark` `^7.3.0`.** astro 7.1.6 pinned it to exactly 7.2.2 (an *optional* peer even then, so an unmet one is dropped silently rather than erroring); 7.2.10 widens the range to `^7.3.0`, which the tree's 7.2.2 — a hard dep of `@astrojs/mdx` — doesn't satisfy, so pnpm dropped it from astro's peer set. That's load-bearing: `docs/astro.config.mjs` sets `markdown.remarkPlugins`/`rehypePlugins`, and astro's `coerceLegacyMarkdownPlugins()` does `await import("@astrojs/markdown-remark")` and **throws** if it can't resolve. It only worked via pnpm's hoisted fallback copy — an undeclared edge a narrower `hoist-pattern`, or a starlight/mdx bump dropping that dependency, would break. A `sharp` bump to `^0.35.4` was also part of this branch originally (astro 7.2.8 raised its own optional sharp floor, and the stale 0.35.3 pin had stopped sharing a copy with astro). That change reached `main` first via #574, so it no longer appears in this diff — and #572, the dedicated sharp PR, was superseded by #574 and is already closed. ## Synced with main `origin/main` advanced while this was in review (#570 go-deps, #573 actions-deps, #574 npm-deps all merged). `origin/main` is merged in here — never rebased, per §Branch Maintenance. `pnpm-lock.yaml` conflicted. Resolved by taking main's post-#574 lockfile (`git checkout --theirs pnpm-lock.yaml`) and re-running a targeted `pnpm install` against the merged manifests, rather than hand-merging conflicting YAML. That is deliberate: a lockfile's peer-suffixed keys encode a whole resolution graph, and hand-merging them yields a tree that installs but matches neither side's actual resolution. Re-resolving lets pnpm rebuild the graph under policy. The result keeps both sides intact — #574's catalog `@types/node@26.4.1` and `tsx@4.23.13` are preserved, alongside this branch's `astro@7.2.10` and `@astrojs/markdown-remark@7.3.0`. Net diff vs `main` is now `docs/package.json` (2 lines) plus 281+/136− in `pnpm-lock.yaml`, with zero downgrades. One package drops out entirely — `@rollup/pluginutils@5.4.0`, correct because astro 7.2.x drops its `rollup` optional peer. ## Verification - `pnpm install --frozen-lockfile` — clean, no policy violation (this is what #571 failed), and leaves the lockfile byte-identical. Every entry in the resulting tree is past the 7-day cooldown; the newest is `@types/node@26.4.1` at 7d 17h. - `make build-docs` — 22 pages, all internal links valid, mermaid patched, 68 diagram PNGs rendered. - `make ci` — green on the merged tree. ## Related - #571 — the Dependabot PR this replaces. - #441 — the underlying Dependabot/pnpm cooldown mismatch. [Commented there](#441 (comment)) with the updated failure mode: the repo pinned pnpm 11.1.3 until #490 moved it to 11.21.0, which *does* enforce the policy under `--frozen-lockfile` — so this now fails loudly in CI rather than merging silently as #441 originally described. - #578 — filed from this PR's review: `pnpm-install`'s `--reporter=silent` swallowed the diagnostic entirely, which is why five red jobs stated no reason. - #572 — superseded by #574 (identical sharp bump); closed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01CbyVditEujZabgu3R11VAm Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Member
|
Superseded — #579 merged ( @dependabot close |
Contributor
Author
|
Looks like astro is up-to-date now, so this is no longer needed. |
EricAndrechek
added a commit
that referenced
this pull request
Oct 12, 2026
## Summary The code half of #441 has already landed: `.github/dependabot.yml` carries a 7-day `cooldown` (with the same `@wave-rf/*` and `@wavehouse/*` excludes as `minimumReleaseAgeExclude`), and pnpm 11.21 now verifies the lockfile against `minimumReleaseAge` even under `--frozen-lockfile`, so the "CI does not catch this" premise in the issue is stale. What is left is transitive packages that Dependabot's age-blind resolver pulls in, which a `cooldown` cannot prevent (it gates only the package being bumped). This PR adds no workflow and no Dependabot config change. It documents the remainder in the dev guide's Dependabot section: the failure is loud (`ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` in `make verify`), and the targeted fix is to set the bumped package's manifest range to a release that resolves under the policy (committed to the Dependabot branch), run plain `pnpm install`, then `pnpm install --frozen-lockfile` to confirm, in place of the full `pnpm clean --lockfile` regeneration. I did not build the write-back workflow (issue option 3). It needs a token that can push to `dependabot/npm_and_yarn/**` branches and still trigger CI (a `GITHUB_TOKEN` push does not), and no such token exists in the repo's secrets. That is a decision for a maintainer, so #441 stays open for it. ## Test plan - Checked out Dependabot PR #754's head (`npm-deps-7a9629ed98`) in a scratch worktree and ran `pnpm install --lockfile-only --frozen-lockfile` on pnpm 11.21.0. Output: `Verifying lockfile against supply-chain policies (1086 entries)` then `Lockfile passes`. This confirms the policy check runs under `--frozen-lockfile` and that a post-cooldown Dependabot lockfile passes it. Scratch worktree removed afterwards. - Read #754's failing Lint and Docs build jobs: they fail on an Astro/Starlight markdown parse error, not on a release-age violation. - `scripts/lint-pr-title.sh` accepts the title. - Unverified: I could not reproduce a lockfile that violates the policy, so the quoted `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` behaviour and the targeted-install remedy rest on the measurements recorded in the #441 comment from 2026-09-09 (PR #571). - Unverified: pre-commit `make verify` covers markdown lint for the two changed files; nothing else is exercised by a docs-only change. ## Related Issues Refs #441 (stays open for the write-back workflow). Part of #740. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Wjv2nu841pxTMdUWSAPmDH Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps astro from 7.1.6 to 7.2.8.
Release notes
Sourced from astro's releases.
... (truncated)
Changelog
Sourced from astro's changelog.
... (truncated)
Commits
7cadf10[ci] release (#17826)ecb4082Update Sharp to 0.35.4 (#17837)8bf6f1achore: split v5/v6 changelogs (#17825)db7c53bchore(deps): replace "find-process" with a smaller, lighter alternative (#17786)eface15[ci] release (#17815)633855bUse workerd's compatibility date for Cloudflare defaults (#17819)55d38c8Deserialize each route once when loading the manifest (#17415)a0d2fe3Pass file path to SVGO soprefixIdsgenerates unique per-file prefixes (#17...ae26d18Handle GET and HEAD request bodies during rewrites (#17813)023b48bNormalize request paths before route matching (#17772)