Skip to content

deps: bump the npm-deps group across 1 directory with 16 updates - #754

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-deps-7a9629ed98
Closed

deps: bump the npm-deps group across 1 directory with 16 updates#754
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-deps-7a9629ed98

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-deps group with 16 updates in the / directory:

Package From To
@biomejs/biome 2.5.8 2.5.15
markdownlint-cli2 0.23.2 0.23.3
@vitest/coverage-v8 4.1.11 5.0.3
tsx 4.23.13 4.23.15
@astrojs/markdown-remark 7.3.0 7.3.1
@astrojs/starlight 0.41.7 0.42.4
astro 7.2.10 7.3.5
katex 0.18.4 0.18.10
sharp 0.35.4 0.35.5
starlight-image-zoom 0.15.0 0.16.0
starlight-links-validator 0.25.3 0.26.0
@cloudflare/workers-types 4.20260702.1 5.20260930.2
playwright 1.62.1 1.63.0
wrangler 4.118.0 4.145.0
@types/node 26.4.1 26.6.3
vitest 4.1.11 5.0.3

Updates @biomejs/biome from 2.5.8 to 2.5.15

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.15

2.5.15

Patch Changes

  • #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

    For example, the following snippet triggers the rule.

    function Component({ items = [] }) {
  return items;
}

  • #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

    <script>
  export let name;
</script>

  • #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

    {
  "linter": {
    "rules": {
      "nursery": {
        "useLogicalProperties": {
          "level": "warn",
          "options": {
            "direction": "rtl"
          }
        }
      }
    }
  }
}

  • #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

    import { page } from "$app/stores";

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.15

Patch Changes

  • #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

    For example, the following snippet triggers the rule.

    function Component({ items = [] }) {
  return items;
}

  • #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

    <script>
  export let name;
</script>

  • #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

    {
  "linter": {
    "rules": {
      "nursery": {
        "useLogicalProperties": {
          "level": "warn",
          "options": {
            "direction": "rtl"
          }
        }
      }
    }
  }
}

  • #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

    import { page } from "$app/stores";

  • #11723 3b429d1 Thanks @​m1handr! - Fixed #11656: noAstroSetHtmlDirective now correctly reports set:html directives inside Astro template expressions.

... (truncated)

Commits

Updates markdownlint-cli2 from 0.23.2 to 0.23.3

Changelog

Sourced from markdownlint-cli2's changelog.

0.23.3

  • Update dependencies
Commits
  • 916ad0a Update to version 0.23.3.
  • ed9cb41 Freshen list of external custom rules included with the markdownlint-cli2-rul...
  • 3fe0056 Remove test-main suite now that test-fs runs all the same tests (except 1 whi...
  • d52a859 Update test case infrastructure to be able to run "require" tests when using ...
  • 8a4b4be Bump eslint-plugin-jsdoc from 64.3.5 to 64.3.6
  • 578caa6 Update OutputFormatterOptions to include an FsPromisesLike parameter so outpu...
  • 018d1eb Update indirect playwright dependencies.
  • a3a26a8 Bump @​playwright/test from 1.62.1 to 1.63.0
  • 75e7193 Bump eslint-plugin-jsdoc from 64.3.3 to 64.3.5
  • f1a6823 Bump eslint from 10.9.1 to 10.10.0
  • Additional commits viewable in compare view

Updates @vitest/coverage-v8 from 4.1.11 to 5.0.3

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.3

   🐞 Bug Fixes

    View changes on GitHub

v5.0.2

   🐞 Bug Fixes

... (truncated)

Commits

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

  • exclude bare builtins from namespace inheritance (38e1588)
  • expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
  • make namespaced register() overloads portable for declaration emit (562c434)

This release is also available on:

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

  • restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

This release is also available on:

Commits
  • ca66105 test: fix drive-less file URLs in ESM resolver fixtures
  • 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
  • 38e1588 fix: exclude bare builtins from namespace inheritance
  • 562c434 fix: make namespaced register() overloads portable for declaration emit
  • edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
  • 70e7828 test: upgrade tinyspy for disposable API
  • 9ed2022 ci: avoid duplicate release notifications
  • 872e77f refactor: use disposables for cleanup
  • 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
  • See full diff in compare view

Updates @astrojs/markdown-remark from 7.3.0 to 7.3.1

Release notes

Sourced from @​astrojs/markdown-remark's releases.

@​astrojs/markdown-remark@​7.3.1

Patch Changes

  • #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.
Changelog

Sourced from @​astrojs/markdown-remark's changelog.

7.3.1

Patch Changes

  • #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.
Commits

Updates @astrojs/starlight from 0.41.7 to 0.42.4

Release notes

Sourced from @​astrojs/starlight's releases.

@​astrojs/starlight@​0.42.4

Patch Changes

@​astrojs/starlight@​0.42.3

Patch Changes

@​astrojs/starlight@​0.42.2

Patch Changes

@​astrojs/starlight@​0.42.1

Patch Changes

  • #4198 96a44d4 Thanks @​mayank99! - Removes the popover attribute from the sidebar pane on desktop viewports. This ensures the desktop sidebar doesn't stay in a "hidden" popover visibility state.

@​astrojs/starlight@​0.42.0

Minor Changes

  • #3572 292fb17 Thanks @​HiDeoo! - Distributes package as JavaScript files with dedicated type declaration files instead of TypeScript source files.

  • #4121 2623ae6 Thanks @​delucis! - Simplifies markup for Starlight’s mobile menu toggle

    ⚠️ Potentially breaking change: If you use a theme plugin, custom styles, or component overrides targeting the MobileMenuToggle button or PageFrame components, you may need to adjust these for the new markup. The button is no longer wrapped in a <starlight-menu-button> custom element and no longer uses the aria-expanded attribute. Instead, you can use the .sl-menu-button class name to target the button and the :popover-open pseudo-class to style the menu open state specifically.

    In the following example, custom styles for the menu button are updated for the new approach:

    - starlight-menu-button button {
+ .sl-menu-button {
  color: var(--sl-color-text);
}

starlight-menu-button[aria-expanded='true'] button {


.sl-menu-button:has(~ :popover-open) {
color: var(--sl-color-text-accent-high);
}

See MobileMenuToggle.astro and PageFrame.astro on GitHub for the full source code of the updated components.

  • #3572 292fb17 Thanks @​HiDeoo! - Removes the tagline configuration option, which was never used.

    • ... (truncated)

    Changelog

    Sourced from @​astrojs/starlight's changelog.

    0.42.4

    Patch Changes

    0.42.3

    Patch Changes

    0.42.2

    Patch Changes

    0.42.1

    Patch Changes

    • #4198 96a44d4 Thanks @​mayank99! - Removes the popover attribute from the sidebar pane on desktop viewports. This ensures the desktop sidebar doesn't stay in a "hidden" popover visibility state.

    0.42.0

    Minor Changes

    • #3572 292fb17 Thanks @​HiDeoo! - Distributes package as JavaScript files with dedicated type declaration files instead of TypeScript source files.

    • #4121 2623ae6 Thanks @​delucis! - Simplifies markup for Starlight’s mobile menu toggle

      ⚠️ Potentially breaking change: If you use a theme plugin, custom styles, or component overrides targeting the MobileMenuToggle button or PageFrame components, you may need to adjust these for the new markup. The button is no longer wrapped in a <starlight-menu-button> custom element and no longer uses the aria-expanded attribute. Instead, you can use the .sl-menu-button class name to target the button and the :popover-open pseudo-class to style the menu open state specifically.

      In the following example, custom styles for the menu button are updated for the new approach:

      - starlight-menu-button button {
+ .sl-menu-button {
  color: var(--sl-color-text);
}

starlight-menu-button[aria-expanded='true'] button {


.sl-menu-button:has(~ :popover-open) {
color: var(--sl-color-text-accent-high);
}

    ... (truncated)

    Commits

    Updates astro from 7.2.10 to 7.3.5

    Release notes

    Sourced from astro's releases.

    astro@7.3.5

    Patch Changes

    • #17736 2b8b2e8 Thanks @​ematipico! - Adds a new container function called renderComponent(), which renders Astro components with inlined styles and scripts.

      Users must import the component with the new ?container query string:

      import { experimental_AstroContainer } from "astro/container";
import TodoList from "../components/TodoList.astro?container";
const container = await experimental_AstroContainer.create();
const _string = container.renderComponent(TodoList);

    astro@7.3.4

    Patch Changes

    • #18063 40896ac Thanks @​adamchal! - Fixes incremental builds repeatedly rendering unchanged pages when modules or compiled CSS reference bundled assets.

    • #18053 cf5d72f Thanks @​Princesseuh! - Improves the astro check error shown for TypeScript 7. The command now explains that TypeScript 7 is not currently supported and provides instructions for experimentally type-checking Astro files with TypeScript 7.1 and @astrojs/ts-content-mapper.

    • #18086 795a7e4 Thanks @​ump45nose! - Fix double-escaped ampersands in Markdown image alt and title attributes. The __ASTRO_IMAGE_ round-trip now decodes the numeric (&#x26;) and named (&amp;) character references the Markdown processors emit, so an & in an alt or title is escaped exactly once in the final HTML instead of twice.

    • #18074 0429805 Thanks @​SurefireStudios! - Fix three error names that did not match their documented reference. MissingLocale, MissingIndexForInternationalization and NoManifestAvailable reported names ending in Error in the dev overlay, while their error reference pages are published under the unsuffixed names, so the name shown to users could not be found in the docs.

    • #18007 2245837 Thanks @​L4XB! - Fixes the dev server re-evaluating the whole server module graph on every request. The astro:head-metadata plugin invalidated its component metadata virtual module from its own transform hook, so each evaluation of that module scheduled the next one. Adapters that run requests outside Vite's module runner, such as @astrojs/cloudflare, paid for a full re-evaluation of the server graph on every request for the lifetime of the process.

    • #18096 43657c4 Thanks @​matthewp! - Fixes domain-based i18n routing to respect security.allowedDomains when selecting a locale from request host headers

    • #18043 8a53a8b Thanks @​astro-factory! - Fixes image.responsiveStyles emitting invalid object-position CSS values for same-axis keyword pairs (top bottom, left right, etc.)

    • #18029 c08252d Thanks @​matthewp! - Runs astro dev and astro preview in the foreground when an AI agent is detected on Windows, allowing the agent to manage the process lifetime. Pass --background explicitly to request an Astro-managed background process. Agent-inferred backgrounding remains enabled on other platforms.

    • Updated dependencies [3fd16ee, 8358d59]:

      • @​astrojs/markdown-satteri@​0.4.2

    astro@7.3.3

    Patch Changes

    • #17651 504333c Thanks @​sxzz! - Refactors internal version handling to use a smaller, ESM-native dependency

    • #17942 0bc5715 Thanks @​matthewp! - Returns appropriate 400 and 404 responses from the image endpoint for invalid and missing local image paths

    • #17700 b2222fc Thanks @​winklemad! - Fixes Astro.preferredLocaleList returning an empty list when a locale is configured with the object form ({ path, codes }) and the browser sends the code with different casing or an underscore, such as en-US matching a configured en-us

    • #17941 394ff79 Thanks @​matthewp! - Fixes astro preview --ignore-lock (and astro dev --ignore-lock) being refused when run from an AI agent environment. The flag now starts the server in the foreground instead of erroring, since agent detection only inferred background mode and was never explicitly requested. An explicit --background combined with --ignore-lock still errors.

    • #17928 3277927 Thanks @​ArmandPhilippot! - Fixes TypeScript autocompletion for getImage() to suggest all available predefined options.

    ... (truncated)

    Changelog

    Sourced from astro's changelog.

    7.3.5

    Patch Changes

    • #17736 2b8b2e8 Thanks @​ematipico! - Adds a new container function called renderComponent(), which renders Astro components with inlined styles and scripts.

      Users must import the component with the new ?container query string:

      import { experimental_AstroContainer } from "astro/container";
import TodoList from "../components/TodoList.astro?container";
const container = await experimental_AstroContainer.create();
const _string = container.renderComponent(TodoList);

    7.3.4

    Patch Changes

    • #18063 40896ac Thanks @​adamchal! - Fixes incremental builds repeatedly rendering unchanged pages when modules or compiled CSS reference bundled assets.

    • #18053 cf5d72f Thanks @​Princesseuh! - Improves the astro check error shown for TypeScript 7. The command now explains that TypeScript 7 is not currently supported and provides instructions for experimentally type-checking Astro files with TypeScript 7.1 and @astrojs/ts-content-mapper.

    • #18086 795a7e4 Thanks @​ump45nose! - Fix double-escaped ampersands in Markdown image alt and title attributes. The __ASTRO_IMAGE_ round-trip now decodes the numeric (&#x26;) and named (&amp;) character references the Markdown processors emit, so an & in an alt or title is escaped exactly once in the final HTML instead of twice.

    • #18074 0429805 Thanks @​SurefireStudios! - Fix three error names that did not match their documented reference. MissingLocale, MissingIndexForInternationalization and NoManifestAvailable reported names ending in Error in the dev overlay, while their error reference pages are published under the unsuffixed names, so the name shown to users could not be found in the docs.

    • #18007 2245837 Thanks @​L4XB! - Fixes the dev server re-evaluating the whole server module graph on every request. The astro:head-metadata plugin invalidated its component metadata virtual module from its own transform hook, so each evaluation of that module scheduled the next one. Adapters that run requests outside Vite's module runner, such as @astrojs/cloudflare, paid for a full re-evaluation of the server graph on every request for the lifetime of the process.

    • #18096 43657c4 Thanks @​matthewp! - Fixes domain-based i18n routing to respect security.allowedDomains when selecting a locale from request host headers

    • #18043 8a53a8b Thanks @​astro-factory! - Fixes image.responsiveStyles emitting invalid object-position CSS values for same-axis keyword pairs (top bottom, left right, etc.)

    • #18029 c08252d Thanks @​matthewp! - Runs astro dev and astro preview in the foreground when an AI agent is detected on Windows, allowing the agent to manage the process lifetime. Pass --background explicitly to request an Astro-managed background process. Agent-inferred backgrounding remains enabled on other platforms.

    • Updated dependencies [3fd16ee, 8358d59]:

      • @​astrojs/markdown-satteri@​0.4.2

    7.3.3

    Patch Changes

    • #17651 504333c Thanks @​sxzz! - Refactors internal version handling to use a smaller, ESM-native dependency

    • #17942 0bc5715 Thanks @​matthewp! - Returns appropriate 400 and 404 responses from the image endpoint for invalid and missing local image paths

    • #17700 b2222fc Thanks @​winklemad! - Fixes Astro.preferredLocaleList returning an empty list when a locale is configured with the object form ({ path, codes }) and the browser sends the code with different casing or an underscore, such as en-US matching a configured en-usDescription has been truncated

    @dependabot
    dependabot Bot requested review from a team and taitelee October 7, 2026 15:02
    @dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 7, 2026
    @dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 7, 2026
    @coderabbitai

    coderabbitai Bot commented Oct 7, 2026 •
    edited
    Loading

    Copy link
    Copy Markdown

    Important

    Review skipped

    Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

    ⚙️ Run configuration
    • Configuration used: Organization UI
    • Review profile: ASSERTIVE
    • Plan: Advanced
    • Run ID: daf38b72-3596-49be-97b1-c4c16f75df85

    You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

    Use the checkbox below for a quick retry:

    • 🔍 Trigger review
    • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

    Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

    ❤️ Share

    Comment @coderabbitai help to get the list of available commands.

    @github-actions github-actions Bot added documentation Improvements or additions to documentation area/sdk TypeScript SDK (clients/ts/) area/docs Documentation, site/, README labels Oct 7, 2026
    @dependabot
    dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-deps-7a9629ed98 branch from 4a74869 to 0433dfc Compare October 7, 2026 17:35
    @github-code-quality

    github-code-quality Bot commented Oct 7, 2026 •
    edited
    Loading

    Copy link
    Copy Markdown
    Contributor

    Code Coverage Overview

    Languages: Go

    Go

    The overall line coverage in commit acc0c3a in the dependabot/npm_and_y... branch remains at 93%, unchanged from commit 7e4b65d in the main branch.

    Show a line coverage summary of the most impacted files.
    File main 7e4b65d dependabot/npm_and_y... acc0c3a +/-
    internal/mq/nats_topology.go 91% 92% +1%
    internal/mq/external.go 84% 85% +1%

    Updated October 07, 2026 18:12 UTC

    @dependabot
    deps: bump the npm-deps group across 1 directory with 16 updates
    acc0c3a 
    Bumps the npm-deps group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.8` | `2.5.15` |
| [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2) | `0.23.2` | `0.23.3` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.11` | `5.0.3` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` |
| [@astrojs/markdown-remark](https://github.com/withastro/astro/tree/HEAD/packages/markdown/remark) | `7.3.0` | `7.3.1` |
| [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.7` | `0.42.4` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.2.10` | `7.3.5` |
| [katex](https://github.com/KaTeX/KaTeX) | `0.18.4` | `0.18.10` |
| [sharp](https://github.com/lovell/sharp) | `0.35.4` | `0.35.5` |
| [starlight-image-zoom](https://github.com/HiDeoo/starlight-image-zoom/tree/HEAD/packages/starlight-image-zoom) | `0.15.0` | `0.16.0` |
| [starlight-links-validator](https://github.com/HiDeoo/starlight-links-validator/tree/HEAD/packages/starlight-links-validator) | `0.25.3` | `0.26.0` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `4.20260702.1` | `5.20260930.2` |
| [playwright](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.118.0` | `4.145.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.6.3` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.11` | `5.0.3` |



Updates `@biomejs/biome` from 2.5.8 to 2.5.15
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.15/packages/@biomejs/biome)

Updates `markdownlint-cli2` from 0.23.2 to 0.23.3
- [Changelog](https://github.com/DavidAnson/markdownlint-cli2/blob/main/CHANGELOG.md)
- [Commits](DavidAnson/markdownlint-cli2@v0.23.2...v0.23.3)

Updates `@vitest/coverage-v8` from 4.1.11 to 5.0.3
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/coverage-v8)

Updates `tsx` from 4.23.13 to 4.23.15
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.13...v4.23.15)

Updates `@astrojs/markdown-remark` from 7.3.0 to 7.3.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/markdown/remark/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/markdown-remark@7.3.1/packages/markdown/remark)

Updates `@astrojs/starlight` from 0.41.7 to 0.42.4
- [Release notes](https://github.com/withastro/starlight/releases)
- [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md)
- [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.42.4/packages/starlight)

Updates `astro` from 7.2.10 to 7.3.5
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.3.5/packages/astro)

Updates `katex` from 0.18.4 to 0.18.10
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](KaTeX/KaTeX@v0.18.4...v0.18.10)

Updates `sharp` from 0.35.4 to 0.35.5
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.4...v0.35.5)

Updates `starlight-image-zoom` from 0.15.0 to 0.16.0
- [Release notes](https://github.com/HiDeoo/starlight-image-zoom/releases)
- [Changelog](https://github.com/HiDeoo/starlight-image-zoom/blob/main/packages/starlight-image-zoom/CHANGELOG.md)
- [Commits](https://github.com/HiDeoo/starlight-image-zoom/commits/starlight-image-zoom@0.16.0/packages/starlight-image-zoom)

Updates `starlight-links-validator` from 0.25.3 to 0.26.0
- [Release notes](https://github.com/HiDeoo/starlight-links-validator/releases)
- [Changelog](https://github.com/HiDeoo/starlight-links-validator/blob/main/packages/starlight-links-validator/CHANGELOG.md)
- [Commits](https://github.com/HiDeoo/starlight-links-validator/commits/starlight-links-validator@0.26.0/packages/starlight-links-validator)

Updates `@cloudflare/workers-types` from 4.20260702.1 to 5.20260930.2
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `playwright` from 1.62.1 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.1...v1.63.0)

Updates `wrangler` from 4.118.0 to 4.145.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.145.0/packages/wrangler)

Updates `@types/node` from 26.4.1 to 26.6.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `vitest` from 4.1.11 to 5.0.3
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest)

---
updated-dependencies:
- dependency-name: "@astrojs/markdown-remark"
  dependency-version: 7.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: "@astrojs/starlight"
  dependency-version: 0.42.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260930.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-deps
- dependency-name: "@types/node"
  dependency-version: 26.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-deps
- dependency-name: astro
  dependency-version: 7.3.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: katex
  dependency-version: 0.18.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: markdownlint-cli2
  dependency-version: 0.23.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: playwright
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: sharp
  dependency-version: 0.35.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: starlight-image-zoom
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: starlight-links-validator
  dependency-version: 0.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: tsx
  dependency-version: 4.23.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: vitest
  dependency-version: 5.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: npm-deps
- dependency-name: wrangler
  dependency-version: 4.145.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
    @dependabot
    dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-deps-7a9629ed98 branch from 0433dfc to acc0c3a Compare October 7, 2026 18:04
    This was referenced Oct 8, 2026
    Closed
    Closed
    Merged
    EricAndrechek added a commit that referenced this pull request Oct 9, 2026
    @EricAndrechek @claude
    ci: reuse Go build objects across pushes of a PR that changes deps (#794
    596642a 
    )

Repeated pushes to a PR reused no Go build objects. Measured from CI
logs (2026-10-06 to 10-08), that only matters on a PR that changes
`go.mod`/`go.sum`, so only that case is cached, and only for the two
long-pole jobs.

- **Measured, typical PR.** The integration suite's `app` part compiles
in 5.8–8.5 s from `main`'s entry, against 2.3–3.2 s from a same-tree
one. e2e's 4–7 s cover build is hidden behind its SDK build. A PR-scoped
cache would buy about 4–5 s per push, which is inside the `app` part's
run-to-run spread, so these PRs still save nothing.
- **Measured, dependency-changing PR (#730, #742, #753).** Every push
recompiles the dependency delta from `main`'s generation: 35–50 s in the
integration suite and a 37–49 s cover build in e2e, against about 3 s
and 4 s from the PR's own entry. That is about 30–45 s per push on the
critical path. Of 129 PR runs since 2026-09-25, 34 came from 9 such PRs,
and 25 of those were second or later pushes.
- **Classifier.** `scripts/classify-paths.sh` also emits `go-deps`: any
`go.mod`/`go.sum` in the change set, in any module, which are the files
the cache keys hash. `classify-changes.sh` passes it through only for a
cleanly classified pull request and sets it false everywhere it fails
closed. The `changes` job exposes it as an output.
- **setup-env.** A new `go-cache-pr-save` input, which the `app` part
and e2e set only when `go-deps` is true. So a PR that changes no
dependency never saves, even while `main` holds no entry for its key:
just after a bump lands on `main`, after a failed `main` run, or for a
newly opted-in job. With the input set, the job looks up the exact key
first, from the PR's scope or `main`'s, so a PR whose dependency change
`main` already has hits `main`'s entry and saves nothing. Only on a miss
does it restore the newest entry of its flavor (the PR's own, then
`main`'s) and save the exact key into the PR's scope. The key is per
dependency state, so a PR saves once per dependency change. Merge-queue
refs and branches stay restore-only, and nothing is added to `ci.yml`
beyond the two inputs.
- **Pruning.** `pr-cache-cleanup.yml` gains a `workflow_run` job that
runs after every PR's CI run. It runs the new
`scripts/ci/prune-pr-build-cache.sh` from the default branch with
`actions: write` and deletes every PR-scoped `gobuild-v3` entry that
`main` also holds or that a newer entry of the same flavor supersedes.
It deduplicates the paged listing before grouping, since a row returned
twice would otherwise delete the PR's newest entry, and a fixture test
(`make test-prune-pr-build-cache`, a new `make verify` leaf) pins the
selection and the failure handling. No PR code holds the write token.
The job needs no PR number, so it covers fork PRs too. A PR holds at
most about 0.48 GiB of build cache (double that for the minutes before a
prune).
- **Budget.** The README sizes this for four such PRs open at once, the
most open at once in the last two weeks. The worst case at rest is about
11.7 GiB, about 1.7 GiB over the cap, and eviction by last access takes
it from `main`'s superseded generation, which nothing reads (inferred).
At two such PRs everything fits. `main`'s live entries stay safe up to
six: 3.9 + N × (0.5 CodeQL + 0.48 build) ≤ 10 GiB, assuming the
superseded generation is the size of the live one. The six build flavors
together are 1.02 GiB on `main`; the issue's "about 1.3 GiB per suffix"
was the total for all six of a PR's flavors.

## Test plan

This branch's diff matches #783's (same 13 files, +450/−67), which
CodeRabbit approved; the only line differences are the verify-leaf list
and the `make verify` table row, which differ because the base did.
Re-run here: the pre-commit `make verify` (which runs both fixture
suites below) and a full `make ci`. Items marked "measured on #783" were
not repeated; the CI items are observable once this PR targets `main`.

- [x] `make lint-gha` (actionlint, which also checks the new input and
the `go-deps` output) and `make lint-sh` clean; `make verify` green in
the pre-commit hook, including the new leaf.
- [x] `make test-classify-paths`: new `go-deps` cases (root and nested
modules, look-alike names, mixed with docs, empty, large input); a
mutant that matches only the root `go.mod`/`go.sum` fails it (mutant
measured on #783). `classify-changes.sh` against a stub `gh`:
`go-deps=true` only for a pull request whose file list holds a `go.sum`;
false on push, merge group, dispatch and a failed listing.
- [ ] (measured on #783) The setup-env step conditions, evaluated for
push to `main`, `pull_request` with and without the input, `merge_group`
and `workflow_dispatch`: exactly one restore path runs, and only a PR
miss with the input set is save-capable.
- [ ] (measured on #783) `prune-pr-build-cache.sh --dry-run` against the
live cache list selects 6 entries (1058 MiB): copies of `main`'s keys
under #731, #754 and #756. It keeps #753's own entries (one per flavor,
not on `main`) and never touches `main` or merge-queue scopes.
- [x] `make test-prune-pr-build-cache`: deletes copies of `main`'s key
and version and keeps a same key with another version; deletes
superseded entries and the older of a same-second pair; keeps
`-integration-` apart from `-integration-app-`; ignores other families
and `main`/merge-queue scopes; keeps a PR's only entry listed twice.
Through a stub `gh`: a 404 reads as already gone, a 403 fails after the
rest are attempted, and a failed listing fails. Mutants caught (measured
on #783): no early dedup (the pre-fix script), key-only match, merged
flavors, no prefix filter, `main` scope included, listing failure
ignored, 404 treated as an error, 403 swallowed.
- [ ] This PR's own run, which changes no dependency: `Detect changes`
logs `go-deps=false`, and every Go job, the `app` part and e2e included,
uses the plain restore step, with no `Cache saved` for `gobuild-v3` in
any post step.
- [ ] After merge, the first `PR cache cleanup` run triggered by a PR's
CI (`Prune PR build caches`): passes and deletes the entries the dry run
listed, if they are still there.
- [ ] The first PR that changes `go.mod`/`go.sum` (the next Dependabot
go-deps PR): `Detect changes` logs `go-deps=true`; the first push
restores `main`'s generation through restore-keys and saves
`gobuild-v3-Linux-go-integration-app-<its hash>` and `-e2e-cov-<its
hash>` under `refs/pull/<n>/merge`; the second push exact-hits them, its
integration compile is about 3 s and e2e reaches its containers about 20
s after `make` starts; the prune leaves one entry per flavor; the close
cleanup deletes them. A fork PR's save is unverified: if GitHub refuses
it, the job only logs a warning.
- [x] `make ci` passes on this branch, after merging `main` (#793 and
#788).

## Related Issues

Closes #781. Refs #535 (two generations on `main` still leave thin
headroom). Part of #740.

Supersedes #783. Now based on `main`: its parent, the `-trimpath` PR
#793, has merged. It does not itself use `-trimpath` or `make
ci-remote`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Wjv2nu841pxTMdUWSAPmDH

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
    @EricAndrechek EricAndrechek mentioned this pull request Oct 9, 2026
    Merged
    EricAndrechek added a commit that referenced this pull request Oct 12, 2026
    @EricAndrechek @claude
    docs(deps): document the Dependabot release-age lockfile fix (#801)
    fb52bcd 
    ## Summary

The code half of #441 has already landed: `.github/dependabot.yml`
carries a 7-day `cooldown` (with the same `@wave-rf/*` and
`@wavehouse/*` excludes as `minimumReleaseAgeExclude`), and pnpm 11.21
now verifies the lockfile against `minimumReleaseAge` even under
`--frozen-lockfile`, so the "CI does not catch this" premise in the
issue is stale. What is left is transitive packages that Dependabot's
age-blind resolver pulls in, which a `cooldown` cannot prevent (it gates
only the package being bumped).

This PR adds no workflow and no Dependabot config change. It documents
the remainder in the dev guide's Dependabot section: the failure is loud
(`ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` in `make verify`), and the
targeted fix is to set the bumped package's manifest range to a release
that resolves under the policy (committed to the Dependabot branch), run
plain `pnpm install`, then `pnpm install --frozen-lockfile` to confirm,
in place of the full `pnpm clean --lockfile` regeneration.

I did not build the write-back workflow (issue option 3). It needs a
token that can push to `dependabot/npm_and_yarn/**` branches and still
trigger CI (a `GITHUB_TOKEN` push does not), and no such token exists in
the repo's secrets. That is a decision for a maintainer, so #441 stays
open for it.

## Test plan

- Checked out Dependabot PR #754's head (`npm-deps-7a9629ed98`) in a
scratch worktree and ran `pnpm install --lockfile-only
--frozen-lockfile` on pnpm 11.21.0. Output: `Verifying lockfile against
supply-chain policies (1086 entries)` then `Lockfile passes`. This
confirms the policy check runs under `--frozen-lockfile` and that a
post-cooldown Dependabot lockfile passes it. Scratch worktree removed
afterwards.
- Read #754's failing Lint and Docs build jobs: they fail on an
Astro/Starlight markdown parse error, not on a release-age violation.
- `scripts/lint-pr-title.sh` accepts the title.
- Unverified: I could not reproduce a lockfile that violates the policy,
so the quoted `ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` behaviour and the
targeted-install remedy rest on the measurements recorded in the #441
comment from 2026-09-09 (PR #571).
- Unverified: pre-commit `make verify` covers markdown lint for the two
changed files; nothing else is exercised by a docs-only change.

## Related Issues

Refs #441 (stays open for the write-back workflow). Part of #740.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Wjv2nu841pxTMdUWSAPmDH

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
    @EricAndrechek

    EricAndrechek commented Oct 13, 2026

    Copy link
    Copy Markdown
    Member

    @dependabot rebase

    @dependabot @github

    dependabot Bot commented on behalf of github Oct 13, 2026

    Copy link
    Copy Markdown
    Contributor Author

    Looks like these dependencies are updatable in another way, so this is no longer needed.

    @dependabot dependabot Bot closed this Oct 13, 2026
    @dependabot
    dependabot Bot deleted the dependabot/npm_and_yarn/npm-deps-7a9629ed98 branch October 13, 2026 07:57
    @github-project-automation github-project-automation Bot moved this from Backlog to Done in WaveHouse Task Board Oct 13, 2026
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Reviewers

    @taitelee taitelee Awaiting requested review from taitelee taitelee was automatically assigned from Wave-RF/wavehouse-admins

    Assignees

    No one assigned

    Labels

    area/docs Documentation, site/, README area/sdk TypeScript SDK (clients/ts/) dependencies Pull requests that update a dependency file documentation Improvements or additions to documentation javascript Pull requests that update javascript code

    Projects

    WaveHouse Task Board
    Archived in project

    Milestone

    No milestone

    Development

    Successfully merging this pull request may close these issues.

    1 participant

    @EricAndrechek