Skip to content

chore(deps)(deps): bump astro from 6.4.4 to 6.4.6 in /apps/docs#168

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/apps/docs/astro-6.4.4
Closed

chore(deps)(deps): bump astro from 6.4.4 to 6.4.6 in /apps/docs#168
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/apps/docs/astro-6.4.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps astro from 6.4.4 to 6.4.6.

Release notes

Sourced from astro's releases.

astro@6.4.6

Patch Changes

  • #16765 b10e86e Thanks @​fkatsuhiro! - Fixes an issue where renaming an image file while the dev server is running triggers a build error. Now Astro correctly hot-reloads the image without crashing.

  • #17026 add3df1 Thanks @​matthewp! - Hardens addAttribute to drop attribute names containing characters that are invalid per the HTML spec (", ', >, /, =, whitespace)

  • #17033 ffda27b Thanks @​matthewp! - Validates the request origin against allowedDomains before fetching prerendered error pages. When allowedDomains is configured and the Host header matches, the original origin is used. Otherwise, the fetch falls back to localhost.

astro@6.4.5

Patch Changes

  • #16985 4ecff32 Thanks @​maximslo! - Fixes the experimental.logger destination not being used for the "Server listening on..." startup message. The logger is now resolved before the server starts listening, and adapterLogger re-creates itself when the underlying logger changes so the startup message uses the correct destination.

  • #16947 e0703a6 Thanks @​ematipico! - Fixes Astro.request.url not reflecting validated X-Forwarded-Proto/X-Forwarded-Host headers when security.allowedDomains is configured. Previously, only Astro.url was updated with the forwarded origin while Astro.request.url retained the socket-derived URL, causing the two to diverge behind TLS-terminating proxies.

  • #16997 dc45246 Thanks @​matthewp! - Reverts a change to isNode runtime detection that caused a significant build time regression for Cloudflare adapter users with large prerendered sites

Changelog

Sourced from astro's changelog.

6.4.6

Patch Changes

  • #16765 b10e86e Thanks @​fkatsuhiro! - Fixes an issue where renaming an image file while the dev server is running triggers a build error. Now Astro correctly hot-reloads the image without crashing.

  • #17026 add3df1 Thanks @​matthewp! - Hardens addAttribute to drop attribute names containing characters that are invalid per the HTML spec (", ', >, /, =, whitespace)

  • #17033 ffda27b Thanks @​matthewp! - Validates the request origin against allowedDomains before fetching prerendered error pages. When allowedDomains is configured and the Host header matches, the original origin is used. Otherwise, the fetch falls back to localhost.

6.4.5

Patch Changes

  • #16985 4ecff32 Thanks @​maximslo! - Fixes the experimental.logger destination not being used for the "Server listening on..." startup message. The logger is now resolved before the server starts listening, and adapterLogger re-creates itself when the underlying logger changes so the startup message uses the correct destination.

  • #16947 e0703a6 Thanks @​ematipico! - Fixes Astro.request.url not reflecting validated X-Forwarded-Proto/X-Forwarded-Host headers when security.allowedDomains is configured. Previously, only Astro.url was updated with the forwarded origin while Astro.request.url retained the socket-derived URL, causing the two to diverge behind TLS-terminating proxies.

  • #16997 dc45246 Thanks @​matthewp! - Reverts a change to isNode runtime detection that caused a significant build time regression for Cloudflare adapter users with large prerendered sites

Commits

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 15, 2026
@dependabot dependabot Bot requested a review from agjs as a code owner June 15, 2026 07:19
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 15, 2026
@agjs agjs mentioned this pull request Jun 19, 2026
Merged
agjs added a commit that referenced this pull request Jun 19, 2026
@agjs
chore(deps): aggregate weekly dependency updates (api, ui, docs, ci) (#…
d74a803 
…190)

* chore(deps): aggregate weekly dependency updates across api, ui, docs

Consolidates 21 Dependabot PRs (#168-#189) into a single change.
Lockfiles regenerated with bun@1.3.14; full static + UI + docs gates pass.

apps/api:
- @anthropic-ai/sdk 0.100.1 -> 0.102.0, openai 6.41.0 -> 6.42.0
- @sentry/bun 10.55.0 -> 10.56.0
- bullmq 5.77.6 -> 5.78.0
- @boring-stack-pkg/eslint-plugin-{db-transactions,drizzle-conventions,elysia} 0.1.1 -> 0.1.2
- @eslint-community/eslint-plugin-eslint-comments 4.7.1 -> 4.7.2
- eslint-plugin-unicorn 64.0.0 -> 65.0.0 (major; lint clean)

apps/ui:
- react-router-dom 7.16.0 -> 7.17.0, @types/react 19.2.16 -> 19.2.17
- @tanstack/react-query(+devtools) 5.100.14 -> 5.101.0
- @sentry/react 10.55.0 -> 10.56.0, react-hook-form 7.77.0 -> 7.78.0
- radix-ui 1.4.3 -> 1.5.0
- storybook group 10.4.1 -> 10.4.2
- vite 8.0.14 -> 8.0.16, vitest(+coverage-v8) 4.1.7 -> 4.1.8
- eslint-plugin-unicorn 64.0.0 -> 65.0.0 (major; lint clean)

apps/docs:
- astro 6.4.2 -> 6.4.4, @astrojs/starlight 0.39.2 -> 0.39.3
- @astrojs/react 5.0.6 -> 5.0.7, wrangler 4.95.0 -> 4.98.0
- @types/react override bumped to 19.2.17 for cross-app parity

ci:
- azure/setup-kubectl 4.0.1 -> 5.1.0 (major)

Deferred: ioredis 5.11.1 (half of #169). bullmq 5.78.0 exact-pins
ioredis 5.10.1; taking 5.11.1 splits the tree into two ioredis copies
with conflicting RedisOptions types. Held back until bullmq's pin advances.

* chore(security): remediate transitive-dep advisories blocking CI

The required `validate` (bun audit) and `dep vuln scan` (osv-scanner + bun
audit) gates were red on this branch and on main due to advisory-data drift
against pre-existing transitive deps. Remediates them so CI is green.

Fixed via patched-version overrides (mirrored across apps per the
package-override-parity rule; <7d releases exempted from the install
quarantine in each app's bunfig.toml):
- form-data 4.0.5 -> 4.0.6 (GHSA-hmw2-7cc7-3qxx CRLF injection) — api, docs
- undici -> 7.28.0 (GHSA-vmh5-mc38-953g TLS bypass, GHSA-pr7r-676h-xcf6) — ui, docs
- tmp 0.2.6 -> 0.2.7 (GHSA-7c78-jf6q-g5cm type-confusion path traversal) — ui, docs

Accepted-risk suppressions (osv-scanner.toml IgnoredVulns + reasoning;
all build-time/non-exploitable in our usage, ignoreUntil 2026-09-19):
- api: nodemailer (GHSA-p6gq-j5cr-w38f — SMTP-only usage never passes the
  vulnerable `raw` option; also --ignore'd in the api bun audit step),
  @opentelemetry/core, esbuild, protobufjs
- ui: @babel/core, esbuild, js-yaml
- docs: astro (6.4.6), dompurify (x3), esbuild

Verification (infra up): api check + 1188 tests; ui check + 656 tests;
docs build:ci; osv-scanner clean on api/ui/docs; bun audit clean on api/ui;
yamllint (CI config) clean.
@dependabot
chore(deps)(deps): bump astro from 6.4.4 to 6.4.6 in /apps/docs
e3a4ed5 
Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 6.4.4 to 6.4.6.
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@6.4.6/packages/astro)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 6.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps)(deps): bump astro from 6.4.2 to 6.4.4 in /apps/docs chore(deps)(deps): bump astro from 6.4.4 to 6.4.6 in /apps/docs Jun 19, 2026
@dependabot dependabot Bot force-pushed the dependabot/bun/apps/docs/astro-6.4.4 branch from d61e252 to e3a4ed5 Compare June 19, 2026 09:06
@agjs

agjs commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Superseded by #190 (merged into main as d74a803), which consolidated the weekly Dependabot bumps into a single PR. The bump from this PR is included there.

@agjs agjs closed this Jun 19, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 19, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/bun/apps/docs/astro-6.4.4 branch June 19, 2026 09:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@agjs agjs Awaiting requested review from agjs agjs is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@agjs