Bump the development-security group across 1 directory with 5 updates by dependabot[bot] · Pull Request #952 · planetlabs/maps

dependabot · 2026-08-07T03:13:13Z

Bumps the development-security group with 5 updates in the / directory:

Package	From	To
astro	`6.3.7`	`7.2.0`
vite	`7.3.3`	`8.2.1`
brace-expansion	`1.1.14`	`1.1.18`
shell-quote	`1.8.2`	`1.10.0`
ws	`8.20.0`	`8.21.2`

Updates astro from 6.3.7 to 7.2.0

Release notes

Sourced from astro's releases.

astro@7.2.0

Minor Changes
#17174 0224a3a Thanks @matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.
astro preview --background
When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:
astro preview status
astro preview logs
astro preview logs --follow
astro preview stop
If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.
#17532 7f94895 Thanks @florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
logger: {

entrypoint: new URL('./src/logger.js', import.meta.url),


entrypoint: './src/logger.js',
},
});
Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.
#17084 961bbe5 Thanks @matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.
import type { AstroPrerenderer, PrerenderResult } from 'astro';
const prerenderer: AstroPrerenderer = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.0

Minor Changes
#17174 0224a3a Thanks @matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.
astro preview --background
When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:
astro preview status
astro preview logs
astro preview logs --follow
astro preview stop
If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.
#17532 7f94895 Thanks @florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
logger: {

entrypoint: new URL('./src/logger.js', import.meta.url),


entrypoint: './src/logger.js',
},
});
Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.
#17084 961bbe5 Thanks @matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.
import type { AstroPrerenderer, PrerenderResult } from 'astro';

... (truncated)

Commits

60e9432 [ci] release (#17558)
af92694 docs: slightly reword session options description (#17607)
caace2e [ci] format
0224a3a Add background mode for astro preview (#17174)
961bbe5 Experimental incremental static builds (#17084)
7f94895 feat(logger): allow passing relative string entrypoints (#17532)
90c98ae feat(session): add session: false to opt out of session support (#16871)
3ea55ce Support detect devEngines for installs (#17579)
0089f83 Fix Content Layer build crash when neotraverse 0.6.x is hoisted by another de...
f4150da [ci] format
Additional commits viewable in compare view

Updates vite from 7.3.3 to 8.2.1

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.1

Please refer to CHANGELOG.md for details.

v8.2.1

Please refer to CHANGELOG.md for details.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.2.1 (2026-08-06)

Bug Fixes

build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)

bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)

css: don't re-run lightningcss visitor during minify (fix #23146) (#23147) (de041a7)

deps: update all non-major dependencies (#23136) (14454fd)

deps: update rolldown-related dependencies (#23070) (7ac6f7f)

don't mutate the user config when resolving the lib entry from the top-level input (#23135) (b4bf596)

handle shebang ending with uncommon line terminators (#23038) (17f7b2f)

server: use a random port when port is 0 (#23158) (fddf4ea)

Performance Improvements

css: look up pure CSS chunks through a Set (#23114) (1331b0b)

Documentation

build: fix incomplete @default for build.minify (#23177) (ef02435)

Miscellaneous Chores

deps: update dependency rolldown-plugin-dts to ^0.28.0 (#23137) (4adc1e7)

deps: update dependency strip-literal to v4 (#23140) (9db65ce)

Code Refactoring

bundled-dev: avoid injecting server values in the bundle (#22967) (23b8a08)

bundled-dev: remove rolldown lazy stub module workaround (#23129) (e72036e)

Tests

bundled-dev: enable sourcemap playgrounds (#23080) (c2155fe)

reduce logs (#23138) (7673c02)

8.2.0 (2026-07-30)

Features

add input to server.fs.allow (#23035) (95a3cda)

bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)

bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)

config: include column in config incompatibility location (#23064) (8a24572)

dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)

Bug Fixes

bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)

deps: update all non-major dependencies (#23069) (4c07b74)

hmr: preserve environment snapshot during server restart (#22992) (b1186c3)

importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)

... (truncated)

Commits

4216158 release: v8.2.1
fddf4ea fix(server): use a random port when port is 0 (#23158)
de041a7 fix(css): don't re-run lightningcss visitor during minify (fix #23146) (#23147)
15f0307 fix(build): make client chunkImportMap work with sharedPlugins: true (#23184)
c2155fe test(bundled-dev): enable sourcemap playgrounds (#23080)
ef02435 docs(build): fix incomplete @default for build.minify (#23177)
eac0cc8 fix(bundled-dev): inject client script tag before chunk scripts (#23161)
23b8a08 refactor(bundled-dev): avoid injecting server values in the bundle (#22967)
e72036e refactor(bundled-dev): remove rolldown lazy stub module workaround (#23129)
14454fd fix(deps): update all non-major dependencies (#23136)
Additional commits viewable in compare view

Updates brace-expansion from 1.1.14 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
See full diff in compare view

Updates shell-quote from 1.8.2 to 1.10.0

Changelog

Sourced from shell-quote's changelog.

v1.10.0 - 2026-07-10

Merged

[New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/issues/1)

Commits

[Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8

[Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3

[readme] remove the space in js code fences so evalmd evaluates them 2116fa3

[Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11) 1c36f3f

[readme] document that quote outputs POSIX quoting, not cmd.exe/PowerShell 100e96e

[readme] document parse's supported parameter-expansion subset e1c75cd

[Fix] parse: a backslash inside single quotes must not escape the closing quote 5d460a3

[readme] fix stale example outputs 2de86f5

[Tests] quote: pin that a backslash with whitespace is not doubled in single quotes (#14) 190e236

[readme] quote: use output verbatim; do not re-quote it (#11) 1b36468

[Refactor] parse: fix swapped SINGLE_QUOTE/DOUBLE_QUOTE variable names 801af5c

[types] fix an error TS v6 ignores but v7 fails on 59bbf8b

[Dev Deps] update @arethetypeswrong/cli, evalmd a04d475

[Dev Deps] update @arethetypeswrong/ci, eslint d390f9a

[Tests] quote: the tilde test escapes every ~, not just a leading one (#9) 617d119

v1.9.0 - 2026-06-24

Commits

[New] add types dca6e21

[Dev Deps] update eslint 9aa9e8f

[Fix] parse: finalize tokens in linear time (GHSA-395f-4hp3-45gv) 7ff5488

[actions] update workflows 75e8497

[actions] Windows + node 4/6/7: pin eslint to 9 before install, since npm 2/3 cannot stage eslint 10@types/esrecurse 3fb739d

[actions] retry npm install on Windows to survive npm 2/3 staging-rename flake abe0163

[actions] Windows + node 5/7: install deps with a modern node b4bafa2

[Fix] quote: escape leading ~ to prevent shell tilde-expansion 7a76c1a

[Dev Deps] update auto-changelog, tape 7184b44

[Dev Deps] apparently jackspeak is no longer in the graph 9ba368a

v1.8.4 - 2026-05-22

Commits

[Fix] quote: validate object-token shapes 4378a6e

[Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, npmignore 22ebec0

[Tests] increase coverage 9f3caa3

[readme] replace runkit CI badge with shields.io check-runs badge 3344a04

[Dev Deps] update @ljharb/eslint-config 699c511

v1.8.3 - 2025-06-01

... (truncated)

Commits

64988d9 v1.10.0
617d119 [Tests] quote: the tilde test escapes every ~, not just a leading one (#9)
59bbf8b [types] fix an error TS v6 ignores but v7 fails on
190e236 [Tests] quote: pin that a backslash with whitespace is not doubled in singl...
a04d475 [Dev Deps] update @arethetypeswrong/cli, evalmd
b9545b3 [New] parse: add opt-in splitUnquoted option for shell field-splitting of...
1b36468 [readme] quote: use output verbatim; do not re-quote it (#11)
1c36f3f [Tests] quote: pin conservative escaping of =, @, ^, ,, :, ! (#11)
e1c75cd [readme] document parse's supported parameter-expansion subset
c0842c8 [Fix] parse: match nested ${...} braces so nested parameter expansion is ...
Additional commits viewable in compare view

Updates ws from 8.20.0 to 8.21.2

Release notes

Sourced from ws's releases.

8.21.2

Bug fixes

Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

Empty fragments are now counted toward the limit (a2f4e7c0).

The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
</tr></table>

... (truncated)

Commits

787ebf2 [dist] 8.21.2
b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
e4bb883 [security] Use GitHub PVR as main reporting channel
2eb3be0 [test] Skip test on Node.js versions where it does not apply
ae1de54 [dist] 8.21.1
8e9511b [ci] Trust Coveralls Homebrew tap
f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
8df8265 [ci] Update actions/checkout action to v7
a2f4e7c [fix] Count empty fragments toward the limit (#2329)
e79f912 [pkg] Approve install scripts for bufferutil and utf-8-validate
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the development-security group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `6.3.7` | `7.2.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.3` | `8.2.1` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.14` | `1.1.18` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.2` | `1.10.0` | | [ws](https://github.com/websockets/ws) | `8.20.0` | `8.21.2` | Updates `astro` from 6.3.7 to 7.2.0 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.2.0/packages/astro) Updates `vite` from 7.3.3 to 8.2.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.1/packages/vite) Updates `brace-expansion` from 1.1.14 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.14...v1.1.18) Updates `shell-quote` from 1.8.2 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.2...v1.10.0) Updates `ws` from 8.20.0 to 8.21.2 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.0...8.21.2) --- updated-dependencies: - dependency-name: astro dependency-version: 7.2.0 dependency-type: direct:development dependency-group: development-security - dependency-name: vite dependency-version: 8.2.1 dependency-type: direct:development dependency-group: development-security - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: development-security - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: development-security - dependency-name: ws dependency-version: 8.21.2 dependency-type: indirect dependency-group: development-security ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 7, 2026

Navigation Menu

Uh oh!

Bump the development-security group across 1 directory with 5 updates - #952

Bump the development-security group across 1 directory with 5 updates#952
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-security-97440faeb3

dependabot Bot commented on behalf of github Aug 7, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

astro@7.2.0

Minor Changes

7.2.0

Minor Changes

plugin-legacy@8.2.1

v8.2.1

create-vite@8.2.0

plugin-legacy@8.2.0

v8.2.0

v8.2.0-beta.0

v8.1.5

v8.1.4

v8.1.3

v8.1.2

v8.1.1

create-vite@8.1.0

plugin-legacy@8.1.0

v8.1.0

plugin-legacy@8.1.0-beta.0

v8.1.0-beta.0

v8.0.16

8.2.1 (2026-08-06)

Bug Fixes

Performance Improvements

Documentation

Miscellaneous Chores

Code Refactoring

Tests

8.2.0 (2026-07-30)

Features

Bug Fixes

v1.1.15

v1.10.0 - 2026-07-10

Merged

Commits

v1.9.0 - 2026-06-24

Commits

v1.8.4 - 2026-05-22

Commits

v1.8.3 - 2025-06-01

8.21.2

Bug fixes

8.21.1

Bug fixes

8.21.0

Features

Bug fixes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 7, 2026 •

edited

Loading