Repository navigation
chore(website): upgrade the site toolchain, dependencies, and Workers compatibility date - #359
Merged
Merged
Conversation
- wrangler 4.143.0 -> 4.149.0 - pnpm 10.34.6 -> 12.11.2 - `onlyBuiltDependencies` -> `allowBuilds`, which is what pnpm 11 renamed it to - `minimumReleaseAge: 4320`: three days, to block supply-chain attacks - CI: pnpm/action-setup v4 -> v6, the first major that installs pnpm 12 wrangler stops at 4.149.0 because 4.150.0 is younger than the cooldown. Verified: frozen install, build, and deploy dry-run (417 assets, only `ASSETS`).
One day before 2026-08-04, where Cloudflare starts enabling the `nodejs_compat` flags for every Worker and the upload grows.
- astro 7.3.5 -> 7.3.8 - @astrojs/starlight 0.42.4 -> 0.42.6 - @astrojs/cloudflare 14.3.3 -> 14.3.4 - @fontsource/noto-sans-sc 5.3.0 -> 5.3.1 - @lucide/astro 1.48.0 -> 1.55.0 (dev) Everything stays within the existing semver ranges and passes the three-day release cooldown. satori (0.33 -> 0.47) and motion (13 -> 14) are left out on purpose: both majors need their own verification pass. Verified: frozen install, `BUB_ASTRO_IMAGE_MODE=build pnpm build`.
motion 14.0 has no breaking changes for the JavaScript API. It only deprecates internal APIs and pins its internal dependencies exactly, which shows up here as `framer-motion: 14.1.0` instead of `^13.4.5`. Audited every call site (HookIntro, TapeModel, Testimonials, BaseLayout). The site only uses `animate`, `inView`, and `stagger`, with `duration`, `ease`, `delay`, transforms, and `controls.stop()`. None of the earlier renames apply: `easing` -> `ease` and `stagger`'s `start` -> `startDelay` landed in 11.0, and the 12.0 `inView` callback signature already matches. Verified: frozen install, `BUB_ASTRO_IMAGE_MODE=build pnpm build`, and the client bundle. Only the shared animate chunk grows, 52,480 -> 52,863 B (gzip 18,803 -> 18,953 B); the viewport (inView) chunk is byte identical with the same content hash. Total JS 3,539,565 -> 3,539,948 B.
satori 0.34 through 0.47 rewrote the CSS engine: it drops the `yoga-layout` dependency in favour of its own `layout.wasm`, applies `opacity` per group, interpolates gradients in their own colour space, and aligns text by baseline. Verified against the 0.33.5 baseline with a per-pixel diff of all eight prerendered OG images. Differences are confined to the CJK description line (bbox x 62-550, y 407-437) and top out at maxΔ 16-18 with meanΔ 0.003-0.009, i.e. sub-pixel antialiasing. Titles, logo and the gradient background are byte-identical, so the gradient colour-space change is a no-op for this card. The yoga-layout removal drops three lockfile entries. satori stays a build-time-only dependency: it does not appear in dist/server. Verified: frozen install, `BUB_ASTRO_IMAGE_MODE=build pnpm build`.
The old value stopped one day before 2026-08-04 to avoid the nodejs_compat defaults, on the assumption that crossing the line grows the upload. That assumption does not hold for this project, and the date was costing us the Node.js builtins: the SSR bundle imports `node:fs`, `node:wasi`, `node:worker_threads` and `node:path`, which cannot resolve at a date before 2026-08-04 without the flag. Measured on a single build with `wrangler deploy --dry-run`, patching only the date: 2026-08-03, 2026-08-04, 2026-10-01, 2026-10-06, 2026-10-13 and 2026-10-14 all produce byte-identical output -- 557 modules, same gzip size. An explicit `nodejs_compat` flag does not change it either. The Astro adapter emits `no_bundle: true`, so Wrangler never bundles the Worker and never injects the unenv polyfills the docs describe. 2026-10-13 is the ceiling rather than the current date because wrangler ships the workerd binary: at 2026-10-14, `wrangler dev` refuses to start with "This Worker requires compatibility date \"2026-10-14\", but the newest date supported by this server binary is \"2026-10-13\"". wrangler 4.149.0 pins workerd 1.20261006.1; raise wrangler before raising the date. Behaviour verified against the pinned wrangler dev server: every route still serves, no runtime warnings, and the SSR output for `/` and `/zh-cn/` is byte-identical to the same build running at 2026-08-03. Verified: `pnpm install --frozen-lockfile`, `BUB_ASTRO_IMAGE_MODE=build pnpm build`, `pnpm exec wrangler deploy --dry-run` (still only the ASSETS binding).
Two of these were verbatim duplicates: the required Cloudflare project configuration was already listed a few lines earlier under "recommended settings", and the Git-integration statement is covered by the responsibilities section at the end of the file. The MkDocs paragraph is stale -- the repository has no `mkdocs.yml` and no root `docs/` -- and the only fact it carried, that production targets Cloudflare Workers, is already the subject of the section directly below it. Deletions only, 14 lines; no wording was changed.
frostming
approved these changes
Oct 14, 2026
pnpm 12 writes pnpm-lock.yaml as two YAML documents: an env document holding the pinned package manager and its binaries, and the project document. check-yaml rejects any file with more than one document unless --allow-multiple-documents is set.
Both restated what the configuration already says. The compatibility-date constraint now sits as a comment next to the value in wrangler.jsonc, and the cooldown is documented by the minimumReleaseAge comment in pnpm-workspace.yaml.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Website-only maintenance: refresh the build toolchain, bring the dependencies up
to date, and move the Workers compatibility date to the newest value the pinned
toolchain can actually run.
Toolchain
10.34.6→12.11.2viapackageManager, andpnpm/action-setup@v4→v6inmain.ymlso CI sets up the same version.onlyBuiltDependencies→allowBuilds(same three packages; the old key isdeprecated). Unlisted packages still keep their install scripts disabled.
minimumReleaseAge: 4320— a three-day cooldown on newly publishedpackages, for supply-chain hardening. A frozen install also fails while any
lockfile entry is younger than the cooldown, so a bump has to wait for it.
That is why
satoristops at 0.47.1 here rather than 0.56.x; it can follow uponce the release is old enough.
supportedArchitectures.cpukeepswasm32next tocurrent. The Cloudflarebundle needs the Sätteri WASI fallback; without it the build fails with
Rolldown failed to resolve import "@bruits/satteri-wasm32-wasi".Dependencies
astro@astrojs/starlight@astrojs/cloudflaremotionsatori@fontsource/noto-sans-sc@lucide/astrowranglermotion14 is a major bump but documents no breaking changes. All four call sites(
BaseLayout,HookIntro,TapeModel,Testimonials) were re-checked in abrowser, including the
prefers-reduced-motionbranches.satorirenders the OG images at build time. Rendering identical inputs with0.33.5 and 0.47.1 differs only by sub-pixel antialiasing on the CJK description
line (max channel delta 16–18); 0.47.1 and 0.56.x render byte-identically. The
0.34–0.47 line rewrites the CSS engine from
yoga-layouttolayout.wasm, whichis why the
satori>fflateadvisory override stays in place.Workers compatibility date
2026-04-22→2026-10-13. Cloudflare advises tracking the current date, but theceiling here is the
workerdbinary bundled withwrangler: a date newer thanthat binary makes
pnpm devandpnpm previewrefuse to start. Withwrangler4.149.0 (
workerd1.20261006.1),2026-10-13starts and2026-10-14does not.Crossing
2026-08-04enablesnodejs_compatby default. It does not change theupload: the Astro adapter emits
no_bundle: true, so Wrangler never bundles theWorker and never injects the
unenvpolyfills.wrangler deploy --dry-runon asingle build produced byte-identical output (557 modules, same gzip size) for
every date from
2026-08-03through2026-10-14.Docs
DEPLOYMENT.mdonly loses lines that no longer match the repository — the legacyMkDocs transition note, the "deploys via Git integration rather than Actions" line
that is repeated a few sections lower, and a second copy of the required
Cloudflare project settings. Its one addition is the package manager version in
the Cloudflare project settings list.
Pre-commit
check-yamlgains--allow-multiple-documents. pnpm 12 writespnpm-lock.yamlas two YAML documents — an env document holding the pinned package manager and
its binaries, then the project document — and the hook rejects more than one
document by default.
Impact
website/only, plus thecheck-docsjob in.github/workflows/main.yml. Nochanges to Python or runtime code.
Verification
pnpm --dir website install --frozen-lockfile— passes, including the newsupply-chain policy check.
pnpm --dir website build— passes, OG images included.wrangler deploy --dry-runacross the compatibility-date range above.Known warnings
Pre-existing and unchanged by this PR:
Unexpected Node.js imports for environment "ssr"for the SätteriWASI package and for postcss; both are dead code at runtime.