Skip to content

chore(deps): update all non-major dependencies - #594

Merged
renovate[bot] merged 1 commit into
masterfrom
renovate/all-minor-patch
Oct 16, 2026
Merged

chore(deps): update all non-major dependencies#594
renovate[bot] merged 1 commit into
masterfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Oct 16, 2026

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@astrojs/markdown-remark (source) 7.3.2 → 7.3.3 age confidence
@astrojs/mdx (source) 8.0.3 → 8.1.0 age confidence
@vitest/coverage-v8 (source) 5.0.4 → 5.0.5 age confidence
astro (source) 7.3.8 → 7.4.0 age confidence
pnpm (source) 12.11.2 → 12.14.0 age confidence
vitest (source) 5.0.4 → 5.0.5 age confidence

Release Notes

withastro/astro (@​astrojs/markdown-remark)

v7.3.3

Compare Source

Patch Changes
withastro/astro (@​astrojs/mdx)

v8.1.0

Compare Source

Minor Changes
Patch Changes
vitest-dev/vitest (@​vitest/coverage-v8)

v5.0.5

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
withastro/astro (astro)

v7.4.0

Compare Source

Minor Changes

  • #​17894 b7a1bd9 Thanks @​Princesseuh! - Adds a new --timings flag to astro build to help you find what slows down your builds

    When a build takes longer than expected, it can be hard to tell whether the cause is an integration, a Markdown processor plugin, image processing, or even syntax highlighting. Add the --timings flag to your build command to print a summary once the build finishes:

    astro build --timings

    This is helpful to decide what to optimize first, or to compare build times before and after a change to your project.

  • #​17830 a937b0d Thanks @​florian-lefebvre! - Adds a new optional getFontProperties() callback to font providers

    Font providers can now expose the weights, styles, subsets and formats a font family actually has. Astro uses it when resolving your font configuration to warn about values a provider cannot serve, for example a weight a font family does not offer.

    All built-in providers implement it. If you maintain a custom font provider, implementing this callback is optional for now but it will be required in Astro 8:

    import type { FontProvider } from 'astro';

const provider: FontProvider = {
	name: 'my-provider',
	resolveFont: ({ familyName }) => {
		// ...
	},
	getFontProperties: ({ familyName }) => ({
		weights: ['400', '700'],
		styles: ['normal', 'italic'],
		subsets: ['latin'],
		formats: ['woff2'],
	}),
};

  • #​17830 a937b0d Thanks @​florian-lefebvre! - Adds a fetch() function to the font provider init() context

    This function requests a provider API, retrying transient failures and more. It lets providers that wrap a 3rd-party unifont provider pass the context to it directly:

    import type { FontProvider } from 'astro';
import type { InitializedProvider } from 'unifont';
import { acmeProvider } from '@acme/unifont-provider';

export function acmeFontProvider(): FontProvider {
	const provider = acmeProvider();
	let initializedProvider: InitializedProvider | undefined;
	return {
		name: provider._name,
		async init(context) {
			initializedProvider = await provider(context);
		},
		// ...
	};
}

  • #​18015 0b30239 Thanks @​florian-lefebvre! - Adds experimental.redirectPage, letting you provide your own src/pages/3xx.astro in place of the redirect page Astro generates in static builds.

    A static site has no server to send an HTTP Location header, so Astro generates a small HTML page with a <meta http-equiv="refresh"> tag for each redirect it builds:

    • Your redirects entries
    • Astro.redirect() calls in prerendered pages
    • i18n redirects

    That page's markup, wording, and refresh delay were fixed, so you could not brand or translate it.

    To enable this feature, add the experimental flag to your Astro config:

    // astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  experimental: {
    redirectPage: true,
  },
});

    Then create src/pages/3xx.astro. Astro renders it once per redirect, passing that redirect's details as props:

    ---
// src/pages/3xx.astro
import type { RedirectPageProps as Props } from 'astro';

const { from, to, status, delay } = Astro.props;
---

<html lang="en">
  <head>
    <meta http-equiv="refresh" content={`${delay};url=${to}`} />
    <meta name="robots" content="noindex" />
    <title>Redirecting…</title>
  </head>
  <body>
    <p>This page has moved. <a href={to}>Continue to {to}</a>.</p>
  </body>
</html>

    Your page must render a <meta http-equiv="refresh"> tag pointing at to, because in a static build that tag is the redirect. Astro logs a warning during the build if it is missing.

    See the experimental redirect page documentation for more information.

  • #​18265 910ee69 Thanks @​astro-factory! - Adds a notFound() handler to astro/fetch and astro/hono that renders the custom 404 page when no route matches, including a prerendered 404.astro

    Add it before pages() in a custom worker or server entrypoint that does not run inside App.render, such as a Hono app used directly as a Cloudflare worker. Without it, pages() and middleware() return an empty 404 with an internal X-Astro-Error header for unmatched routes. astro() already includes this handling.

    import { Hono } from 'hono';
import { notFound, pages } from 'astro/hono';
import { cf } from '@astrojs/cloudflare/hono';

const app = new Hono();
app.use(cf());
app.use(notFound());
app.use(pages());
export default app;

  • #​18177 7d814e5 Thanks @​Princesseuh! - Adds support for separate build and runtime image services

    image.service now also accepts a build and a runtime service. The build service optimizes images on prerendered pages when you build your site, and is also used during development. The runtime service handles images on on-demand rendered pages and the image endpoint of your deployed site.

    The following example uses Sharp to optimize images on prerendered pages, and an image CDN for on-demand rendered pages:

    // astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  image: {
    service: {
      build: { entrypoint: 'astro/assets/services/sharp' },
      runtime: { entrypoint: 'my-image-cdn-service' },
    },
  },
});
Changes for integration authors

config.image.service keeps the shape the user configured it with. When a project sets build and runtime services, config.image.service.entrypoint and config.image.service.config are undefined.

If your integration reads image.service, check for the runtime property to get the service you need:

'astro:config:done': ({ config }) => {
  const { service } = config.image;
  const runtimeService = 'runtime' in service ? service.runtime : service;

  if (runtimeService.entrypoint === 'astro/assets/services/sharp') {
    // ...
  }
},

Setting image.service with updateConfig() replaces the existing service instead of merging with it when the two use different shapes. For example, setting a single service in a project that uses build and runtime services replaces both.

  • #​18277 2715958 Thanks @​florian-lefebvre! - Increases the minimum Node.js version to 22.22.0

    The minimum supported Node.js version is now 22.22.0, the latest Node.js 22 release supported by StackBlitz. This change is in line with Astro's Node.js support policy.

  • #​18313 71e2b24 Thanks @​matthewp! - Allows integrations to control where Astro writes client, server, and prerender build output.

    Custom prerenderers can access the final output locations through the new outputDirectories context:

    setPrerenderer((defaultPrerenderer, { outputDirectories }) => {
  const { client, server, prerender } = outputDirectories

  return createPrerenderer({
    defaultPrerenderer,
    client,
    server,
    prerender,
  })
})

  • #​18177 7d814e5 Thanks @​Princesseuh! - Lets custom prerenderers report the images used on prerendered pages

    Astro now generates images on prerendered pages from the image information that a prerenderer's getStaticPaths() and render() return. If your prerenderer wraps Astro's default one, pass this information through:

    setPrerenderer((defaultPrerenderer) => ({
  name: 'my-prerenderer',
  async setup() {
    await defaultPrerenderer.setup?.();
  },
  async getStaticPaths() {
    const result = await defaultPrerenderer.getStaticPaths();
    const { paths, metadata } = Array.isArray(result) ? { paths: result } : result;
    return { paths: paths.filter(({ pathname }) => !pathname.startsWith('/drafts')), metadata };
  },
  render(request, options) {
    return defaultPrerenderer.render(request, options);
  },
  async teardown() {
    await defaultPrerenderer.teardown?.();
  },
}));

    Returning a plain array from getStaticPaths() or a plain Response from render() still works, but is deprecated: images used on those pages are not generated.

  • #​17932 b905ff1 Thanks @​Princesseuh! - Adds support for experimental parallel prerendering

    This experimental feature makes astro build render your static pages in parallel, using multiple CPU cores at once instead of one. On sites with many pages, this can significantly reduce build times, at the cost of higher memory usage.

    To enable this feature, add the experimental flag in your Astro config:

    // astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  experimental: {
    parallelPrerender: true,
  },
});

    By default, Astro uses all available CPU cores but one. Each additional worker increases the memory used by your build. If your build runs out of memory, or does not get faster, set workers to a lower number:

    // astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  experimental: {
    parallelPrerender: {
      workers: 4,
    },
  },
});

    Each worker renders as many pages at once as your build.concurrency setting allows.

    This feature has no effect when your adapter provides its own way of prerendering pages. Among official adapters, this only applies to @astrojs/cloudflare. Astro logs a warning during the build when the flag is ignored.

    For more information on enabling and using this feature in your project, see the experimental parallel prerendering docs.

Patch Changes
pnpm/pnpm (pnpm)

v12.14.0: pnpm 12.14.0

Compare Source

This release adds the sideEffectsCache.exclude setting, stops pnpm install from waiting on the daily update check, and keeps pnpm from aborting with a core dump when the reader of its output exits.

Minor Changes

  • Added the sideEffectsCache.exclude setting for packages whose build depends on something pnpm cannot include in the cache key, such as the system libraries a native addon links against. pnpm builds the listed packages in every project and never restores or saves their builds through the side-effects cache, locally or on a remoteCache server. Under the global virtual store, each project gets its own copy of these packages and of the packages that depend on them. Entries use the same name, @scope/*, and name@version patterns as minimumReleaseAgeExclude #​5271.

  • pnpm login now prints the npm-notice response header during web-based login. Registries use it to show the verification code that completes the sign-in in the browser.

Patch Changes
Installing packages

  • pnpm install and pnpm add no longer wait for the daily update check. If the command finishes first, pnpm skips the update notice and checks again next time. On a registry that accepted the connection but never answered, an install that had nothing to do used to take minutes #​16839.

  • pnpm install, pnpm add and pnpm update now reuse pnpm-lock.yaml when the workspace configures a catalog entry that no dependency references, such as an unused entry or one whose package an overrides entry replaces. Before, every resolution in such a workspace resolved all dependencies again from the registry #​16923.

  • pnpm install now looks up a git dependency's branch or tag once per install, even when many workspace projects depend on it. With linkWorkspacePackages enabled, it used to run git ls-remote once per project #​16899.

  • A filtered install, such as pnpm install --filter <pkg>, now keeps the pnpm-lock.yaml entries of workspace projects that are missing from disk, as in a sparse checkout. Their importers, packages, and catalog entries stay even when the filter matches every project on disk #​16931.

  • pnpm now decides whether a dependency that a package also declares as an optional peer is linked as a dependency or as a peer from the shallowest path that reaches the package. When an existing lockfile records such a dependency as a regular dependency and a newly added dependency now provides the peer, pnpm records it as a peer, as a fresh install does. The lockfile entry of such a package can change on the next install #​16901.

  • An install that adds nothing to the store no longer changes the modification time of the store directory. CI caches that check modification times, such as GitLab's, no longer re-upload an unchanged store #​16929.

Running commands and scripts

  • pnpm no longer aborts with a core dump when the reader of its output has exited, as in pnpm list | head -1 or pnpm start 2>&1 | head -1. The command finishes with its usual exit code, and a failing script's exit code is kept. A write to stdout that fails for another reason, such as a full disk, ends the command with exit code 1 #​16904 pnpm/tasks#132.

  • On Windows, pnpm exec, pnpm run, and commands such as pnpm nx now return when the command they run exits, even if it left a detached process running and pnpm's output is redirected or piped. Previously a shell reading that output waited until the detached process, such as the Nx daemon, exited #​16930.

  • Commands that do not write the project manifest now leave a missing package.json absent. This covers queries such as pnpm why and pnpm outdated, pnpm fetch, pnpm dedupe --check, and commands that exit with an error, such as pnpm rt ls. These commands used to create one from the initialization template. pnpm sbom run from a lockfile alone now reports the root component as unknown with version 0.0.0 #​16907.

  • pnpm run now reports a failed script as a JSON record under --reporter=ndjson. It printed a plain [ELIFECYCLE] line to stderr.

  • pnpm run no longer prints [ELIFECYCLE] Command failed with exit code N. to stderr when a script fails under --reporter=silent, --silent, or --loglevel=silent.

  • pnpm pipeline --dry-run no longer writes a run report when no projects are selected. With --json it prints {"tasks": []} pnpm/tasks#126.

Packing and publishing

  • pnpm pack and pnpm publish now ship the whole gitignored directory that main, browser, or bin points into, as npm does. Previously only the main and bin files themselves were packed, and a gitignored browser file was left out #​16908.

  • pnpm pack and pnpm publish now honor a .npmignore or .gitignore inside a subdirectory when package.json has a files field. The package root's ignore files and those inherited from the workspace are still skipped #​16909.

Setting up pnpm and toolchains

  • --registry, --https-proxy, --http-proxy, and --no-proxy now apply when pnpm resolves and downloads the pnpm version a project pins in packageManager. Before, these lookups went to https://registry.npmjs.org/, which a firewall that only allows a private registry blocks #​16911.

  • On Windows, pnpm install now installs the Rust toolchain for rustup's default host, so a machine set up with rustup set default-host x86_64-pc-windows-gnu gets the MinGW toolchain. Without a default host, pnpm installs the MSVC toolchain for the machine's architecture, as rustup does. This includes a pnpm built for MinGW, such as the MSYS2 package, which has installed the MinGW toolchain since 12.13.0. An x64 pnpm on ARM64 Windows now installs the ARM64 toolchain #​16854.

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude

v12.13.0: pnpm 12.13.0

Compare Source

This release adds the pnpm profile and pnpm token commands, the storeIndexFormat: files setting for stores shared over a network filesystem, and faster Python dependency resolution.

Minor Changes

  • Added the pnpm profile command to view and update registry user profile settings.

  • Added pnpm token to list, create, and revoke authentication tokens on the registry.

  • Added the storeIndexFormat setting. Set it to files to keep a store's package index as one file per package instead of the SQLite index.db, for a store on a network filesystem that several machines use at once. SQLite's locking does not work across machines, so concurrent installs on such a store could corrupt index.db.

  • Added the nodePackageMap setting, which groups the package-map settings. nodePackageMap.mode: write-only writes node_modules/.package-map.json for other tools without making Node.js load it. mode: load also makes Node.js load the map, like nodeExperimentalPackageMap: true. nodePackageMap.type replaces nodePackageMapType. The old settings still work #​14937.

    nodePackageMap:
  mode: write-only
  type: loose
Patch Changes
Setting up pnpm

  • pnpm setup now works when pnpm was installed with npm on macOS. It installed pnpm from npm's bin directory and left a $PNPM_HOME/bin/pnpm that could not run #​16855.

  • pnpm runs again after pnpm setup when globalShims enables pnpm. Every command failed with "the global target of the pnpm shim points back at the shim" #​16874.

  • A pnpm built for the MinGW target on Windows, such as the MSYS2 package, now installs the MinGW Rust toolchain that rust-toolchain.toml names. It used to install the MSVC toolchain.

Installing packages

  • On macOS, pnpm install no longer fails with ERR_PNPM_LOCKFILE_WRITE_FILE when the project is on a virtiofs or SMB share. pnpm now falls back to a regular fsync when the file system rejects a full sync #​16846.

  • On macOS, pnpm install, pnpm patch-commit, and other commands that load a pnpmfile no longer hang at random.

  • pnpm install now puts the executables of a Python build backend's requirements on the PATH while the backend runs. Projects built with uv_build now install. Before, they failed with "uv-build was not properly installed".

  • Removing a link: dependency now also removes its symlink from node_modules when nodeLinker is hoisted #​16884.

  • pnpm-lock.yaml no longer records the tarball URL of a package installed from a scoped registry, such as one set by @types:registry=, when pnpm can rebuild the URL from that registry #​16866.

Packing, auditing, and pipelines

  • pnpm pack and pnpm publish now pack only package.json, the README, the license, and the files named in main and bin when files is an empty array. They used to pack every file in the package #​16889.

  • pnpm audit and pnpm audit signatures no longer check runtimes installed through devEngines.runtime, such as node@runtime:24.21.0, against the npm package of the same name. pnpm audit signatures reported these runtimes as having an invalid registry signature #​16869.

  • pnpm pipeline now runs the root's tasks when pnpm-workspace.yaml lists only the root in packages or omits packages, as pnpm -r run does. A change to a root file in such a workspace no longer triggers a full-run warning. When a full run has no projects to run, pnpm pipeline now reports that no projects are selected #​16849.

Performance

  • pnpm install resolves Python dependencies faster. With --lockfile-only, a project with 10 dependencies now resolves in about 4 seconds, down from about 40. When the index publishes a metadata file beside each wheel (PEP 658), as PyPI does, pnpm downloads only the wheels of the releases it selects.

  • A repeat install against an existing lockfile no longer reads registry metadata for the dependencies it takes from that lockfile. On a warm store this removes thousands of metadata lookups from a repeat install of a large workspace.

  • pnpm install with enableModulesDir: false now verifies the packages already in the store while the dependencies resolve, and checks a package's files in parallel. On a 5,100-package install with the store on a network filesystem, this removed a 19-second pause between resolution and fetching.

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude

v12.12.1: pnpm 12.12.1

Compare Source

This release adds OIDC authentication to pnpm dist-tag and the tool: protocol. pnpm publish now checks which registry an NPM_ID_TOKEN was issued for before using it.

Patch Changes

  • pnpm publish now uses an NPM_ID_TOKEN only if its aud claim matches the selected registry, such as npm:registry.npmjs.org. A token for another registry is skipped with a warning, and pnpm falls back to the configured credentials.

  • pnpm dist-tag add, rm, and ls now support OIDC authentication in CI. Enable "Allow npm dist-tag" in the package's trusted publishing settings to manage tags without a stored npm token.

  • Added the tool: protocol for the tools pnpm downloads itself: Node.js, Bun, Deno, and Yarn. pnpm add bun@tool:1.3.0, pnx node@tool:22, and pnx yarn@tool:4 work like the runtime: spelling, which stays supported as an alias. A lockfile written for runtime: stays up to date when package.json switches to tool:, and the other way around.

    A named registry can no longer be called tool.

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude

v12.12.0: pnpm 12.12.0

Compare Source

This release shares task results and dependency builds through a remote cache, adds the addMissingPeerTypes setting, and lets pnpm add --config and pnpm update manage configuration dependencies. It also fixes dangerouslyAllowAllBuilds running the build scripts of packages that allowBuilds denies.

Minor Changes

  • pnpm pipeline can share task results between machines. A result is a signed artifact stored on a pnpr server or on a server that speaks the Turborepo Remote Cache API, such as Vercel Remote Cache.

    The remote side-effects cache can also store dependency builds on a Turborepo Remote Cache server. Both caches read the new remoteCache setting, which names the server and holds the signing keys. pnpm pipeline --report records the run under the organization remoteCache.org names.

  • Added the addMissingPeerTypes setting, which links the @types package of a peer dependency next to every package that peer-depends on it. For example, a package that peer-depends on react gets the project's @types/react linked next to it. This lets TypeScript find the types of a peer dependency when the global virtual store is on #​15689.

  • pnpm add --config and pnpm update now handle configuration dependencies the way they handle other dependencies [#​16814](https://redire

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changeset-bot

changeset-bot Bot commented Oct 16, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: c2eb7ea

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate
renovate Bot merged commit 982a82d into master Oct 16, 2026
2 checks passed
@renovate
renovate Bot deleted the renovate/all-minor-patch branch October 16, 2026 17:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants