chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
astro (source)	7.1.6 → 7.2.0
globals	17.8.0 → 17.9.0
pnpm (source)	11.18.0 → 11.20.0
typescript-eslint (source)	8.65.0 → 8.66.0
vite (source)	8.2.0 → 8.2.1

---

Release Notes

withastro/astro (astro)

v7.2.0

Compare Source

Minor Changes

• #​17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

  This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

  astro preview --background

  When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

  astro preview status
  astro preview logs
  astro preview logs --follow
  astro preview stop

  If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

  To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

• #​17532 7f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

  Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  
  export default defineConfig({
    logger: {
  -    entrypoint: new URL('./src/logger.js', import.meta.url),
  +    entrypoint: './src/logger.js',
    },
  });

  Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

• #​17084 961bbe5 Thanks @​matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

  A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

  import type { AstroPrerenderer, PrerenderResult } from 'astro';
  
  const prerenderer: AstroPrerenderer = {
    name: 'my-adapter:prerenderer',
    getStaticPaths,
    async render(request, { routeData }): Promise<PrerenderResult> {
      const { response, metadata } = await renderInRuntime(request, routeData);
      return { response, metadata };
    },
  };

  This is a non-breaking widening: prerenderers that return a bare Response continue to work unchanged, and in-process prerenderers can keep returning a Response since the build collects their metadata directly.

• #​16871 90c98ae Thanks @​adamchal! - Adds session: false in astro.config to opt out of session support. Projects that do not set session: false see no behavior change.

  import { defineConfig } from 'astro/config';
  
  export default defineConfig({
    session: false,
  });

  The session runtime and dependencies (unstorage) are now tree-shaken out of the SSR bundle for any project where no session driver is wired via:

  • session: false
  • no session config at all
  • a session config without a driver

  Useful for serverless/edge runtimes where cold-start parse time is sensitive.

• #​17084 961bbe5 Thanks @​matthewp! - Adds experimental support for incremental static builds with experimental.incrementalBuild.

  When enabled, Astro can skip regenerating static pages from dynamic routes when both the page's module dependencies and its data cache key are unchanged from the previous build. This currently applies to pages returned from getStaticPaths() that include a cacheKey.

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  
  export default defineConfig({
    experimental: {
      incrementalBuild: true,
    },
  });

  Return a cacheKey for each generated page from getStaticPaths():

  ---
  export async function getStaticPaths() {
    const posts = await fetchPosts();
  
    return posts.map((post) => ({
      params: { slug: post.slug },
      props: { post },
      cacheKey: post.digest,
    }));
  }
  ---

  For incremental builds to skip rendering in CI, Astro's cache directory must be preserved between builds. Astro empties the output directory on each build and restores skipped pages from the cache directory, so only that directory needs to persist. For the default config, cache and restore node_modules/.astro/ before running astro build.

  See the experimental incremental static builds documentation for more information.

• #​17084 961bbe5 Thanks @​matthewp! - Adds the optional digest property to content collection entries.

  Loaders can provide an opaque digest value that changes when an entry changes. This is now reflected in the CollectionEntry type returned by getCollection() and getEntry(), making it easier to detect content changes without re-hashing large entry bodies.

  ---
  import { getCollection } from 'astro:content';
  
  const posts = await getCollection('blog');
  
  for (const post of posts) {
    console.log(post.digest);
  }
  ---

  The property is optional because not every loader provides a digest. See incremental static builds for how digest can be used as a cacheKey.

Patch Changes

• #​17534 5a5337e Thanks @​florian-lefebvre! - Improves logger.entrypoint reference docs

• #​17529 d52a787 Thanks @​QVinto! - Fixes astro dev crashing with Invalid URL when --host is set to a specific non-loopback address

  Vite only reports a local URL for loopback hosts. When the dev server was started with --host <custom-address> bound to a specific non-loopback address (a LAN or Tailscale IP, for example), the URL was reported under network and local was empty, so writing the dev lock file threw Invalid URL and killed a server that had already started successfully.

  The lock file URL now falls back to the network URL, and a server that exposes no URL at all is left untracked rather than being taken down by lock file bookkeeping.

• #​17566 296248c Thanks @​astrobot-houston! - Fixes fontProviders.googleicons() returning the full icon font (~3.9MB) instead of only the requested glyphs when multiple experimental.glyphs are specified

• #​17560 ef45de1 Thanks @​astrobot-houston! - Fixes Astro.url.pathname for non-index pages when using build.format: 'preserve'. Previously, a page like src/pages/about-me.astro would output to dist/about-me.html but Astro.url.pathname would incorrectly return /about-me/ instead of /about-me.html.

• #​17573 0089f83 Thanks @​astrobot-houston! - Fixes a Content Layer build crash that could occur when another dependency causes an older version of neotraverse to be hoisted to the project root

• #​17571 116f700 Thanks @​astrobot-houston! - Fixes cookies set via Astro.cookies.set() inside a custom 404.astro or 500.astro error page being silently dropped from the final response

• #​17579 3ea55ce Thanks @​bluwy! - Supports the devEngines field in package.json when detecting the package manager for install commands

• #​17422 e4e2037 Thanks @​jiwonyoon-dev! - Fixes popover being rendered as popover="true"/popover="false" on custom elements (tag names containing a hyphen). Per the Popover API, the attribute only accepts "auto", "manual", or being absent, so boolean values are now always rendered as a bare popover attribute (or omitted), regardless of the tag name.

sindresorhus/globals (globals)

v17.9.0

Compare Source

pnpm/pnpm (pnpm)

v11.20.0: pnpm 11.20

Compare Source

Minor Changes

• Security fix. Affects projects using namedRegistries on pnpm 11.1.0–11.19.x. It is semi-breaking for those projects — see "If you use named registries" below.

  The lockfile recorded no marker for which registry a package came from. Packages were keyed by name@version alone, and entry lookup went through refToRelative(ref, name), so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single packages: entry and whichever resolved first decided the tarball every consumer got.

  That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell.

  Packages resolved from a named registry are now recorded under registry-qualified keys (<name>@<registryName>:<version>, e.g. foo@work:1.0.0), so each registry gets its own entry and the lockfile pins which one a dependency came from.

  The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use namedRegistries sees no difference, and older pnpm versions keep reading the file.

If you use named registries

Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating.

Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a current pnpm re-qualifies them. The result is a lockfile that flips back and forth, and while it is in the old shape the project is exposed again. Because the lockfile format version is deliberately unchanged, pnpm cannot detect this and warn you about it.

There is no setting to keep the old behavior: the old shape is the vulnerability.

Tarball URLs that follow the standard registry layout are no longer written to the lockfile for named-registry packages; they are recomputed from the namedRegistries setting on demand.

To use named registries, map your aliases in pnpm-workspace.yaml:

namedRegistries:
  work: https://npm.enterprise.example.com/

New built-in npmjs: alias

npmjs: now resolves to https://registry.npmjs.org/ with no configuration, alongside the existing gh: alias for GitHub Packages. It pins a dependency to the public registry even when registry points elsewhere, such as an internal proxy:

{ "dependencies": { "left-pad": "npmjs:^1.3.0" } }

npm: cannot do this — it is the alias protocol (npm:<name>@<range>) and resolves through whatever registry points at.

If you mirror or proxy npmjs, point the alias at your mirror:

namedRegistries:
  npmjs: https://npm.internal.example.com/

Built-in registry URLs are also the prefixes a lockfile's recorded tarball URL is matched against when pnpm verifies a package. Without the override, an entry whose tarball URL is on registry.npmjs.org is verified against the public registry rather than your mirror. This only affects lockfiles that record such URLs — a canonical URL for your configured registry is omitted from the lockfile and unaffected — and only when a tarball-URL, minimumReleaseAge, or trustPolicy check runs. Overriding the alias is the same escape hatch GHES users already have for gh.

Every alias the lockfile references must stay in namedRegistries: reading an entry whose alias is gone fails with ERR_PNPM_MISSING_NAMED_REGISTRY rather than silently falling back to the default registry, since that would fetch a different package. Renaming an alias re-resolves the packages that used it.

Named registry aliases that shadow a reserved dependency specifier prefix (file, link, workspace, runtime, npm, jsr, ...) are now rejected with ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME instead of being silently shadowed by the corresponding resolver.

pnpm licenses and pnpm sbom now keep the two artifacts apart as well: license records carry the registry alias, and SBOM components carry the purl repository_url qualifier.

Patch Changes

• An empty http-proxy, https-proxy, proxy, or no-proxy value — from the .npmrc, pnpm-workspace.yaml, the CLI, or the HTTP_PROXY / HTTPS_PROXY / PROXY / NO_PROXY environment variables — no longer fails the install with ERR_PNPM_INVALID_PROXY. Empty settings read as unset, so a shell exporting HTTP_PROXY= disables the proxy, and an empty proxy= in the .npmrc no longer suppresses HTTPS_PROXY #​13533.

  proxy=false in the .npmrc or proxy: false in pnpm-workspace.yaml now turns proxying off instead of being read as a proxy host named false. false and null on https-proxy / http-proxy / no-proxy read as unset, and on the command line they are ordinary host names, since a flag carries its value verbatim.

• The env lockfile no longer pins @pnpm/exe alongside pnpm when the wanted pnpm version is 12 or newer. From v12 the unscoped pnpm package is itself the native executable, so @pnpm/exe is not published for it and resolving it would fail. The engine identity check now verifies the native binary through whichever package ships it.

• lexCompare and nerfDart are now published as @pnpm/text.ordinal-comparator and @pnpm/config.registry-auth-key. Use these instead of @pnpm/util.lex-comparator and @pnpm/config.nerf-dart.

• Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs. Two registry URLs of equal length were previously ordered arbitrarily, so which one a tarball URL matched could differ between runs.

• Dependency resolution is faster: package metadata is now filtered once per packument instead of once per dependency edge when minimumReleaseAge is active, and parsed semver versions and ranges are reused instead of re-parsed on every comparison.

• Security: pnpm rebuild now refuses a lockfile whose packages key carries a path traversal in the package name (e.g. ../../../escaped@1.0.0), instead of running that package's lifecycle scripts and linking its bins in a directory outside the virtual store. Such a name is rejected with ERR_PNPM_INVALID_DEPENDENCY_NAME.

Platinum Sponsors

Gold Sponsors

v11.19.0: pnpm 11.19

Compare Source

Minor Changes

• pnpm login no longer requires an interactive terminal when the registry supports web-based login: without a TTY it prints the authentication URL (skipping the QR code and the "Press ENTER to open the URL in your browser" prompt) and polls the registry until the browser approval completes. Only the classic username/password login still fails with ERR_PNPM_LOGIN_NON_INTERACTIVE in a non-interactive terminal.

• The save-prefix setting now accepts =: newly added dependencies are saved with an explicit = operator (=1.2.3) instead of the setting being silently treated as the default ^.

Patch Changes

• allowBuilds entries can now approve git-hosted packages that pnpm downloads as a tarball, such as github: dependencies (which are fetched from codeload.github.com rather than cloned), by their repository URL without the resolved commit hash. This matches the hashless git+ matching already supported for cloned git dependencies. For example:

  allowBuilds:
    "foo@git+https://github.com/org/foo.git": true

  This approves the package whether pnpm clones it or downloads a tarball, so the entry no longer has to be updated every time the pinned commit changes. GitLab and Bitbucket tarball downloads are matched the same way. Approving or denying a specific resolved commit by its full tarball dep path continues to work.

• pnpm outdated --include-github-actions no longer blocks on an interactive git credential prompt when a workflow uses a private action repo.

• Prevented minimumReleaseAge from replacing latest with a SemVer-greater version than the registry tag target #​13034.

• Fixed empty bundledDependencies and bundleDependencies arrays causing nondeterministic lockfile changes. See #​13123.

• The install summary no longer prints (X is available) when the registry's dist-tags.latest is still held back by the active minimumReleaseAge policy. The hint only ever names the actual latest tag, so an immature latest suppresses the hint instead of advertising the version pnpm just refused to install #​11698.

• pnpm update keeps the explicit = operator of an exact version pin: a dependency saved as =3.5.1 now updates to =3.5.2 instead of the bare 3.5.2. See #​13168.

• Preserve a workspace dependency's link: entry when a run does not target it — e.g. pnpm update <other-pkg> (with or without --recursive), or a plain install after a root/catalog dependency change — with injectWorkspacePackages, instead of spuriously rewriting it to a peer-suffixed file: protocol. See #​10433.

• Workspace dependencies declared with a relative path (e.g. "foo": "workspace:../foo") are no longer silently dropped from the workspace projects graph, so --filter selection and the topological order of recursive commands take them into account.

Platinum Sponsors

Gold Sponsors

typescript-eslint/typescript-eslint (typescript-eslint)

v8.66.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

vitejs/vite (vite)

v8.2.1

Compare Source

Bug Fixes

• build: make client chunkImportMap work with sharedPlugins: true (#​23184) (15f0307)
• bundled-dev: inject client script tag before chunk scripts (#​23161) (eac0cc8)
• css: don't re-run lightningcss visitor during minify (fix #​23146) (#​23147) (de041a7)
• deps: update all non-major dependencies (#​23136) (14454fd)
• deps: update rolldown-related dependencies (#​23070) (7ac6f7f)
• don't mutate the user config when resolving the lib entry from the top-level input (#​23135) (b4bf596)
• handle shebang ending with uncommon line terminators (#​23038) (17f7b2f)
• server: use a random port when port is 0 (#​23158) (fddf4ea)

Performance Improvements

• css: look up pure CSS chunks through a Set (#​23114) (1331b0b)

Documentation

• build: fix incomplete @default for build.minify (#​23177) (ef02435)

Miscellaneous Chores

• deps: update dependency rolldown-plugin-dts to ^0.28.0 (#​23137) (4adc1e7)
• deps: update dependency strip-literal to v4 (#​23140) (9db65ce)

Code Refactoring

• bundled-dev: avoid injecting server values in the bundle (#​22967) (23b8a08)
• bundled-dev: remove rolldown lazy stub module workaround (#​23129) (e72036e)

Tests

• bundled-dev: enable sourcemap playgrounds (#​23080) (c2155fe)
• reduce logs (#​23138) (7673c02)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5c682cc

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.53%. Comparing base (ce37fb2) to head (cf94888).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #241   +/-   ##
=======================================
  Coverage   87.53%   87.53%           
=======================================
  Files          18       18           
  Lines         409      409           
  Branches       90       90           
=======================================
  Hits          358      358           
  Misses         51       51           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.