chore(deps): bump the astro-stack group in /website with 4 updates by dependabot[bot] · Pull Request #34 · pierow2k/morphace

dependabot · 2026-11-05T15:45:38Z

Bumps the astro-stack group in /website with 4 updates: @astrojs/cloudflare, @astrojs/starlight, astro and wrangler.

Updates @astrojs/cloudflare from 14.4.2 to 14.4.4

Release notes

Sourced from @astrojs/cloudflare's releases.

@astrojs/cloudflare@14.4.4

Patch Changes

#18552 549f88e Thanks @astro-factory! - Fixes a dev dependency scan error caused by object keys named import in frontmatter, such as the import option of import.meta.glob()

Updated dependencies []:

@astrojs/underscore-redirects@1.0.4

@astrojs/cloudflare@14.4.3

Patch Changes

#18526 d0504c2 Thanks @astro-factory! - Fixes process is not defined errors in client-side scripts and islands that reference process.env. The adapter's process.env define now applies only to the server output, so browser builds get Vite's default replacement.

Updated dependencies []:

@astrojs/underscore-redirects@1.0.4

Changelog

Sourced from @astrojs/cloudflare's changelog.

14.4.4

Patch Changes

#18552 549f88e Thanks @astro-factory! - Fixes a dev dependency scan error caused by object keys named import in frontmatter, such as the import option of import.meta.glob()

Updated dependencies []:

@astrojs/underscore-redirects@1.0.4

14.4.3

Patch Changes

#18526 d0504c2 Thanks @astro-factory! - Fixes process is not defined errors in client-side scripts and islands that reference process.env. The adapter's process.env define now applies only to the server output, so browser builds get Vite's default replacement.

Updated dependencies []:

@astrojs/underscore-redirects@1.0.4

Commits

d354ffb [ci] release (#18547)
549f88e fix(cloudflare): don't hoist object keys named import in frontmatter dep sc...
fda754d [ci] release (#18478)
d0504c2 fix(cloudflare): scope process.env define to server environments so client bu...
3773941 Restore CSS tree-shaking for unused barrel-imported Astro components (#18493)
See full diff in compare view

Updates @astrojs/starlight from 0.42.7 to 0.42.8

Release notes

Sourced from @astrojs/starlight's releases.

@astrojs/starlight@0.42.8

Patch Changes

#4309 3490c80 Thanks @athulsreekumar! - Fixes autogenerated sidebar groups omitting directories whose names match Object.prototype properties, such as constructor or toString

#4290 bf93823 Thanks @RaphaelFakhri! - Fixes missing last-updated dates in production builds for pages whose file path contains special characters

#4295 af9557e Thanks @delucis! - Fixes a formatting issue in some error messages impacting projects with Zod ≥4.5 installed

#4299 a103f38 Thanks @clean99! - Fixes empty sidebars when autogenerating entries from the docs root directory using directory: ''

Changelog

Sourced from @astrojs/starlight's changelog.

0.42.8

Patch Changes

#4309 3490c80 Thanks @athulsreekumar! - Fixes autogenerated sidebar groups omitting directories whose names match Object.prototype properties, such as constructor or toString

#4290 bf93823 Thanks @RaphaelFakhri! - Fixes missing last-updated dates in production builds for pages whose file path contains special characters

#4295 af9557e Thanks @delucis! - Fixes a formatting issue in some error messages impacting projects with Zod ≥4.5 installed

#4299 a103f38 Thanks @clean99! - Fixes empty sidebars when autogenerating entries from the docs root directory using directory: ''

Commits

6c9ca43 [ci] release (#4298)
3490c80 Fix Object.prototype property names in autogenerated sidebars (#4309)
bf93823 Fix last updated dates for file paths containing special characters (#4290)
a103f38 Fix sidebar autogeneration from the docs root directory (#4299)
af9557e Fix error map issue with Zod ≥4.5 (#4295)
See full diff in compare view

Updates astro from 7.4.2 to 7.4.5

Release notes

Sourced from astro's releases.

astro@7.4.5

Patch Changes

#18558 fac3c50 Thanks @astro-factory! - Fixes astro dev status and other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process

#18559 10dae2f Thanks @astro-factory! - Fixes import.meta.env values containing $ sequences (such as $$ or $&) being corrupted in astro build when server code reads the import.meta.env object directly, for example with const { MY_SECRET } = import.meta.env

#18544 e3bec3d Thanks @skezo! - Fixes request paths with invalid percent-encoding (e.g. /%C0%AF or a bare %) being logged as an Invalid URL encoding error and routed with the undecoded path. These requests now return a 400, the same as a path that is encoded too many times.

#18520 e023aba Thanks @matthewp! - Makes rendering of string tag names stricter and consistent across .astro dynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as / or = can no longer change the generated markup. A string that does not start with a valid element name (for example '!--' or '') now throws an error instead of producing invalid HTML.

astro@7.4.4

Patch Changes

#18344 df838da Thanks @edmundhung! - Allows astro add to configure tagged versions of official adapters

astro@7.4.4-beta.0

Patch Changes

#18539 db62f3b Thanks @matthewp! - Allows astro add to configure tagged versions of official adapters

astro@7.4.3

Patch Changes

#18488 e4e25fa Thanks @umeraamir69! - CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string into script-src and style-src.

#18500 e5a3a1b Thanks @astro-factory! - Fixes <Image> and <Picture> emitting duplicate srcset candidates when densities contains equivalent values such as 1 and '1x'

#18517 c3185b7 Thanks @okxint! - Fix unhandled AbortError rejection when ClientRouter skips a pending view transition

#18497 c712113 Thanks @astro-factory! - Fixes an uncaught TypeError in the browser when a server:defer island request fails due to a network error. The fallback content is kept, as it is for non-200 responses.

#18525 d0240b9 Thanks @astro-factory! - Fixes a DEP0190 deprecation warning printed by astro info on Node.js 24 and later

#18522 776b9a6 Thanks @astro-factory! - Fixes memoryCache() serving an empty body for cached pages that return an empty 404 or 500 response. These responses now render the 404 or 500 error page on every request.

#18511 d060ff9 Thanks @astro-factory! - Fixes transition:name styles missing in dev when the element is inside a component that is only rendered through another component with no styles or scripts

#18494 5fe699c Thanks @astro-factory! - Fixes the astro CLI refusing to run on StackBlitz by allowing Node.js >=22.22.0 inside WebContainers, whose Node.js version users cannot change

#18506 bf43a60 Thanks @astro-factory! - Fixes <ClientRouter /> animating scroll restoration on back/forward navigation when scroll-behavior: smooth is set. Saved scroll positions are now restored instantly, matching the browser's native behavior.

#18476 8ea79a2 Thanks @astro-factory! - Fixes a DataCloneError crash when building pages that render SVG imports with <Image /> or getImage() while experimental.parallelPrerender is enabled.

#18504 6dbd737 Thanks @astro-factory! - Fixes <Picture> emitting a duplicate 1x candidate in <source> srcset when densities includes 1

#18524 7524889 Thanks @astro-factory! - Fixes type errors reported in Astro's built-in <Image />, <Picture />, <Code />, <Debug /> and <ClientRouter /> components when type-checking a project that extends astro/tsconfigs/strictest with tsc and @astrojs/ts-content-mapper

#18493 3773941 Thanks @astro-factory! - Fixes scoped styles of unused Astro components being included in the build when those components are re-exported from a barrel file

... (truncated)

Changelog

Sourced from astro's changelog.

7.4.5

Patch Changes

#18558 fac3c50 Thanks @astro-factory! - Fixes astro dev status and other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process

#18559 10dae2f Thanks @astro-factory! - Fixes import.meta.env values containing $ sequences (such as $$ or $&) being corrupted in astro build when server code reads the import.meta.env object directly, for example with const { MY_SECRET } = import.meta.env

#18544 e3bec3d Thanks @skezo! - Fixes request paths with invalid percent-encoding (e.g. /%C0%AF or a bare %) being logged as an Invalid URL encoding error and routed with the undecoded path. These requests now return a 400, the same as a path that is encoded too many times.

#18520 e023aba Thanks @matthewp! - Makes rendering of string tag names stricter and consistent across .astro dynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as / or = can no longer change the generated markup. A string that does not start with a valid element name (for example '!--' or '') now throws an error instead of producing invalid HTML.

7.4.4

Patch Changes

#18344 df838da Thanks @edmundhung! - Allows astro add to configure tagged versions of official adapters

7.4.3

Patch Changes

#18488 e4e25fa Thanks @umeraamir69! - CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string into script-src and style-src.

#18500 e5a3a1b Thanks @astro-factory! - Fixes <Image> and <Picture> emitting duplicate srcset candidates when densities contains equivalent values such as 1 and '1x'

#18517 c3185b7 Thanks @okxint! - Fix unhandled AbortError rejection when ClientRouter skips a pending view transition

#18497 c712113 Thanks @astro-factory! - Fixes an uncaught TypeError in the browser when a server:defer island request fails due to a network error. The fallback content is kept, as it is for non-200 responses.

#18525 d0240b9 Thanks @astro-factory! - Fixes a DEP0190 deprecation warning printed by astro info on Node.js 24 and later

#18522 776b9a6 Thanks @astro-factory! - Fixes memoryCache() serving an empty body for cached pages that return an empty 404 or 500 response. These responses now render the 404 or 500 error page on every request.

#18511 d060ff9 Thanks @astro-factory! - Fixes transition:name styles missing in dev when the element is inside a component that is only rendered through another component with no styles or scripts

#18494 5fe699c Thanks @astro-factory! - Fixes the astro CLI refusing to run on StackBlitz by allowing Node.js >=22.22.0 inside WebContainers, whose Node.js version users cannot change

#18506 bf43a60 Thanks @astro-factory! - Fixes <ClientRouter /> animating scroll restoration on back/forward navigation when scroll-behavior: smooth is set. Saved scroll positions are now restored instantly, matching the browser's native behavior.

#18476 8ea79a2 Thanks @astro-factory! - Fixes a DataCloneError crash when building pages that render SVG imports with <Image /> or getImage() while experimental.parallelPrerender is enabled.

#18504 6dbd737 Thanks @astro-factory! - Fixes <Picture> emitting a duplicate 1x candidate in <source> srcset when densities includes 1

#18524 7524889 Thanks @astro-factory! - Fixes type errors reported in Astro's built-in <Image />, <Picture />, <Code />, <Debug /> and <ClientRouter /> components when type-checking a project that extends astro/tsconfigs/strictest with tsc and @astrojs/ts-content-mapper

#18493 3773941 Thanks @astro-factory! - Fixes scoped styles of unused Astro components being included in the build when those components are re-exported from a barrel file

#18512 1151b9e Thanks @jp-knj! - Fixes CSP hashes added with Astro.csp from components rendered inside <body> being left out of the CSP <meta> element in static builds, including MDX pages

Updated dependencies [6cf3423, edfbf4a]:

... (truncated)

Commits

d354ffb [ci] release (#18547)
10dae2f fix(env): preserve $ in import.meta.env values when the env object is inlin...
fac3c50 Preserve dev server lock file when process signal check returns EPERM (#18558)
e023aba Make string tag name rendering stricter and consistent (#18520)
e3bec3d Reject request paths with invalid percent-encoding with a 400 (#18544)
883e672 [ci] release (#18540)
df838da astro add: configure tagged official adapters (#18344)
fda754d [ci] release (#18478)
776b9a6 Prevent memory cache from storing empty 404/500 responses that would be rerou...
d060ff9 Fix transition:name styles silently dropped in dev when component is nested u...
Additional commits viewable in compare view

Updates wrangler from 4.153.0 to 4.156.2

Release notes

Sourced from wrangler's releases.

wrangler@4.156.2

Patch Changes
#16642 d38cb02 Thanks @dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-02

Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

#16642 d38cb02 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20261101.1 ^5.20261102.1

workerd 1.20261101.1 1.20261102.1
#16623 51bbf8b Thanks @petebacondarwin! - Deprecate shared tooling helper exports from Miniflare

Miniflare continues to export getNodeCompat, NodeJSCompatMode, and getFreshSourceMapSupport for compatibility. These exports are deprecated and now use the implementations in @cloudflare/workers-utils. Add a dependency on that package and replace the Miniflare imports with:
import {
  getNodeCompat,
  type NodeJSCompatMode,
} from "@cloudflare/workers-utils/node-compat";
import { getFreshSourceMapSupport } from "@cloudflare/workers-utils/sourcemap";
Wrangler and the Cloudflare Vite and Vitest plugins now use the shared helpers directly. The helpers retain their behavior and can be imported without loading the Workers runtime.

The deprecated Miniflare exports will be removed in a later release, allowing downstream tools such as cf to migrate and release independently first.
#16531 e5b1798 Thanks @dario-piotrowicz! - Avoid unrelated route permission checks when comparing dashboard configuration

When a Worker was last updated from the dashboard, wrangler deploy and wrangler versions upload fetched route and custom-domain metadata even when the command could not change it. Wrangler now fetches only the route categories configured for deployment, allowing Worker-scoped Editor tokens to upload Workers without routes or custom domains.

Updated dependencies [d38cb02, d38cb02, 51bbf8b]:

miniflare@5.20261102.0-beta
wrangler@4.156.1

Patch Changes

#16594 effe4ed Thanks @jaeminbird! - Fix wrangler types --check reporting CRLF types files as out of date

When worker-configuration.d.ts was checked out with CRLF line endings (for example with Git's core.autocrlf=true, the default on Windows), the runtime header kept a trailing \r and never matched the expected header. wrangler types --check then always failed, wrangler dev always warned that the types might be out of date, and cached runtime types were never reused. Generated types files are now read with either line ending.

#16635 76e18a8 Thanks @dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-01

Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

... (truncated)

Commits

680666e Version Packages (#16646)
e5b1798 Avoid unrelated route permission checks when comparing dashboard configuratio...
51bbf8b [miniflare] Move shared tooling helpers to workers-utils (#16623)
1598fd3 [vitest-plugin] Support cloudflare.config.ts with the new config option (#16424)
ca55031 Version Packages (#16598)
2667a9f [wrangler] Fix Pages Functions middleware routing for repeated slashes (#16603)
5740867 [wrangler] Enforce the Pages development asset directory boundary (#16535)
d174de8 [wrangler] Deploy the requested directory for delegated pages deploy (#16366)
effe4ed [wrangler] Fix wrangler types --check reporting CRLF types files as out of ...
b1ced56 Version Packages (#16556)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the astro-stack group in /website with 4 updates: [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare), [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight), [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) and [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler). Updates `@astrojs/cloudflare` from 14.4.2 to 14.4.4 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@14.4.4/packages/integrations/cloudflare) Updates `@astrojs/starlight` from 0.42.7 to 0.42.8 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.42.8/packages/starlight) Updates `astro` from 7.4.2 to 7.4.5 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.4.5/packages/astro) Updates `wrangler` from 4.153.0 to 4.156.2 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.156.2/packages/wrangler) --- updated-dependencies: - dependency-name: "@astrojs/cloudflare" dependency-version: 14.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: astro-stack - dependency-name: "@astrojs/starlight" dependency-version: 0.42.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: astro-stack - dependency-name: astro dependency-version: 7.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: astro-stack - dependency-name: wrangler dependency-version: 4.156.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: astro-stack ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-11-05T15:46:43Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	morphace	`c0d6660`	Commit Preview URL Branch Preview URL	Nov 05 2026, 03:47 PM

codacy-production · 2026-11-05T15:47:37Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 5, 2026

github-actions Bot enabled auto-merge (squash) November 5, 2026 15:45

github-actions Bot merged commit ba2cc0d into main Nov 5, 2026
10 of 11 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/website/astro-stack-686bb9d3c5 branch November 5, 2026 15:47

Navigation Menu

Repository navigation

chore(deps): bump the astro-stack group in /website with 4 updates - #34

chore(deps): bump the astro-stack group in /website with 4 updates#34
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/website/astro-stack-686bb9d3c5

dependabot Bot commented on behalf of github Nov 5, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Nov 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

codacy-production Bot commented Nov 5, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Dependency	From	To
`@cloudflare/workers-types`	^5.20261101.1	^5.20261102.1
workerd	1.20261101.1	1.20261102.1

Conversation

dependabot Bot commented on behalf of github Nov 5, 2026

@​astrojs/cloudflare@​14.4.4

Patch Changes

@​astrojs/cloudflare@​14.4.3

Patch Changes

14.4.4

Patch Changes

14.4.3

Patch Changes

@​astrojs/starlight@​0.42.8

Patch Changes

0.42.8

Patch Changes

astro@7.4.5

Patch Changes

astro@7.4.4

Patch Changes

astro@7.4.4-beta.0

Patch Changes

astro@7.4.3

Patch Changes

7.4.5

Patch Changes

7.4.4

Patch Changes

7.4.3

Patch Changes

wrangler@4.156.2

Patch Changes

wrangler@4.156.1

Patch Changes

Uh oh!

cloudflare-workers-and-pages Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

Uh oh!

codacy-production Bot commented Nov 5, 2026

Up to standards ✅

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`@astrojs/cloudflare@14`.4.4

`@astrojs/cloudflare@14`.4.3

`@astrojs/starlight@0`.42.8

cloudflare-workers-and-pages Bot commented Nov 5, 2026 •

edited

Loading