chore(deps): bump the production-dependencies group across 1 directory with 42 updates

[dependabot]

Bumps the production-dependencies group with 42 updates in the / directory:

Package	From	To
typescript	6.0.3	7.0.2
@astrojs/cloudflare	14.1.4	14.3.2
@hugeicons/core-free-icons	4.2.3	4.3.3
@sentry/browser	10.67.0	10.75.0
@tabler/icons	3.45.0	3.46.0
@tanstack/virtual-core	3.17.5	3.17.11
astro	7.1.3	7.3.3
posthog-js	1.405.3	1.434.0
tailwind-variants	3.2.2	3.3.1
@astrojs/react	6.0.1	6.0.6
@base-ui/react	1.6.0	1.8.0
@tanstack/react-virtual	3.14.7	3.14.13
lucide-react	1.25.0	1.47.0
react	19.2.7	19.3.0
react-dom	19.2.7	19.3.0
shadcn	4.13.1	4.21.0
sonner	2.0.7	2.0.8
tailwind-merge	3.6.0	3.7.0
@astrojs/starlight	0.41.3	0.42.1
sharp	0.35.3	0.35.4
three	0.185.1	0.186.0
@modelcontextprotocol/sdk	1.29.0	1.30.0
pg	8.22.0	8.23.0
@apidevtools/swagger-parser	12.1.0	13.0.0
@aws-sdk/client-s3	3.1091.0	3.1135.0
@babel/parser	8.0.4	8.0.5
@fastify/busboy	3.2.0	3.2.2
@hono/mcp	0.3.1	0.3.2
@hono/node-server	2.0.11	2.1.1
@hono/zod-openapi	1.5.1	1.6.3
@libsql/client	0.17.4	0.18.0
@sentry/bun	10.67.0	10.75.0
@sentry/node	10.67.0	10.75.0
@ungap/structured-clone	1.3.3	1.4.0
add-mcp	1.13.0	2.4.0
hono	4.12.31	4.13.8
posthog-node	5.46.0	5.52.4
whatwg-url	17.1.0	17.1.1
ws	8.21.1	8.21.3
yaml	2.9.0	2.9.1
zod	4.4.3	4.6.5
@astrojs/language-server	2.16.12	2.17.0

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates @astrojs/cloudflare from 14.1.4 to 14.3.2

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.3.2

Patch Changes

• #17958 b95c574 Thanks @​astro-factory! - Fixes a build failure when the wrangler config uses the exports field to declare Durable Object classes

• #18022 24946f7 Thanks @​matthewp! - Fixes cold astro dev crashes when using the passthrough image service

• #17842 d68db73 Thanks @​adamchal! - Fixes broken images on static sites by transforming prerendered images at build time with the default Cloudflare Images binding

• #17945 750b4db Thanks @​matthewp! - Pre-bundles renderer server entrypoints and the default console logger during dev so they are included in the initial optimization pass, preventing a mid-request re-optimization that could crash the dev server on Cloudflare (workerd).

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.3.1

Patch Changes

• #17914 a400504 Thanks @​astro-factory! - Fixes a build crash when a custom worker entrypoint exports Durable Object classes alongside prerendered pages. The prerender worker no longer inherits durable_objects, migrations, or workflows from the entry worker config.

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.3.0

Minor Changes

• #17795 15e2deb Thanks @​matthewp! - Adds concurrent rendering support for experimental.incrementalBuild, including when using @astrojs/cloudflare

  Incremental builds no longer disable caching when build.concurrency is greater than 1. Projects that set build.concurrency: 1 to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.

• #17887 35aa62e Thanks @​matthewp! - Adds a Cloudflare finalize() response handler for custom request handlers

  Call finalize() to apply cookies and Cloudflare CDN cache defaults to the response from an astro/fetch pipeline:

  import { astro, FetchState } from 'astro/fetch';
  import { cf, finalize } from '@astrojs/cloudflare/fetch';
  export default {
  async fetch(request: Request, env: Env, context: ExecutionContext) {
  const state = new FetchState(request);
  const asset = await cf(state, env, context);
  if (asset) return asset;
  return finalize(state, await astro(state));
  
  },
  };

  The @astrojs/cloudflare/hono middleware applies these response headers automatically. Cloudflare custom entrypoints also fall back to static assets when no Astro route matches and use the default server entrypoint when prerendering through workerd.

Patch Changes

... (truncated)

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.3.2

Patch Changes

• #17958 b95c574 Thanks @​astro-factory! - Fixes a build failure when the wrangler config uses the exports field to declare Durable Object classes

• #18022 24946f7 Thanks @​matthewp! - Fixes cold astro dev crashes when using the passthrough image service

• #17842 d68db73 Thanks @​adamchal! - Fixes broken images on static sites by transforming prerendered images at build time with the default Cloudflare Images binding

• #17945 750b4db Thanks @​matthewp! - Pre-bundles renderer server entrypoints and the default console logger during dev so they are included in the initial optimization pass, preventing a mid-request re-optimization that could crash the dev server on Cloudflare (workerd).

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

14.3.1

Patch Changes

• #17914 a400504 Thanks @​astro-factory! - Fixes a build crash when a custom worker entrypoint exports Durable Object classes alongside prerendered pages. The prerender worker no longer inherits durable_objects, migrations, or workflows from the entry worker config.

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

14.3.0

Minor Changes

• #17795 15e2deb Thanks @​matthewp! - Adds concurrent rendering support for experimental.incrementalBuild, including when using @astrojs/cloudflare

  Incremental builds no longer disable caching when build.concurrency is greater than 1. Projects that set build.concurrency: 1 to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.

• #17887 35aa62e Thanks @​matthewp! - Adds a Cloudflare finalize() response handler for custom request handlers

  Call finalize() to apply cookies and Cloudflare CDN cache defaults to the response from an astro/fetch pipeline:

  import { astro, FetchState } from 'astro/fetch';
  import { cf, finalize } from '@astrojs/cloudflare/fetch';
  export default {
  async fetch(request: Request, env: Env, context: ExecutionContext) {
  const state = new FetchState(request);
  const asset = await cf(state, env, context);
  if (asset) return asset;
  return finalize(state, await astro(state));
  
  },
  };

... (truncated)

Commits

• 8a3106e [ci] release (#17939)
• 24946f7 Pre-bundle the Cloudflare passthrough image service (#18022)
• 558b301 Fix prerendered Cloudflare pages rendering as [object Object] with nodejs_com...
• d68db73 Compile images by default with Cloudflare adapter (#17842)
• b95c574 fix(cloudflare): exclude exports field from prerender worker config (#17957...
• 750b4db Pre-bundle renderer server entrypoints and the default logger to stop Cloudfl...
• 2fc7ce9 Fix WebAssembly error when importing astro:actions in Cloudflare Vitest tests...
• aa4949e [ci] release (#17915)
• 4b92ddc Guard setFetchHandler call in non-runnable dev entrypoint to fix sessions + m...
• 9870f95 [ci] format
• Additional commits viewable in compare view

Updates @hugeicons/core-free-icons from 4.2.3 to 4.3.3

Commits

• See full diff in compare view

Updates @sentry/browser from 10.67.0 to 10.75.0

Release notes

Sourced from @​sentry/browser's releases.

10.75.0

Important Changes

• feat(v10/effect): Capture errors through the Effect v4 ErrorReporter API (#24445)

  On Effect v4, Sentry.effectLayer now registers a Sentry ErrorReporter. Failures that pass through Effect.withErrorReporting, ErrorReporter.report or the built-in HTTP and RPC reporting boundaries are captured automatically, with ErrorReporter.ignore, ErrorReporter.severity and ErrorReporter.attributes annotations respected. Nothing changes on Effect v3.

Other Changes

• feat(v10/core): Accept a CollectBehavior shorthand for dataCollection.httpHeaders (#24339)
• fix(v10/browser): Release the XHR virtualError once the request completed (#24307)
• fix(v10/browser-utils): Skip nullish LCP entries in vendored web-vitals (#24349)
• fix(v10/bundler-plugins): Stamp debug IDs onto emitted source maps when disable-upload is set (#24332)
• fix(v10/core): Don't instrument the SDK's own envelope requests (#24276)
• fix(v10/nextjs): Only include emitted chunk directories in Turbopack sourcemap upload (#24295)
• fix(v10/nitro): Import from nitro/h3 instead of h3 directly (#24444)
• fix(v10/node-core): Don't recurse in logAndExitProcess on a broken stdio pipe (#24353)
• fix(v10/nuxt): Detect Nitro version via the app's Nuxt dependency chain (#24025)
• fix(v10/replay): Don't rewrite already-emitted nodes when syncing mirror attributes (#23588)

Bundle size 📦

Path	Size
@​sentry/browser	27.18 KB
@​sentry/browser - with treeshaking flags	25.66 KB
@​sentry/browser (incl. Tracing)	45.6 KB
@​sentry/browser (incl. Tracing + Span Streaming)	47.34 KB
@​sentry/browser (incl. Tracing, Profiling)	50.24 KB
@​sentry/browser (incl. Tracing, Replay)	83.99 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	73.84 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	88.6 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	100.94 KB
@​sentry/browser (incl. Feedback)	43.94 KB
@​sentry/browser (incl. sendFeedback)	31.87 KB
@​sentry/browser (incl. FeedbackAsync)	36.88 KB
@​sentry/browser (incl. Metrics)	28.25 KB
@​sentry/browser (incl. Logs)	28.47 KB
@​sentry/browser (incl. Metrics & Logs)	29.15 KB
@​sentry/react	28.93 KB
@​sentry/react (incl. Tracing)	47.81 KB
@​sentry/vue	32.47 KB
@​sentry/vue (incl. Tracing)	47.55 KB
@​sentry/svelte	27.21 KB
CDN Bundle	29.53 KB
CDN Bundle (incl. Tracing)	47.52 KB
CDN Bundle (incl. Logs, Metrics)	31.07 KB
CDN Bundle (incl. Tracing, Logs, Metrics)	48.81 KB
CDN Bundle (incl. Replay, Logs, Metrics)	69.49 KB
CDN Bundle (incl. Tracing, Replay)	84.22 KB

... (truncated)

Changelog

Sourced from @​sentry/browser's changelog.

10.75.0

Important Changes

• feat(v10/effect): Capture errors through the Effect v4 ErrorReporter API (#24445)

  On Effect v4, Sentry.effectLayer now registers a Sentry ErrorReporter. Failures that pass through Effect.withErrorReporting, ErrorReporter.report or the built-in HTTP and RPC reporting boundaries are captured automatically, with ErrorReporter.ignore, ErrorReporter.severity and ErrorReporter.attributes annotations respected. Nothing changes on Effect v3.

Other Changes

• feat(v10/core): Accept a CollectBehavior shorthand for dataCollection.httpHeaders (#24339)
• fix(v10/browser): Release the XHR virtualError once the request completed (#24307)
• fix(v10/browser-utils): Skip nullish LCP entries in vendored web-vitals (#24349)
• fix(v10/bundler-plugins): Stamp debug IDs onto emitted source maps when disable-upload is set (#24332)
• fix(v10/core): Don't instrument the SDK's own envelope requests (#24276)
• fix(v10/nextjs): Only include emitted chunk directories in Turbopack sourcemap upload (#24295)
• fix(v10/nitro): Import from nitro/h3 instead of h3 directly (#24444)
• fix(v10/node-core): Don't recurse in logAndExitProcess on a broken stdio pipe (#24353)
• fix(v10/nuxt): Detect Nitro version via the app's Nuxt dependency chain (#24025)
• fix(v10/replay): Don't rewrite already-emitted nodes when syncing mirror attributes (#23588)

10.74.0

• feat(v10): Streamline isolation scope handling & reset in isolation scopes (#24152)
• fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (#23433)
• fix(v10/browser): Set user_agent.original on all spans for consistent filtering (#24226)
• fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entry (#24181)
• fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)
• fix(v10/core): Match wrapped Facebook Mobile browser errors in DEFAULT_IGNORE_ERRORS (#23877)
• fix(v10/core): Resolve MCP capture policy per operation (#23796)
• fix(v10/nextjs): Fix SDK import crashing under jsdom/happy-dom (#23906)
• fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundles (#24223)
• fix(v10/nextjs): Register Vercel AI span processors on Next.js (#23773)
• fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute for C:\ (#24026)
• fix(v10/profiling-node): Bump @​sentry/node-cpu-profiler to 2.4.4 (#24238)
• fix(v10/sveltekit): Handle SvelteKit 3 error kinds in handleErrorWithSentry (#23995)
• fix(v10/sveltekit): Read Cloudflare execution context from platform.ctx (#23994)
• fix(v10/sveltekit): Read SvelteKit config from the Vite plugin (#23998)

• test(e2e): Assert Next.js Cloudflare worker bundle stays free of orchestrion bundler plugins (#23910)

Work in this release was contributed by @​halillusion and @​zkasuran. Thank you for your contributions!

10.73.0

... (truncated)

Commits

• 9ffb58c release: 10.75.0
• 664c906 meta(changelog): Update changelog for 10.75.0 (#24446)
• e3e7acc fix(v10/nitro): Import from nitro/h3 instead of h3 directly (#24444)
• 4bb51d1 feat(v10/effect): Capture errors through the Effect v4 ErrorReporter API (#24...
• 738f17e fix(v10/core): Don't instrument the SDK's own envelope requests (#24276)
• f63c56a fix(v10/node-core): Don't recurse in logAndExitProcess on a broken stdio pipe...
• 0e24355 fix(v10/browser-utils): Skip nullish LCP entries in vendored web-vitals (#24349)
• ac3ea13 fix(v10/nuxt): Detect Nitro version via the app's Nuxt dependency chain (#24025)
• 9235d43 fix(v10/nextjs): Only include emitted chunk directories in Turbopack sourcema...
• e2deda0 feat(v10/core): Accept CollectBehavior shorthand for `dataCollection.httpHe...
• Additional commits viewable in compare view

Updates @tabler/icons from 3.45.0 to 3.46.0

Release notes

Sourced from @​tabler/icons's releases.

Release 3.46.0

18 new icons:

• outline/play-bug
• outline/play-bugs
• outline/remote-control
• outline/rocking-chair
• outline/run-sprint
• outline/sparkles-2-off
• outline/tabs
• outline/tags-chevron-down
• outline/tags-chevron-left
• outline/tags-chevron-right
• outline/tags-chevron-up
• outline/thinking-high
• outline/thinking-low
• outline/thinking-medium
• outline/treasure-chest
• outline/twig
• outline/vault
• outline/yarn

Fixed icons: outline/credits, outline/currency-tether, outline/device-3d-camera, outline/device-screen, outline/home-lock, outline/map-lock, outline/notdef, outline/queue-pop-in, outline/server-bolt, outline/server, outline/sparkles-2, outline/transform-point-bottom-left, outline/transform-point-bottom-right, outline/transform-point-top-left, outline/transform-point-top-right

Commits

• 8ac7d81 Release 3.46.0
• 2727ba9 Enhance release process in package.json: add GitHub authentication check and ...
• 4ff4802 Add npm login check before release-it initialization in package.json
• 74a7690 Merge branch 'main' of https://github.com/tabler/tabler-icons
• f828849 Update dependencies in package.json and pnpm-lock.yaml: remove @​release-it-pl...
• 1a39582 Fix rect width/height swap in optimize script (#1570)
• 54bac86 Secure PR validation: run fork code without privileges (#1569)
• eaaf32d Update Turbo package to version 2.10.7 and adjust schema reference in turbo.json
• 2cfcde7 Remove unused AI tag generation script and related package dependency from pr...
• be0e5a8 Refactor SVG paths for several icons to improve structure and consistency: `o...
• Additional commits viewable in compare view

Updates @tanstack/virtual-core from 3.17.5 to 3.17.11

Release notes

Sourced from @​tanstack/virtual-core's releases.

@​tanstack/virtual-core@​3.17.11

Patch Changes

• #1284 06d1b6b - Read the current scroll offset when the debounced scroll-end fallback fires so measurement adjustments made since the last browser scroll event are not overwritten by stale state.

• #1248 2c0a0ea - Keep a travelling smooth scrollToIndex alive when content is prepended. With anchorTo: 'end', the prepend anchor sync wrote scrollTop instantly, which cancelled the browser's smooth animation and left the scroll stranded partway; Chromium drops a smooth request re-issued right after such a cancel, so it could not be resumed. The sync is now skipped while a smooth programmatic scroll is still in flight, and the animation continues to its recomputed target. A smooth scroll that has already landed still receives the anchor sync.

@​tanstack/virtual-core@​3.17.10

Patch Changes

• #1272 ab3278c - Keep an end-pinned virtualizer following appended items when older items are trimmed in the same update and the item count does not increase. Recognize ordered, overlapping windows while preserving reading anchors for users who have scrolled away from the end.

  Preserve item keys in the lazy measurement cache so a stable getItemKey callback reading mutable data cannot change the identity of previously measured rows.

@​tanstack/virtual-core@​3.17.9

Patch Changes

• #1260 4a0adf3 - Recover the bottom pin when the browser clamps an end-anchored scroll compensation write. resizeItem compensates a size change by writing scrollTop before the consumer has committed the new total size, so when the grown item does not itself extend the scroll range the browser clamps the write to the old maximum and the viewport is left short of the end with no scroll event to correct it. Two cases hit this: paddingEnd > 0 with a growing last item, where the overflowing item only extends scrollHeight to its own end and the clamp lands exactly paddingEnd short (#1258); and a row above the last one growing while the last row keeps its size, under directDomUpdates (#1266). A compensation write whose target exceeds the scroll maximum at write time is now recorded as clamped and re-issued once the sizer has grown — right after notify for consumers that size the container synchronously in onChange, and from _willUpdate for consumers that size it during a render. The clamped read-back keeps the retry pending; any other scroll event cancels it, so a user reading history is never yanked.

@​tanstack/virtual-core@​3.17.8

Patch Changes

• #1256 a0a411e - Cancel the pending isScrolling reset when a scroll observer is torn down, and reset isScrolling and scrollDirection in cleanup() so they don't stay stuck after the scroll element changes or is removed.

• #1246 d2cf98b - Ignore connected measurement nodes whose indexes are outside the current item count.

@​tanstack/virtual-core@​3.17.7

Patch Changes

• #1239 a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

@​tanstack/virtual-core@​3.17.6

Patch Changes

• #1236 7ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.

Changelog

Sourced from @​tanstack/virtual-core's changelog.

3.17.11

Patch Changes

• #1284 06d1b6b - Read the current scroll offset when the debounced scroll-end fallback fires so measurement adjustments made since the last browser scroll event are not overwritten by stale state.

• #1248 2c0a0ea - Keep a travelling smooth scrollToIndex alive when content is prepended. With anchorTo: 'end', the prepend anchor sync wrote scrollTop instantly, which cancelled the browser's smooth animation and left the scroll stranded partway; Chromium drops a smooth request re-issued right after such a cancel, so it could not be resumed. The sync is now skipped while a smooth programmatic scroll is still in flight, and the animation continues to its recomputed target. A smooth scroll that has already landed still receives the anchor sync.

3.17.10

Patch Changes

• #1272 ab3278c - Keep an end-pinned virtualizer following appended items when older items are trimmed in the same update and the item count does not increase. Recognize ordered, overlapping windows while preserving reading anchors for users who have scrolled away from the end.

  Preserve item keys in the lazy measurement cache so a stable getItemKey callback reading mutable data cannot change the identity of previously measured rows.

3.17.9

Patch Changes

• #1260 4a0adf3 - Recover the bottom pin when the browser clamps an end-anchored scroll compensation write. resizeItem compensates a size change by writing scrollTop before the consumer has committed the new total size, so when the grown item does not itself extend the scroll range the browser clamps the write to the old maximum and the viewport is left short of the end with no scroll event to correct it. Two cases hit this: paddingEnd > 0 with a growing last item, where the overflowing item only extends scrollHeight to its own end and the clamp lands exactly paddingEnd short (#1258); and a row above the last one growing while the last row keeps its size, under directDomUpdates (#1266). A compensation write whose target exceeds the scroll maximum at write time is now recorded as clamped and re-issued once the sizer has grown — right after notify for consumers that size the container synchronously in onChange, and from _willUpdate for consumers that size it during a render. The clamped read-back keeps the retry pending; any other scroll event cancels it, so a user reading history is never yanked.

3.17.8

Patch Changes

• #1256 a0a411e - Cancel the pending isScrolling reset when a scroll observer is torn down, and reset isScrolling and scrollDirection in cleanup() so they don't stay stuck after the scroll element changes or is removed.

• #1246 d2cf98b - Ignore connected measurement nodes whose indexes are outside the current item count.

3.17.7

Patch Changes

• #1239 a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

3.17.6

Patch Changes

• #1236 7ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.

Commits

• 78371e8 ci: Version Packages (#1279)
• 06d1b6b fix(virtual-core): refresh offset in scroll-end fallback (#1284)
• 2c0a0ea fix(virtual-core): keep a travelling smooth scroll alive through a prepend (#...
• df47889 ci: Version Packages (#1277)
• ab3278c fix(virtual-core): preserve measurement keys and follow sliding windows (#1272)
• 171029d ci: Version Packages (#1269)
• 4a0adf3 fix(virtual-core): re-issue clamped end-anchor compensation once the sizer gr...
• e9874f0 ci: Version Packages (#1247)
• a0a411e fix(virtual-core): cancel the isScrolling debounce on scroll-observer cleanup...
• d2cf98b fix(virtual-core): ignore stale connected measurements (#1246)
• Additional commits viewable in compare view

Updates astro from 7.1.3 to 7.3.3

Release notes

Sourced from astro's releases.

astro@7.3.3

Patch Changes

• #17651 504333c Thanks @​sxzz! - Refactors internal version handling to use a smaller, ESM-native dependency

• #17942 0bc5715 Thanks @​matthewp! - Returns appropriate 400 and 404 responses from the image endpoint for invalid and missing local image paths

• #17700 b2222fc Thanks @​winklemad! - Fixes Astro.preferredLocaleList returning an empty list when a locale is configured with the object form ({ path, codes }) and the browser sends the code with different casing or an underscore, such as en-US matching a configured en-us

• #17941 394ff79 Thanks @​matthewp! - Fixes astro preview --ignore-lock (and astro dev --ignore-lock) being refused when run from an AI agent environment. The flag now starts the server in the foreground instead of erroring, since agent detection only inferred background mode and was never explicitly requested. An explicit --background combined with --ignore-lock still errors.

• #17928 3277927 Thanks @​ArmandPhilippot! - Fixes TypeScript autocompletion for getImage() to suggest all available predefined options.

• #17928 3277927 Thanks @​ArmandPhilippot! - Fixes a type error in getImage() options that allowed passing both widths and densities at the same time.

• #17857 2637ed1 Thanks @​Princesseuh! - Improves rendering performance

• #17943 2fc7ce9 Thanks @​matthewp! - Fixes a WebAssembly error when importing astro:actions in tests that run under @cloudflare/vitest-pool-workers

• #18018 1b5a234 Thanks @​astro-factory! - Fixes trailing-slash redirect response body pointing to the incoming URL instead of the redirect target. The location header was correct, but the HTML body (<meta http-equiv="refresh">, <title>, and <a> tag) contained the original request path without the trailing-slash correction or query string.

• #17905 eaf70fa Thanks @​SudoDevStudio! - Fixes custom dev toolbar apps losing their UI after client-side navigation with <ClientRouter />.

• #18011 558b301 Thanks @​astro-factory! - Fixes prerendered Cloudflare pages rendering as [object Object] when nodejs_compat is enabled in wrangler.toml

• #17944 ba08e35 Thanks @​matthewp! - Fixes a regression in astro dev where writes outside the module graph (for example, @astrojs/cloudflare's .wrangler/state files) invalidated the middleware on every request, causing repeated SSR reloads. Such writes no longer invalidate the middleware.

• #17531 ae837db Thanks @​danilloestrela! - Updates svgo to 4.0.2 to resolve a security advisory

• #17953 dbbf10e Thanks @​astro-factory! - Fixes a one-time page reload shortly after the first load on cold dev-server starts when a project has framework components imported from MDX content entries. MDX files are now included in the dev dependency pre-bundling scan, so their framework dependencies are bundled up front instead of being discovered (and reloaded for) at runtime.

• #17955 4e8ad9a Thanks @​matthewp! - Improves dev server startup time. The content config and dev server app module graphs now begin compiling during server creation without blocking the server from listening. Request handling waits for the shared setup result when needed, cutting astro dev ready time by roughly a third on projects with a content config.

• #17960 9838049 Thanks @​Chy-Zaber-Bin-Zahid! - Improves the diagnostics of some Astro errors.

• #17998 0e5478d Thanks @​astro-factory! - Fixes SVG <style> elements nested inside <defs> or other container elements not being hashed for CSP

• #17994 80f9f1d Thanks @​astro-factory! - Fixes experimental.incrementalBuild restoring pages with stale CSS after a preprocessor partial changes or missing original images referenced by restored pages

• #17889 8ae6b46 Thanks @​ajfAfg! - Fixes a bug where the dev server stripped the configured base from URLs that only share a prefix with it. With base: '/s', requests to /src/... were rewritten to /rc/... and failed, breaking those pages during development.

• #17980 cfccafa Thanks @​gameroman! - Improves JSDoc for fonts api

• #17953 dbbf10e Thanks @​astro-factory! - Fixes CSS HMR for framework components rendered through content entries after ClientRouter navigation

• #17970 0b4dc3a Thanks @​matthewp! - Improves serialization of transition animation values in generated CSS

• #17999 ...

  Description has been truncated

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: spiritledsoftware/caplets/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 87a67761-6361-4dd1-af73-4d8b79d17da2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​tanstack/​react-virtual@​3.14.7 ⏵ 3.14.13	+1		+1	+1
	@​base-ui/​react@​1.6.0 ⏵ 1.8.0			+1
	@​tanstack/​virtual-core@​3.17.5 ⏵ 3.17.11	+1		+1	+1
	@​types/​pg@​8.20.0 ⏵ 8.23.1	+1		+1	+3
	@​types/​react-dom@​19.2.3 ⏵ 19.3.0	+1		+1
	@​types/​react@​19.2.17 ⏵ 19.3.0	+1		+1
	posthog-node@​5.46.0 ⏵ 5.52.4	+19		+1
	@​types/​three@​0.185.1 ⏵ 0.186.0	+1		+1
	@​babel/​parser@​8.0.4 ⏵ 8.0.5				-5
	@​astrojs/​language-server@​2.16.12 ⏵ 2.17.0			+1	+1
	lucide-react@​1.25.0 ⏵ 1.47.0			+1	+1
	@​astrojs/​react@​6.0.1 ⏵ 6.0.6
	posthog-js@​1.405.3 ⏵ 1.434.0			+2
	sonner@​2.0.7 ⏵ 2.0.8			+1
	@​apidevtools/​swagger-parser@​12.1.0 ⏵ 13.0.0				-5
	react@​19.2.7 ⏵ 19.3.0	+1		+1
	@​astrojs/​cloudflare@​14.1.4 ⏵ 14.3.2			+1	+1
	@​astrojs/​starlight@​0.41.3 ⏵ 0.42.1	+1		+1	+2
	tailwind-merge@​3.6.0 ⏵ 3.7.0	+1		+1	+2
	pg@​8.22.0 ⏵ 8.23.0	+1		+1
	@​hono/​mcp@​0.3.1 ⏵ 0.3.2			+1	-4
	@​libsql/​client@​0.17.4 ⏵ 0.18.0	+1		+1
	astro@​7.1.3 ⏵ 7.3.3	+1	+75	+1
	@​ungap/​structured-clone@​1.3.3 ⏵ 1.4.0	+1		+1
	ws@​8.21.3
	@​sentry/​bun@​10.67.0 ⏵ 10.75.0			+1
	yaml@​2.9.1
	three@​0.185.1 ⏵ 0.186.0
	@​tabler/​icons@​3.45.0 ⏵ 3.46.0			+1
	@​sentry/​browser@​10.67.0 ⏵ 10.75.0	+19		+1
	@​fastify/​busboy@​3.2.0 ⏵ 3.2.2	+1
See 12 more rows in the dashboard

View full report