Skip to content

chore(deps): bump astro from 7.0.3 to 7.2.8 - #46

Merged
yordis merged 1 commit into
mainfrom
dependabot/npm_and_yarn/astro-7.2.8
Sep 17, 2026
Merged

chore(deps): bump astro from 7.0.3 to 7.2.8#46
yordis merged 1 commit into
mainfrom
dependabot/npm_and_yarn/astro-7.2.8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps astro from 7.0.3 to 7.2.8.

Release notes

Sourced from astro's releases.

astro@7.2.8

Patch Changes

astro@7.2.7

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

  • #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

astro@7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

astro@7.2.5

Patch Changes

  • #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

    As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

  • #17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #17783 60b14ff Thanks @​matthewp! - Fixes a type error when passing an image from a content collection image() schema to a component or <Image />. The schema returned by image() was missing the apng format, so it no longer matched the type of an imported image.

  • #17664 d483125 Thanks @​astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases "unsafe-inline" resource. Now when "unsafe-inline", Astro won't emit hashes for the directive specified.

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.8

Patch Changes

7.2.7

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

  • #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

7.2.5

Patch Changes

  • #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

    As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

  • #17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 15, 2026
@cursor

cursor Bot commented Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown

PR Summary

Low Risk
Single dependency version change for the marketing Astro app; watch for Sharp minimum-version mismatch with the pinned sharp@0.34.5.

Overview
Bumps the marketing app’s Astro dependency from ^7.0.3 to ^7.2.8 in apps/marketing/package.json; no script or config changes in this diff.

Astro 7.2.8+ expects Sharp ≥ 0.35.4, but this package still pins sharp at 0.34.5, so a follow-up bump to sharp may be needed if installs or image builds fail after the upgrade.

Reviewed by Cursor Bugbot for commit 9b7f7ae. Bugbot is set up for automated code reviews on this repo. Configure here.

@github-actions github-actions Bot added vouch:trusted PR author is trusted by repo permissions or the VOUCHED list. size:XXL labels Sep 15, 2026
@github-actions

github-actions Bot commented Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider Metric Main baseline This PR Impact PR ceiling
Codex Total thread wire 13.2 KiB 13.5 KiB +408 B (+3.0%) 15.1 KiB ✅
Codex Thread snapshot wire 6.9 KiB 7.1 KiB +168 B (+2.4%) 7.3 KiB ✅
Codex Live turn WebSocket wire 6.2 KiB 6.5 KiB +240 B (+3.8%) 7.8 KiB ✅
Codex Live turn WebSocket decoded 54.7 KiB 56.3 KiB +1.6 KiB (+2.9%) 66.4 KiB ✅
Codex Live turn messages 8 10 +2 (+25.0%) 21 ✅
Claude Total thread wire 13.2 KiB 13.5 KiB +356 B (+2.6%) 15.1 KiB ✅
Claude Thread snapshot wire 6.9 KiB 7.1 KiB +168 B (+2.4%) 7.3 KiB ✅
Claude Live turn WebSocket wire 6.3 KiB 6.4 KiB +188 B (+2.9%) 7.8 KiB ✅
Claude Live turn WebSocket decoded 55.5 KiB 57.0 KiB +1.5 KiB (+2.8%) 66.4 KiB ✅
Claude Live turn messages 8 9 +1 (+12.5%) 21 ✅

Baseline: eb6fcb3 · PR result: 9b7f7ae · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

  • Codex decoded thread snapshot: 113.9 KiB
  • Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

@dependabot
chore(deps): bump astro from 7.0.3 to 7.2.8
9b7f7ae 
Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 7.0.3 to 7.2.8.
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.8/packages/astro)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 7.2.8
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/astro-7.2.8 branch from 6d39f91 to 9b7f7ae Compare September 17, 2026 19:41
cursor[bot]
cursor Bot reviewed Sep 17, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 9b7f7ae. Configure here.

Comment thread apps/marketing/package.json
"dependencies": {
"@t3tools/shared": "workspace:*",
"astro": "^7.0.3",
"astro": "^7.2.8",

@cursor cursor Bot Sep 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sharp pin below Astro minimum

Medium Severity

Astro 7.2.8 raises the minimum supported sharp version to 0.35.4 to patch GHSA-26w7-cxv4-gfx2. This app still exact-pins sharp at 0.34.5, and with pnpm that direct dependency is what astro:assets typically loads, so image processing can keep using the unpatched native library this upgrade is meant to replace.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 9b7f7ae. Configure here.

@yordis
yordis merged commit 22b725b into main Sep 17, 2026
18 of 20 checks passed
@yordis
yordis deleted the dependabot/npm_and_yarn/astro-7.2.8 branch September 17, 2026 21:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code size:XXL vouch:trusted PR author is trusted by repo permissions or the VOUCHED list.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@yordis