chore(deps): bump @astrojs/starlight from 0.41.10 to 0.42.0 by dependabot[bot] · Pull Request #389 · boringstack-xyz/tsforge

dependabot · 2026-09-11T01:06:33Z

Bumps @astrojs/starlight from 0.41.10 to 0.42.0.

Release notes

Sourced from @astrojs/starlight's releases.

@astrojs/starlight@0.42.0

Minor Changes
#3572 292fb17 Thanks @HiDeoo! - Distributes package as JavaScript files with dedicated type declaration files instead of TypeScript source files.
#4121 2623ae6 Thanks @delucis! - Simplifies markup for Starlight’s mobile menu toggle

⚠️ Potentially breaking change: If you use a theme plugin, custom styles, or component overrides targeting the MobileMenuToggle button or PageFrame components, you may need to adjust these for the new markup. The button is no longer wrapped in a <starlight-menu-button> custom element and no longer uses the aria-expanded attribute. Instead, you can use the .sl-menu-button class name to target the button and the :popover-open pseudo-class to style the menu open state specifically.

In the following example, custom styles for the menu button are updated for the new approach:
- starlight-menu-button button {
+ .sl-menu-button {
  color: var(--sl-color-text);
}

starlight-menu-button[aria-expanded='true'] button {


.sl-menu-button:has(~ :popover-open) {
color: var(--sl-color-text-accent-high);
}
See MobileMenuToggle.astro and PageFrame.astro on GitHub for the full source code of the updated components.

#3572 292fb17 Thanks @HiDeoo! - Removes the tagline configuration option, which was never used.

If your configuration included a tagline option, you can safely remove it without any replacement.
#4134 6135f01 Thanks @HiDeoo! - Updates internal @astrojs/mdx, @astrojs/markdown-satteri, and satteri dependencies.

⚠️ BREAKING CHANGE: The following minimum versions are now required:

astro v7.2.10 or later

@astrojs/markdown-satteri 0.4.0 or later (if you use it)

@astrojs/markdown-remark 7.3.0 or later (if you use it)

Please update Starlight and Astro together:
npx @astrojs/upgrade
#4121 2623ae6 Thanks @delucis! - Refactors Starlight’s mobile menu toggle to work when JavaScript fails or is disabled

⚠️ BREAKING CHANGE: This release drops official support for Chromium-based browsers prior to version 116 (released August 2023), Safari-based browsers prior to version 17.0 (released September 2023), and Firefox prior to version 125 (released April 2024). You can find a list of currently supported browsers and their versions using this browserslist query.

This change also removes the data-mobile-menu-expanded attribute, which was previously added to <body> while the mobile menu is open. If you have custom code that was depending on this attribute, you will need to update it to use a new selector to check if the mobile menu is open.

In the following example, a custom background colour for the site header while the menu is open is updated for the new approach:

... (truncated)

Changelog

Sourced from @astrojs/starlight's changelog.

0.42.0

Minor Changes
#3572 292fb17 Thanks @HiDeoo! - Distributes package as JavaScript files with dedicated type declaration files instead of TypeScript source files.
#4121 2623ae6 Thanks @delucis! - Simplifies markup for Starlight’s mobile menu toggle

⚠️ Potentially breaking change: If you use a theme plugin, custom styles, or component overrides targeting the MobileMenuToggle button or PageFrame components, you may need to adjust these for the new markup. The button is no longer wrapped in a <starlight-menu-button> custom element and no longer uses the aria-expanded attribute. Instead, you can use the .sl-menu-button class name to target the button and the :popover-open pseudo-class to style the menu open state specifically.

In the following example, custom styles for the menu button are updated for the new approach:
- starlight-menu-button button {
+ .sl-menu-button {
  color: var(--sl-color-text);
}

starlight-menu-button[aria-expanded='true'] button {


.sl-menu-button:has(~ :popover-open) {
color: var(--sl-color-text-accent-high);
}
See MobileMenuToggle.astro and PageFrame.astro on GitHub for the full source code of the updated components.

#3572 292fb17 Thanks @HiDeoo! - Removes the tagline configuration option, which was never used.

If your configuration included a tagline option, you can safely remove it without any replacement.
#4134 6135f01 Thanks @HiDeoo! - Updates internal @astrojs/mdx, @astrojs/markdown-satteri, and satteri dependencies.

⚠️ BREAKING CHANGE: The following minimum versions are now required:

astro v7.2.10 or later

@astrojs/markdown-satteri 0.4.0 or later (if you use it)

@astrojs/markdown-remark 7.3.0 or later (if you use it)

Please update Starlight and Astro together:
npx @astrojs/upgrade
#4121 2623ae6 Thanks @delucis! - Refactors Starlight’s mobile menu toggle to work when JavaScript fails or is disabled

⚠️ BREAKING CHANGE: This release drops official support for Chromium-based browsers prior to version 116 (released August 2023), Safari-based browsers prior to version 17.0 (released September 2023), and Firefox prior to version 125 (released April 2024). You can find a list of currently supported browsers and their versions using this browserslist query.

This change also removes the data-mobile-menu-expanded attribute, which was previously added to <body> while the mobile menu is open. If you have custom code that was depending on this attribute, you will need to update it to use a new selector to check if the mobile menu is open.

... (truncated)

Commits

88ad3c2 [ci] release (#4172)
74cb3f1 Update dependencies (#4173)
6135f01 Use Sätteri 0.10 APIs (#4134)
2623ae6 Refactor mobile menu to use Popover API (#4121)
09af1c6 chore(deps): update magic-string to v1 (#4082)
292fb17 [i18nIgnore] Transpile Starlight packages (#3572)
0138f22 [ci] release (#4169)
32a5e29 Fix hidden heading anchor links (#4167)
cdfafd8 perf: optimize route and sidebar lookups (#4148)
dd7fb97 chore: add benchmarks (#4157)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) from 0.41.10 to 0.42.0. - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.42.0/packages/starlight) --- updated-dependencies: - dependency-name: "@astrojs/starlight" dependency-version: 0.42.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-09-11T01:06:46Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	tsforge	`db42ab4`	Sep 11 2026, 01:06 AM

Dependency bumps (dependabot #376 #379 #380 #381 #384 #387 #389 #390 #391 #392 #393 #394): wrangler 4.131.2, astro 7.3.2, mermaid 12.0.0, sharp 0.35.4, bun-types 1.4.2, @astrojs/starlight 0.42.0, globals 17.12.0, eslint 10.10.0 + typescript-eslint 8.69.0, @astrojs/react 6.0.5, @astrojs/sitemap 3.7.4, softprops/action-gh-release 3.0.3. - Starlight 0.42 (via @astrojs/mdx 8) needs the @astrojs/markdown-remark ^7.3.0 peer; added to the docs app (the docs build failed without it). - typescript-eslint 8.69 flags `void _drop;` as a meaningless void; removed (the `_` prefix + rest-sibling destructuring already silence unused-var). Security scans - osv: every accepted-risk entry had expired (2026-09-12) and no longer matched; the 8 open advisories were all fixable, so patched versions are pinned via overrides (devalue, js-yaml, lodash-es, smol-toml, svgo, valibot) and the dead allowlist is emptied. osv-scanner: no issues. - gitleaks: allowlist the Chrome extension manifest — its "key" is the extension's PUBLIC key (pins the ID the bridge accepts), not a secret.

…eaking into non-code sessions (#395) * docs(spec): chrome research bridge design * feat(browser): research in the user's logged-in Chrome + stop coding-mode leaking into non-code sessions Chrome research bridge - New MV3 extension (packages/chrome-extension) connected to tsforge over a token- and Origin-checked localhost WebSocket (chrome-bridge subsystem). - browser_* tools: tabs, adopt, open, navigate, read (chunked markdown with numbered refs), click, scroll, screenshot, close; agent tabs live in a "tsforge" tab group. Read + navigate only, enforced in the extension: default-deny click policy re-checked on the live element at click time, group-scoped tabs, http(s)-only navigation, private hosts blocked. - note tool: append-only notes/<topic>.md, outside the code write-guard. - TSFORGE_BROWSER / _PORT / _ALLOW_PRIVATE, /browser, /config toggle, docs. Non-code sessions no longer get the TypeScript build machinery - Auto gate stays dormant until the folder has JS/TS code, then wakes; while dormant: assistant prompt, no check/pull_conventions, no gate runs/nudges. - ESLint with nothing to lint passes (--no-error-on-unmatched-pattern). - Research reads count as progress for readonly-spin without a live gate. - task_complete works without a gate (marked not gate-checked). - Folders with no code start in normal mode, not plan-first. - Repetition re-steer, checklist rules and /gate "" follow the gate state. - Assistant prompt no longer opens as a TypeScript engineer. * chore(deps): fold open dependabot bumps; fix security scans Dependency bumps (dependabot #376 #379 #380 #381 #384 #387 #389 #390 #391 #392 #393 #394): wrangler 4.131.2, astro 7.3.2, mermaid 12.0.0, sharp 0.35.4, bun-types 1.4.2, @astrojs/starlight 0.42.0, globals 17.12.0, eslint 10.10.0 + typescript-eslint 8.69.0, @astrojs/react 6.0.5, @astrojs/sitemap 3.7.4, softprops/action-gh-release 3.0.3. - Starlight 0.42 (via @astrojs/mdx 8) needs the @astrojs/markdown-remark ^7.3.0 peer; added to the docs app (the docs build failed without it). - typescript-eslint 8.69 flags `void _drop;` as a meaningless void; removed (the `_` prefix + rest-sibling destructuring already silence unused-var). Security scans - osv: every accepted-risk entry had expired (2026-09-12) and no longer matched; the 8 open advisories were all fixable, so patched versions are pinned via overrides (devalue, js-yaml, lodash-es, smol-toml, svgo, valibot) and the dead allowlist is emptied. osv-scanner: no issues. - gitleaks: allowlist the Chrome extension manifest — its "key" is the extension's PUBLIC key (pins the ID the bridge accepts), not a secret. * test(f19): give the cold write-guard tests a real timeout The write-guard and end-to-end F19 tests each build a fresh TypeScript program + ESLint engine for a new plugin workspace: ~1s locally, 2s under CI=true, and 5s+ on a shared GitHub runner, where they hit bun's default 5s timeout. The late rejection then surfaced as a misleading "expected promise that rejects" — the drift IS detected (all six pass under CI=true with a longer timeout). They are correctness tests, not perf budgets: 30s, matching the explicit timeouts other heavy tests in the suite already use.

dependabot · 2026-09-25T19:35:54Z

Dependabot could not run Bun to update your dependencies due to a configuration error. Because of this, Dependabot cannot update this pull request.

agjs · 2026-09-25T19:39:29Z

Superseded by #395, which landed this bump on main (with bun.lock regenerated; this PR couldn't pass CI because dependabot doesn't update bun.lock). Released in 0.54.0.

dependabot · 2026-09-25T19:39:33Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 11, 2026

agjs closed this Sep 25, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/astrojs/starlight-0.42.0 branch September 25, 2026 19:39

Navigation Menu

chore(deps): bump @astrojs/starlight from 0.41.10 to 0.42.0 - #389

chore(deps): bump @astrojs/starlight from 0.41.10 to 0.42.0#389
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/astrojs/starlight-0.42.0

dependabot Bot commented on behalf of github Sep 11, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 11, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 25, 2026

Uh oh!

agjs commented Sep 25, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​astrojs/starlight@​0.42.0

Minor Changes

0.42.0

Minor Changes

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

dependabot Bot commented on behalf of github Sep 25, 2026

Uh oh!

agjs commented Sep 25, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 11, 2026 •

edited

Loading

`@astrojs/starlight@0`.42.0

cloudflare-workers-and-pages Bot commented Sep 11, 2026 •

edited

Loading