build(deps): bump astro from 7.1.1 to 7.2.8 in /packages/kumo-docs-astro by dependabot[bot] · Pull Request #789 · cloudflare/kumo

dependabot · 2026-09-09T15:54:15Z

Fixes #[insert GH or internal issue link(s)].

Describe your change...

Reviews
- bonk has reviewed the change
- automated review not possible because:
Tests
- Tests included/updated
- Automated tests not possible - manual testing has been completed as follows:
- Additional testing not necessary because:

Bumps astro from 7.1.1 to 7.2.8.

Release notes

astro@7.2.8

Patch Changes

#17837 ecb4082 Thanks @matthewp! - Updates the minimum supported version of Sharp to 0.35.4

#17786 db7c53b Thanks @gameroman! - Replaces the internal find-process dependency with a smaller, lighter alternative

astro@7.2.7

Patch Changes

#17415 55d38c8 Thanks @iseraph-dev! - Deserializes each route once when loading the SSR manifest

#17772 023b48b Thanks @matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

#17819 633855b Thanks @matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

#17813 ae26d18 Thanks @matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

#17816 a0d2fe3 Thanks @astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

astro@7.2.6

Patch Changes

#17812 29af6da Thanks @matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

astro@7.2.5

Patch Changes

#17758 5f419e2 Thanks @astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

#17416 493796b Thanks @iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

#17712 bd374b7 Thanks @fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

#17719 dac1768 Thanks @astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

#17770 84eb7e7 Thanks @astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

#17713 d035290 Thanks @wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

#17743 adc750f Thanks @contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

#17757 660991c Thanks @astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

#17783 60b14ff Thanks @matthewp! - Fixes a type error when passing an image from a content collection image() schema to a component or <Image />. The schema returned by image() was missing the apng format, so it no longer matched the type of an imported image.

#17664 d483125 Thanks @astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases "unsafe-inline" resource. Now when "unsafe-inline", Astro won't emit hashes for the directive specified.

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.8

Patch Changes

#17837 ecb4082 Thanks @matthewp! - Updates the minimum supported version of Sharp to 0.35.4

#17786 db7c53b Thanks @gameroman! - Replaces the internal find-process dependency with a smaller, lighter alternative

7.2.7

Patch Changes

#17415 55d38c8 Thanks @iseraph-dev! - Deserializes each route once when loading the SSR manifest

#17772 023b48b Thanks @matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

#17819 633855b Thanks @matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

#17813 ae26d18 Thanks @matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

#17816 a0d2fe3 Thanks @astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

7.2.6

Patch Changes

#17812 29af6da Thanks @matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

7.2.5

Patch Changes

#17758 5f419e2 Thanks @astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

#17416 493796b Thanks @iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

#17712 bd374b7 Thanks @fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

#17719 dac1768 Thanks @astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

#17770 84eb7e7 Thanks @astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

#17713 d035290 Thanks @wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

#17743 adc750f Thanks @contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

#17757 660991c Thanks @astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

... (truncated)

Commits

7cadf10 [ci] release (#17826)
ecb4082 Update Sharp to 0.35.4 (#17837)
8bf6f1a chore: split v5/v6 changelogs (#17825)
db7c53b chore(deps): replace "find-process" with a smaller, lighter alternative (#17786)
eface15 [ci] release (#17815)
633855b Use workerd's compatibility date for Cloudflare defaults (#17819)
55d38c8 Deserialize each route once when loading the manifest (#17415)
a0d2fe3 Pass file path to SVGO so prefixIds generates unique per-file prefixes (#17...
ae26d18 Handle GET and HEAD request bodies during rewrites (#17813)
023b48b Normalize request paths before route matching (#17772)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

cloudflare-workers-and-pages · 2026-09-09T16:00:25Z

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://dependabot-npm-and-yarn-packages-kumo-docs-astro-astr-kumo-docs.design-engineering.workers.dev (commit `8c2ebde`)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://6797d013-kumo-docs.design-engineering.workers.dev	`8c2ebde`	2026-09-10T13:36:48.856Z	Visit the dashboard ↗
Build: Failed ❌ View logs ↗		`e1ffc4b`	2026-09-09T15:54:40.460Z	View logs ↗

Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 7.1.1 to 7.2.8. - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.2.8/packages/astro) --- updated-dependencies: - dependency-name: astro dependency-version: 7.2.8 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

pkg-pr-new · 2026-09-10T13:36:32Z

npm i https://pkg.pr.new/@cloudflare/kumo@789

commit: 8c2ebde

github-actions · 2026-09-10T13:39:28Z

📐 Bundle Size

Consumer fixtures bundled against packages/kumo/dist (peers external, minified ESM).

Fixture	Raw	Gzip	Brotli
Button (root)	174.6 KB	49.9 KB	43.1 KB
Button (components/button)	174.5 KB	49.9 KB	43.0 KB
Button + Dialog + Select (root)	299.5 KB	85.8 KB	71.8 KB
Button + Dialog + Select (component subpaths)	299.5 KB	85.9 KB	71.8 KB
Chart (root)	218.6 KB	63.4 KB	54.7 KB
Chart (components/chart)	218.5 KB	63.3 KB	54.7 KB
Badge (components/badge)	44.7 KB	11.7 KB	10.0 KB
Flow (components/flow)	208.9 KB	58.3 KB	50.5 KB
Button (primitives/button)	12.2 KB	4.4 KB	3.9 KB
Primitives barrel	635.7 KB	176.9 KB	139.3 KB
Code highlighting (code)	2.08 MB	467.9 KB	349.2 KB

npm tarball: 528 files, 1.45 MB packed, 6.78 MB unpacked.

⚠️ 22 flagged files in tarball (tests / raw scripts)

dist/blocks-source/resource-list/resource-list.test.tsx
scripts/component-registry/cache.ts
scripts/component-registry/discovery.ts
scripts/component-registry/example-cleanup.ts
scripts/component-registry/index.test.ts
scripts/component-registry/index.ts
scripts/component-registry/markdown-generator.ts
scripts/component-registry/metadata.ts
scripts/component-registry/props-filter.ts
scripts/component-registry/schema-generator.ts
scripts/component-registry/sub-components.ts
scripts/component-registry/types.ts
scripts/component-registry/utils.ts
scripts/component-registry/variant-parser.ts
scripts/css-build.ts
scripts/generate-primitives.ts
scripts/theme-generator/config.ts
scripts/theme-generator/generate-css.test.ts
scripts/theme-generator/generate-css.ts
scripts/theme-generator/index.ts
scripts/theme-generator/migrate.ts
scripts/theme-generator/types.ts

Report-only: no size thresholds are enforced yet.

Commit: 8c2ebde6

github-actions · 2026-09-10T13:41:51Z

Visual Regression Report — 31 changed, 14 unchanged

31 screenshot(s) with visual changes:

Button / Basic

317 px (0.36%) changed

Before	After	Diff

Button / Variant: Secondary

523 px (0.59%) changed

Before	After	Diff

Button / Sizes

1,089 px (1.23%) changed

Before	After	Diff

Button / Icon Only

112 px (0.13%) changed

Before	After	Diff

Button / Loading State

603 px (0.68%) changed

Before	After	Diff

Button / Disabled State

232 px (0.26%) changed

Before	After	Diff

Button / Title

1,111 px (1.25%) changed

Before	After	Diff

Button / Link as Button

820 px (0.93%) changed

Before	After	Diff

Dialog / Dialog With Actions

352 px (0.4%) changed

Before	After	Diff

Dialog / Dialog Basic

478 px (0.54%) changed

Before	After	Diff

Dialog / Dialog Sizes

2,864 px (3.23%) changed

Before	After	Diff

Dialog / Dialog Alert

1,321 px (1.49%) changed

Before	After	Diff

Dialog / Dialog Confirmation

1,463 px (1.65%) changed

Before	After	Diff

Dialog / Custom Max Width

303 px (0.34%) changed

Before	After	Diff

Dialog / Dialog With Combobox

130 px (0.15%) changed

Before	After	Diff

Dialog / Dialog With Dropdown

499 px (0.56%) changed

Before	After	Diff

Select / Select Basic

1,097 px (1.24%) changed

Before	After	Diff

Select / Select Sizes

3,034 px (1.87%) changed

Before	After	Diff

Select / Select Dynamic Placement

3,917 px (3.76%) changed

Before	After	Diff

Select / Select Without Label

664 px (0.75%) changed

Before	After	Diff

Select / Select With Description

1,687 px (1.62%) changed

Before	After	Diff

Select / Select With Error

1,979 px (1.9%) changed

Before	After	Diff

Select / Select Placeholder

977 px (1.1%) changed

Before	After	Diff

Select / Select With Tooltip

1,031 px (1.16%) changed

Before	After	Diff

Select / Select Custom Rendering

739 px (0.83%) changed

Before	After	Diff

Select / Select Loading

3,050 px (1.73%) changed

Before	After	Diff

Select / Select Multiple

1,563 px (1.76%) changed

Before	After	Diff

Select / Select Complex

1,098 px (1.06%) changed

Before	After	Diff

Select / Select Disabled Items

735 px (0.83%) changed

Before	After	Diff

Select / Select Grouped With Disabled

1,313 px (1.48%) changed

Before	After	Diff

Select (Open)

98 px (0%) changed

Before	After	Diff

14 screenshot(s) unchanged

Button / Variant: Primary
Button / Variant: Ghost
Button / Variant: Destructive
Button / Variant: Outline
Button / Variant: Secondary Destructive
Button / With Icon
Button / Link with Tooltip
Button / Disabled Link
Dialog / Dialog With Select
Dialog (Open)
Select / Select Placement
Select / Select Disabled Options
Select / Select Grouped
Select / Select Long List

Generated by Kumo Visual Regression

rozenmd · 2026-09-10T13:45:33Z

/bonk review this change

ask-bonk · 2026-09-10T13:47:37Z

I'm Bonk, and I've done a quick review of your PR.

0 findings posted inline.

packages/kumo-docs-astro/package.json:23: Astro 7.2.8 requires @astrojs/markdown-remark 7.2.4, but the direct dependency and lockfile retain 7.2.1. Align the package and regenerate the lockfile.

Review notes

Confirmed the requested target is PR build(deps): bump astro from 7.1.1 to 7.2.8 in /packages/kumo-docs-astro #789. I inspected its two-file dependency update, the current review guidance, and the docs package configuration.
The lockfile resolves Astro 7.2.8 and its new transitive dependencies. The repository’s CI checks, including Docs Build, lint, tests, typecheck, and format, are passing; local pnpm validation is unavailable because pnpm is not installed in this runner.
Astro 7.2.8 declares an exact optional peer on @astrojs/markdown-remark 7.2.4, while this PR leaves the direct dependency and lockfile resolution at 7.2.1. I will post one inline compatibility finding with a concrete suggestion.
GitHub could not resolve the unchanged dependency line for the inline comment, so the compatibility finding is included above instead.

github run

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 9, 2026

dependabot Bot and others added 2 commits September 10, 2026 15:31

fix: update pnpm-lock

8c2ebde

rozenmd force-pushed the dependabot/npm_and_yarn/packages/kumo-docs-astro/astro-7.2.8 branch from e1ffc4b to 8c2ebde Compare September 10, 2026 13:33

rozenmd requested a review from mattrothenberg September 10, 2026 13:41

rozenmd requested a review from stritt September 10, 2026 13:44

mattrothenberg approved these changes Sep 10, 2026

View reviewed changes

rozenmd merged commit 1251ed4 into main Sep 10, 2026
18 of 19 checks passed

rozenmd deleted the dependabot/npm_and_yarn/packages/kumo-docs-astro/astro-7.2.8 branch September 10, 2026 13:47

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 9, 2026 • edited by rozenmd Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

astro@7.2.8

Patch Changes

astro@7.2.7

Patch Changes

astro@7.2.6

Patch Changes

astro@7.2.5

Patch Changes

7.2.8

Patch Changes

7.2.7

Patch Changes

7.2.6

Patch Changes

7.2.5

Patch Changes

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://dependabot-npm-and-yarn-packages-kumo-docs-astro-astr-kumo-docs.design-engineering.workers.dev (commit 8c2ebde)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Uh oh!

pkg-pr-new Bot commented Sep 10, 2026

Uh oh!

github-actions Bot commented Sep 10, 2026

📐 Bundle Size

Uh oh!

github-actions Bot commented Sep 10, 2026

Button / Basic

Button / Variant: Secondary

Button / Sizes

Button / Icon Only

Button / Loading State

Button / Disabled State

Button / Title

Button / Link as Button

Dialog / Dialog With Actions

Dialog / Dialog Basic

Dialog / Dialog Sizes

Dialog / Dialog Alert

Dialog / Dialog Confirmation

Dialog / Custom Max Width

Dialog / Dialog With Combobox

Dialog / Dialog With Dropdown

Select / Select Basic

Select / Select Sizes

Select / Select Dynamic Placement

Select / Select Without Label

Select / Select With Description

Select / Select With Error

Select / Select Placeholder

Select / Select With Tooltip

Select / Select Custom Rendering

Select / Select Loading

Select / Select Multiple

Select / Select Complex

Select / Select Disabled Items

Select / Select Grouped With Disabled

Select (Open)

Uh oh!

rozenmd commented Sep 10, 2026

Uh oh!

Uh oh!

ask-bonk Bot commented Sep 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Sep 9, 2026 •

edited by rozenmd

Loading

cloudflare-workers-and-pages Bot commented Sep 9, 2026 •

edited

Loading

Preview URL: https://dependabot-npm-and-yarn-packages-kumo-docs-astro-astr-kumo-docs.design-engineering.workers.dev (commit `8c2ebde`)