fix(deps): update minor+patch #7
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/minor+patch"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
^0.4.5→^0.4.6^8.1.1→^8.1.2^1.20261027.1→^1.20261104.1^0.9.5→^0.9.6^1.2.42→^1.2.43^7.4.2→^7.4.5^1.3.1→^1.4.0^1.20261027.1→^1.20261104.1Release Notes
withastro/astro (@astrojs/markdown-satteri)
v0.4.6Compare Source
Patch Changes
edfbf4aThanks @matthewp! - Fixes Prism code blocks for languages Prism doesn't support, such asvueorsvelte. Their code is now displayed as plain text instead of being rendered as HTML. Also correctly escapes the code block language in the generatedclassanddata-languageattributes.edfbf4a]:withastro/astro (@astrojs/mdx)
v8.1.2Compare Source
Patch Changes
edfbf4a]:cloudflare/workerd (@cloudflare/workerd-linux-64)
v1.20261104.1Compare Source
What's Changed
Full Changelog: https://github.com/cloudflare/workerd/compare/v1.20261103.1...v1.20261104.1
v1.20261103.1Compare Source
What's Changed
already called end()fix by @mikea in #8157jsg::JsStringby @nathanwhit in #8112Full Changelog: https://github.com/cloudflare/workerd/compare/v1.20261102.1...v1.20261103.1
v1.20261102.1Compare Source
What's Changed
Full Changelog: https://github.com/cloudflare/workerd/compare/v1.20261101.1...v1.20261102.1
v1.20261101.1Compare Source
What's Changed
Full Changelog: https://github.com/cloudflare/workerd/compare/v1.20261031.1...v1.20261101.1
v1.20261031.1Compare Source
What's Changed
Full Changelog: https://github.com/cloudflare/workerd/compare/v1.20261030.1...v1.20261031.1
v1.20261030.1Compare Source
What's Changed
NullOrUndefined<T>to Rust JSG as a clearer alternative toOption<Nullable<T>>by @nathanwhit in #8080Full Changelog: https://github.com/cloudflare/workerd/compare/v1.20261029.1...v1.20261030.1
v1.20261029.1Compare Source
What's Changed
New Contributors
Full Changelog: https://github.com/cloudflare/workerd/compare/v1.20261028.1...v1.20261029.1
v1.20261028.1Compare Source
What's Changed
fetch/tests by @npaun in #7921Full Changelog: https://github.com/cloudflare/workerd/compare/v1.20261027.1...v1.20261028.1
emdash-cms/emdash (@emdash-cms/sandbox-workerd)
v0.9.6Compare Source
Patch Changes
064fbbf,75030fc,ec973c0,ceaf9b6,3d29980,9d9fd82,3ce9d36,8da0792,c238da2,a6f4091,f197acf,57abb5c,e1c4a87,bed3e42,4409acb,53acf71,6be7263,9e7cd3d,a16ab2c,9201138,d1e25e0,6c5d878,56cb9da]:withastro/astro (astro)
v7.4.5Compare Source
Patch Changes
#18558
fac3c50Thanks @astro-factory! - Fixesastro dev statusand other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process#18559
10dae2fThanks @astro-factory! - Fixesimport.meta.envvalues containing$sequences (such as$$or$&) being corrupted inastro buildwhen server code reads theimport.meta.envobject directly, for example withconst { MY_SECRET } = import.meta.env#18544
e3bec3dThanks @skezo! - Fixes request paths with invalid percent-encoding (e.g./%C0%AFor a bare%) being logged as anInvalid URL encodingerror and routed with the undecoded path. These requests now return a400, the same as a path that is encoded too many times.#18520
e023abaThanks @matthewp! - Makes rendering of string tag names stricter and consistent across.astrodynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as/or=can no longer change the generated markup. A string that does not start with a valid element name (for example'!--'or'') now throws an error instead of producing invalid HTML.v7.4.4Compare Source
Patch Changes
df838daThanks @edmundhung! - Allowsastro addto configure tagged versions of official adaptersv7.4.3Compare Source
Patch Changes
#18488
e4e25faThanks @umeraamir69! - CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string intoscript-srcandstyle-src.#18500
e5a3a1bThanks @astro-factory! - Fixes<Image>and<Picture>emitting duplicatesrcsetcandidates whendensitiescontains equivalent values such as1and'1x'#18517
c3185b7Thanks @okxint! - Fix unhandledAbortErrorrejection whenClientRouterskips a pending view transition#18497
c712113Thanks @astro-factory! - Fixes an uncaughtTypeErrorin the browser when aserver:deferisland request fails due to a network error. The fallback content is kept, as it is for non-200 responses.#18525
d0240b9Thanks @astro-factory! - Fixes aDEP0190deprecation warning printed byastro infoon Node.js 24 and later#18522
776b9a6Thanks @astro-factory! - FixesmemoryCache()serving an empty body for cached pages that return an empty404or500response. These responses now render the404or500error page on every request.#18511
d060ff9Thanks @astro-factory! - Fixestransition:namestyles missing in dev when the element is inside a component that is only rendered through another component with no styles or scripts#18494
5fe699cThanks @astro-factory! - Fixes theastroCLI refusing to run on StackBlitz by allowing Node.js>=22.22.0inside WebContainers, whose Node.js version users cannot change#18506
bf43a60Thanks @astro-factory! - Fixes<ClientRouter />animating scroll restoration on back/forward navigation whenscroll-behavior: smoothis set. Saved scroll positions are now restored instantly, matching the browser's native behavior.#18476
8ea79a2Thanks @astro-factory! - Fixes aDataCloneErrorcrash when building pages that render SVG imports with<Image />orgetImage()whileexperimental.parallelPrerenderis enabled.#18504
6dbd737Thanks @astro-factory! - Fixes<Picture>emitting a duplicate1xcandidate in<source>srcsetwhendensitiesincludes1#18524
7524889Thanks @astro-factory! - Fixes type errors reported in Astro's built-in<Image />,<Picture />,<Code />,<Debug />and<ClientRouter />components when type-checking a project that extendsastro/tsconfigs/strictestwithtscand@astrojs/ts-content-mapper#18493
3773941Thanks @astro-factory! - Fixes scoped styles of unused Astro components being included in the build when those components are re-exported from a barrel file#18512
1151b9eThanks @jp-knj! - Fixes CSP hashes added withAstro.cspfrom components rendered inside<body>being left out of the CSP<meta>element in static builds, including MDX pagesUpdated dependencies [
6cf3423,edfbf4a]:emdash-cms/emdash (emdash)
v1.4.0Compare Source
Minor Changes
064fbbfThanks @swissky! - Addsadmin.hiddenNavItemsto hide built-in admin areas a site doesn't use. Set it to any ofcalendar,media,comments,menus,redirects,widgets,sections,bylines, andimport, for exampleadmin: { hiddenNavItems: ["comments", "redirects"] }. Hidden areas disappear from the sidebar and the command palette. On the dashboard, listingmediahides the Upload Media button, and listingcalendarkeeps the Scheduled count but removes its link to the calendar. The pages and API routes stay reachable for users with the required role. An unknown name fails the build.Patch Changes
75030fcThanks @danielmlr! - Fixes translating a menu on Cloudflare D1, which failed for larger menus and left an empty translated menu behind. On D1, translating or deleting a menu and reordering or replacing its items now either save completely or leave the menus unchanged.What should I do?
If translating a menu failed before, delete the empty translated menu it left behind, then translate the menu again.
#4167
ec973c0Thanks @cyface! - Fixes extra database round trips ongetEmDashEntryandgetEmDashCollectionfor sites that register byline custom fields or have entries with an author but no explicit byline credit. These reads now resolve bylines from the content query itself and load custom-field values in one batched step, instead of re-reading every entry's credits. On Cloudflare D1, a page that reads a few entries saves two to six sequential queries.#4287
ceaf9b6Thanks @danielmlr! - Fixes expired OAuth tokens and unused login codes fromemdash loginand MCP clients staying in the database forever. Scheduled cleanup now deletes them after they expire.#4286
3d29980Thanks @danielmlr! - Fixes lost edits on D1, Durable Objects and PostgreSQL when two saves of the same entry, both based on the same version, arrive at once, for example from two MCP clients or from scripts usingemdash content update --rev: both reported success, and the first was silently overwritten. The second save now returns409 CONFLICT, the same response a save based on an outdated version already gets.#4459
9d9fd82Thanks @emdash-autofix! - FixesPOST /_emdash/api/oauth/tokenreturning uppercaseINVALID_GRANTfor refresh-token and device-code failures. These responses now use the RFC-standardinvalid_grantcode so OAuth clients can recognize rejected grants and restart authorization.#4243
3ce9d36Thanks @emdashbot! - Fixes Cloudflare-cached pages remaining outdated after content is deleted or unpublished. Pages using EmDash cache hints no longer send an automaticLast-Modifiedheader, so Cloudflare stops answering304 Not Modifiedbased on an entry timestamp that does not cover related lists or settings changes. This applies to entry, collection, publication-date, and reference-list hints. Sites using an object cache reload those content snapshots once after upgrading so cached validators from earlier versions are not reused.Taxonomy definitions and collection-to-taxonomy mappings also revalidate in the background after 30 seconds, so long-lived server processes pick up changes saved elsewhere without adding a blocking query to each render. A failed refresh retains the last good snapshot.
What should I do?
cacheHint.lastModifiedis no longer populated automatically. For an entry's displayed modification date, useentry.data.updatedAtinstead; it is not a validator for the whole page.Pages relying on automatic validators also lose Astro's implicit
Cache-Control: no-cacheheader. Set your own browserCache-Controlif you need a fresh check on every visit. If you want conditional requests, supply a customlastModifiedhint toAstro.cache.set(). Its timestamp must advance whenever any part of the response changes, including settings, related entries, deletions, and unpublishes.#4157
8da0792Thanks @opariffazman! - Fixes external auth providers, such as Cloudflare Access, writing the session store on every authenticated/_emdashrequest. EmDash now writes the session only when the signed-in user differs from the stored one, so sites on Cloudflare no longer spend one Workers KV write per request, which could exhaust the Workers Free plan's daily write limit and hit KV's one-write-per-second limit on a key for parallel requests.#3192
c238da2Thanks @bazemoreb! - Names media downloads after the file that was uploaded. The public media file route previously sentContent-Disposition: attachmentwith nofilename, so browsers fell back to the last path segment of the URL and saved every PDF, DOCX or CSV under its storage key. The route now looks the original filename up by storage key and emits both the quoted ASCIIfilenameand the RFC 5987filename*form, so non-ASCII names survive.Media with no matching database row is served exactly as before, and a failed lookup never fails the download.
#3129
a6f4091Thanks @eisenbruch! - Fixes saving an entry turning an empty image or file field ("") into{ "provider": "external", "id": "", "src": "" }. A blank image or file field, or a blank image inside a repeater, is now saved asnull, the canonical empty value. Entries with no image stop changing on every save after that.A required image or file field now returns a validation error for
""instead of saving an empty image. This only affects API, MCP or import clients, because the admin never sends"".#4296
f197acfThanks @danielmlr! - Fixes media usage tracking in collections that have a reference field namedtitleorname, where saving an entry recorded none of the images and files it uses. Saving now records them.What should I do?
Entries in those collections that were saved before this release can still be missing from Used in after you upgrade. Open Settings → Media usage tracking and wait until it shows Ready. If it shows Needs attention instead, repair each affected collection once:
#4285
57abb5cThanks @danielmlr! - Fixes menus showing dead links to entries that are in the trash or not published.getMenu()leaves those items out. Any itemgetMenu()leaves out now takes its child items with it, instead of moving them to the top level of the menu. In edit mode, menus still link to unpublished entries. With the object cache enabled, a cached menu now refreshes when an entry or taxonomy term it links to changes.#4365
e1c4a87Thanks @danielmlr! - Fixes creating a child menu item through the menu items API on PostgreSQL. A request with aparentIdand nosortOrderfailed; the item is now placed after its existing siblings.#4208
bed3e42Thanks @danielmlr! - Fixes content list search, in the admin and through the content list API'sqparameter, failing when the collection has a reference field namedtitleorname. The search now leaves out a reference field bound to a relation and matches the entry's other fields.#4205
4409acbThanks @danielmlr! - Fixes entry creation, entry saves and content-list search failing withno such columnin a collection that has a reference field markedsearchable. Adding such a field to a search-enabled collection failed, and after a seed turned search on, creating or saving any entry in that collection failed. Site search and content-list search now ignore thesearchableflag on a reference field bound to a relation.What should I do?
If creating or saving entries in a collection still fails after upgrading and the server log shows
no such column, open the collection under Content Types, untick Search and save, then tick it again and save. This rebuilds the collection's search index.#4386
53acf71Thanks @Stormster! - Fixes entry slugs being generated from a field namedtitleinstead of the collection's configured title field. In a collection whosetitleFieldisnameand which also has atitlefield (a person's job title, say), typing in the editor now fills the slug from the name, and entries created through the API without a slug get one from the name too, so two people with the same job title no longer collide withSLUG_CONFLICT. Collections without atitleFieldkeep the previoustitle, thenname, order.#4394
6be7263Thanks @emdash-autofix! - Fixes sandboxed pluginctx.taxonomiesmutations (createTerm(),addEntryTerms(), andremoveEntryTerms()),ctx.content.create(), versioned content actions (getVersioned(),publish(),unpublish(),schedule(),unschedule(),getTrashedVersioned(), andrestore()), andctx.comments.setStatus()on Cloudflare when requests run across multiple Worker isolates. Content creation consistently uses runtime validation and hooks and preservestranslationOflinks instead of falling back to a plain database insert.Runner-created invocations without a content-create callback now receive
Content creation is not configuredrather than a database insert that bypasses runtime behavior.createPluginTestHost()supplies a database-backed callback with content-handler validation so transport-level tests can continue creating content and linked translations without starting the full EmDash runtime. It preserves the transport host's support fordata.sluganddata.status.Await these operation promises before returning from a plugin route or hook. Their RPC connection now lasts only for that invocation; unlike the previous loopback binding, it cannot support work that outlives the invocation.
Publication after-hooks remain deferred. Same-entry actions attempted while an after-hook is running can return
CONTENT_ACTION_REENTRANT; faster callback routing can expose this overlap in tests that assumed hooks had already finished. In runtime-host tests, callawait host.waitForDeferredTasks()after an action before inspecting its after-hook effects or starting another action on the same entry. This method waits for queued deferred runtime work, including work those tasks enqueue; it does not run future scheduled tasks or wait for arbitrary unawaited plugin operations.#4380
9e7cd3dThanks @emdash-autofix! - Fixesemdash site importfailing withCOLLECTION_EXISTSwhen manually deleted target collections still have media-usage cleanup pending. For these manually deleted collections, import now runs as many cleanup steps as the request budget allows, then imports the collection in the same request if enough budget remains. It waits for active deletion leases or retry delays before reusing a slug. Cancellation during this per-collection cleanup stops before importing the collection. Failed cleanup of a manually deleted collection includes recovery instructions, and collection schema error messages are preserved in statuserrorDetail.#4276
a16ab2cThanks @emdash-autofix! - Fixes site builds usingzustand/traditionalor other dependencies that default-importuse-sync-external-storeshims, which previously failed with a missing default export error.#4396
9201138Thanks @emdash-autofix! - Fixes keyboard navigation and entrance animations in the admin and visual editor's floating toolbars with Tiptap 3.20.3 and later. Escape closes image alt-text editing, Shift+Tab returns to the caption, and arrow keys move between toolbar controls again.#3279
d1e25e0Thanks @eisenbruch! - Fixes the visual editing toolbar's "Open in admin" so each entry gets its own admin window. The window name was a single constant shared by the whole site, so opening the admin for one entry navigated away from another already open in that tab. A repeat click on the same entry still reuses that entry's window.#3596
6c5d878Thanks @swissky! - Caches widget areas in the object cache. With an object cache configured,<WidgetArea>,getWidgetArea(),getWidgetAreaWithCacheHint()andgetWidgetAreas()no longer query the database on each page load. Widget changes made in the admin, by seeding or by a site transfer invalidate the cached areas; code that writes the widget tables directly should call the newinvalidateWidgetObjectCache()export.#3890
56cb9daThanks @swissky! - Fixes importing WordPress custom post types with a hyphen in their name (such asteam-member) through the EmDash Exporter plugin. The import created theteam_membercollection but then failed every entry withCollection "team-member" does not exist, and custom taxonomies for that post type were not linked to the collection. The review step now shows the collection the import will use and recognizes it on a repeated import, so field type conflicts with it are reported. ThewxrSourceimport source now suggests the same valid collection names, such asteam_memberforteam-memberandwp_contentfor a post type namedcontent.Updated dependencies [
6cc69bb,3fcf437,064fbbf,f0956f1,500a45b,2a62e8a,5cd334e,b82016d,0bc006c,d840b08,a1a0174,a6b28a6,e80c1f0,936a4cb,936a4cb,936a4cb,e80c1f0,190022c,9e720d6,2ed2755,229c64b,d60c43c,dd0bc9e,4e4b068,0bc23ad,7a04c81,046ec3c,15557d1,2e103a4,245a562,fa46578,585cd22,e847d4b,e6ee72f,53acf71,0709277,6094ff8,d160cb0,20a5923,9201138,26c4faf,3ad08dc]:Configuration
📅 Schedule: (in timezone Europe/Berlin)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.