Skip to content

build(deps): bump sharp, @astrojs/cloudflare, @astrojs/mdx and astro - #31

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-7928daea4a
Open

build(deps): bump sharp, @astrojs/cloudflare, @astrojs/mdx and astro#31
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-7928daea4a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 25, 2026

Copy link
Copy Markdown

Bumps sharp to 0.35.2 and updates ancestor dependencies sharp, @astrojs/cloudflare, @astrojs/mdx and astro. These dependencies need to be updated together.

Updates sharp from 0.34.5 to 0.35.2

Release notes

Sourced from sharp's releases.

v0.35.2

v0.35.2-rc.2

  • TypeScript: Add mediaType to metadata response. #4492

  • Improve WebAssembly fallback detection. #4513

  • Improve code bundler support with stub binaries. #4543

  • Verify GIF effort option is an integer. #4544 @​metsw24-max

  • Verify recomb matrix entries are numbers. #4545 @​metsw24-max

  • TypeScript: Replace namespace with named exports for ESM. #4546

... (truncated)

Commits
  • c9622a3 Release v0.35.2
  • cd4568f Upgrade to sharp-libvips v1.3.1
  • 78390cf Tests: Add font file to prevent font discovery flakiness (#4550)
  • 61210b4 Verify convolve kernel values are numbers (#4549)
  • 1cb27dc Prerelease v0.35.2-rc.2
  • c7606c3 Upgrade to sharp-libvips v1.3.1-rc.0
  • 29d1e9e Prerelease v0.35.2-rc.1
  • bbba0a1 Improve code bundler support with stub binaries
  • ab52866 Bound dilate and erode width to avoid mask-size overflow (#4548)
  • 0f594dd Prerelease v0.35.2-rc.0
  • Additional commits viewable in compare view

Updates @astrojs/cloudflare from 13.1.10 to 14.1.4

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.1.4

Patch Changes

  • #17457 d46ecd8 Thanks @​matthewp! - Fixes a dev server crash when using Astro Actions with the Cloudflare adapter

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

@​astrojs/cloudflare@​14.1.3

Patch Changes

  • #17363 3f4efc5 Thanks @​astrobot-houston! - Fixes astro preview --open not opening a browser when using an adapter with a custom preview entrypoint, such as @astrojs/cloudflare

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

@​astrojs/cloudflare@​14.1.2

Patch Changes

  • #17323 4298883 Thanks @​ematipico! - Fixes build-time image optimization ignoring a custom image service registered by an integration

    Previously, when using imageService: 'compile' or imageService: 'custom', a custom image service was only respected if it was set directly in the image.service option of astro.config. If an integration registered the service instead, images were silently optimized with the default Sharp service at build time. A custom image service now transforms your images at build time no matter how it was configured.

  • #17323 4298883 Thanks @​ematipico! - Prebundles astro/components and the <ClientRouter /> transition runtime modules in the dev server environment so pages using them no longer trigger a mid-session dep optimizer reload, which caused React "Invalid hook call" errors in islands on the first request after a cold cache

  • #17323 4298883 Thanks @​ematipico! - Fixes an issue where vars weren't available at build time. Now the adapter loads vars from the Wrangler config so astro:env public variables resolve at build time

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

@​astrojs/cloudflare@​14.1.1

Patch Changes

  • Updated dependencies [eb6f97e]:
    • @​astrojs/internal-helpers@​0.10.1
    • @​astrojs/underscore-redirects@​1.0.3

@​astrojs/cloudflare@​14.1.0

Minor Changes

  • #17099 fdab7ce Thanks @​adamchal! - Adds configured image service support with the compile and custom options.

    The Cloudflare adapter supports various options that affect how images are processed for both pre-rendered and on-demand routes:

    • Setting imageService: 'compile' now ensures it is used for pre-rendered routes. When no custom image service is defined, the behavior remains unchanged.
    • With imageService: 'custom', assets are now processed at build time for pre-rendered routes. If you have configured an image service, it will be bundled to handle images at runtime; otherwise, the behavior remains unchanged.
    • The other imageService options remain unchanged.

    Learn more about the image service options available in the Cloudflare adapter guide.

... (truncated)

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.1.4

Patch Changes

  • #17457 d46ecd8 Thanks @​matthewp! - Fixes a dev server crash when using Astro Actions with the Cloudflare adapter

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

14.1.3

Patch Changes

  • #17363 3f4efc5 Thanks @​astrobot-houston! - Fixes astro preview --open not opening a browser when using an adapter with a custom preview entrypoint, such as @astrojs/cloudflare

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

14.1.2

Patch Changes

  • #17323 4298883 Thanks @​ematipico! - Fixes build-time image optimization ignoring a custom image service registered by an integration

    Previously, when using imageService: 'compile' or imageService: 'custom', a custom image service was only respected if it was set directly in the image.service option of astro.config. If an integration registered the service instead, images were silently optimized with the default Sharp service at build time. A custom image service now transforms your images at build time no matter how it was configured.

  • #17323 4298883 Thanks @​ematipico! - Prebundles astro/components and the <ClientRouter /> transition runtime modules in the dev server environment so pages using them no longer trigger a mid-session dep optimizer reload, which caused React "Invalid hook call" errors in islands on the first request after a cold cache

  • #17323 4298883 Thanks @​ematipico! - Fixes an issue where vars weren't available at build time. Now the adapter loads vars from the Wrangler config so astro:env public variables resolve at build time

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

14.1.1

Patch Changes

  • Updated dependencies [eb6f97e]:
    • @​astrojs/internal-helpers@​0.10.1
    • @​astrojs/underscore-redirects@​1.0.3

14.1.0

Minor Changes

  • #17099 fdab7ce Thanks @​adamchal! - Adds configured image service support with the compile and custom options.

    The Cloudflare adapter supports various options that affect how images are processed for both pre-rendered and on-demand routes:

    • Setting imageService: 'compile' now ensures it is used for pre-rendered routes. When no custom image service is defined, the behavior remains unchanged.
    • With imageService: 'custom', assets are now processed at build time for pre-rendered routes. If you have configured an image service, it will be bundled to handle images at runtime; otherwise, the behavior remains unchanged.

... (truncated)

Commits

Updates @astrojs/mdx from 5.0.3 to 7.0.3

Release notes

Sourced from @​astrojs/mdx's releases.

@​astrojs/mdx@​7.0.3

Patch Changes

  • #17341 64b0d66 Thanks @​Princesseuh! - Fixes custom pre components not applying to syntax-highlighted code blocks when using the Sätteri Markdown processor with MDX.

@​astrojs/mdx@​7.0.2

Patch Changes

  • Updated dependencies [eb6f97e]:
    • @​astrojs/internal-helpers@​0.10.1
    • @​astrojs/markdown-remark@​7.2.1

@​astrojs/mdx@​7.0.1

Patch Changes

@​astrojs/mdx@​7.0.0

Major Changes

Minor Changes

  • #17093 4585fe5 Thanks @​Princesseuh! - Replaces the import entrypoint of getContainerRenderer()

    A new container-renderer entrypoint exporting getContainerRenderer() has been added to the following integrations: React, Preact, Svelte, SolidJS, Vue, and MDX. This prevents bundlers from trying to bundle unrelated exports from the package root when only the Container API is used.

    If you are using the Container API, update your import statements to use the new entrypoint. The following example updates the getContainerRenderer() import for React:

    - import { getContainerRenderer } from '@astrojs/react';
+ import { getContainerRenderer } from '@astrojs/react/container-renderer';

    Importing getContainerRenderer() from the package root still works, but is now deprecated and logs a warning.

  • #17129 ff7b718 Thanks @​Princesseuh! - Adds support for modifying frontmatter programmatically with the default Markdown processor.

    A Sätteri plugin can now read and mutate ctx.data.astro.frontmatter, and Astro uses the result as the page's frontmatter, in both Markdown and MDX.

Patch Changes

@​astrojs/mdx@​7.0.0-beta.4

Patch Changes

... (truncated)

Changelog

Sourced from @​astrojs/mdx's changelog.

7.0.3

Patch Changes

  • #17341 64b0d66 Thanks @​Princesseuh! - Fixes custom pre components not applying to syntax-highlighted code blocks when using the Sätteri Markdown processor with MDX.

7.0.2

Patch Changes

  • Updated dependencies [eb6f97e]:
    • @​astrojs/internal-helpers@​0.10.1
    • @​astrojs/markdown-remark@​7.2.1

7.0.1

Patch Changes

7.0.0

Major Changes

Minor Changes

  • #17093 4585fe5 Thanks @​Princesseuh! - Replaces the import entrypoint of getContainerRenderer()

    A new container-renderer entrypoint exporting getContainerRenderer() has been added to the following integrations: React, Preact, Svelte, SolidJS, Vue, and MDX. This prevents bundlers from trying to bundle unrelated exports from the package root when only the Container API is used.

    If you are using the Container API, update your import statements to use the new entrypoint. The following example updates the getContainerRenderer() import for React:

    - import { getContainerRenderer } from '@astrojs/react';
+ import { getContainerRenderer } from '@astrojs/react/container-renderer';

    Importing getContainerRenderer() from the package root still works, but is now deprecated and logs a warning.

  • #17129 ff7b718 Thanks @​Princesseuh! - Adds support for modifying frontmatter programmatically with the default Markdown processor.

    A Sätteri plugin can now read and mutate ctx.data.astro.frontmatter, and Astro uses the result as the page's frontmatter, in both Markdown and MDX.

Patch Changes

... (truncated)

Commits

Updates astro from 6.1.8 to 7.1.3

Release notes

Sourced from astro's releases.

astro@7.1.3

Patch Changes

  • #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

astro@7.1.2

Patch Changes

  • #17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

  • #17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

  • #17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

astro@7.1.1

Patch Changes

astro@7.1.0

Minor Changes

  • #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

    // src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

  • #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

    Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

    // astro.config.mjs

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.3

Patch Changes

  • #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

7.1.2

Patch Changes

  • #17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

  • #17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

  • #17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

7.1.1

Patch Changes

7.1.0

Minor Changes

  • #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

    // src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

  • #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump sharp, @astrojs/cloudflare, @astrojs/mdx and astro
d8fd9c9 
Bumps [sharp](https://github.com/lovell/sharp) to 0.35.2 and updates ancestor dependencies [sharp](https://github.com/lovell/sharp), [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare), [@astrojs/mdx](https://github.com/withastro/astro/tree/HEAD/packages/integrations/mdx) and [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). These dependencies need to be updated together.


Updates `sharp` from 0.34.5 to 0.35.2
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.2)

Updates `@astrojs/cloudflare` from 13.1.10 to 14.1.4
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@14.1.4/packages/integrations/cloudflare)

Updates `@astrojs/mdx` from 5.0.3 to 7.0.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/mdx/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/mdx@7.0.3/packages/integrations/mdx)

Updates `astro` from 6.1.8 to 7.1.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.3/packages/astro)

---
updated-dependencies:
- dependency-name: sharp
  dependency-version: 0.35.2
  dependency-type: indirect
- dependency-name: "@astrojs/cloudflare"
  dependency-version: 14.1.4
  dependency-type: direct:production
- dependency-name: "@astrojs/mdx"
  dependency-version: 7.0.3
  dependency-type: direct:production
- dependency-name: astro
  dependency-version: 7.1.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 25, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from jungbluth as a code owner July 25, 2026 22:30
@dependabot dependabot Bot mentioned this pull request Jul 25, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jungbluth jungbluth Awaiting requested review from jungbluth jungbluth is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants