chore(deps): bump astro, @astrojs/starlight, astro-mermaid and starlight-llms-txt in /docs#825
chore(deps): bump astro, @astrojs/starlight, astro-mermaid and starlight-llms-txt in /docs#825dependabot[bot] wants to merge 3 commits intomainfrom
Conversation
…ght-llms-txt Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro), [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight), [astro-mermaid](https://github.com/joesaby/astro-mermaid) and [starlight-llms-txt](https://github.com/delucis/starlight-llms-txt/tree/HEAD/packages/starlight-llms-txt). These dependencies needed to be updated together. Updates `astro` from 5.18.1 to 6.1.8 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@6.1.8/packages/astro) Updates `@astrojs/starlight` from 0.37.6 to 0.38.3 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.38.3/packages/starlight) Updates `astro-mermaid` from 1.3.1 to 1.4.0 - [Release notes](https://github.com/joesaby/astro-mermaid/releases) - [Commits](joesaby/astro-mermaid@v1.3.1...v1.4.0) Updates `starlight-llms-txt` from 0.7.0 to 0.8.1 - [Release notes](https://github.com/delucis/starlight-llms-txt/releases) - [Changelog](https://github.com/delucis/starlight-llms-txt/blob/main/packages/starlight-llms-txt/CHANGELOG.md) - [Commits](https://github.com/delucis/starlight-llms-txt/commits/starlight-llms-txt@0.8.1/packages/starlight-llms-txt) --- updated-dependencies: - dependency-name: astro dependency-version: 6.1.8 dependency-type: direct:production - dependency-name: "@astrojs/starlight" dependency-version: 0.38.3 dependency-type: direct:production - dependency-name: astro-mermaid dependency-version: 1.4.0 dependency-type: direct:production - dependency-name: starlight-llms-txt dependency-version: 0.8.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
APM Review Panel VerdictDisposition: REQUEST_CHANGES PR: Per-persona findingsPython Architect: No Python source changes. No APM CLI code, no module structure, no design patterns affected. This PR is entirely within the Node.js docs toolchain ( CLI Logging Expert: No changes to DevX UX Expert: The docs site (Astro + Starlight) is the user-facing documentation funnel -- the primary conversion surface for new contributors and enterprise evaluators. The astro 5 -> 6 jump is a major semver boundary. Astro v6 introduced breaking changes (config API, adapter contracts, server output mode). The Deploy Docs CI workflow is currently failing ( Supply Chain Security Expert: Scope is correctly limited to the docs Node.js project. The Auth Expert: No authentication code changes. AuthResolver, token management, credential resolution flows, and remote host auth are entirely unaffected. No concerns. OSS Growth Hacker: Keeping docs tooling current is a hygiene signal for community trust -- stale dependencies read as an abandoned project. The CEO arbitrationThis is a routine dependabot docs-tooling update that hits a real blocker: the astro 5 -> 6 major version upgrade is breaking the Deploy Docs CI workflow. There is no strategic disagreement among the panel -- all specialists agree the scope is narrow (docs only, no APM Python surface), the intent is correct (stay current on tooling), but the merge must wait for the build to pass. The Node.js 20 deprecation warning surfaced in the annotations is a separate but adjacent concern (actions/checkout@v4, actions/setup-node@v4 will need Node.js 24 variants by June 2026) that maintainers should track but is not a blocker for this PR. The strategic call: hold at REQUEST_CHANGES until CI is green. If the astro v6 migration requires config changes beyond a lockfile bump, dependabot may need manual assist from a maintainer. Required actions before merge
Optional follow-ups
|
…t webhooks (#865) * ci: add merge-gate orchestrator (shadow) + stuck-PR watchdog PR #856 surfaced a structural CI fragility: required status checks are satisfied by two independent webhook channels (pull_request emits 'Build & Test (Linux)', pull_request_target emits the four Tier 2 stubs). When the pull_request delivery is dropped, 4/5 stubs go green and the 5th hangs in 'Expected -- Waiting' forever -- ambiguous yellow indistinguishable from a slow build. Recovery is folklore. This PR ships two safety nets in shadow mode: * .github/workflows/merge-gate.yml + scripts/ci/merge_gate_wait.sh Single orchestrator that polls the Checks API for 'Build & Test (Linux)' on the PR head SHA and aggregates into one verdict. Triggers on BOTH pull_request and pull_request_target so a single dropped delivery is recoverable; concurrency dedupes. Times out cleanly with a clear error message if Tier 1 never dispatched -- turning the invisible failure into a loud red check. NOT YET REQUIRED -- shadow observation first, ruleset flip after merge. * .github/workflows/watchdog-stuck-prs.yml + scripts/ci/watchdog_scan.sh Cron every 15 min. For open non-draft PRs with no ci.yml run on the head SHA AND non-paths-ignored files, posts one recovery comment. Backstop for any required check that stops dispatching. Tested live (dry-run) against microsoft/apm: watchdog correctly distinguishes stuck PRs (#853, #409) from docs-only PRs (#864, #461, #825). Both scripts shellcheck-clean. merge_gate_wait.sh tested end-to-end against PR #856 head SHA (success path, exit 0) and a non-existent SHA (timeout path, exit 2 with clear error annotation). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci(merge-gate): handle self-bootstrap and use checkout on pull_request Two fixes for the script-fetch step: 1. On 'pull_request' the runner has no secrets and a read-only token, so actions/checkout of PR head is safe -- use it for simplicity. We only need API-fetch under 'pull_request_target' where checkout would be a security risk. 2. On 'pull_request_target', when the script does not yet exist on base (i.e. THIS PR is the one adding it), curl returns 404 and we degrade to a self-bootstrap no-op pass instead of failing. Once the script lands on main, the gate becomes real. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: address Copilot review feedback on PR #865 - merge_gate_wait.sh: use $EXPECTED_CHECK in failure annotation instead of hardcoded 'Build & Test (Linux)' so the orchestrator stays generic. - merge-gate.yml: add curl --retry/--max-time on the script bootstrap fetch so a transient GitHub API blip does not redden the gate. - watchdog_scan.sh: fail loudly with stderr capture if 'gh pr list' errors out, instead of silently treating it as zero PRs (which would hide auth regressions or rate limiting). - watchdog_scan.sh: paginate the changed-files API call so PRs touching >100 files cannot be misclassified as docs-only and skipped. - CHANGELOG: append (#865) to follow the repo convention. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: drop watchdog -- gate's dual-trigger redundancy is sufficient The watchdog (cron every 15min, posts recovery comments on stuck PRs) was originally justified for the shadow-mode transition window. Since we are flipping to required immediately after this PR merges, that justification disappears. The merge-gate workflow already triggers on both 'pull_request' and 'pull_request_target' with concurrency dedup, so a single dropped webhook still fires the gate. The watchdog only added value for the double-drop case (both webhook channels fail for the same PR), which is vanishingly rare. We can add it back later if we ever observe one. Removes: - .github/workflows/watchdog-stuck-prs.yml - .github/scripts/ci/watchdog_scan.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Bumps astro, @astrojs/starlight, astro-mermaid and starlight-llms-txt. These dependencies needed to be updated together.
Updates
astrofrom 5.18.1 to 6.1.8Release notes
Sourced from astro's releases.
... (truncated)
Changelog
Sourced from astro's changelog.
... (truncated)
Commits
63c5c85[ci] release (#16356)71c93ca[ci] format5a84551Improves Vue scoped style handling in DEV mode during client router navigatio...ba2dbf1refactor(astro): correct Fixture type signatures in test-utils (#16380)217c5b3perf(core): cache crawl result (#16381)6e5bc17chore: absorb tests into others (#16365)dc8a01dchore: reduce fixtures by merging them (#16364)bb0ff91refactor(astro): migrate error tests to typescript (#16377)a6866a7fix(core): clean chunk name (#16367)811015dchore: remove lone fixtures (#16363)Updates
@astrojs/starlightfrom 0.37.6 to 0.38.3Release notes
Sourced from
@astrojs/starlight's releases.... (truncated)
Changelog
Sourced from
@astrojs/starlight's changelog.... (truncated)
Commits
7a59b9a[ci] release (#3773)313611bUpdate Czech translations for consistency (#3799)fedd48bInclude draft content notice on pages with hero component (#3801)d940845[ci] format6e7bed1docs: update jsdoc forUserConfigSchema.titlewith example (#3770)d871021[ci] release (#3766)a4c6c20Improve performance of sidebar generation logic (#3768)f24ce99fix: use region-specific translations for default locale (#3759)1a87ed4Update to Vitest 4.1 (#3757)ac64c72[ci] release (#3752)Updates
astro-mermaidfrom 1.3.1 to 1.4.0Release notes
Sourced from astro-mermaid's releases.
Commits
ebe84bcchore: bump version to 1.4.0 (#44)1623261Chore: support Astro 6.x and above in peerDependencies (#42)50bb768feat: addenableLogoption to control client-side logging (#38)d3b1b07Update README.md88e6ea9Update demo dependency to 1.3.1Updates
starlight-llms-txtfrom 0.7.0 to 0.8.1Release notes
Sourced from starlight-llms-txt's releases.
Changelog
Sourced from starlight-llms-txt's changelog.
Commits
5b7d9e0[ci] release (#98)29e5efbfix: strip HTML comments from llms.txt output (#97)a66510efix(deps): update astro (#95)6409751fix(deps): update astro (#92)897ff05fix(deps): update dependency astro to ^6.0.4 (#89)c0eb642fix(deps): update dependency@astrojs/starlightto ^0.38.1 (#88)9b81974fix(deps): update dependency astro to ^6.0.3 (#86)b70667afix(deps): update dependency astro to ^6.0.2 (#82)9aee078[ci] release (#81)dea7b22feat: add Astro v6 support (#80)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.