Skip to content

chore(deps): bump the npm-dependencies group across 1 directory with 17 updates - #43

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-130745bc78
Open

chore(deps): bump the npm-dependencies group across 1 directory with 17 updates#43
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-130745bc78

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 17 updates in the / directory:

Package From To
@astrojs/cloudflare 14.2.0 14.3.4
astro 7.2.0 7.3.6
fast-xml-parser 5.10.1 5.11.2
jose 6.2.8 6.2.12
marked 18.0.9 18.1.0
sanitize-html 2.17.7 2.18.0
@types/sanitize-html 2.16.1 2.16.2
@types/node 26.2.0 26.6.4
@types/sanitize-html 2.16.1 2.16.2
eslint 10.8.1 10.12.0
eslint-plugin-astro 3.1.0 3.2.1
globals 17.9.0 17.13.0
prettier 3.9.6 3.9.9
prettier-plugin-astro 0.14.1 1.1.0
typescript 6.0.3 7.0.2
typescript-eslint 8.67.0 8.71.1
vitest 4.1.10 5.0.3
wrangler 4.120.1 4.147.0

Updates @astrojs/cloudflare from 14.2.0 to 14.3.4

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.3.4

Patch Changes

  • #18213 1e5523d Thanks @​astro-factory! - Fixes the globalThis.process shim being prepended to client-side scripts. The shim is now only added to the server output.

  • #18253 78dca00 Thanks @​astro-factory! - Fixes the @astrojs/cloudflare/hono usage example so i18n() is mounted before pages(). In the old order, i18n() never ran, so locale redirects and fallbacks were skipped.

  • #18145 02246c9 Thanks @​astro-factory! - Fixes dev dependency scan failing when a frontmatter line starts with import.meta or import(

  • #17677 4f85749 Thanks @​andreialba! - Fixes remote images without a file extension failing with 400 Unsupported format: null when using the cloudflare-binding image service

    Astro only adds the f (format) parameter to /_image URLs when it can infer a format from the source, and otherwise leaves it off so the image service resolves the format from the source itself. Extensionless remote images, such as GitHub avatars like https://avatars.githubusercontent.com/u/1234, take that path. The image transform endpoint now falls back to the source's media type when f is absent, passing SVG sources through unchanged and encoding everything else as WebP. This also fixes SVG images, which are requested as f=svg and previously failed the same way.

  • #18057 8db3024 Thanks @​asqar! - Fixes astro build failing with fetch failed / connect ECONNREFUSED 127.0.0.1:<port> during prerendering on hosts where localhost resolves to IPv6

    The prerenderer started its Vite preview server with host: 'localhost' and then built the fetch URL by re-stating that same hostname. localhost was therefore resolved twice, independently — once by listen() to pick a bind address and once by fetch() to pick a connect address — with nothing making the two agree. On hosts where those resolutions land on different families, the preview server listens on ::1 while fetch dials 127.0.0.1, and every prerender request is refused. The URL is now derived from the address actually bound, so bind and connect agree by construction.

  • Updated dependencies [6987261, 62b13ba]:

    • @​astrojs/internal-helpers@​0.12.0
    • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.3.3

Patch Changes

  • #18059 30cb32e Thanks @​Princesseuh! - Fixes image transforms without a specified quality outputting an higher quality than expected on certain formats

  • #18091 28d59a9 Thanks @​astro-factory! - Fixes optimizeDeps.include glob astro/runtime/** matching .d.ts files, which caused 83 unnecessary optimizer entries and empty output chunks per environment during dev

  • #18032 f7dbc6a Thanks @​adamchal! - Fixes image requests when using imageService: 'compile' with passthroughImageService().

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.3.2

Patch Changes

  • #17958 b95c574 Thanks @​astro-factory! - Fixes a build failure when the wrangler config uses the exports field to declare Durable Object classes

  • #18022 24946f7 Thanks @​matthewp! - Fixes cold astro dev crashes when using the passthrough image service

  • #17842 d68db73 Thanks @​adamchal! - Fixes broken images on static sites by transforming prerendered images at build time with the default Cloudflare Images binding

  • #17945 750b4db Thanks @​matthewp! - Pre-bundles renderer server entrypoints and the default console logger during dev so they are included in the initial optimization pass, preventing a mid-request re-optimization that could crash the dev server on Cloudflare (workerd).

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.3.1

Patch Changes

  • #17914 a400504 Thanks @​astro-factory! - Fixes a build crash when a custom worker entrypoint exports Durable Object classes alongside prerendered pages. The prerender worker no longer inherits durable_objects, migrations, or workflows from the entry worker config.

  • Updated dependencies []:

... (truncated)

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.3.4

Patch Changes

  • #18213 1e5523d Thanks @​astro-factory! - Fixes the globalThis.process shim being prepended to client-side scripts. The shim is now only added to the server output.

  • #18253 78dca00 Thanks @​astro-factory! - Fixes the @astrojs/cloudflare/hono usage example so i18n() is mounted before pages(). In the old order, i18n() never ran, so locale redirects and fallbacks were skipped.

  • #18145 02246c9 Thanks @​astro-factory! - Fixes dev dependency scan failing when a frontmatter line starts with import.meta or import(

  • #17677 4f85749 Thanks @​andreialba! - Fixes remote images without a file extension failing with 400 Unsupported format: null when using the cloudflare-binding image service

    Astro only adds the f (format) parameter to /_image URLs when it can infer a format from the source, and otherwise leaves it off so the image service resolves the format from the source itself. Extensionless remote images, such as GitHub avatars like https://avatars.githubusercontent.com/u/1234, take that path. The image transform endpoint now falls back to the source's media type when f is absent, passing SVG sources through unchanged and encoding everything else as WebP. This also fixes SVG images, which are requested as f=svg and previously failed the same way.

  • #18057 8db3024 Thanks @​asqar! - Fixes astro build failing with fetch failed / connect ECONNREFUSED 127.0.0.1:<port> during prerendering on hosts where localhost resolves to IPv6

    The prerenderer started its Vite preview server with host: 'localhost' and then built the fetch URL by re-stating that same hostname. localhost was therefore resolved twice, independently — once by listen() to pick a bind address and once by fetch() to pick a connect address — with nothing making the two agree. On hosts where those resolutions land on different families, the preview server listens on ::1 while fetch dials 127.0.0.1, and every prerender request is refused. The URL is now derived from the address actually bound, so bind and connect agree by construction.

  • Updated dependencies [6987261, 62b13ba]:

    • @​astrojs/internal-helpers@​0.12.0
    • @​astrojs/underscore-redirects@​1.0.4

14.3.3

Patch Changes

  • #18059 30cb32e Thanks @​Princesseuh! - Fixes image transforms without a specified quality outputting an higher quality than expected on certain formats

  • #18091 28d59a9 Thanks @​astro-factory! - Fixes optimizeDeps.include glob astro/runtime/** matching .d.ts files, which caused 83 unnecessary optimizer entries and empty output chunks per environment during dev

  • #18032 f7dbc6a Thanks @​adamchal! - Fixes image requests when using imageService: 'compile' with passthroughImageService().

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.4

14.3.2

Patch Changes

  • #17958 b95c574 Thanks @​astro-factory! - Fixes a build failure when the wrangler config uses the exports field to declare Durable Object classes

  • #18022 24946f7 Thanks @​matthewp! - Fixes cold astro dev crashes when using the passthrough image service

  • #17842 d68db73 Thanks @​adamchal! - Fixes broken images on static sites by transforming prerendered images at build time with the default Cloudflare Images binding

  • #17945 750b4db Thanks @​matthewp! - Pre-bundles renderer server entrypoints and the default console logger during dev so they are included in the initial optimization pass, preventing a mid-request re-optimization that could crash the dev server on Cloudflare (workerd).

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.4

14.3.1

Patch Changes

... (truncated)

Commits
  • e4f8f46 [ci] release (#18120)
  • 78dca00 Mount i18n() before pages() in documented astro/hono order (#18253)
  • 1e5523d Scope Cloudflare adapter process banner to SSR and prerender environments onl...
  • 322cd13 Update astro (#18203)
  • 4f85749 fix(cloudflare): resolve image format from the source when f is absent (#17...
  • 02246c9 Fix @astrojs/cloudflare dependency scan incorrectly matching import.meta ...
  • 4ce2fca [ci] format
  • 8db3024 fix(cloudflare): derive prerender server URL from the bound address (#18057)
  • 790c6f7 [ci] release (#18035)
  • 00393ff Update dependency vitest [SECURITY] (#18026)
  • Additional commits viewable in compare view

Updates astro from 7.2.0 to 7.3.6

Release notes

Sourced from astro's releases.

astro@7.3.6

Patch Changes

  • #18166 5134d0f Thanks @​astro-factory! - Fixes an intermittent dev server crash when using astro:actions inside a server island with adapters that use a pre-bundled SSR environment (e.g. @astrojs/cloudflare)

  • #18076 8a2df66 Thanks @​astro-factory! - Fixes stale scoped styles during HMR when both markup and <style> are changed in a single save

  • #18252 2d29e7e Thanks @​astro-factory! - Fixes CSS from other pages leaking into a page's <head> in dev when the page imports a module such as astro:config/server.

  • #18000 6724575 Thanks @​barclayd! - Fixes a bug where server islands containing framework components rendered empty in the dev server when using a custom src/fetch.ts

  • #18241 7c5fd6f Thanks @​astro-factory! - Fixes the composable i18n() handler from astro/fetch and astro/hono returning an empty 404 for paths without a locale prefix. It now renders the custom 404 page, matching astro().

  • #18164 1a6997f Thanks @​astro-factory! - Fixes CSS Module HMR in dev when a component is rendered both with and without hydration on the same page. Astro now uses path-based class name hashing in dev mode so that editing CSS declarations no longer changes the generated selectors, allowing Vite's CSS HMR to update styles without a full page reload.

  • #18243 dd29d62 Thanks @​astro-factory! - Fixes context.props being null in middleware and endpoints when the composable astro/hono or astro/fetch actions() handler runs before middleware(), or when pages() runs without middleware()

  • #18193 95d5d16 Thanks @​astro-factory! - Fixes astro build failing on Windows with Node.js 25+ with ERR_INVALID_ARG_VALUE when clearing the output directory hits a transient EPERM error

  • #18220 d6c13a4 Thanks @​astro-factory! - Fixes type errors reported in Astro's built-in <Picture /> and <Font /> components when type-checking a project with tsc and @astrojs/ts-content-mapper

  • #18133 faac481 Thanks @​astro-factory! - Fixes lost request state when Vite discovers server dependencies during a request in Cloudflare dev mode

  • #18146 2af4516 Thanks @​astro-factory! - Fixes CSS imported from an injectScript('page') script being dropped during build

  • #18159 e5f8fe0 Thanks @​astro-factory! - Fixes a hang when a server:defer component is inside a slot of another component in an MDX content collection entry

  • #18246 c3b42ad Thanks @​astro-factory! - Fixes the glob() loader skipping content files whose paths contain # or ?

  • #18248 b97184e Thanks @​astro-factory! - Fixes a bug where page routes added with injectRoute() returned a 404 when i18n.routing.prefixDefaultLocale was true and the route path had no locale prefix

  • #18251 3415263 Thanks @​astro-factory! - Fixes content collection changes being ignored in astro dev after the dev server restarts because of a config change

  • #18226 ad54af0 Thanks @​imharjot! - Fixes Astro.cookies.get() returning undefined for request cookies with empty values

  • #18155 37ab0e4 Thanks @​astro-factory! - Fixes nondeterministic ordering of the server manifest's assets array, ensuring builds with identical inputs produce byte-identical output

  • #18099 6987261 Thanks @​renovate! - Adds YAML parsing with timestamp and merge key support, and formats YAML errors consistently across Astro, Markdown, MDX, and Markdoc.

  • #15595 64e4039 Thanks @​qzio! - Improves CSRF protection by taking modern browsers headers into account

  • #18215 941bd5e Thanks @​ump45nose! - Fixes a runtime ReferenceError for inlined scripts that import a URL with /* @vite-ignore */.

    Astro now inlines scripts after Vite replaces its preload markers, so ignored dynamic imports can remain inline without shipping an unresolved __VITE_PRELOAD__ reference.

  • #18179 6caa659 Thanks @​matthewp! - Fixes custom View Transition direction names that are not valid CSS identifiers, such as names starting with a digit or containing spaces. These directions now match their animations correctly.

  • #18250 7eae39b Thanks @​astro-factory! - Fixes a 404 for a CSS file that a dynamic import preloads when the imported module uses a component that is also a hydrated island on the same page

  • #18176 7c9d00d Thanks @​astro-factory! - Fixes duplicate CSS in production builds when a component is both server-rendered and used with client:only on the same page

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.6

Patch Changes

  • #18166 5134d0f Thanks @​astro-factory! - Fixes an intermittent dev server crash when using astro:actions inside a server island with adapters that use a pre-bundled SSR environment (e.g. @astrojs/cloudflare)

  • #18076 8a2df66 Thanks @​astro-factory! - Fixes stale scoped styles during HMR when both markup and <style> are changed in a single save

  • #18252 2d29e7e Thanks @​astro-factory! - Fixes CSS from other pages leaking into a page's <head> in dev when the page imports a module such as astro:config/server.

  • #18000 6724575 Thanks @​barclayd! - Fixes a bug where server islands containing framework components rendered empty in the dev server when using a custom src/fetch.ts

  • #18241 7c5fd6f Thanks @​astro-factory! - Fixes the composable i18n() handler from astro/fetch and astro/hono returning an empty 404 for paths without a locale prefix. It now renders the custom 404 page, matching astro().

  • #18164 1a6997f Thanks @​astro-factory! - Fixes CSS Module HMR in dev when a component is rendered both with and without hydration on the same page. Astro now uses path-based class name hashing in dev mode so that editing CSS declarations no longer changes the generated selectors, allowing Vite's CSS HMR to update styles without a full page reload.

  • #18243 dd29d62 Thanks @​astro-factory! - Fixes context.props being null in middleware and endpoints when the composable astro/hono or astro/fetch actions() handler runs before middleware(), or when pages() runs without middleware()

  • #18193 95d5d16 Thanks @​astro-factory! - Fixes astro build failing on Windows with Node.js 25+ with ERR_INVALID_ARG_VALUE when clearing the output directory hits a transient EPERM error

  • #18220 d6c13a4 Thanks @​astro-factory! - Fixes type errors reported in Astro's built-in <Picture /> and <Font /> components when type-checking a project with tsc and @astrojs/ts-content-mapper

  • #18133 faac481 Thanks @​astro-factory! - Fixes lost request state when Vite discovers server dependencies during a request in Cloudflare dev mode

  • #18146 2af4516 Thanks @​astro-factory! - Fixes CSS imported from an injectScript('page') script being dropped during build

  • #18159 e5f8fe0 Thanks @​astro-factory! - Fixes a hang when a server:defer component is inside a slot of another component in an MDX content collection entry

  • #18246 c3b42ad Thanks @​astro-factory! - Fixes the glob() loader skipping content files whose paths contain # or ?

  • #18248 b97184e Thanks @​astro-factory! - Fixes a bug where page routes added with injectRoute() returned a 404 when i18n.routing.prefixDefaultLocale was true and the route path had no locale prefix

  • #18251 3415263 Thanks @​astro-factory! - Fixes content collection changes being ignored in astro dev after the dev server restarts because of a config change

  • #18226 ad54af0 Thanks @​imharjot! - Fixes Astro.cookies.get() returning undefined for request cookies with empty values

  • #18155 37ab0e4 Thanks @​astro-factory! - Fixes nondeterministic ordering of the server manifest's assets array, ensuring builds with identical inputs produce byte-identical output

  • #18099 6987261 Thanks @​renovate! - Adds YAML parsing with timestamp and merge key support, and formats YAML errors consistently across Astro, Markdown, MDX, and Markdoc.

  • #15595 64e4039 Thanks @​qzio! - Improves CSRF protection by taking modern browsers headers into account

  • #18215 941bd5e Thanks @​ump45nose! - Fixes a runtime ReferenceError for inlined scripts that import a URL with /* @vite-ignore */.

    Astro now inlines scripts after Vite replaces its preload markers, so ignored dynamic imports can remain inline without shipping an unresolved __VITE_PRELOAD__ reference.

  • #18179 6caa659 Thanks @​matthewp! - Fixes custom View Transition direction names that are not valid CSS identifiers, such as names starting with a digit or containing spaces. These directions now match their animations correctly.

  • #18250 7eae39b Thanks @​astro-factory! - Fixes a 404 for a CSS file that a dynamic import preloads when the imported module uses a component that is also a hydrated island on the same page

... (truncated)

Commits
  • e4f8f46 [ci] release (#18120)
  • 95d5d16 Fix emptyDir EPERM fallback to use rmSync instead of rmdirSync for Node 25+ c...
  • c5275e3 Skip dev toolbar source annotations when compiling in Vite test mode (#18162)...
  • cb767f9 Remove dead use astro:head-inject directive that caused rolldown MODULE_LEV...
  • 8a2df66 Clear stale compile metadata in HMR when markup and style change together (#1...
  • c7799a4 Support "Variable" suffix in fontsource font family names (#18249)
  • 2b3f73d Return proper action errors for malformed JSON bodies and undecodable action ...
  • 2d29e7e Stop dev-mode CSS collector from crossing page boundaries via `virtual:astro:...
  • c3b42ad fix(content): handle # and ? in glob() loader file paths (#18246)
  • 3415263 Re-initialize content layer after in-place dev server restart (#18251)
  • Additional commits viewable in compare view

Updates fast-xml-parser from 5.10.1 to 5.11.2

Release notes

Sourced from fast-xml-parser's releases.

v5.11.2

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.1...v5.11.2

v5.11.1

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.0...v5.11.1

v5.11.0

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.0

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.11.2 / 2026-09-29

  • fix (#875): decode Uint8Array XML input as UTF-8 (By emme1t)
  • fix (#880) :type EntityDecoderOptions.setXmlVersion's version as a number (By Yevhenii Kotyrlo)

5.11.1 / 2026-08-27

  • fix: validator; Replace regex with a single-pass scanner for attribute tokens, eliminating quadratic behavior on long whitespace runs.

5.11.0 / 2026-08-16

  • feat: support for endIndex in node metadata (#850) [By Pavel Dranichnikov]
  • fix: don't crash on a closing tag with no matching opening tag (#861) [By Haïm Dimer]
  • fix: DOCTYPE to read SYSTEM/PUBLIC
  • deps: strnum v2.4.2

5.10.1 / 2026-07-17

  • fix: multiple DOCTYPE declarations.
  • deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

  • upgrade:
    • xml-naming v0.3.0: cache support
    • PEM v1.6.2: sibling bug fix
    • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

  • update strnum

*5.9.2 / 2026-06-17

  • dummy release to test changes in github action

*5.9.1 / 2026-06-17

  • dummy release to test release from github action

*5.9.0 / 2026-06-15

  • update strnum to 2.3.0
    • you can set hex, binary, enotation, infinity, unicode
  • validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is bydeault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid

... (truncated)

Commits

Updates jose from 6.2.8 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • Description has been truncated

@dependabot
chore(deps): bump the npm-dependencies group across 1 directory with …
5268401 
…17 updates

Bumps the npm-dependencies group with 17 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) | `14.2.0` | `14.3.4` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.2.0` | `7.3.6` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.10.1` | `5.11.2` |
| [jose](https://github.com/panva/jose) | `6.2.8` | `6.2.12` |
| [marked](https://github.com/markedjs/marked) | `18.0.9` | `18.1.0` |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.7` | `2.18.0` |
| [@types/sanitize-html](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sanitize-html) | `2.16.1` | `2.16.2` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.6.4` |
| [@types/sanitize-html](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sanitize-html) | `2.16.1` | `2.16.2` |
| [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.12.0` |
| [eslint-plugin-astro](https://github.com/ota-meshi/eslint-plugin-astro) | `3.1.0` | `3.2.1` |
| [globals](https://github.com/sindresorhus/globals) | `17.9.0` | `17.13.0` |
| [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.9` |
| [prettier-plugin-astro](https://github.com/withastro/prettier-plugin-astro) | `0.14.1` | `1.1.0` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.67.0` | `8.71.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `5.0.3` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.120.1` | `4.147.0` |



Updates `@astrojs/cloudflare` from 14.2.0 to 14.3.4
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@14.3.4/packages/integrations/cloudflare)

Updates `astro` from 7.2.0 to 7.3.6
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.3.6/packages/astro)

Updates `fast-xml-parser` from 5.10.1 to 5.11.2
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.2)

Updates `jose` from 6.2.8 to 6.2.12
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.8...v6.2.12)

Updates `marked` from 18.0.9 to 18.1.0
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](markedjs/marked@v18.0.9...v18.1.0)

Updates `sanitize-html` from 2.17.7 to 2.18.0
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.18.0/packages/sanitize-html)

Updates `@types/sanitize-html` from 2.16.1 to 2.16.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sanitize-html)

Updates `@types/node` from 26.2.0 to 26.6.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/sanitize-html` from 2.16.1 to 2.16.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sanitize-html)

Updates `eslint` from 10.8.1 to 10.12.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.8.1...v10.12.0)

Updates `eslint-plugin-astro` from 3.1.0 to 3.2.1
- [Release notes](https://github.com/ota-meshi/eslint-plugin-astro/releases)
- [Changelog](https://github.com/ota-meshi/eslint-plugin-astro/blob/main/CHANGELOG.md)
- [Commits](ota-meshi/eslint-plugin-astro@v3.1.0...v3.2.1)

Updates `globals` from 17.9.0 to 17.13.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.9.0...v17.13.0)

Updates `prettier` from 3.9.6 to 3.9.9
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.6...3.9.9)

Updates `prettier-plugin-astro` from 0.14.1 to 1.1.0
- [Release notes](https://github.com/withastro/prettier-plugin-astro/releases)
- [Changelog](https://github.com/withastro/prettier-plugin-astro/blob/main/CHANGELOG.md)
- [Commits](withastro/prettier-plugin-astro@v0.14.1...v1.1.0)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v6.0.3...v7.0.2)

Updates `typescript-eslint` from 8.67.0 to 8.71.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.71.1/packages/typescript-eslint)

Updates `vitest` from 4.1.10 to 5.0.3
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest)

Updates `wrangler` from 4.120.1 to 4.147.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.147.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: "@astrojs/cloudflare"
  dependency-version: 14.3.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: astro
  dependency-version: 7.3.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: fast-xml-parser
  dependency-version: 5.11.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: jose
  dependency-version: 6.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: marked
  dependency-version: 18.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: sanitize-html
  dependency-version: 2.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@types/sanitize-html"
  dependency-version: 2.16.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@types/sanitize-html"
  dependency-version: 2.16.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: eslint
  dependency-version: 10.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: eslint-plugin-astro
  dependency-version: 3.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: globals
  dependency-version: 17.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: prettier
  dependency-version: 3.9.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: prettier-plugin-astro
  dependency-version: 1.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.71.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: vitest
  dependency-version: 5.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: wrangler
  dependency-version: 4.147.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants