Skip to content

chore(deps): Bump the minor-and-patch group across 1 directory with 14 updates - #482

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/astro-site/minor-and-patch-9583b849c8
Open

chore(deps): Bump the minor-and-patch group across 1 directory with 14 updates#482
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/astro-site/minor-and-patch-9583b849c8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 18, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 14 updates in the /astro-site directory:

Package From To
@astrojs/markdown-remark 7.2.1 7.2.2
astro 7.1.3 7.2.2
remarque-tokens 0.24.0 0.26.0
sanitize-html 2.17.6 2.17.7
satori 0.28.2 0.29.0
svelte 5.56.7 5.56.9
@astrojs/check 0.9.9 0.9.10
@axe-core/playwright 4.12.1 4.13.0
@typescript-eslint/parser 8.65.0 8.67.0
eslint 10.7.0 10.8.1
eslint-plugin-astro 3.0.1 3.1.0
playwright 1.61.1 1.62.1
remark-smartypants 3.0.2 3.0.3
shiki 4.1.0 4.4.3

Updates @astrojs/markdown-remark from 7.2.1 to 7.2.2

Release notes

Sourced from @​astrojs/markdown-remark's releases.

@​astrojs/markdown-remark@​7.2.2

Patch Changes

  • Updated dependencies [c895b12]:
    • @​astrojs/internal-helpers@​0.10.2
Changelog

Sourced from @​astrojs/markdown-remark's changelog.

7.2.2

Patch Changes

  • Updated dependencies [c895b12]:
    • @​astrojs/internal-helpers@​0.10.2
Commits

Updates astro from 7.1.3 to 7.2.2

Release notes

Sourced from astro's releases.

astro@7.2.2

Patch Changes

  • #17611 9bc3207 Thanks @​thelazylamaGit! - Fixes component styles rendered from content entries remaining stale until a second save when an adapter uses Astro's fallback development environment

  • #17634 2267eee Thanks @​astrobot-houston! - Fixes incremental builds dropping optimized images for cached pages when using a collectStaticImages prerenderer (e.g. @astrojs/cloudflare with compile-time image optimization)

  • #17650 4cdf128 Thanks @​astrobot-houston! - Fixes intermittent ImageNotFound errors during build on projects with many images. The build now limits concurrent image file reads to avoid exhausting OS file descriptors (EMFILE) and retries transient I/O errors with backoff. Non-transient errors are no longer silently swallowed.

  • #17683 2378221 Thanks @​astrobot-houston! - Fixes prerenderConflictBehavior not applying to content collection duplicate ID warnings in the glob() and file() loaders. Setting it to 'error' now throws during content sync, and 'ignore' suppresses the warning.

  • #17659 90c6ea4 Thanks @​astrobot-houston! - Fixes the Fonts API breaking experimental.incrementalBuild caching by embedding a build-local, randomly-assigned server port in generated code used for the dependency hash

  • #17630 fd1d9ee Thanks @​ericclemmons! - Fixes incremental builds becoming prohibitively slow for sites with many pages or content entries that share a large dependency graph.

  • #17690 93beecc Thanks @​NgoQuocViet2001! - Prevents files in directories whose names start with pages from being treated as page routes

  • #17671 09f0dc7 Thanks @​tarikermis! - Fixes astro dev refusing to start after a Docker container restart when an unrelated process reuses the PID from a persisted lock file. Astro now checks the process command across platforms, so stale lock files are cleaned up and --force does not signal the unrelated process.

astro@7.2.1

Patch Changes

  • #17612 7133730 Thanks @​thelazylamaGit! - Fixes CSS hot module replacement after navigating between pages with ClientRouter

  • #17628 4ada248 Thanks @​astrobot-houston! - Fixes a CSP violation when using both security.csp and experimental.clientPrerender with data-astro-prefetch links. The dynamically injected <script type="speculationrules"> now uses a static "source": "document" approach with a CSS selector, producing a deterministic payload that is hashed and included in the CSP script-src directive at build time.

  • #17605 89e4647 Thanks @​ashleigh-yeoman! - Fixes middleware HMR not responding to changes in imported modules. Previously, only direct edits to the middleware file would trigger a reload.

  • #17582 bd2c1a5 Thanks @​astrobot-houston! - Fixes a regression where content collection reference() fields silently accepted entry IDs that don't exist, such as an ID that doesn't match a loader's slugified version of it. Astro now logs an error for references that point to a missing entry after all loaders finish syncing.

  • #17661 97b0cc7 Thanks @​ArmandPhilippot! - Improves Markdown options documentation with links to the Markdown guide and official processors.

  • #17349 4328c73 Thanks @​astrobot-houston! - Fixes an issue where requests handled by the dev prerender environment (e.g. /_image with @astrojs/cloudflare's prerenderEnvironment: 'node') returned a 500 when a prerendered catch-all route existed, because non-prerendered route modules were imported in an environment where their runtime-specific APIs are unavailable

  • #17603 722eed6 Thanks @​astrobot-houston! - Fixes <video> and <audio> elements being non-functional after navigating via view transitions (<ClientRouter />)

  • #17616 3a890d2 Thanks @​lazerg! - Fixes experimental.incrementalBuild re-rendering unchanged routes that import more than one asset. The route's dependency hash depended on the order the assets finished building, so two builds of identical sources could produce different hashes. The hash is now based on the file name each asset resolves to.

  • #17547 fba468c Thanks @​dmgawel! - Improves getCollection() and getEntry() performance for entries without local image references

  • #17602 16e0d9d Thanks @​astrobot-houston! - Fixes a build error caused by hash collisions in generated content collection image import identifiers

astro@7.2.0

Minor Changes

  • #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

    This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

    

    • 






... (truncated)





Changelog

Sourced from astro's changelog.




7.2.2


Patch Changes


    

  • 

    #17611 9bc3207 Thanks @​thelazylamaGit! - Fixes component styles rendered from content entries remaining stale until a second save when an adapter uses Astro's fallback development environment
    

    • 

  • 

    #17634 2267eee Thanks @​astrobot-houston! - Fixes incremental builds dropping optimized images for cached pages when using a collectStaticImages prerenderer (e.g. @astrojs/cloudflare with compile-time image optimization)
    

    • 

  • 

    #17650 4cdf128 Thanks @​astrobot-houston! - Fixes intermittent ImageNotFound errors during build on projects with many images. The build now limits concurrent image file reads to avoid exhausting OS file descriptors (EMFILE) and retries transient I/O errors with backoff. Non-transient errors are no longer silently swallowed.
    

    • 

  • 

    #17683 2378221 Thanks @​astrobot-houston! - Fixes prerenderConflictBehavior not applying to content collection duplicate ID warnings in the glob() and file() loaders. Setting it to 'error' now throws during content sync, and 'ignore' suppresses the warning.
    

    • 

  • 

    #17659 90c6ea4 Thanks @​astrobot-houston! - Fixes the Fonts API breaking experimental.incrementalBuild caching by embedding a build-local, randomly-assigned server port in generated code used for the dependency hash
    

    • 

  • 

    #17630 fd1d9ee Thanks @​ericclemmons! - Fixes incremental builds becoming prohibitively slow for sites with many pages or content entries that share a large dependency graph.
    

    • 

  • 

    #17690 93beecc Thanks @​NgoQuocViet2001! - Prevents files in directories whose names start with pages from being treated as page routes
    

    • 

  • 

    #17671 09f0dc7 Thanks @​tarikermis! - Fixes astro dev refusing to start after a Docker container restart when an unrelated process reuses the PID from a persisted lock file. Astro now checks the process command across platforms, so stale lock files are cleaned up and --force does not signal the unrelated process.
    

    • 



7.2.1


Patch Changes


    

  • 

    #17612 7133730 Thanks @​thelazylamaGit! - Fixes CSS hot module replacement after navigating between pages with ClientRouter
    

    • 

  • 

    #17628 4ada248 Thanks @​astrobot-houston! - Fixes a CSP violation when using both security.csp and experimental.clientPrerender with data-astro-prefetch links. The dynamically injected <script type="speculationrules"> now uses a static "source": "document" approach with a CSS selector, producing a deterministic payload that is hashed and included in the CSP script-src directive at build time.
    

    • 

  • 

    #17605 89e4647 Thanks @​ashleigh-yeoman! - Fixes middleware HMR not responding to changes in imported modules. Previously, only direct edits to the middleware file would trigger a reload.
    

    • 

  • 

    #17582 bd2c1a5 Thanks @​astrobot-houston! - Fixes a regression where content collection reference() fields silently accepted entry IDs that don't exist, such as an ID that doesn't match a loader's slugified version of it. Astro now logs an error for references that point to a missing entry after all loaders finish syncing.
    

    • 

  • 

    #17661 97b0cc7 Thanks @​ArmandPhilippot! - Improves Markdown options documentation with links to the Markdown guide and official processors.
    

    • 

  • 

    #17349 4328c73 Thanks @​astrobot-houston! - Fixes an issue where requests handled by the dev prerender environment (e.g. /_image with @astrojs/cloudflare's prerenderEnvironment: 'node') returned a 500 when a prerendered catch-all route existed, because non-prerendered route modules were imported in an environment where their runtime-specific APIs are unavailable
    

    • 

  • 

    #17603 722eed6 Thanks @​astrobot-houston! - Fixes <video> and <audio> elements being non-functional after navigating via view transitions (<ClientRouter />)
    

    • 

  • 

    #17616 3a890d2 Thanks @​lazerg! - Fixes experimental.incrementalBuild re-rendering unchanged routes that import more than one asset. The route's dependency hash depended on the order the assets finished building, so two builds of identical sources could produce different hashes. The hash is now based on the file name each asset resolves to.
    

    • 

  • 

    #17547 fba468c Thanks @​dmgawel! - Improves getCollection() and getEntry() performance for entries without local image references
    

    • 

  • 

    #17602 16e0d9d Thanks @​astrobot-houston! - Fixes a build error caused by hash collisions in generated content collection image import identifiers
    

    • 



7.2.0


Minor Changes


    

  • #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.
    • 






... (truncated)





Commits

    

  • 14f8f87 [ci] release (#17673)
    • 

  • 93beecc Fix page directory boundary detection (#17690)
    • 

  • 2378221 fix(content): apply prerenderConflictBehavior to content collection duplicate...
    • 

  • fd1d9ee fix(build): Optimize incremental builds with shared content graph hashing (#1...
    • 

  • 8df416a test: skip type check tests in ecosystem-ci (#17587)
    • 

  • 09f0dc7 Detect stale dev server lock files after PID reuse (#17671)
    • 

  • 2267eee fix: preserve restored image transforms when merging adapter-collected images...
    • 

  • 4cdf128 fix(assets): prevent EMFILE errors on large image builds with concurrency lim...
    • 

  • 90c6ea4 fix(fonts): strip volatile server address from incremental build hash (#17659)
    • 

  • 9bc3207 fix(dev): apply the dev CSS plugin to the fallback Astro environment (#17611)
    • 

  • Additional commits viewable in compare view
    • 







Updates remarque-tokens from 0.24.0 to 0.26.0



Changelog

Sourced from remarque-tokens's changelog.




0.26.0 — 2026-07-23


remarque-new-page skill (closes #108) + token-drift.yml optional audit input (closes #110) — the last two items of the skill-suite/CI program.


Added


    

  • .claude/skills/remarque-new-page/SKILL.md — a third Claude Code skill, a companion to (not a restatement of) the existing remarque loader skill: five steps, each ending in a machine gate. (1) load the loader skill's three files rather than build from training-data token values; (2) pick one of REMARQUE.md's seven archetypes, never an invented eighth; (3) for module-backed pages (Essay/Broadsheet/Forms/Palette Deck) fetch the registry item — node_modules/remarque-tokens/registry/<name>.json or the served URL — and verify its sha256 against the integrity pin before applying anything (the same transcription bug issue #89 documents, a hand-copied sidenote aria-label that drifted out of DOM order); (4) wire the page per AGENT_RULES pitfalls #6 (string-form @import only)/#7 (unlayered tokens import) and the .remarque-prose/.content-reading pairing (.remarque-prose supplies typography only, never centers the column); (5) gate acceptance on remarque-audit --json reporting passed: true and the registry item's own markup-contract assertions (sidenote DOM-order, data-entry-number/attr(), label/aria-describedby pairing, data-palette/data-theme co-location — per module).
    • 

  • All three skills now ship in the npm tarball. scripts/lib/skills.mjs's shared SKILLS table gains the new skill (canonical .claude/skills/remarque-new-page/SKILL.md, packaged skills/remarque-new-page/SKILL.md) — scripts/build-skills.mjs/scripts/test-skills.mjs cover it automatically through that shared table, no separate wiring needed for the freshness/frontmatter/flag/path checks. scripts/test-pack.mjs's hardcoded tarball-listing and installed-package assertions are extended to check for the third skill explicitly (that script doesn't read the shared table). New export: remarque-tokens/skills/new-page (→ skills/remarque-new-page/SKILL.md). package.json's existing skills/ files entry already covers the new directory; no files change needed.
    • 

  • README + AGENT_RULES.md "Installing the Skills" — both updated for three skills (three cp commands instead of two) and both skill-listing bullets extended with a remarque-new-page entry.
    • 

  • .github/workflows/token-drift.yml: three new OPTIONAL workflow_call inputs — run-audit (boolean, default false), palette-path (string, default ''), src-dir (string, default '.'). When run-audit: true, a new step runs npx remarque-audit --palette <palette-path> --src <src-dir> from the consumer's own checkout, against the remarque-tokens the consumer already installed under package-dir — one workflow call now covers both the drift and audit gates instead of a caller wiring a second script step by hand. palette-path/src-dir are relative to package-dir (the audit step's working directory), matching how npx remarque-audit is normally invoked locally. The step fails fast with a clear ::error:: if run-audit: true but palette-path is left blank (workflow_call has no conditional-required-input mechanism). Backward compatible by construction: run-audit defaults to false, and both existing callers — williamzujkowski.github.io's audits.yml and tsundoku's deploy.yml, both read on their own main branches for this release — call this workflow today with only css-file/package-dir/remarque-ref, so neither is affected without opting in.
    • 

  • run-golden deliberately NOT added, despite the issue text raising it alongside run-audit. scripts/palette-golden.mjs is remarque-internal tooling: it binds THIS package's own tokens-palette.css to the remarque-light/remarque-dark reference palettes from @williamzujkowski/oklch-terminal-themes and checks remarque's own release hasn't drifted from its golden values. It ships no CLI bin (package.json's bin only exports remarque-audit/remarque-drift/remarque-theme) and takes no --palette/--src arguments a generic consumer could point at their own stylesheet — there is no consumer-facing analog to generify, unlike run-audit/remarque-audit. Documented inline in the workflow's own header comment.
    • 

  • Version-only regeneration of tokens.json/tokens.d.ts/registry.json/registry/*.json (no token, CSS, or registry-content changes this release — tokens.schema.json unchanged).
    • 



0.25.0 — 2026-07-23


remarque-adopt skill + skills npm export (closes #107) — ratified 3-0 (skill-suite vote, 2026-07-23), the anchor item of the skill suite. Codifies the consumer-conformance playbook run five times in one day as hand-written agent briefs (williamzujkowski.github.io#381, tsundoku#243/#237, remarque-starter#7/#8) into a procedural, machine-gated skill.


Added


    

  • .claude/skills/remarque-adopt/SKILL.md — a new Claude Code skill, distinct from the existing remarque loader skill: triggers on "bump remarque-tokens" / "upgrade the design system" / "adopt remarque in an existing site" / an audit failing after a version bump, not on ordinary page work. Five steps, each ending in a machine gate: (1) bump the pin and verify the resolved version, not the range typed — 0.x caret ranges never cross a minor below 1.0, the exact trap that froze remarque-starter at 0.10.x through 0.18.0; (2) discover newly-required tokens mechanically from remarque-audit --json's failures, never by reading the CHANGELOG and guessing; (3) add missing tokens solved against the consumer's own --color-bg/--color-surface/--color-code-bg (keep-if-passing against the package default; the tsundoku#243 hue-collision case — the default viz "red" landing on top of that site's terracotta accent and its own --color-error — is the worked example for checking hue collisions as a distinct failure mode from contrast); (4) run remarque-drift --json and classify FAIL (undocumented core-tier override, fix it) / WARN (documented in DESIGN-DEVIATIONS.md/DESIGN-NOTES.md, ratified) / INFO (palette-tier personalization, expected); (5) a fixed PR-body contract (what changed, token decisions table, drift summary, gate results, anything explicitly declined). Acceptance throughout is pinned to passed: true in the JSON output, never agent judgment.
    • 

  • Both skills now ship in the npm tarball. .claude/skills/{remarque,remarque-adopt}/SKILL.md remain the ONE canonical, hand-authored copies (also what a Claude Code session working in this repo reads directly); scripts/build-skills.mjs copies them byte-for-byte into skills/remarque/SKILL.md and skills/remarque-adopt/SKILL.md for packaging — the same single-source-plus-generated-copy relationship tokens.json already has to the CSS tiers, kept fresh the same way (--check gates CI freshness; a prepack script hook runs the plain copy automatically on every npm pack/npm publish, so a stale packaged copy can't ship even if someone forgets to re-run the script by hand). New exports: remarque-tokens/skills/remarque and remarque-tokens/skills/adopt. package.json's files gains skills/, scripts/build-skills.mjs, and scripts/lib/skills.mjs.
    • 

  • README + AGENT_RULES.md: "Installing the skills" — Claude Code only discovers skills from a project's own .claude/skills/ (or ~/.claude/skills/), never node_modules, so installing the npm package alone does nothing for a consumer's Claude Code session. Both docs now give the exact cp -r node_modules/remarque-tokens/skills/<name> .claude/skills/<name> pair and note the copies are versioned with the installed package, not auto-updating — re-copy on a MAJOR bump.
    • 

  • scripts/test-skills.mjs (enforce-not-instruct applied to the skills themselves, panel condition) — asserts, per skill: frontmatter parses with a non-empty name/description; every CLI flag referenced alongside a remarque-audit/remarque-drift/remarque-theme command line is grepped straight out of scripts/audit.mjs/scripts/drift-check.mjs/scripts/theme.mjs's own arg parsing (not hand-maintained separately, so a renamed flag fails this test instead of shipping a stale doc); every backticked package-relative file path referenced (*.md/*.mjs/*.js/*.json/*.css, excluding consumer-side conventions like DESIGN-DEVIATIONS.md/DESIGN-NOTES.md and node_modules/subpath-export forms) resolves to a real file in this repo; the packaged skills/<name>/SKILL.md copy is byte-identical to the canonical file. Wired into deploy.yml alongside scripts/build-skills.mjs --check.
    • 

  • scripts/test-pack.mjs extended — the real npm-tarball smoke test now also asserts (via tar -tzf) that package/skills/remarque/SKILL.md and package/skills/remarque-adopt/SKILL.md land in the packed tarball, and that both resolve inside the scratch consumer's node_modules/remarque-tokens/skills/ after a real npm install — proving the prepack hook actually fires during a real pack/publish, not just that the files exist in the working tree.
    • 

  • Version-only regeneration of tokens.json/tokens.d.ts/tokens.schema.json and registry.json/registry/*.json (no token or registry content changes this release).
    • 








Commits

    

  • 8840970 feat: remarque-new-page skill + reusable-workflow audit input (closes #108, c...
    • 

  • f3ea75b feat: remarque-adopt skill + skills npm export (closes #107) (#112)
    • 

  • See full diff in compare view
    • 







Updates sanitize-html from 2.17.6 to 2.17.7



Changelog

Sourced from sanitize-html's changelog.




2.17.7 (2026-08-13)


Security


    

  • Fixed an XSS / URL scheme policy bypass affecting configurations that allow the SVG animation elements (animate, animateColor, animateMotion, animateTransform or set) together with attributeName and one of the animation value attributes. The default configuration was not affected, as these elements are not in the default allowedTags. apostrophecms was not affected. Thanks to koyokr for responsibly disclosing the vulnerability (GHSA-g8qq-57p8-ggw5).
    • 








Commits






Updates satori from 0.28.2 to 0.29.0



Release notes

Sourced from satori's releases.




0.29.0


0.29.0 (2026-07-23)


Features








Commits






Updates svelte from 5.56.7 to 5.56.9



Release notes

Sourced from svelte's releases.




svelte@5.56.9


Patch Changes


    

  • 

    fix: skip controlled each fast path while another batch is pending (#18625)
    

    • 

  • 

    fix: better whitespace handling inside printer (#18638)
    

    • 

  • 

    fix: don't duplicate comments in attributes (#18636)
    

    • 

  • 

    fix: preserve CSS comments in the AST printer (#18637)
    

    • 



svelte@5.56.8


Patch Changes


    

  • 

    fix: call onerror and provide a working reset when hydrating a failed boundary (#18556)
    

    • 

  • 

    fix: preserve select selection when spread attributes omit value (#18561)
    

    • 








Changelog

Sourced from svelte's changelog.




5.56.9


Patch Changes


    

  • 

    fix: skip controlled each fast path while another batch is pending (#18625)
    

    • 

  • 

    fix: better whitespace handling inside printer (#18638)
    

    • 

  • 

    fix: don't duplicate comments in attributes (#18636)
    

    • 

  • 

    fix: preserve CSS comments in the AST printer (#18637)
    

    • 



5.56.8


Patch Changes


    

  • 

    fix: call onerror and provide a working reset when hydrating a failed boundary (#18556)
    

    • 

  • 

    fix: preserve select selection when spread attributes omit value (#18561)
    

    • 








Commits






Updates @astrojs/check from 0.9.9 to 0.9.10



Release notes

Sourced from @​astrojs/check's releases.




@​astrojs/check@​0.9.10


Patch Changes








Changelog

Sourced from @​astrojs/check's changelog.




0.9.10


Patch Changes








Commits






Updates @axe-core/playwright from 4.12.1 to 4.13.0



Release notes

Sourced from @​axe-core/playwright's releases.




Release 4.13.0


What's Changed



Full Changelog: dequelabs/axe-core-npm@v4.11.3...v4.13.0







Changelog

Sourced from @​axe-core/playwright's changelog.




4.13.0 (2026-08-10)


Features








Commits






Updates @typescript-eslint/parser from 8.65.0 to 8.67.0



Release notes

Sourced from @​typescript-eslint/parser's releases.




v8.67.0


8.67.0 (2026-08-10)


🚀 Features


    

  • typescript-eslint: export basic globs for using tseslint (#12105)
    • 



❤️ Thank You



See GitHub Releases for more information.


You can read about our versioning strategy and releases on our website.


v8.66.0


8.66.0 (2026-08-03)


🚀 Features


    

  • typescript-estree: handle import.defer() as ImportExpression (#12609)
    • 



🩹 Fixes


    

  • eslint-plugin: [no-unnecessary-type-conversion] ignore shadowed built-ins (#12590)
    • 

  • eslint-plugin: [prefer-nullish-coalescing] handle shadowed Boolean calls (#12591)
    • 

  • eslint-plugin: [no-useless-default-assignment] don't report defaults used by other overloads (#12607)
    • 

  • eslint-plugin: [no-unnecessary-type-parameters] check MappedType key remapping (#12588)
    • 

  • eslint-plugin: [class-literal-property-style] preserve type annotations and don't drop decorators (#12617)
    • 

  • website: list onUnsupportedTypeScriptVersion in parser options (#12585)
    • 



❤️ Thank You



See GitHub Releases for more information.


You can read about our versioning strategy and releases on our website.







Changelog

Sourced from @​typescript-eslint/parser's changelog.




8.67.0 (2026-08-10)


This was a version bump only for parser to align it with other projects, there were no code changes.


See 

    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          chore(deps): Bump the minor-and-patch group across 1 directory with 1…
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          0fd1485
        
      

    

  

    

      
…4 updates

Bumps the minor-and-patch group with 14 updates in the /astro-site directory:

| Package | From | To |
| --- | --- | --- |
| [@astrojs/markdown-remark](https://github.com/withastro/astro/tree/HEAD/packages/markdown/remark) | `7.2.1` | `7.2.2` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.3` | `7.2.2` |
| [remarque-tokens](https://github.com/williamzujkowski/remarque) | `0.24.0` | `0.26.0` |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.6` | `2.17.7` |
| [satori](https://github.com/vercel/satori) | `0.28.2` | `0.29.0` |
| [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.56.7` | `5.56.9` |
| [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check) | `0.9.9` | `0.9.10` |
| [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.12.1` | `4.13.0` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.65.0` | `8.67.0` |
| [eslint](https://github.com/eslint/eslint) | `10.7.0` | `10.8.1` |
| [eslint-plugin-astro](https://github.com/ota-meshi/eslint-plugin-astro) | `3.0.1` | `3.1.0` |
| [playwright](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.1` |
| [remark-smartypants](https://github.com/silvenon/remark-smartypants) | `3.0.2` | `3.0.3` |
| [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `4.1.0` | `4.4.3` |



Updates `@astrojs/markdown-remark` from 7.2.1 to 7.2.2
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/markdown/remark/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/markdown-remark@7.2.2/packages/markdown/remark)

Updates `astro` from 7.1.3 to 7.2.2
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.2/packages/astro)

Updates `remarque-tokens` from 0.24.0 to 0.26.0
- [Changelog](https://github.com/williamzujkowski/remarque/blob/main/CHANGELOG.md)
- [Commits](williamzujkowski/remarque@v0.24.0...v0.26.0)

Updates `sanitize-html` from 2.17.6 to 2.17.7
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/HEAD/packages/sanitize-html)

Updates `satori` from 0.28.2 to 0.29.0
- [Release notes](https://github.com/vercel/satori/releases)
- [Commits](vercel/satori@0.28.2...0.29.0)

Updates `svelte` from 5.56.7 to 5.56.9
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.56.9/packages/svelte)

Updates `@astrojs/check` from 0.9.9 to 0.9.10
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/astro-check/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/check@0.9.10/packages/language-tools/astro-check)

Updates `@axe-core/playwright` from 4.12.1 to 4.13.0
- [Release notes](https://github.com/dequelabs/axe-core-npm/releases)
- [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md)
- [Commits](https://github.com/dequelabs/axe-core-npm/commits/v4.13.0)

Updates `@typescript-eslint/parser` from 8.65.0 to 8.67.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/parser)

Updates `eslint` from 10.7.0 to 10.8.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.7.0...v10.8.1)

Updates `eslint-plugin-astro` from 3.0.1 to 3.1.0
- [Release notes](https://github.com/ota-meshi/eslint-plugin-astro/releases)
- [Changelog](https://github.com/ota-meshi/eslint-plugin-astro/blob/main/CHANGELOG.md)
- [Commits](ota-meshi/eslint-plugin-astro@v3.0.1...v3.1.0)

Updates `playwright` from 1.61.1 to 1.62.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.61.1...v1.62.1)

Updates `remark-smartypants` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/silvenon/remark-smartypants/releases)
- [Commits](silvenon/remark-smartypants@v3.0.2...v3.0.3)

Updates `shiki` from 4.1.0 to 4.4.3
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.4.3/packages/shiki)

---
updated-dependencies:
- dependency-name: "@astrojs/markdown-remark"
  dependency-version: 7.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: astro
  dependency-version: 7.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: remarque-tokens
  dependency-version: 0.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: sanitize-html
  dependency-version: 2.17.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: satori
  dependency-version: 0.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: svelte
  dependency-version: 5.56.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@astrojs/check"
  dependency-version: 0.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@axe-core/playwright"
  dependency-version: 4.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.67.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: eslint-plugin-astro
  dependency-version: 3.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: playwright
  dependency-version: 1.62.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: remark-smartypants
  dependency-version: 3.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: shiki
  dependency-version: 4.4.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      
  dependencies

  Pull requests that update a dependency file

      
  javascript

  Pull requests that update javascript code

  labels


      Aug 18, 2026

    

  



  

  
  

  
    

        

              @dependabot


        

      

            dependabot
Bot

              requested a review
  from williamzujkowski
    as a code owner


        August 18, 2026 17:47        
        
      

    





    

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      
  dependencies

  Pull requests that update a dependency file

      
  javascript

  Pull requests that update javascript code

  labels


      Aug 18, 2026

    

  








      

  
      



  

  @socket-security






  



    

      

  

    

      
          
      

      
            socket-security
    Bot

      

      

      commented


        Aug 18, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        



        

    

  





      


        



  
    

      
          
Review the following changes in direct dependencies. Learn more about Socket for GitHub.






Diff
Package
Supply Chain
Security		
Vulnerability
Quality
Maintenance
License





Addednpm/​@​astrojs/​markdown-remark@​7.2.2991006993100


Addednpm/​@​axe-core/​playwright@​4.13.01001001009970


Addednpm/​satori@​0.29.0981001009870


Addednpm/​@​typescript-eslint/​parser@​8.67.01001007298100


Addednpm/​shiki@​4.4.31001007797100


Addednpm/​remarque-tokens@​0.26.07810010096100


Addednpm/​@​astrojs/​check@​0.9.101001008090100


Addednpm/​playwright@​1.62.11001001009980


Addednpm/​remark-smartypants@​3.0.31001008685100


Addednpm/​svelte@​5.56.9881008798100


Addednpm/​astro@​7.2.2981008898100


Addednpm/​eslint-plugin-astro@​3.1.09810010093100


Addednpm/​sanitize-html@​2.17.710010010094100


Addednpm/​eslint@​10.8.19710010095100





View full report



      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    
















  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










    
        

  

    
    

    

  

    Reviewers
  


    


      

          


  
      @williamzujkowski
  
    williamzujkowski


          Awaiting requested review from williamzujkowski


                    williamzujkowski is a code owner
      



      







  
      

  


      
  

    Assignees
  



        


    No one assigned







  
        


  


  

    Labels
  



    

      
    dependencies

  Pull requests that update a dependency file
  
    javascript

  Pull requests that update javascript code








  
        

  

    

        

    Projects
  


        




    None yet




  



  
        


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

  
  
        

  

    

      0 participants