chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: astro.

Updates astro from 5.16.6 to 7.2.9

Release notes

Sourced from astro's releases.

astro@7.2.9

Patch Changes

• #17846 b441180 Thanks @​Princesseuh! - Fixes importing .html files not being typed outside of .astro files

• #17831 32e8b44 Thanks @​astro-factory! - Fixes a crash when requesting /index.html against a dynamic page route like [slug].astro

• #17841 c35448e Thanks @​astro-factory! - Fixes SSR manifest containing stale entryModules references to prerender-only chunks that no longer exist in the final build output

• #17847 eb87a23 Thanks @​matthewp! - Fixes set:text escaping in MDX script and style elements

astro@7.2.8

Patch Changes

• #17837 ecb4082 Thanks @​matthewp! - Updates the minimum supported version of Sharp to 0.35.4

• #17786 db7c53b Thanks @​gameroman! - Replaces the internal find-process dependency with a smaller, lighter alternative

astro@7.2.7

Patch Changes

• #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

• #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

• #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

• #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

• #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

astro@7.2.6

Patch Changes

• #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

astro@7.2.5

Patch Changes

• #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

• #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

• #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

• #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

• #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

• #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

... (truncated)

Changelog

Sourced from astro's changelog.

5.17.1

Patch Changes

• #15334 d715f1f Thanks @​florian-lefebvre! - BREAKING CHANGE to the experimental Fonts API only

  Removes the getFontBuffer() helper function exported from astro:assets when using the experimental Fonts API

  This experimental feature introduced in v15.6.13 ended up causing significant memory usage during build. This feature has been removed and will be reintroduced after further exploration and testing.

  If you were relying on this function, you can replicate the previous behavior manually:

  • On prerendered routes, read the file using node:fs
  • On server rendered routes, fetch files using URLs from fontData and context.url

5.17.0

Minor Changes

• #14932 b19d816 Thanks @​patrickarlt! - Adds support for returning a Promise from the parser() option of the file() loader

  This enables you to run asynchronous code such as fetching remote data or using async parsers when loading files with the Content Layer API.

  For example:

  import { defineCollection } from 'astro:content';
  import { file } from 'astro/loaders';
  const blog = defineCollection({
  loader: file('src/data/blog.json', {
  parser: async (text) => {
  const data = JSON.parse(text);
    // Perform async operations like fetching additional data
    const enrichedData = await fetch(`https://api.example.com/enrich`, {
      method: 'POST',
      body: JSON.stringify(data),
    }).then((res) => res.json());
  return enrichedData;
  },
  
  }),
  });
  export const collections = { blog };

  See the parser() reference documentation for more information.

• #15171 f220726 Thanks @​mark-ignacio! - Adds a new, optional kernel configuration option to select a resize algorithm in the Sharp image service

... (truncated)

Commits

• ad7a332 [ci] release (#17845)
• eb87a23 Escape set:text values in Astro JSX (#17847)
• b441180 fix(astro): type .html imports outside of .astro files (#17846)
• 32e8b44 Guard against stripping /index.html when stripped pathname no longer matches ...
• c35448e fix(build): strip prerender-only entry specifiers from SSR manifest (#17841)
• 7cadf10 [ci] release (#17826)
• ecb4082 Update Sharp to 0.35.4 (#17837)
• 8bf6f1a chore: split v5/v6 changelogs (#17825)
• db7c53b chore(deps): replace "find-process" with a smaller, lighter alternative (#17786)
• eface15 [ci] release (#17815)
• Additional commits viewable in compare view

Updates esbuild from 0.25.12 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

0.27.2

• Allow import path specifiers starting with #/ (#4361)

  Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

  This change was contributed by @​hybrist.

• Automatically add the -webkit-mask prefix (#4357, #4358)

  This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

  /* Original code */
  main {
    mask: url(x.png) center/5rem no-repeat
  }
  /* Old output (with --target=chrome110) */
  main {
  mask: url(x.png) center/5rem no-repeat;
  }
  /* New output (with --target=chrome110) */
  main {
  -webkit-mask: url(x.png) center/5rem no-repeat;
  mask: url(x.png) center/5rem no-repeat;
  }

  This change was contributed by @​BPJEnnova.

• Additional minification of switch statements (#4176, #4359)

  This release contains additional minification patterns for reducing switch statements. Here is an example:

  // Original code
  switch (x) {
    case 0:
      foo()
      break
    case 1:
    default:
      bar()
  }

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[cloudflare-workers-and-pages]

Deploying modestbench with    Cloudflare Pages

Latest commit:	c97a7c3
Status:	🚫  Build failed.

View logs

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​astrojs/​mdx@​4.3.14 ⏵ 7.0.8			+1
	@​astrojs/​starlight@​0.37.7 ⏵ 0.41.9			+1
	astro@​5.16.6 ⏵ 7.2.9	+10	+29	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@astrojs/mdx@7.0.8 → npm/@astrojs/starlight@0.41.9 → npm/astro@7.2.9 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[boneskull]

@dependabot rebase