Bump the npm_and_yarn group across 1 directory with 4 updates #79

dependabot · 2025-09-15T10:13:20Z

Bumps the npm_and_yarn group with 3 updates in the /frontend directory: @astrojs/node, astro and devalue.

Updates @astrojs/node from 9.2.1 to 9.4.1

Release notes

Sourced from @astrojs/node's releases.

@astrojs/node@9.4.1

Patch Changes

5fc3c59 Thanks @ematipico! - Fixes a routing bug in standalone mode with trailingSlash set to "always".

@astrojs/node@9.4.0

Minor Changes
#14188 e3422aa Thanks @ascorbic! - Adds support for specifying a host to load prerendered error pages

By default, if a user defines a custom error page that is prerendered, Astro will load it from the same host as the one that the request is made to. This change allows users to specify a different host for loading prerendered error pages. This can be useful in scenarios such as where the server is running behind a reverse proxy or when prerendered pages are hosted on a different domain.

To use this feature, set the experimentalErrorPageHost adapter option in your Astro configuration to the desired host URL. For example, if your server is running on localhost and served via a proxy, you can ensure the prerendered error pages are fetched via the localhost URL:
import { defineConfig } from 'astro/config';
import node from '@astrojs/node';
export default defineConfig({
  adapter: node({
    // If your server is running on localhost and served via a proxy, set the host like this to ensure prerendered error pages are fetched via the localhost URL
    experimentalErrorPageHost: 'http://localhost:4321',
  }),
});
For more information on enabling and using this experimental feature, see the @astrojs/node adapter docs.
@astrojs/node@9.3.3

Patch Changes

Updated dependencies [0567fb7]:

@astrojs/internal-helpers@0.7.1

@astrojs/node@9.3.2

Patch Changes

Updated dependencies [f4e8889]:

@astrojs/internal-helpers@0.7.0

@astrojs/node@9.3.1

Patch Changes

#14148 e4d74ba Thanks @ColoredCarrot! - fix(node): emit set-cookie header from middlewares for not-found routes (#14136)

@astrojs/node@9.3.0

Minor Changes

#14012 a125a14 Thanks @florian-lefebvre! - Adds a new experimental configuration option experimentalDisableStreaming to allow you to opt out of Astro's default HTML streaming for pages rendered on demand.

HTML streaming helps with performance and generally provides a better visitor experience. In most cases, disabling streaming is not recommended.

... (truncated)

Changelog

Sourced from @astrojs/node's changelog.

9.4.1

Patch Changes

5fc3c59 Thanks @ematipico! - Fixes a routing bug in standalone mode with trailingSlash set to "always".

9.4.0

Minor Changes
#14188 e3422aa Thanks @ascorbic! - Adds support for specifying a host to load prerendered error pages

By default, if a user defines a custom error page that is prerendered, Astro will load it from the same host as the one that the request is made to. This change allows users to specify a different host for loading prerendered error pages. This can be useful in scenarios such as where the server is running behind a reverse proxy or when prerendered pages are hosted on a different domain.

To use this feature, set the experimentalErrorPageHost adapter option in your Astro configuration to the desired host URL. For example, if your server is running on localhost and served via a proxy, you can ensure the prerendered error pages are fetched via the localhost URL:
import { defineConfig } from 'astro/config';
import node from '@astrojs/node';
export default defineConfig({
  adapter: node({
    // If your server is running on localhost and served via a proxy, set the host like this to ensure prerendered error pages are fetched via the localhost URL
    experimentalErrorPageHost: 'http://localhost:4321',
  }),
});
For more information on enabling and using this experimental feature, see the @astrojs/node adapter docs.
9.3.3

Patch Changes

Updated dependencies [0567fb7]:

@astrojs/internal-helpers@0.7.1

9.3.2

Patch Changes

Updated dependencies [f4e8889]:

@astrojs/internal-helpers@0.7.0

9.3.1

Patch Changes

#14148 e4d74ba Thanks @ColoredCarrot! - fix(node): emit set-cookie header from middlewares for not-found routes (#14136)

9.3.0

... (truncated)

Commits

a186848 [ci] release (#14217)
d55b88a [ci] format
5fc3c59 Merge commit from fork
dc9e35c [ci] release (#14189)
56a05aa [ci] format
e3422aa feat: add support for specifying a prerendered error page host (#14188)
0f0a4c4 [ci] release (#14172)
5eaf524 [ci] release (#14171)
09b533b [ci] release (#14149)
e4d74ba fix(node): emit set-cookie header from middlewares for not-found routes (#141...
Additional commits viewable in compare view

Updates astro from 5.12.9 to 5.13.7

Release notes

Sourced from astro's releases.

[email protected]

Patch Changes

#14330 72e14ab Thanks @ascorbic! - Removes pinned package that is no longer needed.

#14335 17c7b03 Thanks @florian-lefebvre! - Bumps sharp minimal version to 0.34.0

[email protected]

Patch Changes

#14294 e005855 Thanks @martrapp! - Restores the ability to use Google Analytics History change trigger with the <ClientRouter />.

#14326 c24a8f4 Thanks @jsparkdev! - Updates vite version to fix CVE

#14108 218e070 Thanks @JusticeMatthew! - Updates dynamic route split regex to avoid infinite retries/exponential complexity

#14327 c1033be Thanks @ascorbic! - Pins simple-swizzle to avoid compromised version

[email protected]

Patch Changes

#14286 09c5db3 Thanks @ematipico! - BREAKING CHANGES only to the experimental CSP feature

The following runtime APIs of the Astro global have been renamed:

Astro.insertDirective to Astro.csp.insertDirective

Astro.insertStyleResource to Astro.csp.insertStyleResource

Astro.insertStyleHash to Astro.csp.insertStyleHash

Astro.insertScriptResource to Astro.csp.insertScriptResource

Astro.insertScriptHash to Astro.csp.insertScriptHash

The following runtime APIs of the APIContext have been renamed:

ctx.insertDirective to ctx.csp.insertDirective

ctx.insertStyleResource to ctx.csp.insertStyleResource

ctx.insertStyleHash to ctx.csp.insertStyleHash

ctx.insertScriptResource to ctx.csp.insertScriptResource

ctx.insertScriptHash to ctx.csp.insertScriptHash

#14283 3224637 Thanks @ematipico! - Fixes an issue where CSP headers were incorrectly injected in the development server.

#14275 3e2f20d Thanks @florian-lefebvre! - Adds support for experimental CSP when using experimental fonts

Experimental fonts now integrate well with experimental CSP by injecting hashes for the styles it generates, as well as font-src directives.

No action is required to benefit from it.

#14280 4b9fb73 Thanks @ascorbic! - Fixes a bug that caused cookies to not be correctly set when using middleware sequences

#14276 77281c4 Thanks @ArmandPhilippot! - Adds a missing export for resolveSrc, a documented image services utility.

... (truncated)

Changelog

Sourced from astro's changelog.

5.13.7

Patch Changes

#14330 72e14ab Thanks @ascorbic! - Removes pinned package that is no longer needed.

#14335 17c7b03 Thanks @florian-lefebvre! - Bumps sharp minimal version to 0.34.0

5.13.6

Patch Changes

#14294 e005855 Thanks @martrapp! - Restores the ability to use Google Analytics History change trigger with the <ClientRouter />.

#14326 c24a8f4 Thanks @jsparkdev! - Updates vite version to fix CVE

#14108 218e070 Thanks @JusticeMatthew! - Updates dynamic route split regex to avoid infinite retries/exponential complexity

#14327 c1033be Thanks @ascorbic! - Pins simple-swizzle to avoid compromised version

5.13.5

Patch Changes

#14286 09c5db3 Thanks @ematipico! - BREAKING CHANGES only to the experimental CSP feature

The following runtime APIs of the Astro global have been renamed:

Astro.insertDirective to Astro.csp.insertDirective

Astro.insertStyleResource to Astro.csp.insertStyleResource

Astro.insertStyleHash to Astro.csp.insertStyleHash

Astro.insertScriptResource to Astro.csp.insertScriptResource

Astro.insertScriptHash to Astro.csp.insertScriptHash

The following runtime APIs of the APIContext have been renamed:

ctx.insertDirective to ctx.csp.insertDirective

ctx.insertStyleResource to ctx.csp.insertStyleResource

ctx.insertStyleHash to ctx.csp.insertStyleHash

ctx.insertScriptResource to ctx.csp.insertScriptResource

ctx.insertScriptHash to ctx.csp.insertScriptHash

#14283 3224637 Thanks @ematipico! - Fixes an issue where CSP headers were incorrectly injected in the development server.

#14275 3e2f20d Thanks @florian-lefebvre! - Adds support for experimental CSP when using experimental fonts

Experimental fonts now integrate well with experimental CSP by injecting hashes for the styles it generates, as well as font-src directives.

No action is required to benefit from it.

#14280 4b9fb73 Thanks @ascorbic! - Fixes a bug that caused cookies to not be correctly set when using middleware sequences

... (truncated)

Commits

468c845 [ci] release (#14336)
72e14ab fix: remove the pinned simple-swizzle (#14330)
17c7b03 feat: update sharp (#14335)
aa7bebd [ci] release (#14295)
c1033be fix: pin simple-swizzle (#14327)
c24a8f4 fix(vite): update vite to fix CVE (#14326)
218e070 Fix: Dynamic route split regex (#14108)
0eba233 fix(deps): update astro dependencies (#14308)
d63f6bb fix(deps): update astro dependencies (#13749)
bdc8ce2 fix(deps): update astro dependencies (#14305)
Additional commits viewable in compare view

Updates vite from 6.3.5 to 6.3.6

Release notes

Sourced from vite's releases.

v6.3.6

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.3.6 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (0ab19ea), closes #20736

fix: upgrade sirv to 3.0.2 (#20735) (e11d240), closes #20735

test: detect ts support via process.features (#20544) (7d99229), closes #20544

Commits

3f337c5 release: v6.3.6
e11d240 fix: upgrade sirv to 3.0.2 (#20735)
0ab19ea fix: apply fs.strict check to HTML files (#20736)
7d99229 test: detect ts support via process.features (#20544)
See full diff in compare view

Updates devalue from 5.1.1 to 5.3.2

Release notes

Sourced from devalue's releases.

v5.3.2

Patch Changes

0623a47: fix: disallow array method access when parsing

0623a47: fix: disallow __proto__ properties on objects

v5.3.1

Patch Changes

ae904c5: fix: correctly differentiate between +0 and -0

v5.3.0

Minor Changes

2896e7b: feat: support Temporal

fec694d: feat: support URL and URLSearchParams objects

Changelog

Sourced from devalue's changelog.

5.3.2

Patch Changes

0623a47: fix: disallow array method access when parsing

0623a47: fix: disallow __proto__ properties on objects

5.3.1

Patch Changes

ae904c5: fix: correctly differentiate between +0 and -0

5.3.0

Minor Changes

2896e7b: feat: support Temporal

fec694d: feat: support URL and URLSearchParams objects

5.2.1

Patch Changes

e46f4c8: fix: handle repeated array buffers and subarrays

2dfa504: fix: handle custom classes with null proto as pojo

5.2.0

Handle custom classes with null proto as pojo (#95)

Commits

86a6a66 Version Packages (#109)
0623a47 Merge commit from fork
02d20e8 Version Packages (#108)
ae904c5 fix stringify not picking up negative zero if a normal zero has appeared befo...
e95b87a fix pkg.repository
8300172 fix changeset config
434d8ae Version Packages (#106)
67c8334 mention support for URL/URLSearchParams/Temporal in README
fec694d feat: support URL and URLSearchParams (#92)
2896e7b Add support for Temporal objects (#98)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by svelte-admin, a new releaser for devalue since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps the npm_and_yarn group with 3 updates in the /frontend directory: [@astrojs/node](https://github.com/withastro/astro/tree/HEAD/packages/integrations/node), [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) and [devalue](https://github.com/sveltejs/devalue). Updates `@astrojs/node` from 9.2.1 to 9.4.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/node/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/integrations/node) Updates `astro` from 5.12.9 to 5.13.7 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/[email protected]/packages/astro) Updates `vite` from 6.3.5 to 6.3.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.3.6/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.3.6/packages/vite) Updates `devalue` from 5.1.1 to 5.3.2 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.1.1...v5.3.2) --- updated-dependencies: - dependency-name: "@astrojs/node" dependency-version: 9.4.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: astro dependency-version: 5.13.7 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.3.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.3.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 15, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 4 updates #79

Bump the npm_and_yarn group across 1 directory with 4 updates #79

Uh oh!

dependabot bot commented on behalf of github Sep 15, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bump the npm_and_yarn group across 1 directory with 4 updates #79

Are you sure you want to change the base?

Bump the npm_and_yarn group across 1 directory with 4 updates #79

Uh oh!

Conversation

dependabot bot commented on behalf of github Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​astrojs/node@​9.4.1

Patch Changes

@​astrojs/node@​9.4.0

Minor Changes

@​astrojs/node@​9.3.3

Patch Changes

@​astrojs/node@​9.3.2

Patch Changes

@​astrojs/node@​9.3.1

Patch Changes

@​astrojs/node@​9.3.0

Minor Changes

9.4.1

Patch Changes

9.4.0

Minor Changes

9.3.3

Patch Changes

9.3.2

Patch Changes

9.3.1

Patch Changes

9.3.0

[email protected]

Patch Changes

[email protected]

Patch Changes

[email protected]

Patch Changes

5.13.7

Patch Changes

5.13.6

Patch Changes

5.13.5

Patch Changes

v6.3.6

6.3.6 (2025-09-08)

v5.3.2

Patch Changes

v5.3.1

Patch Changes

v5.3.0

Minor Changes

5.3.2

Patch Changes

5.3.1

Patch Changes

5.3.0

Minor Changes

5.2.1

Patch Changes

5.2.0

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Sep 15, 2025 •

edited

Loading

`@astrojs/node@9`.4.1

`@astrojs/node@9`.4.0

`@astrojs/node@9`.3.3

`@astrojs/node@9`.3.2

`@astrojs/node@9`.3.1

`@astrojs/node@9`.3.0