build(deps): bump the website-minor-patch group across 1 directory with 6 updates

[dependabot]

Bumps the website-minor-patch group with 6 updates in the /website directory:

Package	From	To
@astrojs/starlight	0.41.5	0.41.7
@biomejs/biome	2.5.6	2.5.7
@types/react	19.2.17	19.2.18
@types/react-dom	19.2.3	19.2.4
astro	7.1.6	7.2.0
vite	8.2.0	8.2.1

Updates @astrojs/starlight from 0.41.5 to 0.41.7

Release notes

Sourced from @​astrojs/starlight's releases.

@​astrojs/starlight@​0.41.7

Patch Changes

• #4114 3e486fb Thanks @​delucis! - Fixes processing of code examples in RTL languages when using Astro’s Sätteri Markdown processor

@​astrojs/starlight@​0.41.6

Patch Changes

• #4102 f1dddc0 Thanks @​delucis! - Adds 1 new icon: forgejo

Changelog

Sourced from @​astrojs/starlight's changelog.

0.41.7

Patch Changes

• #4114 3e486fb Thanks @​delucis! - Fixes processing of code examples in RTL languages when using Astro’s Sätteri Markdown processor

0.41.6

Patch Changes

• #4102 f1dddc0 Thanks @​delucis! - Adds 1 new icon: forgejo

Commits

• 656ffd5 [ci] release (#4115)
• 612fd0a Update dependencies (#4113)
• 3e486fb Refactor Sätteri RTL code support plugin (#4114)
• ae0838f [ci] release (#4106)
• f1dddc0 Add Forgejo icon (#4102)
• See full diff in compare view

Updates @biomejs/biome from 2.5.6 to 2.5.7

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.7

2.5.7

Patch Changes

• #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

• #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

• #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

• #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.

• #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:

  ├── biome.json
  └── subdirectory
      ├── biome.json
      └── lib.js
  

  biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js

  Now, the nested configuration is correctly picked up and applied.

  In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.

• #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

  The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:

  declare function schedule(handler: () => void): string;
  declare function schedule(handler: () => Promise<void>): string | undefined;
  schedule(async () => {}) ?? "fallback";

  The following code is also now invalid, because map(() => 42) returns 42:

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.7

Patch Changes

• #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

• #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

• #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

• #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.

• #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:

  ├── biome.json
  └── subdirectory
      ├── biome.json
      └── lib.js
  

  biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js

  Now, the nested configuration is correctly picked up and applied.

  In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.

• #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

  The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:

  declare function schedule(handler: () => void): string;
  declare function schedule(handler: () => Promise<void>): string | undefined;
  schedule(async () => {}) ?? "fallback";

  The following code is also now invalid, because map(() => 42) returns 42:

  type Mapper<T> = () => T;
  declare function map<T>(mapper: Mapper<T>): T;

... (truncated)

Commits

• 191d051 ci: release (#11119)
• 9847e68 feat(lint): add noNonScalableViewport rule (#11168)
• e63354c feat(lint): add noExtendNative nursery rule (#11136)
• 2fa0a62 docs: rework CLI (#11134)
• e007143 feat(lint): add nursery rule noTailwindArbitraryValue (#10094)
• c171b3b feat(lint): add ignoreIfStatements option to useNullishCoalescing (#10822)
• See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

• See full diff in compare view

Updates @types/react-dom from 19.2.3 to 19.2.4

Commits

• See full diff in compare view

Updates astro from 7.1.6 to 7.2.0

Release notes

Sourced from astro's releases.

astro@7.2.0

Minor Changes

• #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

  This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

  astro preview --background

  When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

  astro preview status
  astro preview logs
  astro preview logs --follow
  astro preview stop

  If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

  To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

• #17532 7f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

  Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  logger: {
  
  entrypoint: new URL('./src/logger.js', import.meta.url),
  
  
  entrypoint: './src/logger.js',
  },
  });

Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

#17084 961bbe5 Thanks @​matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

import type { AstroPrerenderer, PrerenderResult } from 'astro';
const prerenderer: AstroPrerenderer = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.0

Minor Changes

• #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

  This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

  astro preview --background

  When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

  astro preview status
  astro preview logs
  astro preview logs --follow
  astro preview stop

  If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

  To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

• #17532 7f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

  Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  logger: {
  
  entrypoint: new URL('./src/logger.js', import.meta.url),
  
  
  entrypoint: './src/logger.js',
  },
  });

Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

#17084 961bbe5 Thanks @​matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

import type { AstroPrerenderer, PrerenderResult } from 'astro';

... (truncated)

Commits

• 60e9432 [ci] release (#17558)
• af92694 docs: slightly reword session options description (#17607)
• caace2e [ci] format
• 0224a3a Add background mode for astro preview (#17174)
• 961bbe5 Experimental incremental static builds (#17084)
• 7f94895 feat(logger): allow passing relative string entrypoints (#17532)
• 90c98ae feat(session): add session: false to opt out of session support (#16871)
• 3ea55ce Support detect devEngines for installs (#17579)
• 0089f83 Fix Content Layer build crash when neotraverse 0.6.x is hoisted by another de...
• f4150da [ci] format
• Additional commits viewable in compare view

Updates vite from 8.2.0 to 8.2.1

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.1

Please refer to CHANGELOG.md for details.

v8.2.1

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.1 (2026-08-06)

Bug Fixes

• build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)
• bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)
• css: don't re-run lightningcss visitor during minify (fix #23146) (#23147) (de041a7)
• deps: update all non-major dependencies (#23136) (14454fd)
• deps: update rolldown-related dependencies (#23070) (7ac6f7f)
• don't mutate the user config when resolving the lib entry from the top-level input (#23135) (b4bf596)
• handle shebang ending with uncommon line terminators (#23038) (17f7b2f)
• server: use a random port when port is 0 (#23158) (fddf4ea)

Performance Improvements

• css: look up pure CSS chunks through a Set (#23114) (1331b0b)

Documentation

• build: fix incomplete @default for build.minify (#23177) (ef02435)

Miscellaneous Chores

• deps: update dependency rolldown-plugin-dts to ^0.28.0 (#23137) (4adc1e7)
• deps: update dependency strip-literal to v4 (#23140) (9db65ce)

Code Refactoring

• bundled-dev: avoid injecting server values in the bundle (#22967) (23b8a08)
• bundled-dev: remove rolldown lazy stub module workaround (#23129) (e72036e)

Tests

• bundled-dev: enable sourcemap playgrounds (#23080) (c2155fe)
• reduce logs (#23138) (7673c02)

Commits

• 4216158 release: v8.2.1
• fddf4ea fix(server): use a random port when port is 0 (#23158)
• de041a7 fix(css): don't re-run lightningcss visitor during minify (fix #23146) (#23147)
• 15f0307 fix(build): make client chunkImportMap work with sharedPlugins: true (#23184)
• c2155fe test(bundled-dev): enable sourcemap playgrounds (#23080)
• ef02435 docs(build): fix incomplete @default for build.minify (#23177)
• eac0cc8 fix(bundled-dev): inject client script tag before chunk scripts (#23161)
• 23b8a08 refactor(bundled-dev): avoid injecting server values in the bundle (#22967)
• e72036e refactor(bundled-dev): remove rolldown lazy stub module workaround (#23129)
• 14454fd fix(deps): update all non-major dependencies (#23136)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[semgrep-code-tajemniktv]

Semgrep identified an issue, but thinks it may be safe to ignore.
Package dependencies with variant versions may lead to dependency hijack and confusion attacks. Better to specify an exact version or use package-lock.json for a specific version of the package.

Why this might be safe to ignore:

This is a development dependency in a package.json file using caret (^) version ranges, which is standard practice in Node.js projects. The project uses an 'overrides' section and likely has a package-lock.json file (as is standard) that locks dependencies to exact versions in production, mitigating dependency confusion risks. The LOW confidence rating and standard development workflow make this a false positive.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[semgrep-code-tajemniktv]

Semgrep identified an issue, but thinks it may be safe to ignore.
Package dependencies with variant versions may lead to dependency hijack and confusion attacks. Better to specify an exact version or use package-lock.json for a specific version of the package.

Why this might be safe to ignore:

This is a low-confidence dependency version pinning finding in package.json, and the matched caret range is standard package manager usage rather than a directly exploitable issue by itself. Without evidence that installs occur without a lockfile or from an untrusted registry, this does not meaningfully indicate a security vulnerability.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.

_{You can view more details about this finding in the Semgrep AppSec Platform.}