build(deps): bump the website-minor-patch group across 1 directory with 7 updates

[dependabot]

Bumps the website-minor-patch group with 7 updates in the /website directory:

Package	From	To
@astrojs/mdx	7.0.5	7.0.7
@astrojs/react	6.0.2	6.0.4
@biomejs/biome	2.5.7	2.5.9
astro	7.2.0	7.2.4
starlight-blog	0.28.0	0.29.0
starlight-links-validator	0.25.2	0.25.3
vite	8.2.1	8.2.2

Updates @astrojs/mdx from 7.0.5 to 7.0.7

Release notes

Sourced from @​astrojs/mdx's releases.

@​astrojs/mdx@​7.0.7

Patch Changes

• #17731 bc171af Thanks @​Princesseuh! - Updates Sätteri processor to v0.10.3. See its changelog for details on bugs fixed and features added.

• Updated dependencies [05763a0]:

  • @​astrojs/internal-helpers@​0.10.4
  • @​astrojs/markdown-remark@​7.2.4

@​astrojs/mdx@​7.0.6

Patch Changes

• Updated dependencies [8c193f6]:
  • @​astrojs/internal-helpers@​0.10.3
  • @​astrojs/markdown-remark@​7.2.3

Changelog

Sourced from @​astrojs/mdx's changelog.

7.0.7

Patch Changes

• #17731 bc171af Thanks @​Princesseuh! - Updates Sätteri processor to v0.10.3. See its changelog for details on bugs fixed and features added.

• Updated dependencies [05763a0]:

  • @​astrojs/internal-helpers@​0.10.4
  • @​astrojs/markdown-remark@​7.2.4

7.0.6

Patch Changes

• Updated dependencies [8c193f6]:
  • @​astrojs/internal-helpers@​0.10.3
  • @​astrojs/markdown-remark@​7.2.3

Commits

• 8a31cba [ci] release (#17739)
• bc171af feat(satteri): update to Sätteri 0.10.x (#17731)
• 52e6c34 [ci] release (#17691)
• See full diff in compare view

Updates @astrojs/react from 6.0.2 to 6.0.4

Release notes

Sourced from @​astrojs/react's releases.

@​astrojs/react@​6.0.4

Patch Changes

• Updated dependencies [05763a0]:
  • @​astrojs/internal-helpers@​0.10.4

@​astrojs/react@​6.0.3

Patch Changes

• Updated dependencies [8c193f6]:
  • @​astrojs/internal-helpers@​0.10.3

Changelog

Sourced from @​astrojs/react's changelog.

6.0.4

Patch Changes

• Updated dependencies [05763a0]:
  • @​astrojs/internal-helpers@​0.10.4

6.0.3

Patch Changes

• Updated dependencies [8c193f6]:
  • @​astrojs/internal-helpers@​0.10.3

Commits

• 8a31cba [ci] release (#17739)
• 52e6c34 [ci] release (#17691)
• See full diff in compare view

Updates @biomejs/biome from 2.5.7 to 2.5.9

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.9

2.5.9

Patch Changes

• #11321 41386f3 Thanks @​dyc3! - Fixed #11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.

• #11248 57b197e Thanks @​yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.

• #11377 a8798ea Thanks @​Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.

  @layer {
    a {
      color: red;
    }
  }

• #11327 6771cf5 Thanks @​dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.

   <div>
     <!-- first group -->
  +
     <!-- second group -->
   </div>

• #10312 ba8aa18 Thanks @​dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.

• #11333 715e0cd Thanks @​kkkhs! - Fixed #11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.

• #11343 9b98211 Thanks @​johncarmack1984! - Fixed #11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.

  @variant @xl {
    div {
      background: red;
    }
  }

• #11220 3e8c488 Thanks @​santichausis! - Fixed #9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

  For example, Biome no longer reports greet as undeclared in the following Svelte component:

  <script module>

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.9

Patch Changes

• #11321 41386f3 Thanks @​dyc3! - Fixed #11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.

• #11248 57b197e Thanks @​yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.

• #11377 a8798ea Thanks @​Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.

  @layer {
    a {
      color: red;
    }
  }

• #11327 6771cf5 Thanks @​dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.

   <div>
     <!-- first group -->
  +
     <!-- second group -->
   </div>

• #10312 ba8aa18 Thanks @​dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.

• #11333 715e0cd Thanks @​kkkhs! - Fixed #11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.

• #11343 9b98211 Thanks @​johncarmack1984! - Fixed #11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.

  @variant @xl {
    div {
      background: red;
    }
  }

• #11220 3e8c488 Thanks @​santichausis! - Fixed #9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

  For example, Biome no longer reports greet as undeclared in the following Svelte component:

  <script module>
    export function greet() {
      console.log("Hello!");

... (truncated)

Commits

• 2081460 ci: release (#11309)
• 6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
• a8798ea feat: useNamedLayer (#11377)
• 85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
• e65f07e feat(lint): nursery useControlLabel (#11312)
• ba8aa18 feat(lint): add useTailwindShorthandClasses (#10312)
• 6b8f09c ci: release (#11236)
• 23c0369 feat(lint): nursery noInvalidPropertyInitValue (#11187)
• 52b44d6 feat(lint/html): add noSvelteLegacyConst (#11247)
• 0a0fbc1 feat(lint/js): add useReactCompiler (#10710)
• See full diff in compare view

Updates astro from 7.2.0 to 7.2.4

Release notes

Sourced from astro's releases.

astro@7.2.4

Patch Changes

• #17747 a90ff66 Thanks @​Princesseuh! - Fixes builds hanging when an image file is malformed

• #17701 05763a0 Thanks @​matthewp! - Fixes base path stripping to respect path-segment boundaries. With a configured base such as /docs, a request like /docs-archive/page is no longer treated as being under the base, so routing and context.url.pathname now agree on the same pathname.

• #17742 70b449d Thanks @​Kjubikstronk! - Fixes astro build throwing TypeError: Missing parameter for dynamic routes when build.format: 'preserve' and trailingSlash: 'always' are used together. Stripping the framework-injected .html suffix dropped the trailing slash that the compiled route pattern requires, so the route no longer matched itself and its params resolved as empty.

• #17703 771b0a9 Thanks @​astrobot-houston! - Fixes Astro.site always being undefined when rendering components via the Container API, even when site is set in astroConfig

• Updated dependencies [05763a0, bc171af]:

  • @​astrojs/internal-helpers@​0.10.4
  • @​astrojs/markdown-satteri@​0.3.7
  • @​astrojs/markdown-remark@​7.2.4

astro@7.2.3

Patch Changes

• #17724 97140b2 Thanks @​ematipico! - Fixes an issue where Astro could run out of memory when experimental.collectionStorage is set to chunked and there are multiple concurrent updates to the same collection.

• #17636 51723b1 Thanks @​matthewp! - Fixes the dev server sometimes matching against stale routes after pages were added, removed, or renamed, requiring a dev server restart to pick up the change

• #17636 51723b1 Thanks @​matthewp! - Fixes the composable request helpers (astro/fetch) throwing an error when used on a request that had been rewritten with Astro.rewrite() or next()

• #17636 51723b1 Thanks @​matthewp! - Refactors Astro's internal server-side request handling. This is an internal change: all documented public APIs, including App and NodeApp, keep their existing signatures and behavior.

  The undocumented internal app.pipeline property and the AppPipeline export from astro/app have been removed. Adapters that used app.pipeline.getLogger() to wait for the configured log destination can call the new app.getLogger() instead.

  As a result of this refactor, new FetchState(request) from astro/fetch now works anywhere inside a built Astro server — including custom src/fetch.ts entrypoints — without the request needing to first pass through app.render(). Previously this threw an error, breaking patterns like the Cloudflare adapter's advanced custom-worker setup.

• #17723 c3b9aed Thanks @​florian-lefebvre! - Fixes a link in font providers JSDoc annotations

• #17699 e28d227 Thanks @​ArmandPhilippot! - Fixes several documentation issues related to the JSDoc for configuration options.

  • When hovering over the server and fonts options, the JSDoc for the nested options was displayed instead of the JSDoc for the top-level property.
  • Two i18n configuration options were being used incorrectly in the examples.
  • The indentation of some code blocks was broken on hover.

• #17572 2066f39 Thanks @​matthewp! - Fixes a crash when a request arrives with a malformed port in the Host header (for example example.com:65536 or example.com:8080:8080). Such a host made the constructed request URL invalid, and the fallback that was meant to recover reused the same invalid host and threw again. The request URL now degrades to a host the server controls when the incoming host cannot be parsed, so the request is handled instead of erroring.

• #17685 9f15609 Thanks @​astrobot-houston! - Fixes a dev server error where an SSR full reload triggered by a third-party Vite plugin (such as @tailwindcss/vite) could fail with Failed to load url astro:server-app.js

• #17636 51723b1 Thanks @​matthewp! - Improves error handling for custom log destinations. When the configured logger fails to load, Astro now reports the error and continues with the default console logger instead of failing the first request.

• #17631 cf29bec Thanks @​matthewp! - Fixes getCollection() and getEntry() throwing DataCloneError when a collection schema transform returns a Temporal.PlainDate or other class instance.

• Updated dependencies [8c193f6]:

  • @​astrojs/internal-helpers@​0.10.3
  • @​astrojs/markdown-remark@​7.2.3

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.4

Patch Changes

• #17747 a90ff66 Thanks @​Princesseuh! - Fixes builds hanging when an image file is malformed

• #17701 05763a0 Thanks @​matthewp! - Fixes base path stripping to respect path-segment boundaries. With a configured base such as /docs, a request like /docs-archive/page is no longer treated as being under the base, so routing and context.url.pathname now agree on the same pathname.

• #17742 70b449d Thanks @​Kjubikstronk! - Fixes astro build throwing TypeError: Missing parameter for dynamic routes when build.format: 'preserve' and trailingSlash: 'always' are used together. Stripping the framework-injected .html suffix dropped the trailing slash that the compiled route pattern requires, so the route no longer matched itself and its params resolved as empty.

• #17703 771b0a9 Thanks @​astrobot-houston! - Fixes Astro.site always being undefined when rendering components via the Container API, even when site is set in astroConfig

• Updated dependencies [05763a0, bc171af]:

  • @​astrojs/internal-helpers@​0.10.4
  • @​astrojs/markdown-satteri@​0.3.7
  • @​astrojs/markdown-remark@​7.2.4

7.2.3

Patch Changes

• #17724 97140b2 Thanks @​ematipico! - Fixes an issue where Astro could run out of memory when experimental.collectionStorage is set to chunked and there are multiple concurrent updates to the same collection.

• #17636 51723b1 Thanks @​matthewp! - Fixes the dev server sometimes matching against stale routes after pages were added, removed, or renamed, requiring a dev server restart to pick up the change

• #17636 51723b1 Thanks @​matthewp! - Fixes the composable request helpers (astro/fetch) throwing an error when used on a request that had been rewritten with Astro.rewrite() or next()

• #17636 51723b1 Thanks @​matthewp! - Refactors Astro's internal server-side request handling. This is an internal change: all documented public APIs, including App and NodeApp, keep their existing signatures and behavior.

  The undocumented internal app.pipeline property and the AppPipeline export from astro/app have been removed. Adapters that used app.pipeline.getLogger() to wait for the configured log destination can call the new app.getLogger() instead.

  As a result of this refactor, new FetchState(request) from astro/fetch now works anywhere inside a built Astro server — including custom src/fetch.ts entrypoints — without the request needing to first pass through app.render(). Previously this threw an error, breaking patterns like the Cloudflare adapter's advanced custom-worker setup.

• #17723 c3b9aed Thanks @​florian-lefebvre! - Fixes a link in font providers JSDoc annotations

• #17699 e28d227 Thanks @​ArmandPhilippot! - Fixes several documentation issues related to the JSDoc for configuration options.

  • When hovering over the server and fonts options, the JSDoc for the nested options was displayed instead of the JSDoc for the top-level property.
  • Two i18n configuration options were being used incorrectly in the examples.
  • The indentation of some code blocks was broken on hover.

• #17572 2066f39 Thanks @​matthewp! - Fixes a crash when a request arrives with a malformed port in the Host header (for example example.com:65536 or example.com:8080:8080). Such a host made the constructed request URL invalid, and the fallback that was meant to recover reused the same invalid host and threw again. The request URL now degrades to a host the server controls when the incoming host cannot be parsed, so the request is handled instead of erroring.

• #17685 9f15609 Thanks @​astrobot-houston! - Fixes a dev server error where an SSR full reload triggered by a third-party Vite plugin (such as @tailwindcss/vite) could fail with Failed to load url astro:server-app.js

• #17636 51723b1 Thanks @​matthewp! - Improves error handling for custom log destinations. When the configured logger fails to load, Astro now reports the error and continues with the default console logger instead of failing the first request.

• #17631 cf29bec Thanks @​matthewp! - Fixes getCollection() and getEntry() throwing DataCloneError when a collection schema transform returns a Temporal.PlainDate or other class instance.

• Updated dependencies [8c193f6]:

... (truncated)

Commits

• 8a31cba [ci] release (#17739)
• aeda810 [ci] format
• a90ff66 fix(assets): harden vendored image-size box and entry checks (#17747)
• 05763a0 Respect path-segment boundaries when stripping the configured base (#17701)
• 70b449d fix(routing): keep the trailing slash when stripping an injected .html (#17742)
• 771b0a9 fix(container): wire astroConfig.site through to the SSR manifest so Astro.si...
• 52e6c34 [ci] release (#17691)
• 97140b2 fix(collections): chunk writing of collections (#17724)
• e28d227 docs: fix the code snippets in the JSDoc for the configuration options (#17699)
• c3b9aed chore: remove unifont workaround (#17723)
• Additional commits viewable in compare view

Updates starlight-blog from 0.28.0 to 0.29.0

Release notes

Sourced from starlight-blog's releases.

starlight-blog@0.29.0

Minor Changes

• #225 6449901 Thanks @​HiDeoo! - Improves the generated blog markup to provide more consistent CSS selectors for custom styling and theming.

  ⚠️ Potentially breaking change: If you have custom CSS targeting generated blog markup, you may want to double check the visual appearance of the generated pages when updating.

Changelog

Sourced from starlight-blog's changelog.

0.29.0

Minor Changes

• #225 6449901 Thanks @​HiDeoo! - Improves the generated blog markup to provide more consistent CSS selectors for custom styling and theming.

  ⚠️ Potentially breaking change: If you have custom CSS targeting generated blog markup, you may want to double check the visual appearance of the generated pages when updating.

Commits

• 9372411 ci: release (#226)
• 6449901 feat: stable css selectors (#225)
• See full diff in compare view

Updates starlight-links-validator from 0.25.2 to 0.25.3

Release notes

Sourced from starlight-links-validator's releases.

starlight-links-validator@0.25.3

Patch Changes

• #173 7f9c3b7 Thanks @​pat-s! - Fixes a validation issue with Astro redirects when the base option is configured.

• #173 7f9c3b7 Thanks @​pat-s! - Fixes a validation issue when using Bun.

Changelog

Sourced from starlight-links-validator's changelog.

0.25.3

Patch Changes

• #173 7f9c3b7 Thanks @​pat-s! - Fixes a validation issue with Astro redirects when the base option is configured.

• #173 7f9c3b7 Thanks @​pat-s! - Fixes a validation issue when using Bun.

Commits

• e9dc678 ci: release (#174)
• 7f9c3b7 fix: redirect validation with a base and under the Bun runtime (#173)
• See full diff in compare view

Updates vite from 8.2.1 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

• deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

• bundled-dev: handle lazy request error (#23291) (3ba026d)
• bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
• config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
• css: don't pass empty targets to lightningcss (#23295) (2804636)
• define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
• deps: update all non-major dependencies (#23217) (ba958bd)
• deps: update rolldown-related dependencies (#23218) (83ecb2c)
• module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
• optimizer: close custom extension analysis bundles (#23207) (8fb7675)
• reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
• respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
• ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
• vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

• build: note cssTarget precedence (#23200) (a20a35e)

Miscellaneous Chores

• fix ts errors in build test cases (#23209) (a0cfcf7)

Code Refactoring

• use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
• use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

• define: close rolldown bundler after generate (#23231) (b4d66fe)
• module-runner: add TLA circular import case (#23299) (4a261f2)
• module-runner: simplify server-hmr tests (#23300) (599b44b)
• ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

• use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)

Commits

• de1111a release: v8.2.2
• cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
• 9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
• 8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
• 05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
• 495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
• 1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
• 2804636 fix(css): don't pass empty targets to lightningcss (#23295)
• 599b44b test(module-runner): simplify server-hmr tests (#23300)
• 4a261f2 test(module-runner): add TLA circular import case (#23299)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

• Resolves CVE-2026-67213 — nanoid: Denial of Service via infinite loop in random ID generation

[semgrep-code-tajemniktv]

Semgrep identified an issue, but thinks it may be safe to ignore.
Package dependencies with variant versions may lead to dependency hijack and confusion attacks. Better to specify an exact version or use package-lock.json for a specific version of the package.

Why this might be safe to ignore:

This is a development dependency in a package.json file using caret (^) version ranges, which is standard practice in Node.js projects. The project uses an 'overrides' section and likely has a package-lock.json file (as is standard) that locks dependencies to exact versions in production, mitigating dependency confusion risks. The LOW confidence rating and standard development workflow make this a false positive.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[semgrep-code-tajemniktv]

Semgrep identified an issue, but thinks it may be safe to ignore.
Package dependencies with variant versions may lead to dependency hijack and confusion attacks. Better to specify an exact version or use package-lock.json for a specific version of the package.

Why this might be safe to ignore:

This low-confidence rule is matching a normal semver range in package.json, not evidence of an exploitable vulnerability in application code. Using a caret version for a public dependency is common and this finding alone does not meaningfully improve security without additional supply-chain risk context.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[semgrep-code-tajemniktv]

Semgrep identified an issue in your code:

starlight-blog uses the floating range ^0.29.0, allowing later compatible releases to enter developer and CI builds. A hijacked matching release could execute during installation or the Astro build and expose source code or deployment secrets.

More details about this

starlight-blog is declared as ^0.29.0, so package installation can select newer 0.x releases allowed by npm's caret range rather than always using 0.29.0. If a later matching release of starlight-blog were hijacked or published with malicious code, an attacker could exploit the normal dependency installation flow:

1. An attacker publishes a compromised compatible starlight-blog release, such as 0.29.1.
2. A developer or CI job runs npm install while resolving the dependencies in this package.json; the ^0.29.0 range permits npm to select that newer release.
3. The malicious package executes during installation or is included in the Astro build, potentially reading CI environment variables, source files, or deployment credentials and sending them to an attacker-controlled server.
4. Other developers or build agents that install the project later may resolve a different starlight-blog version, making the dependency behavior and resulting build inconsistent across environments.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	"starlight-blog": "^0.29.0",
	"starlight-blog": "0.29.0",

View step-by-step instructions

1. Pin starlight-blog to the exact version by changing the entry to "starlight-blog": "0.29.0".

2. Update the npm lockfile to record this exact version and its resolved integrity data with $ npm install --save-exact starlight-blog@0.29.0.

3. Keep the generated package-lock.json alongside package.json so future installs use the reviewed dependency version.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[semgrep-code-tajemniktv]

Semgrep identified an issue, but thinks it may be safe to ignore.
Package dependencies with variant versions may lead to dependency hijack and confusion attacks. Better to specify an exact version or use package-lock.json for a specific version of the package.

Why this might be safe to ignore:

This is a low-confidence dependency version pinning finding in package.json, and the matched caret range is standard package manager usage rather than a directly exploitable issue by itself. Without evidence that installs occur without a lockfile or from an untrusted registry, this does not meaningfully indicate a security vulnerability.

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by package-dependencies-check.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.