Skip to content

Bump the npm_and_yarn group across 20 directories with 10 updates - #77

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-8b715d0205
Open

Bump the npm_and_yarn group across 20 directories with 10 updates#77
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-8b715d0205

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 22, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 3 updates in the / directory: @astrojs/rss, astro and vite.
Bumps the npm_and_yarn group with 3 updates in the /astro-blog-starter-template directory: @astrojs/rss, astro and ws.
Bumps the npm_and_yarn group with 2 updates in the /chanfana-openapi-template directory: vite and ws.
Bumps the npm_and_yarn group with 2 updates in the /llm-chat-app-template directory: vite and ws.
Bumps the npm_and_yarn group with 1 update in the /microfrontend-template directory: vite.
Bumps the npm_and_yarn group with 2 updates in the /next-starter-template directory: body-parser and undici.
Bumps the npm_and_yarn group with 4 updates in the /nlweb-template directory: body-parser, js-yaml, linkify-it and undici.
Bumps the npm_and_yarn group with 1 update in the /r2-explorer-template directory: undici.
Bumps the npm_and_yarn group with 3 updates in the /react-postgres-fullstack-template directory: vite, js-yaml and undici.
Bumps the npm_and_yarn group with 2 updates in the /react-router-hono-fullstack-template directory: vite and undici.
Bumps the npm_and_yarn group with 2 updates in the /react-router-postgres-ssr-template directory: vite and undici.
Bumps the npm_and_yarn group with 2 updates in the /react-router-starter-template directory: vite and ws.
Bumps the npm_and_yarn group with 3 updates in the /remix-starter-template directory: vite, body-parser and ws.
Bumps the npm_and_yarn group with 3 updates in the /saas-admin-template directory: astro, vite and ws.
Bumps the npm_and_yarn group with 1 update in the /text-to-image-template directory: undici.
Bumps the npm_and_yarn group with 2 updates in the /to-do-list-kv-template directory: vite and body-parser.
Bumps the npm_and_yarn group with 3 updates in the /vite-react-template directory: vite, brace-expansion and undici.
Bumps the npm_and_yarn group with 2 updates in the /workers-builds-notifications-template directory: vite and undici.
Bumps the npm_and_yarn group with 3 updates in the /workflows-starter-template directory: vite, brace-expansion and undici.
Bumps the npm_and_yarn group with 3 updates in the /x402-proxy-template directory: axios, brace-expansion and undici.

Updates @astrojs/rss from 4.0.14 to 4.0.19

Release notes

Sourced from @​astrojs/rss's releases.

@​astrojs/rss@​4.0.19

Patch Changes

  • #17209 fbcfa03 Thanks @​matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.
Changelog

Sourced from @​astrojs/rss's changelog.

4.0.19

Patch Changes

  • #17209 fbcfa03 Thanks @​matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.

4.0.18

Patch Changes

4.0.17

Patch Changes

4.0.16

Patch Changes

4.0.15-beta.4

Patch Changes

4.0.15-beta.3

Patch Changes

4.0.15-beta.2

Patch Changes

... (truncated)

Commits

Updates astro from 6.1.6 to 7.1.0

Release notes

Sourced from astro's releases.

astro@7.1.0

Minor Changes

  • #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

    // src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

  • #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

    Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

    // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});

    Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

  • #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

    Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

    Scoping sources and hashes in your config

    Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.

    // astro.config.mjs

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.0

Minor Changes

  • #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

    // src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

  • #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

    Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

    // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});

    Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

  • #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

    Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

    Scoping sources and hashes in your config

    Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.

    

    • 






... (truncated)





Commits






Updates vite from 6.4.2 to 6.4.3



Release notes

Sourced from vite's releases.




v6.4.3


Please refer to CHANGELOG.md for details.







Changelog

Sourced from vite's changelog.




6.4.3 (2026-06-01)








Commits






Updates undici from 6.21.3 to 5.29.0



Release notes

Sourced from undici's releases.




v7.28.0


⚠️ Security Release


This release line addresses 7 security advisories, all shipped in v7.28.0.




Action required: Upgrade to undici 7.28.0 or later.


npm install undici@^7.28.0




The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is
an 8.x-only regression.




Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the
earlier 7.2x line — the vulnerable single-pool code was still present through
v7.27.2. The per-origin pool fix is
3805b8f8 (#5041).




Summary






Advisory
CVE
Severity (CVSS)
Fixed in
Fix commit






GHSA-vxpw-j846-p89q
CVE-2026-12151
High (7.5)
7.28.0
8cb10f98




GHSA-vmh5-mc38-953g
CVE-2026-9697
High (7.4)
7.28.0
04201f89




GHSA-hm92-r4w5-c3mj
CVE-2026-6734
High (7.5)
7.28.0
3805b8f8




GHSA-pr7r-676h-xcf6
CVE-2026-9678
Moderate (5.9)
7.28.0
85a24055




GHSA-p88m-4jfj-68fv
CVE-2026-9679
Moderate (5.9)
7.28.0
d0574cc4




GHSA-g8m3-5g58-fq7m
CVE-2026-11525
Low (3.7)
7.28.0
d0574cc4




GHSA-35p6-xmwp-9g52
CVE-2026-6733
Low (3.7)
7.28.0
ea8930cf








High severity


WebSocket DoS via fragment count bypass — CVE-2026-12151


GHSA-vxpw-j846-p89q · CWE-400, CWE-770
Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)


A malicious WebSocket server can stream a large number of small or empty
continuation frames. Undici enforced a limit on cumulative payload size but did
not limit the number of fragments per message, leading to unbounded memory
growth and denial of service.


    

  • Affected: applications using new WebSocket(...) or WebSocketStream
against untrusted endpoints.
    • 

  • Workaround: none — upgrade is required.
    • 



TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697


GHSA-vmh5-mc38-953g · CWE-295





... (truncated)





Commits

    

  • f9eba0a Bumped v7.28.0 (#5430)
    • 

  • a027a4a Backport WebSocket maxPayloadSize fixes to v7.x (#5423)
    • 

  • 8cb10f9 websocket: limit the number of fragments in a message
    • 

  • 04201f8 fix: honor requestTls when proxy is SOCKS5
    • 

  • fcd642f fix(socks5): preserve dispatch backpressure return value (#5166)
    • 

  • bc98c97 fix(socks5): use configured connector in Socks5ProxyAgent (#5168)
    • 

  • 9e1c743 fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly (#5099)
    • 

  • 376c8be fix(socks5): enforce authenticated state before CONNECT (#5097)
    • 

  • 3805b8f fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing...
    • 

  • 85a2405 fix(cache): trim qualified field names
    • 

  • Additional commits viewable in compare view
    • 






Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.






Updates @astrojs/rss from 4.0.14 to 4.0.19



Release notes

Sourced from @​astrojs/rss's releases.




@​astrojs/rss@​4.0.19


Patch Changes


    

  • #17209 fbcfa03 Thanks @​matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.
    • 








Changelog

Sourced from @​astrojs/rss's changelog.




4.0.19


Patch Changes


    

  • #17209 fbcfa03 Thanks @​matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.
    • 



4.0.18


Patch Changes



4.0.17


Patch Changes



4.0.16


Patch Changes



4.0.15-beta.4


Patch Changes



4.0.15-beta.3


Patch Changes



4.0.15-beta.2


Patch Changes






... (truncated)





Commits






Updates astro from 6.1.9 to 7.1.3



Release notes

Sourced from astro's releases.




astro@7.1.0


Minor Changes


    

  • 

    #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader
    

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.
    

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
    

    // src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
    

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
    

    • 

  • 

    #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store
    

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.
    

    Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
    

    // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
    

    Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.
    

    • 

  • 

    #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.
    

    Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.
    

    Scoping sources and hashes in your config
    

    Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.
    

    // astro.config.mjs
    

    • 






... (truncated)





Changelog

Sourced from astro's changelog.




7.1.0


Minor Changes


    

  • 

    #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader
    

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.
    

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
    

    // src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
    

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
    

    • 

  • 

    #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store
    

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.
    

    Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
    

    // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
    

    Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.
    

    • 

  • 

    #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.
    

    Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.
    

    Scoping sources and hashes in your config
    

    Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.
    

    

    • 






... (truncated)





Commits






Updates ws from 7.5.10 to 8.21.0



Release notes

Sourced from ws's releases.




8.21.0


Features


    

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).
    • 



Bug fixes


    

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).
    • 



A high volume of tiny fragments and data chunks could be sent by a peer, using
modest network traffic, to crash a ws server or client due to OOM.


import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});


The vulnerability was responsibly disclosed and fixed by Nadav Magier.


In vulnerable versions, the issue can be mitigated by lowering the value of the
maxPayload option if possible.


8.20.1





... (truncated)





Commits

    

  • bca91ad [dist] 8.21.0
    • 

  • 2b2abd4 [security] Limit retained message parts
    • 

  • 78eabe2 [security] Add latest vulnerability to SECURITY.md
    • 

  • 5d9b316 [dist] 8.20.1
    • 

  • c0327ec [security] Fix uninitialized memory disclosure in websocket.close()
    • 

  • ce2a3d6 [ci] Test on node 26
    • 

  • 58e45b8 [ci] Do not test on node 25
    • 

  • 5f26c24 [ci] Run the lint step on node 24
    • 

  • 8439255 [dist] 8.20.0
    • 

  • d3503c1 [minor] Export the PerMessageDeflate class and header utils
    • 

  • Additional commits viewable in compare view
    • 







Updates vite from 5.4.21 to 8.1.5



Release notes

Sourced from vite's releases.




v6.4.3


Please refer to CHANGELOG.md for details.







Changelog

Sourced from vite's changelog.




6.4.3 (2026-06-01)








Commits






Removes ws


Updates vite from 5.4.21 to 8.1.5



Release notes

Sourced from vite's releases.




v6.4.3


Please refer to CHANGELOG.md for details.







Changelog

Sourced from vite's changelog.




6.4.3 (2026-06-01)








Commits






Updates ws from 7.5.10 to 8.21.0



Release notes

Sourced from ws's releases.




8.21.0


Features


    

  • Introduced the maxBufferedChunks and maxFragments options (2b2abd45).
    • 



Bug fixes


    

  • Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).
    • 



A high volume of tiny fragments and data chunks could be sent by a peer, using
modest network traffic, to cra...

Description has been truncated

    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          Bump the npm_and_yarn group across 20 directories with 10 updates
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          2e68812
        
      

    

  

    

      
Bumps the npm_and_yarn group with 3 updates in the / directory: [@astrojs/rss](https://github.com/withastro/astro/tree/HEAD/packages/astro-rss), [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Bumps the npm_and_yarn group with 3 updates in the /astro-blog-starter-template directory: [@astrojs/rss](https://github.com/withastro/astro/tree/HEAD/packages/astro-rss), [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) and [ws](https://github.com/websockets/ws).
Bumps the npm_and_yarn group with 2 updates in the /chanfana-openapi-template directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [ws](https://github.com/websockets/ws).
Bumps the npm_and_yarn group with 2 updates in the /llm-chat-app-template directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [ws](https://github.com/websockets/ws).
Bumps the npm_and_yarn group with 1 update in the /microfrontend-template directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).
Bumps the npm_and_yarn group with 2 updates in the /next-starter-template directory: [body-parser](https://github.com/expressjs/body-parser) and [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 4 updates in the /nlweb-template directory: [body-parser](https://github.com/expressjs/body-parser), [js-yaml](https://github.com/nodeca/js-yaml), [linkify-it](https://github.com/markdown-it/linkify-it) and [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 1 update in the /r2-explorer-template directory: [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 3 updates in the /react-postgres-fullstack-template directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [js-yaml](https://github.com/nodeca/js-yaml) and [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 2 updates in the /react-router-hono-fullstack-template directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 2 updates in the /react-router-postgres-ssr-template directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 2 updates in the /react-router-starter-template directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [ws](https://github.com/websockets/ws).
Bumps the npm_and_yarn group with 3 updates in the /remix-starter-template directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [body-parser](https://github.com/expressjs/body-parser) and [ws](https://github.com/websockets/ws).
Bumps the npm_and_yarn group with 3 updates in the /saas-admin-template directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [ws](https://github.com/websockets/ws).
Bumps the npm_and_yarn group with 1 update in the /text-to-image-template directory: [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 2 updates in the /to-do-list-kv-template directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [body-parser](https://github.com/expressjs/body-parser).
Bumps the npm_and_yarn group with 3 updates in the /vite-react-template directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [brace-expansion](https://github.com/juliangruber/brace-expansion) and [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 2 updates in the /workers-builds-notifications-template directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 3 updates in the /workflows-starter-template directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [brace-expansion](https://github.com/juliangruber/brace-expansion) and [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 3 updates in the /x402-proxy-template directory: [axios](https://github.com/axios/axios), [brace-expansion](https://github.com/juliangruber/brace-expansion) and [undici](https://github.com/nodejs/undici).


Updates `@astrojs/rss` from 4.0.14 to 4.0.19
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro-rss/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/rss@4.0.19/packages/astro-rss)

Updates `astro` from 6.1.6 to 7.1.0
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.0/packages/astro)

Updates `vite` from 6.4.2 to 6.4.3
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `undici` from 6.21.3 to 5.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.3...v7.28.0)

Updates `@astrojs/rss` from 4.0.14 to 4.0.19
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro-rss/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/rss@4.0.19/packages/astro-rss)

Updates `astro` from 6.1.9 to 7.1.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.0/packages/astro)

Updates `ws` from 7.5.10 to 8.21.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.5.10...8.21.0)

Updates `vite` from 5.4.21 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Removes `ws`

Updates `vite` from 5.4.21 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `ws` from 7.5.10 to 8.21.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.5.10...8.21.0)

Updates `vite` from 5.4.21 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `body-parser` from 2.2.1 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.1...v2.3.0)

Updates `undici` from 6.21.3 to 7.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.3...v7.28.0)

Updates `body-parser` from 2.2.1 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.1...v2.3.0)

Removes `js-yaml`

Updates `linkify-it` from 5.0.0 to 5.0.2
- [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/linkify-it@5.0.0...5.0.2)

Updates `undici` from 6.21.3 to 7.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.3...v7.28.0)

Updates `undici` from 6.21.3 to 7.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.3...v7.28.0)

Updates `vite` from 6.4.2 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Removes `js-yaml`

Updates `undici` from 6.21.3 to 7.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.3...v7.28.0)

Updates `vite` from 6.4.2 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `undici` from 6.21.3 to 7.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.3...v7.28.0)

Updates `vite` from 6.4.2 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `undici` from 6.21.3 to 7.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.3...v7.28.0)

Updates `vite` from 6.4.1 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `ws` from 7.5.10 to 8.21.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.5.10...8.21.0)

Updates `vite` from 5.4.14 to 6.4.3
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `body-parser` from 1.20.4 to 1.20.6
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.1...v2.3.0)

Updates `undici` from 5.29.0 to 6.21.3
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.3...v7.28.0)

Updates `ws` from 7.5.10 to 7.5.13
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.5.10...8.21.0)

Updates `astro` from 6.1.6 to 7.1.0
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.0/packages/astro)

Updates `vite` from 6.4.2 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `ws` from 7.5.10 to 8.21.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.5.10...8.21.0)

Updates `undici` from 6.21.3 to 7.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.3...v7.28.0)

Updates `vite` from 6.4.2 to 6.4.3
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `body-parser` from 1.20.4 to 1.20.6
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@v2.2.1...v2.3.0)

Updates `vite` from 6.4.2 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `brace-expansion` from 1.1.12 to 5.0.7
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v5.0.7)

Updates `undici` from 6.21.3 to 7.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.3...v7.28.0)

Updates `vite` from 5.4.21 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `undici` from 6.21.3 to 7.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.3...v7.28.0)

Updates `vite` from 7.3.2 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `brace-expansion` from 1.1.12 to 5.0.7
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v5.0.7)

Updates `undici` from 6.21.3 to 7.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.3...v7.28.0)

Updates `axios` from 1.15.0 to 1.18.1
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.15.0...v1.18.1)

Updates `brace-expansion` from 1.1.12 to 5.0.7
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v5.0.7)

Updates `undici` from 6.21.3 to 7.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.21.3...v7.28.0)

---
updated-dependencies:
- dependency-name: "@astrojs/rss"
  dependency-version: 4.0.19
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 7.1.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 6.4.3
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 5.29.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@astrojs/rss"
  dependency-version: 4.0.19
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 7.1.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.21.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version:
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.21.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.28.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version:
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: linkify-it
  dependency-version: 5.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.28.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.28.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version:
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.28.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.28.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.28.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.21.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 6.4.3
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.21.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 7.5.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 7.1.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.21.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.28.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 6.4.3
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.28.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.28.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.28.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 5.0.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.28.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      
  dependencies

  Pull requests that update a dependency file

      
  javascript

  Pull requests that update javascript code

  labels


      Jul 22, 2026

    

  












  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










    
        

  

    
    

    

  

    Reviewers
  


    

    No reviews







  
      

  


      
  

    Assignees
  



        


    No one assigned







  
        


  


  

    Labels
  



    

      
    dependencies

  Pull requests that update a dependency file
  
    javascript

  Pull requests that update javascript code








  
        

  

    

        

    Projects
  


        




    None yet




  



  
        


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

  
  
        

  

    

      0 participants