deps: consolidated frontend security updates (tracked by #1392) by dependabot[bot] · Pull Request #1385 · microsoft/aspire.dev

dependabot · 2026-07-21T04:44:09Z

Bumps the npm-all group with 32 updates in the /src/frontend directory:

Package	From	To
@astrojs/markdown-remark	`7.2.0`	`7.2.1`
@astrojs/mdx	`7.0.0`	`7.0.3`
@astrojs/rss	`4.0.18`	`4.0.19`
@astrojs/starlight	`0.41.1`	`0.41.3`
@catppuccin/starlight	`2.0.1`	`2.1.0`
@expressive-code/plugin-collapsible-sections	`0.44.0`	`0.44.1`
@expressive-code/plugin-line-numbers	`0.44.0`	`0.44.1`
@fontsource-variable/fira-code	`5.2.7`	`5.3.0`
@fontsource-variable/outfit	`5.2.8`	`5.3.0`
@fontsource-variable/rubik	`5.2.8`	`5.3.0`
@fontsource/poppins	`5.2.7`	`5.3.0`
asciinema-player	`3.16.0`	`3.17.0`
astro	`7.0.3`	`7.1.3`
astro-expressive-code	`0.44.0`	`0.44.1`
satori	`0.26.0`	`0.28.1`
satteri	`0.9.4`	`0.9.5`
sharp	`0.34.5`	`0.35.3`
starlight-github-alerts	`0.3.0`	`0.4.0`
starlight-links-validator	`0.25.1`	`0.25.2`
starlight-llms-txt	`0.10.0`	`0.11.0`
starlight-page-actions	`0.6.2`	`0.7.0`
@iconify-json/material-icon-theme	`1.2.68`	`1.2.69`
@types/hast	`3.0.4`	`3.0.5`
@unocss/astro	`66.6.8`	`66.7.5`
astro-embed	`0.13.0`	`0.13.1`
eslint	`10.6.0`	`10.7.0`
prettier	`3.9.1`	`3.9.5`
tsx	`4.22.4`	`4.23.1`
typescript	`6.0.3`	`7.0.2`
typescript-eslint	`8.62.0`	`8.65.0`
unocss	`66.6.8`	`66.7.5`
vitest	`4.1.9`	`4.1.10`

Updates @astrojs/markdown-remark from 7.2.0 to 7.2.1

Release notes

Sourced from @astrojs/markdown-remark's releases.

@astrojs/markdown-remark@7.2.1

Patch Changes

Updated dependencies [eb6f97e]:

@astrojs/internal-helpers@0.10.1

Changelog

Sourced from @astrojs/markdown-remark's changelog.

7.2.1

Patch Changes

Updated dependencies [eb6f97e]:

@astrojs/internal-helpers@0.10.1

Commits

a86160e [ci] release (#17256)
See full diff in compare view

Updates @astrojs/mdx from 7.0.0 to 7.0.3

Release notes

Sourced from @astrojs/mdx's releases.

@astrojs/mdx@7.0.3

Patch Changes

#17341 64b0d66 Thanks @Princesseuh! - Fixes custom pre components not applying to syntax-highlighted code blocks when using the Sätteri Markdown processor with MDX.

@astrojs/mdx@7.0.2

Patch Changes

Updated dependencies [eb6f97e]:

@astrojs/internal-helpers@0.10.1

@astrojs/markdown-remark@7.2.1

@astrojs/mdx@7.0.1

Patch Changes

#17249 02b73b0 Thanks @ematipico! - Fixes an issue where the peerDependencies field used incorrect dependencies.

Changelog

Sourced from @astrojs/mdx's changelog.

7.0.3

Patch Changes

#17341 64b0d66 Thanks @Princesseuh! - Fixes custom pre components not applying to syntax-highlighted code blocks when using the Sätteri Markdown processor with MDX.

7.0.2

Patch Changes

Updated dependencies [eb6f97e]:

@astrojs/internal-helpers@0.10.1

@astrojs/markdown-remark@7.2.1

7.0.1

Patch Changes

#17249 02b73b0 Thanks @ematipico! - Fixes an issue where the peerDependencies field used incorrect dependencies.

Commits

dec7692 [ci] release (#17338)
64b0d66 fix(satteri): route highlighted code blocks through MDX pre components (#17341)
a86160e [ci] release (#17256)
7d8ec1f [ci] release (#17237)
02b73b0 fix: peer deps of packages (#17249)
0a054e7 chore(head): normalize html charset declarations (#17197)
2bfb179 chore: simpler package.json types (#17229)
dc260da Remove legacy "X-UA-Compatible" meta tags (#17162)
See full diff in compare view

Updates @astrojs/rss from 4.0.18 to 4.0.19

Release notes

Sourced from @astrojs/rss's releases.

@astrojs/rss@4.0.19

Patch Changes

#17209 fbcfa03 Thanks @matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.

Changelog

Sourced from @astrojs/rss's changelog.

4.0.19

Patch Changes

#17209 fbcfa03 Thanks @matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.

Commits

5978993 [ci] release (#17213)
2bfb179 chore: simpler package.json types (#17229)
fbcfa03 Escape source and enclosure fields in RSS feed generation (#17209)
5a8cd09 refactor: update tsconfig to use TypeScript project references (#16505)
46633f5 refactor(create-astro): migrate tests to typescript (#16400)
747a5b3 refactor: migrate astro-rss tests to typescript (#16357)
88fcc98 fix integrations links across docs (#16098)
See full diff in compare view

Updates @astrojs/starlight from 0.41.1 to 0.41.3

Release notes

Sourced from @astrojs/starlight's releases.

@astrojs/starlight@0.41.3

Patch Changes

#3911 1686ecc Thanks @timothyjordan! - Keeps keyboard focus inside the mobile menu while it is open, preventing focus moving to hidden interactive elements in page content.

@astrojs/starlight@0.41.2

Patch Changes

#4008 58a3520 Thanks @FrancoKaddour! - Fixes the table of contents overflowing the right edge of the viewport when a custom --sl-content-width value exceeds available space

#4015 bdbfffc Thanks @delucis! - Fixes an issue where aside icons were rendered incorrectly in projects where Astro’s MDX integration had optimization disabled

Changelog

Sourced from @astrojs/starlight's changelog.

0.41.3

Patch Changes

#3911 1686ecc Thanks @timothyjordan! - Keeps keyboard focus inside the mobile menu while it is open, preventing focus moving to hidden interactive elements in page content.

0.41.2

Patch Changes

#4008 58a3520 Thanks @FrancoKaddour! - Fixes the table of contents overflowing the right edge of the viewport when a custom --sl-content-width value exceeds available space

#4015 bdbfffc Thanks @delucis! - Fixes an issue where aside icons were rendered incorrectly in projects where Astro’s MDX integration had optimization disabled

Commits

96cee6e [ci] release (#4032)
1686ecc fix(MobileMenuToggle): trap keyboard focus inside the mobile menu (#3911)
3948048 [ci] release (#4016)
1a209c5 [ci] format
58a3520 fix(css): prevent TOC overflow with custom --sl-content-width (#4008)
bdbfffc Fix aside icons when MDX optimization is disabled (#4015)
a2266b9 Update playwright (#4013)
See full diff in compare view

Updates @catppuccin/starlight from 2.0.1 to 2.1.0

Release notes

Sourced from @catppuccin/starlight's releases.

v2.1.0

2.1.0 (2026-07-04)

Features

add support for Astro v7 (#92) (e654405)

Changelog

Sourced from @catppuccin/starlight's changelog.

2.1.0 (2026-07-04)

Features

add support for Astro v7 (#92) (e654405)

Commits

32b759a chore(main): release 2.1.0 (#93)
e654405 feat: add support for Astro v7 (#92)
See full diff in compare view

Updates @expressive-code/plugin-collapsible-sections from 0.44.0 to 0.44.1

Release notes

Sourced from @expressive-code/plugin-collapsible-sections's releases.

@expressive-code/plugin-collapsible-sections@0.44.1

Patch Changes

Updated dependencies [ef538d8]

@expressive-code/core@0.44.1

Changelog

Sourced from @expressive-code/plugin-collapsible-sections's changelog.

0.44.1

Patch Changes

Updated dependencies [ef538d8]

@expressive-code/core@0.44.1

Commits

e0f1321 [CI] Release (#462)
See full diff in compare view

Updates @expressive-code/plugin-line-numbers from 0.44.0 to 0.44.1

Release notes

Sourced from @expressive-code/plugin-line-numbers's releases.

@expressive-code/plugin-line-numbers@0.44.1

Patch Changes

Updated dependencies [ef538d8]

@expressive-code/core@0.44.1

Changelog

Sourced from @expressive-code/plugin-line-numbers's changelog.

0.44.1

Patch Changes

Updated dependencies [ef538d8]

@expressive-code/core@0.44.1

Commits

e0f1321 [CI] Release (#462)
See full diff in compare view

Updates @fontsource-variable/fira-code from 5.2.7 to 5.3.0

Commits

See full diff in compare view

Updates @fontsource-variable/outfit from 5.2.8 to 5.3.0

Commits

See full diff in compare view

Updates @fontsource-variable/rubik from 5.2.8 to 5.3.0

Commits

See full diff in compare view

Updates @fontsource/poppins from 5.2.7 to 5.3.0

Commits

See full diff in compare view

Updates asciinema-player from 3.16.0 to 3.17.0

Release notes

Sourced from asciinema-player's releases.

3.17.0

This is a mostly bug fix release:

fixed marker timeline positions vs idleTimeLimit option (fixes #326)

fixed terminal size override via cols/rows options (regressed in 3.16.0)

fixed a visual glitch with step-back in certain situations

This release also brings an experimental segmented recording loading (similar to HLS segmenting). It's not documented yet, I'll test the behavior and API on asciinema.org first before I commit to it fully.

Commits

8ba9c54 Bump version
7548ef9 Place option markers verbatim, not through idle limiter
5aeef2c Pin terminal size to cols/rows overrides during playback
35a3c0d Unify recording pause handling
2c66eb5 Encapsulate segment wait detection
d814f6a Clarify seek resume intent
a46f936 Clarify recording positioning reset
eedf37b Clarify recording event names
f522b3d Load recording segments by index
89a33aa Require position generation
Additional commits viewable in compare view

Updates astro from 7.0.3 to 7.1.3

Release notes

Sourced from astro's releases.

astro@7.1.3

Patch Changes

#17427 630b382 Thanks @astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

astro@7.1.2

Patch Changes

#17445 a5f7230 Thanks @ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

#17402 a89c137 Thanks @farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

#17405 91992ef Thanks @Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

astro@7.1.1

Patch Changes

#17399 4b03702 Thanks @matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

astro@7.1.0

Minor Changes
#17302 5f4dc03 Thanks @astrobot-houston! - Adds a new deferRender option to the glob() content loader

When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
#17296 30698a2 Thanks @ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
// astro.config.mjs

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.3

Patch Changes

#17427 630b382 Thanks @astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

7.1.2

Patch Changes

#17445 a5f7230 Thanks @ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

#17402 a89c137 Thanks @farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

#17405 91992ef Thanks @Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

7.1.1

Patch Changes

#17399 4b03702 Thanks @matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

7.1.0

Minor Changes
#17302 5f4dc03 Thanks @astrobot-houston! - Adds a new deferRender option to the glob() content loader

When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
#17296 30698a2 Thanks @ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

... (truncated)

Commits

cf9ffc7 [ci] release (#17455)
630b382 Use os.availableParallelism() for image optimization queue to fix OOM in CP...
8a7f7e0 [ci] release (#17411)
ebbd793 chore(deps): update astro-embed (#17436)
311e42c [ci] format
1d62202 chore(deps): update neotraverse to v1 (#17446)
a5f7230 fix(astro): update cookie to v2 (#17445)
91992ef fix(prefetch): swallow fetch-fallback rejection to avoid unhandled 'Load fail...
a89c137 fix(astro): propagate mutated locals to custom error pages (#17402)
91c645a [ci] release (#17403)
Additional commits viewable in compare view

Updates astro-expressive-code from 0.44.0 to 0.44.1

Release notes

Sourced from astro-expressive-code's releases.

astro-expressive-code@0.44.1

Patch Changes

ef538d8: Prevent a white corner from appearing when themed horizontal and vertical scrollbars are both visible.

Updated dependencies [ef538d8]

rehype-expressive-code@0.44.1

Changelog

Sourced from astro-expressive-code's changelog.

0.44.1

Patch Changes

ef538d8: Prevent a white corner from appearing when themed horizontal and vertical scrollbars are both visible.

Updated dependencies [ef538d8]

rehype-expressive-code@0.44.1

Commits

e0f1321 [CI] Release (#462)
See full diff in compare view

Updates satori from 0.26.0 to 0.28.1

Release notes

Sourced from satori's releases.

0.28.1

0.28.1 (2026-07-20)

Bug Fixes

render text matching Object.prototype property names as glyphs (#761) (504b4c9)

0.28.0

0.28.0 (2026-07-14)

Features

trigger npm publish after OIDC fix (#771) (b5c1f64)

0.27.0

0.27.0 (2026-04-29)

Bug Fixes

Fixed error when rendering React Fragments inside <svg>

Commits

504b4c9 fix: render text matching Object.prototype property names as glyphs (#761)
b5c1f64 feat: trigger npm publish after OIDC fix (#771)
8119856 docs: fix flexWrap default from 'wrap' to 'nowrap' (#767)
2120646 ci: publish via npm trusted publishing (OIDC) (#770)
2d3af44 fix: SSRF guard for server-side image fetches + pluggable fetcher (#769)
9feec94 fix: text matching Object.prototype property names rendered as image (#768)
91ade3b ci: declare minimum permissions on PR title workflow (#756)
ab49faf chore: migrate workspace to pnpm 10 (#762)
8a0619f chore: remove pull_request_target (#755)
a2e0dce fix bug with fragments in svg
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for satori since your current version.

Updates satteri from 0.9.4 to 0.9.5

Release notes

Sourced from satteri's releases.

satteri-v0.9.5

Patch changes

Updated dependencies: satteri-ast (Cargo)@0.4.2, satteri-mdxjs (Cargo)@0.3.8, satteri-pulldown-cmark (Cargo)@0.5.8

Commits

92d01ec Release (main) (#131)
d2c33ca fix(autolink): misc improvements to autolink behavior and performance (#96)
24a4689 fix(satteri-pulldown-cmark): don't let heading attribute blocks conflict with...
54c782f chore: harden and update ci (#145)
e3f2a10 chore(deps): update pnpm to v11 (#146)
a579002 fix(satteri): set the license field in the package.json (#147)
15b0f85 feat(playground): add a share button (#84)
eaef2be docs: swap two rows for consistent order (#144)
ef3974e feat(plugins): adds ctx.sourceFormat on plugin contexts (#138)
92c006a fix(satteri): declare WASI runtime deps as optionalDependencies (#136)
Additional commits viewable in compare view

Updates sharp from 0.34.5 to 0.35.3

Release notes

Sourced from sharp's releases.

v0.35.3

Tighten verification of text dimensions, TIFF tile dimensions and extend values.

Improve code bundler support by resolving path to libvips binary.

Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

Emit warning about binaries provided by Electron for use on Linux.

Add hasAlpha property to output info. #4500

TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @Andarist

Bound clahe width and height to avoid signed overflow. #4551 @metsw24-max

Bound trim margin to avoid signed overflow. #4552 @metsw24-max

Reject infinite values when validating numbers. #4553 @metsw24-max

Bound extract region to libvips coordinate limit. #4555 @metsw24-max

Verify background colour values are numbers. #4556 @metsw24-max

Bound create and raw input dimensions to coordinate limit. #4558 @metsw24-max

Tighten recomb and affine matrix verification. #4560 @chatman-media

Verify cache memory limit to avoid overflow. #4561 @metsw24-max

v0.35.3-rc.2

Tighten verification of text dimensions, TIFF tile dimensions and extend values.

... (truncated)

Commits

1018449 Release v0.35.3
ba303a7 Prerelease v0.35.3-rc.2
4f94fc5 Upgrade to sharp-libvips v1.3.2
c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
9a8d002 Docs: Add changelog entry and note about transferable #4520
8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBuffer (#4520)
e000d0b Prerelease v0.35.3-rc.1
9554ca9 Prerelease v0.35.3-rc.0
6a29fd5 Emit warning about native binaries on Linux Electron
540d2ea Increase default concurrency when use of MALLOC_ARENA_MAX detected
Additional commits viewable in compare view

Updates starlight-github-alerts from 0.3.0 to 0.4.0

Release notes

Sourced from starlight-github-alerts's releases.

starlight-github-alerts@0.4.0

Minor Changes

#14 f5c0909 Thanks @HiDeoo! - Adds support for Astro v7, drops support for Astro v6.

⚠️ BREAKING CHANGE: The minimum supported version of Starlight is now 0.41.0.

Please follow the upgrade guide to update your project.

#14 f5c0909 Thanks @HiDeoo! - Adds support for the Sätteri Markdown processor.

Changelog

Sourced from starlight-github-alerts's changelog.

0.4.0

Minor Changes

#14 f5c0909 Thanks @HiDeoo! - Adds support for Astro v7, drops support for Astro v6.

⚠️ BREAKING CHANGE: The minimum supported version of Starlight is now 0.41.0.

Please follow the upgrade guide to update your project.

#14 f5c0909 Thanks @HiDeoo! - Adds support for the Sätteri Markdown processor.

Commits

8273f37 ci: release (#15)
f5c0909 Add Astro 7 and Sätteri support (#14)
See full diff in compare view

Updates starlight-links-validator from 0.25.1 to 0.25.2

Release notes

Sourced from starlight-links-validator's releases.

starlight-links-validator@0.25.2

Patch Changes

#171 19b97a0 Thanks @HiDeoo! - Fixes link validation issue for frontmatter-only pages when using Sätteri.

Changelog

Sourced from starlight-links-validator's changelog.

0.25.2

Patch Changes

#171 19b97a0 Thanks @HiDeoo! - Fixes link validation issue for frontmatter-only pages when using Sätteri.

Commits

4e8ab06 ci: release (#172)
19b97a0 Fix Sätteri frontmatter-only page link validation (#171)
See full diff in compare view

Updates starlight-llms-txt from 0.10.0 to 0.11.0

Release notes

Sourced from starlight-llms-txt's releases.

starlight-llms-txt@0.11.0

Minor Changes

#127 bf986de Thanks @funkadelic! - Updates to support Astro 7. The astro peer dependency is now ^7.0.0 and the @astrojs/starlight peer dependency is now >=0.41.0.

Support for Astro 6 and Starlight versions below 0.41 has been dropped. Existing projects on Astro 6 can continue using the previous release until they are ready to upgrade to Astro 7.

Changelog

Sourced from starlight-llms-txt's changelog.

0.11.0

Minor Changes

#127 bf986de Thanks @funkadelic! - Updates to support Astro 7. The astro peer dependency is now ^7.0.0 and the @astrojs/starlight peer dependency is now >=0.41.0.

Support for Astro 6 and Starlight versions below 0.41 has been dropped. Existing projects on Astro 6 can continue using the previous release until they are ready to upgrade to Astro 7.

Commits

1faf4dc [ci] release (#134)
bf986de feat: support Astro 7 (#127)
cacd3d9 fix(deps): update dependency astro to ^6.4.8 (

Bumps the npm-all group with 32 updates in the /src/frontend directory: | Package | From | To | | --- | --- | --- | | [@astrojs/markdown-remark](https://github.com/withastro/astro/tree/HEAD/packages/markdown/remark) | `7.2.0` | `7.2.1` | | [@astrojs/mdx](https://github.com/withastro/astro/tree/HEAD/packages/integrations/mdx) | `7.0.0` | `7.0.3` | | [@astrojs/rss](https://github.com/withastro/astro/tree/HEAD/packages/astro-rss) | `4.0.18` | `4.0.19` | | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.1` | `0.41.3` | | [@catppuccin/starlight](https://github.com/catppuccin/starlight/tree/HEAD/packages/catppuccin-starlight) | `2.0.1` | `2.1.0` | | [@expressive-code/plugin-collapsible-sections](https://github.com/expressive-code/expressive-code/tree/HEAD/packages/@expressive-code/plugin-collapsible-sections) | `0.44.0` | `0.44.1` | | [@expressive-code/plugin-line-numbers](https://github.com/expressive-code/expressive-code/tree/HEAD/packages/@expressive-code/plugin-line-numbers) | `0.44.0` | `0.44.1` | | [@fontsource-variable/fira-code](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/fira-code) | `5.2.7` | `5.3.0` | | [@fontsource-variable/outfit](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/outfit) | `5.2.8` | `5.3.0` | | [@fontsource-variable/rubik](https://github.com/fontsource/font-files/tree/HEAD/fonts/variable/rubik) | `5.2.8` | `5.3.0` | | [@fontsource/poppins](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/poppins) | `5.2.7` | `5.3.0` | | [asciinema-player](https://github.com/asciinema/asciinema-player) | `3.16.0` | `3.17.0` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.0.3` | `7.1.3` | | [astro-expressive-code](https://github.com/expressive-code/expressive-code/tree/HEAD/packages/astro-expressive-code) | `0.44.0` | `0.44.1` | | [satori](https://github.com/vercel/satori) | `0.26.0` | `0.28.1` | | [satteri](https://github.com/bruits/satteri) | `0.9.4` | `0.9.5` | | [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.3` | | [starlight-github-alerts](https://github.com/HiDeoo/starlight-github-alerts/tree/HEAD/packages/starlight-github-alerts) | `0.3.0` | `0.4.0` | | [starlight-links-validator](https://github.com/HiDeoo/starlight-links-validator/tree/HEAD/packages/starlight-links-validator) | `0.25.1` | `0.25.2` | | [starlight-llms-txt](https://github.com/delucis/starlight-llms-txt/tree/HEAD/packages/starlight-llms-txt) | `0.10.0` | `0.11.0` | | [starlight-page-actions](https://github.com/dlcastillop/starlight-page-actions/tree/HEAD/packages/starlight-page-actions) | `0.6.2` | `0.7.0` | | [@iconify-json/material-icon-theme](https://github.com/iconify/icon-sets) | `1.2.68` | `1.2.69` | | [@types/hast](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/hast) | `3.0.4` | `3.0.5` | | [@unocss/astro](https://github.com/unocss/unocss/tree/HEAD/packages-integrations/astro) | `66.6.8` | `66.7.5` | | [astro-embed](https://github.com/delucis/astro-embed/tree/HEAD/packages/astro-embed) | `0.13.0` | `0.13.1` | | [eslint](https://github.com/eslint/eslint) | `10.6.0` | `10.7.0` | | [prettier](https://github.com/prettier/prettier) | `3.9.1` | `3.9.5` | | [tsx](https://github.com/privatenumber/tsx) | `4.22.4` | `4.23.1` | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.62.0` | `8.65.0` | | [unocss](https://github.com/unocss/unocss/tree/HEAD/packages-presets/unocss) | `66.6.8` | `66.7.5` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.9` | `4.1.10` | Updates `@astrojs/markdown-remark` from 7.2.0 to 7.2.1 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/markdown/remark/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/markdown-remark@7.2.1/packages/markdown/remark) Updates `@astrojs/mdx` from 7.0.0 to 7.0.3 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/mdx/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/mdx@7.0.3/packages/integrations/mdx) Updates `@astrojs/rss` from 4.0.18 to 4.0.19 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro-rss/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/rss@4.0.19/packages/astro-rss) Updates `@astrojs/starlight` from 0.41.1 to 0.41.3 - [Release notes](https://github.com/withastro/starlight/releases) - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.3/packages/starlight) Updates `@catppuccin/starlight` from 2.0.1 to 2.1.0 - [Release notes](https://github.com/catppuccin/starlight/releases) - [Changelog](https://github.com/catppuccin/starlight/blob/main/packages/catppuccin-starlight/CHANGELOG.md) - [Commits](https://github.com/catppuccin/starlight/commits/v2.1.0/packages/catppuccin-starlight) Updates `@expressive-code/plugin-collapsible-sections` from 0.44.0 to 0.44.1 - [Release notes](https://github.com/expressive-code/expressive-code/releases) - [Changelog](https://github.com/expressive-code/expressive-code/blob/main/packages/@expressive-code/plugin-collapsible-sections/CHANGELOG.md) - [Commits](https://github.com/expressive-code/expressive-code/commits/@expressive-code/plugin-collapsible-sections@0.44.1/packages/@expressive-code/plugin-collapsible-sections) Updates `@expressive-code/plugin-line-numbers` from 0.44.0 to 0.44.1 - [Release notes](https://github.com/expressive-code/expressive-code/releases) - [Changelog](https://github.com/expressive-code/expressive-code/blob/main/packages/@expressive-code/plugin-line-numbers/CHANGELOG.md) - [Commits](https://github.com/expressive-code/expressive-code/commits/@expressive-code/plugin-line-numbers@0.44.1/packages/@expressive-code/plugin-line-numbers) Updates `@fontsource-variable/fira-code` from 5.2.7 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/fira-code) Updates `@fontsource-variable/outfit` from 5.2.8 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/outfit) Updates `@fontsource-variable/rubik` from 5.2.8 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/variable/rubik) Updates `@fontsource/poppins` from 5.2.7 to 5.3.0 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/poppins) Updates `asciinema-player` from 3.16.0 to 3.17.0 - [Release notes](https://github.com/asciinema/asciinema-player/releases) - [Commits](asciinema/asciinema-player@v3.16.0...v3.17.0) Updates `astro` from 7.0.3 to 7.1.3 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.1.3/packages/astro) Updates `astro-expressive-code` from 0.44.0 to 0.44.1 - [Release notes](https://github.com/expressive-code/expressive-code/releases) - [Changelog](https://github.com/expressive-code/expressive-code/blob/main/packages/astro-expressive-code/CHANGELOG.md) - [Commits](https://github.com/expressive-code/expressive-code/commits/astro-expressive-code@0.44.1/packages/astro-expressive-code) Updates `satori` from 0.26.0 to 0.28.1 - [Release notes](https://github.com/vercel/satori/releases) - [Commits](vercel/satori@0.26.0...0.28.1) Updates `satteri` from 0.9.4 to 0.9.5 - [Release notes](https://github.com/bruits/satteri/releases) - [Commits](bruits/satteri@satteri-v0.9.4...satteri-v0.9.5) Updates `sharp` from 0.34.5 to 0.35.3 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.5...v0.35.3) Updates `starlight-github-alerts` from 0.3.0 to 0.4.0 - [Release notes](https://github.com/HiDeoo/starlight-github-alerts/releases) - [Changelog](https://github.com/HiDeoo/starlight-github-alerts/blob/main/packages/starlight-github-alerts/CHANGELOG.md) - [Commits](https://github.com/HiDeoo/starlight-github-alerts/commits/starlight-github-alerts@0.4.0/packages/starlight-github-alerts) Updates `starlight-links-validator` from 0.25.1 to 0.25.2 - [Release notes](https://github.com/HiDeoo/starlight-links-validator/releases) - [Changelog](https://github.com/HiDeoo/starlight-links-validator/blob/main/packages/starlight-links-validator/CHANGELOG.md) - [Commits](https://github.com/HiDeoo/starlight-links-validator/commits/starlight-links-validator@0.25.2/packages/starlight-links-validator) Updates `starlight-llms-txt` from 0.10.0 to 0.11.0 - [Release notes](https://github.com/delucis/starlight-llms-txt/releases) - [Changelog](https://github.com/delucis/starlight-llms-txt/blob/main/packages/starlight-llms-txt/CHANGELOG.md) - [Commits](https://github.com/delucis/starlight-llms-txt/commits/starlight-llms-txt@0.11.0/packages/starlight-llms-txt) Updates `starlight-page-actions` from 0.6.2 to 0.7.0 - [Release notes](https://github.com/dlcastillop/starlight-page-actions/releases) - [Commits](https://github.com/dlcastillop/starlight-page-actions/commits/v0.7.0/packages/starlight-page-actions) Updates `@iconify-json/material-icon-theme` from 1.2.68 to 1.2.69 - [Commits](https://github.com/iconify/icon-sets/commits) Updates `@types/hast` from 3.0.4 to 3.0.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/hast) Updates `@unocss/astro` from 66.6.8 to 66.7.5 - [Release notes](https://github.com/unocss/unocss/releases) - [Commits](https://github.com/unocss/unocss/commits/v66.7.5/packages-integrations/astro) Updates `astro-embed` from 0.13.0 to 0.13.1 - [Release notes](https://github.com/delucis/astro-embed/releases) - [Changelog](https://github.com/delucis/astro-embed/blob/main/packages/astro-embed/CHANGELOG.md) - [Commits](https://github.com/delucis/astro-embed/commits/astro-embed@0.13.1/packages/astro-embed) Updates `eslint` from 10.6.0 to 10.7.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.6.0...v10.7.0) Updates `prettier` from 3.9.1 to 3.9.5 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.1...3.9.5) Updates `tsx` from 4.22.4 to 4.23.1 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.22.4...v4.23.1) Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) Updates `typescript-eslint` from 8.62.0 to 8.65.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/typescript-eslint) Updates `unocss` from 66.6.8 to 66.7.5 - [Release notes](https://github.com/unocss/unocss/releases) - [Commits](https://github.com/unocss/unocss/commits/v66.7.5/packages-presets/unocss) Updates `vitest` from 4.1.9 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) --- updated-dependencies: - dependency-name: "@astrojs/markdown-remark" dependency-version: 7.2.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@astrojs/mdx" dependency-version: 7.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@astrojs/rss" dependency-version: 4.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@astrojs/starlight" dependency-version: 0.41.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@catppuccin/starlight" dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: "@expressive-code/plugin-collapsible-sections" dependency-version: 0.44.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@expressive-code/plugin-line-numbers" dependency-version: 0.44.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@fontsource-variable/fira-code" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: "@fontsource-variable/outfit" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: "@fontsource-variable/rubik" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: "@fontsource/poppins" dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: asciinema-player dependency-version: 3.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: astro dependency-version: 7.1.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: astro-expressive-code dependency-version: 0.44.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: satori dependency-version: 0.28.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: satteri dependency-version: 0.9.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: sharp dependency-version: 0.35.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: starlight-github-alerts dependency-version: 0.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: starlight-links-validator dependency-version: 0.25.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: starlight-llms-txt dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: starlight-page-actions dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: "@iconify-json/material-icon-theme" dependency-version: 1.2.69 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@types/hast" dependency-version: 3.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: "@unocss/astro" dependency-version: 66.7.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: astro-embed dependency-version: 0.13.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: eslint dependency-version: 10.7.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: prettier dependency-version: 3.9.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-all - dependency-name: tsx dependency-version: 4.23.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-all - dependency-name: typescript-eslint dependency-version: 8.65.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: unocss dependency-version: 66.7.5 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-all - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-all ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates the frontend’s npm dependencies to newer releases across Astro/Starlight, content plugins, and developer tooling.

Changes:

Bumped Astro + Starlight ecosystem packages and related plugins.
Updated build/tooling dependencies (TypeScript, ESLint, Prettier, UnoCSS, Vitest).
Updated a few runtime deps with potential native/build implications (e.g., sharp).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

-    "starlight-github-alerts": "^0.3.0",
+    "satori": "^0.28.1",
+    "satteri": "^0.9.5",
+    "sharp": "0.35.3",


+    "@astrojs/markdown-remark": "7.2.1",
+    "@astrojs/mdx": "^7.0.3",
+    "@astrojs/rss": "^4.0.19",
+    "@astrojs/starlight": "^0.41.3",


IEvangelist · 2026-07-22T12:37:31Z

Tracking moved to canonical PR #1392 (dapire/security-deps/aspire-dev-lowrisk-batch). This PR is retained temporarily for traceability while #1392 is stabilized.

IEvangelist · 2026-07-23T11:04:14Z

Tracked/Superseded by #1392

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 21, 2026

Copilot AI review requested due to automatic review settings July 21, 2026 04:44

dependabot Bot requested a review from IEvangelist as a code owner July 21, 2026 04:44

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 21, 2026

Copilot AI reviewed Jul 21, 2026

View reviewed changes

IEvangelist added the automated-security Automated security dependency management PRs label Jul 21, 2026

IEvangelist changed the title ~~build(deps): bump the npm-all group across 1 directory with 32 updates~~ [auto-sec] Consolidate aspire.dev frontend dependency security remediations Jul 21, 2026

This was referenced Jul 21, 2026

build(deps): bump @astrojs/rss from 4.0.18 to 4.0.19 in /src/frontend #1383

Open

build(deps): bump astro from 7.0.3 to 7.1.0 in /src/frontend #1384

Open

[auto-sec] Consolidate aspire.dev frontend dependency security remediations #1392

Open

IEvangelist changed the title ~~[auto-sec] Consolidate aspire.dev frontend dependency security remediations~~ deps: consolidated frontend security updates (tracked by #1392) Jul 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

deps: consolidated frontend security updates (tracked by #1392)#1385

deps: consolidated frontend security updates (tracked by #1392)#1385
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/frontend/npm-all-5a47dcae59

dependabot Bot commented on behalf of github Jul 21, 2026 •

edited by IEvangelist

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

IEvangelist commented Jul 22, 2026

Uh oh!

IEvangelist commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 21, 2026 • edited by IEvangelist Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​astrojs/markdown-remark@​7.2.1

Patch Changes

7.2.1

Patch Changes

@​astrojs/mdx@​7.0.3

Patch Changes

@​astrojs/mdx@​7.0.2

Patch Changes

@​astrojs/mdx@​7.0.1

Patch Changes

7.0.3

Patch Changes

7.0.2

Patch Changes

7.0.1

Patch Changes

@​astrojs/rss@​4.0.19

Patch Changes

4.0.19

Patch Changes

@​astrojs/starlight@​0.41.3

Patch Changes

@​astrojs/starlight@​0.41.2

Patch Changes

0.41.3

Patch Changes

0.41.2

Patch Changes

v2.1.0

2.1.0 (2026-07-04)

Features

2.1.0 (2026-07-04)

Features

@​expressive-code/plugin-collapsible-sections@​0.44.1

Patch Changes

0.44.1

Patch Changes

@​expressive-code/plugin-line-numbers@​0.44.1

Patch Changes

0.44.1

Patch Changes

3.17.0

astro@7.1.3

Patch Changes

astro@7.1.2

Patch Changes

astro@7.1.1

Patch Changes

astro@7.1.0

Minor Changes

7.1.3

Patch Changes

7.1.2

Patch Changes

7.1.1

Patch Changes

7.1.0

Minor Changes

astro-expressive-code@0.44.1

Patch Changes

0.44.1

Patch Changes

0.28.1

0.28.1 (2026-07-20)

Bug Fixes

0.28.0

0.28.0 (2026-07-14)

Features

0.27.0

0.27.0 (2026-04-29)

Bug Fixes

satteri-v0.9.5

Patch changes

v0.35.3

v0.35.3-rc.2

starlight-github-alerts@0.4.0

dependabot Bot commented on behalf of github Jul 21, 2026 •

edited by IEvangelist

Loading

`@astrojs/markdown-remark@7`.2.1

`@astrojs/mdx@7`.0.3

`@astrojs/mdx@7`.0.2

`@astrojs/mdx@7`.0.1

`@astrojs/rss@4`.0.19

`@astrojs/starlight@0`.41.3

`@astrojs/starlight@0`.41.2

`@expressive-code/plugin-collapsible-sections@0`.44.1

`@expressive-code/plugin-line-numbers@0`.44.1