chore(deps): bump the npm_and_yarn group across 2 directories with 15 updates by dependabot[bot] · Pull Request #68 · pinkpixel-dev/keyper

dependabot · 2026-09-08T23:56:29Z

Bumps the npm_and_yarn group with 3 updates in the /website directory: astro, sharp and fflate.
Bumps the npm_and_yarn group with 2 updates in the /website/.scaffold-backup-opposite-orbit directory: astro and sharp.

Updates astro from 6.4.8 to 7.3.2

Release notes

Sourced from astro's releases.

astro@7.3.2

Patch Changes

#17896 a548223 Thanks @matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

#17931 c1a6a89 Thanks @astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

#17908 42e9188 Thanks @astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

#17936 4b92ddc Thanks @astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

Updated dependencies [a548223]:

@astrojs/markdown-satteri@0.4.1

astro@7.3.1

Patch Changes

#17899 0389640 Thanks @ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

astro@7.3.0

Minor Changes
#17767 ce7c91f Thanks @astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds a logger parameter to image services hooks

Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:
import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};
Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds logger to the context object passed to cache providers

Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:
import type { CacheProvider } from 'astro';
const provider: CacheProvider = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.2

Patch Changes

#17896 a548223 Thanks @matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

#17931 c1a6a89 Thanks @astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

#17908 42e9188 Thanks @astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

#17936 4b92ddc Thanks @astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

Updated dependencies [a548223]:

@astrojs/markdown-satteri@0.4.1

7.3.1

Patch Changes

#17899 0389640 Thanks @ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

7.3.0

Minor Changes
#17767 ce7c91f Thanks @astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds a logger parameter to image services hooks

Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:
import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};
Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds logger to the context object passed to cache providers

Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

... (truncated)

Commits

aa4949e [ci] release (#17915)
42e9188 fix(i18n): replace locale segment by index in fallback routing (#17907) (#17908)
4b92ddc Guard setFetchHandler call in non-runnable dev entrypoint to fix sessions + m...
c1a6a89 fix: include .astro files in client optimizeDeps entries to prevent 504 on la...
a548223 Only treat literal script/style content as raw in MDX rendering (#17896)
92f23cc [ci] release (#17900)
0389640 fix: dont use internal paths (#17899)
f800de1 [ci] release (#17881)
1e0b7e6 [ci] format
4671a5c chore(deps): update react to v19 in 0-css fixture (#17888)
Additional commits viewable in compare view

Updates sharp from 0.34.5 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

Bound resize dimensions to coordinate limit.

Bound composite left and top to coordinate limit. #4564 @metsw24-max

Round palette bit depth up for png and gif colours. #4569 @metsw24-max

Ensure tiff.subifd input option is used. #4572 @metsw24-max

Ensure info.pages is correct when limiting input page range. #4578 @metsw24-max

Improve support for input Streams finishing before output is requested. #4584 @Jaybhade

v0.35.4-rc.0

Upgrade to libvips v8.18.6 for upstream bug fixes.

Bound resize dimensions to coordinate limit.

Bound composite left and top to coordinate limit. #4564 @metsw24-max

Round palette bit depth up for png and gif colours. #4569 @metsw24-max

Ensure tiff.subifd input option is used. #4572 @metsw24-max

Ensure info.pages is correct when limiting input page range. #4578 @metsw24-max

Improve support for input Streams finishing before output is requested. #4584 @Jaybhade

... (truncated)

Commits

7f1a0a2 Release v0.35.4
f927818 Upgrade to sharp-libvips v1.3.3
e802092 Prerelease v0.35.4-rc.0
e13eb2f CI: Fix wasm32 build (#4589)
a82a0b3 Upgrade to libvips v8.18.6
8044fe4 Bound resize dimensions to coordinate limit
147f859 Docs: changelog entries for #4578 #4584
ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
Additional commits viewable in compare view

Updates fflate from 0.4.8 to 0.4.9

Changelog

Sourced from fflate's changelog.

0.8.3

Fix buffer over-read for Zip64 extra fields

Support sync flushes (Z_SYNC_FLUSH in zlib)

Allows for immediate decompression of all pushed bytes

Enables DEFLATE stream concatenation

Fix zip/zipSync when using cross-realm Uint8Array

Improve Zip64 support for streamed or undersized archives

Update performance estimates in README

Fix typings for TypeScript v5.7+

Reduce memory consumption after compression stream completion

0.8.2

Fixed broken UMD build

Fixed edge-case causing skipped data during streaming compression

Fixed bug in GZIP streaming on member boundary

Improved streaming performance on inconsistent chunk sizes

Improved unzip performance on undercompressed archives

Added flushing support into streaming API

Added backpressure support into async streaming API

Use new ondrain handler and queuedSize

0.8.1

Fixed reallocating on pre-supplied buffer in inflateSync and unzlibSync

Minor documentation fixes

0.8.0

BREAKING: synchronous decompression functions now take an options object rather than an output buffer as a second parameter

inflateSync(compressed, outBuf) is now inflateSync(compressed, { out: outBuf })

Support dictionaries in compression and decompression

Support multi-member files in GZIP streaming decompression

Dramatically improved streaming performance

Fixed missing error on certain malformed GZIP files

0.7.3

Fix folder creation for certain operating system

Create 0-length "files" for each directory specified with "object" syntax"

Support empty folders

Add options for folders

Fix minification in SWC

Remove instanceof, no-whitespace assumptions in async functions

0.7.2

Fixed TypeScript typing for errors when using strictNullChecks

Fixed failure to compress files above 64kB with { level: 0 }

Fixed AMD module definition in UMD build

0.7.1

Removed requirement for setTimeout

Added support for unzip file filters (thanks to @manucorporat: #67)

Fixed streaming gunzip and unzlib bug causing corruption

0.7.0

Improved errors

Now errors are error objects instead of strings

Check the error code to apply custom logic based on error type

Made async operations always call callbacks asynchronously

Fixed bug that caused errors to not appear in asynchronous operations in browsers

... (truncated)

Commits

See full diff in compare view

Updates js-yaml from 4.3.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

Commits

79ca68d 4.3.2 released
d90b661 Backport merge limits from v5.4.1
See full diff in compare view

Updates postcss-selector-parser from 6.1.2 to 6.1.4

Release notes

Sourced from postcss-selector-parser's releases.

6.1.4

fix: tolerate non-node children when serializing selectors

6.1.3

Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 via backport of (#316 by @MoOx)

Changelog

Sourced from postcss-selector-parser's changelog.

Changelog of postcss-selector-parser

7.1.6 - 2026-09-03

fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

fix: don't treat a non-prefix token before | as a namespace (#324 by @spokodev)

fix: preserve whitespace before a * namespace in attribute selectors (#325 by @spokodev)

fix: TypeError on unclosed [, ( and trailing | (#330 by @theRizwan)

7.1.4 - 2026-06-11

fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

Fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (#316 by @MoOx)

7.1.1

perf: replace startsWith with strict equality (#308)

fix(types): add walkUniversal declaration (#311)

7.1.0

feat: insert(Before|After) support multiple new node

7.0.0

Feat: make insertions during iteration safe (major)

Commits

4a7e4e3 7.1.4
e2021c5 fix: tolerate non-node children when serializing selectors
7893b74 7.1.3
5bc698c Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clo...
db32327 run oxfmt
16e2581 simplify deps (#319)
b185e20 Add description in package.json + full repo url
de415f1 Add Tidelift security notice
c4f2c8c CI: make Node 14 test job lockfile-v3 compatible (#318)
4e93663 Fix test run on node < 20
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by moox, a new releaser for postcss-selector-parser since your current version.

Updates svgo from 4.0.2 to 4.1.0

Release notes

Sourced from svgo's releases.

v4.1.0

This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.

Support SVGO

If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.

Stricter XML validation

SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#2257).

The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:

disallowed control characters such as &[#1](https://github.com/svg/svgo/issues/1);, , and ;

UTF-16 surrogate code points such as &#xD800;;

invalid XML code points such as .

Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.

Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.

This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.

Security

The removeScripts plugin has been hardened against several script-execution bypasses:

Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#2263).

Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#2264).

Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&[#9](https://github.com/svg/svgo/issues/9);script: from bypassing detection while preserving elements in unrelated custom namespaces (#2268).

These changes address:

GHSA-4vpr-x523-8j87

GHSA-w27v-7q3p-w38r

Dependencies

Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#2244).

Project maintenance

@TrySound is back as an active SVGO maintainer.

Many thanks to @KTibow, @SethFalco, and @XhmikosR for maintaining and improving SVGO over the past several years.

Full Changelog: svg/svgo@v4.0.2...v4.1.0

Commits

5765cbe chore: prepare v4.1.0 release (#2275)
3db3ef3 fix(removeScripts): handle anchor URL bypasses (#2268)
4e9b9ae chore: cache regression screenshots (#2267)
d55270c chore(regression): migrate comparison workers to Tinypool (#2266)
fd51e47 fix(removeScripts): sanitize foreignObject content (#2264)
dcaf957 chore: optimize fixtures in a bounded worker pool (#2265)
a354293 fix(removeScripts): filter executable data URLs (#2263)
4e0d2ac ci(typecheck): return typechecking on CI
0b97fed test(typescript): drop tsd for vitest type testing API
f6e8ae1 chore(pnpm): drop package.json#pnpm.onlyBuiltDependencies
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.

Updates astro from 5.18.0 to 7.3.2

Release notes

Sourced from astro's releases.

astro@7.3.2

Patch Changes

#17896 a548223 Thanks @matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

#17931 c1a6a89 Thanks @astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

#17908 42e9188 Thanks @astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

#17936 4b92ddc Thanks @astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

Updated dependencies [a548223]:

@astrojs/markdown-satteri@0.4.1

astro@7.3.1

Patch Changes

#17899 0389640 Thanks @ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

astro@7.3.0

Minor Changes
#17767 ce7c91f Thanks @astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds a logger parameter to image services hooks

Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:
import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};
Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds logger to the context object passed to cache providers

Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:
import type { CacheProvider } from 'astro';
const provider: CacheProvider = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.2

Patch Changes

#17896 a548223 Thanks @matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

#17931 c1a6a89 Thanks @astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

#17908 42e9188 Thanks @astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

#17936 4b92ddc Thanks @astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

Updated dependencies [a548223]:

@astrojs/markdown-satteri@0.4.1

7.3.1

Patch Changes

#17899 0389640 Thanks @ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

7.3.0

Minor Changes
#17767 ce7c91f Thanks @astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds a logger parameter to image services hooks

Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:
import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};
Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds logger to the context object passed to cache providers

Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

... (truncated)

Commits

aa4949e [ci] release (#17915)
42e9188 fix(i18n): replace locale segment by index in fallback routing (#17907) (#17908)
4b92ddc Guard setFetchHandler call in non-runnable dev entrypoint to fix sessions + m...
c1a6a89 fix: include .astro files in client optimizeDeps entries to prevent 504 on la...
a548223 Only treat literal script/style content as raw in MDX rendering (#17896)
92f23cc [ci] release (#17900)
0389640 fix: dont use internal paths (#17899)
f800de1 [ci] release (#17881)
1e0b7e6 [ci] format
4671a5c chore(deps): update react to v19 in 0-css fixture (#17888)
Additional commits viewable in compare view

Updates sharp from 0.34.5 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

Bound resize dimensions to coordinate limit.

Bound composite left and top to coordinate limit. #4564 @metsw24-max

Round palette bit depth up for png and gif colours. #4569 @metsw24-max

Ensure tiff.subifd input option is used. #4572 @metsw24-max

Ensure info.pages is correct when limiting input page range. #4578 @metsw24-max

Improve support for input Streams finishing before output is requested. #4584 @Jaybhade

v0.35.4-rc.0

Upgrade to libvips v8.18.6 for upstream bug fixes.

Bound resize dimensions to coordinate limit.

Bound composite left and top to coordinate limit. #4564 @metsw24-max

Round palette bit depth up for png and gif colours. #4569 @metsw24-max

Ensure tiff.subifd input option is used. #4572 @metsw24-max

Ensure info.pages is correct when limiting input page range. #4578 @metsw24-max

Improve support for input Streams finishing before output is requested. #4584 @Jaybhade

... (truncated)

Commits

7f1a0a2 Release v0.35.4
f927818 Upgrade to sharp-libvips v1.3.3
e802092 Prerelease v0.35.4-rc.0
e13eb2f CI: Fix wasm32 build (#4589)
a82a0b3 Upgrade to libvips v8.18.6
8044fe4 Bound resize dimensions to coordinate limit
147f859 Docs: changelog entries for #4578 #4584
ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
Additional commits viewable in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

fix: exception when glob pattern contains constructor by @Jason3S in micromatch/picomatch#144

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).

Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).

Commits

81cba8d Publish 2.3.2
fc1f6b6 Merge commit from fork
eec17ae Merge commit from fork
78f8ca4 Merge pull request #156 from micromatch/backport-144
3f4f10e Merge pull request #144 from Jason3S/jdent-object-properties
See full diff in compare view

Updates defu from 6.1.4 to 6.1.7

Release notes

Sourced from defu's releases.

v6.1.7

compare changes

📦 Build

Correct the types export entry (#160)

Export Defu types (#157)

❤️ Contributors

Jakub Michálek (@J-Michalek)

Kricsleo (@kricsleo)

v6.1.6

compare changes

📦 Build

Fix mixed types (407b516)

v6.1.5

compare changes

🩹 Fixes

Prevent prototype pollution via __proto__ in defaults (#156)

Ignore inherited enumerable properties (11ba022)

✅ Tests

Add more tests for plain objects (b65f603)

❤️ Contributors

Pooya Parsa (@pi0)

Kricsleo (@kricsleo)

Changelog

Sourced from defu's changelog.

v6.1.7

compare changes

🩹 Fixes

defu.d.cts: Export Defu types (#157)

📦 Build

Correct the types export entry (#160)

❤️ Contributors

Jakub Michálek (@J-Michalek)

Kricsleo (@kricsleo)

v6.1.6

compare changes

📦 Build

Fix mixed types (407b516)

❤️ Contributors

Pooya Parsa (@pi0)

v6.1.5

compare changes

🩹 Fixes

Prevent prototype pollution via __proto__ in defaults (#156)

Ignore inherited enumerable properties (11ba022)

🏡 Chore

Add tea.yaml (70cffe5)

Update repo (23cc432)

Fix typecheck (89df6bb)

✅ Tests

Add more tests for plain objects (b65f603)

🤖 CI

... (truncated)

Commits

80c0146 chore(release): v6.1.7
40d7ef4 fix(defu.d.cts): export Defu types (#157)
3d3a7c8 build: correct the types export entry (#160)
001c290 chore(release): v6.1.6
407b516 build: fix mixed types
23e59e6 chore(release): v6.1.5
11ba022 fix: ignore inherited enumerable properties
3942bfb fix: prevent prototype pollution via __proto__ in defaults (#156)
d3ef16d chore(deps): update actions/checkout action to v6 (#151)
869a053 chore(deps): update actions/setup-node action to v6 (#149)
Additional commits viewable in compare view

Updates devalue from 5.6.3 to 5.9.2

Release notes

Sourced from devalue's releases.

v5.9.2

Patch Changes

8b2a456: fix: reject out-of-bounds indices

v5.9.1

Patch Changes

39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references

686e379: fix: emit valid JS for Node Buffer in uneval

376b65c: fix: preserve -0 in float typed arrays in uneval

v5.9.0

Minor Changes

07d6...
Description has been truncated

… updates Bumps the npm_and_yarn group with 3 updates in the /website directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro), [sharp](https://github.com/lovell/sharp) and [fflate](https://github.com/101arrowz/fflate). Bumps the npm_and_yarn group with 2 updates in the /website/.scaffold-backup-opposite-orbit directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) and [sharp](https://github.com/lovell/sharp). Updates `astro` from 6.4.8 to 7.3.2 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.3.2/packages/astro) Updates `sharp` from 0.34.5 to 0.35.4 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.5...v0.35.4) Updates `fflate` from 0.4.8 to 0.4.9 - [Release notes](https://github.com/101arrowz/fflate/releases) - [Changelog](https://github.com/101arrowz/fflate/blob/master/CHANGELOG.md) - [Commits](https://github.com/101arrowz/fflate/commits) Updates `js-yaml` from 4.3.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `postcss-selector-parser` from 6.1.2 to 6.1.4 - [Release notes](https://github.com/postcss/postcss-selector-parser/releases) - [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-selector-parser@v6.1.2...6.1.4) Updates `svgo` from 4.0.2 to 4.1.0 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v4.0.2...v4.1.0) Updates `astro` from 5.18.0 to 7.3.2 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.3.2/packages/astro) Updates `sharp` from 0.34.5 to 0.35.4 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.5...v0.35.4) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) Updates `defu` from 6.1.4 to 6.1.7 - [Release notes](https://github.com/unjs/defu/releases) - [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md) - [Commits](unjs/defu@v6.1.4...v6.1.7) Updates `devalue` from 5.6.3 to 5.9.2 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.6.3...v5.9.2) Updates `esbuild` from 0.25.12 to 0.28.2 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md) - [Commits](evanw/esbuild@v0.25.12...v0.28.2) Updates `h3` from 1.15.5 to 1.15.11 - [Release notes](https://github.com/h3js/h3/releases) - [Changelog](https://github.com/h3js/h3/blob/v1.15.11/CHANGELOG.md) - [Commits](h3js/h3@v1.15.5...v1.15.11) Updates `js-yaml` from 4.1.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `nanoid` from 3.3.11 to 3.3.18 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/3.3.18/CHANGELOG.md) - [Commits](ai/nanoid@3.3.11...3.3.18) Updates `postcss` from 8.5.6 to 8.5.28 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.28) Updates `postcss-selector-parser` from 6.1.2 to 6.1.4 - [Release notes](https://github.com/postcss/postcss-selector-parser/releases) - [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-selector-parser@v6.1.2...6.1.4) Updates `smol-toml` from 1.6.0 to 1.8.0 - [Release notes](https://github.com/squirrelchat/smol-toml/releases) - [Commits](squirrelchat/smol-toml@v1.6.0...v1.8.0) Updates `svgo` from 4.0.0 to 4.1.0 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v4.0.2...v4.1.0) Updates `vite` from 6.4.1 to 8.2.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) --- updated-dependencies: - dependency-name: astro dependency-version: 7.3.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.35.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: fflate dependency-version: 0.4.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss-selector-parser dependency-version: 6.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 4.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: astro dependency-version: 7.3.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-version: 0.35.4 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: defu dependency-version: 6.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.9.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.28.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: h3 dependency-version: 1.15.11 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.28 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss-selector-parser dependency-version: 6.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: smol-toml dependency-version: 1.8.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 4.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.2.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-09-08T23:57:09Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
@astrojs/starlight@0.39.3 ⏵ 0.42.0			⁺¹	⁺¹
astro@6.4.8 ⏵ 7.3.2	⁺¹	⁺⁷⁵	⁺¹
sharp@0.34.5 ⏵ 0.35.4	⁺⁵	⁺²²	⁺¹

View full report

socket-security · 2026-09-08T23:57:11Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@emnapi/runtime` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: website/.scaffold-backup-opposite-orbit/package-lock.json → `npm/@astrojs/starlight@0.42.0` → `npm/astro@7.3.2` → `npm/@emnapi/runtime@1.11.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/runtime@1.11.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 8, 2026

Navigation Menu

Uh oh!

chore(deps): bump the npm_and_yarn group across 2 directories with 15 updates - #68

chore(deps): bump the npm_and_yarn group across 2 directories with 15 updates#68
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/website/npm_and_yarn-2d78be82a2

dependabot Bot commented on behalf of github Sep 8, 2026

Uh oh!

socket-security Bot commented Sep 8, 2026

Uh oh!

socket-security Bot commented Sep 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 8, 2026

astro@7.3.2

Patch Changes

astro@7.3.1

Patch Changes

astro@7.3.0

Minor Changes

7.3.2

Patch Changes

7.3.1

Patch Changes

7.3.0

Minor Changes

v0.35.4

v0.35.4-rc.0

0.8.3

0.8.2

0.8.1

0.8.0

0.7.3

0.7.2

0.7.1

0.7.0

4.3.2 - 2026-08-26

Changed

Security

6.1.4

6.1.3

Changelog of postcss-selector-parser

7.1.6 - 2026-09-03

7.1.5 - 2026-08-07

7.1.4 - 2026-06-11

7.1.3 - 2026-06-11

7.1.2 - 2026-06-09

7.1.1

7.1.0

7.0.0

v4.1.0

Support SVGO

Stricter XML validation

Security

Dependencies

Project maintenance

astro@7.3.2

Patch Changes

astro@7.3.1

Patch Changes

astro@7.3.0

Minor Changes

7.3.2

Patch Changes

7.3.1

Patch Changes

7.3.0

Minor Changes

v0.35.4

v0.35.4-rc.0

2.3.2

What's Changed

2.3.2 (2026-03-23)

Fixed

Security

v6.1.7

📦 Build

❤️ Contributors

v6.1.6

📦 Build

v6.1.5

🩹 Fixes

✅ Tests

❤️ Contributors

v6.1.7

🩹 Fixes

📦 Build

❤️ Contributors

v6.1.6

📦 Build

❤️ Contributors

Changelog of `postcss-selector-parser`