Skip to content

chore(deps): bump the site-dependencies group across 1 directory with 2 updates - #123

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/site/site-dependencies-cf9358fa20
Open

chore(deps): bump the site-dependencies group across 1 directory with 2 updates#123
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/site/site-dependencies-cf9358fa20

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the site-dependencies group with 2 updates in the /site directory: astro and pagefind.

Updates astro from 7.2.9 to 7.4.7

Release notes

Sourced from astro's releases.

astro@7.4.7

Patch Changes

  • 7da442b Thanks @​matthewp! - Fixes the image endpoint treating directories whose names differ only by letter case as being inside the build output directory on case-sensitive filesystems
  • Updated dependencies [7da442b]:
    • @​astrojs/internal-helpers@​0.13.1
    • @​astrojs/markdown-satteri@​0.4.7

astro@7.4.6

Patch Changes

  • #18565 cd09986 Thanks @​praveen-kumary! - Avoids attributing client-only components or scripts to unrelated pages importing astro:i18n by bounding top-level page graph traversal at virtual page entries

  • #18608 babd96d Thanks @​umeraamir69! - Fixes an extra page reload on the first page load after starting astro dev without an existing .astro directory

  • #18589 402c0fa Thanks @​astro-factory! - Fixes astro check exiting with code 0 when @astrojs/check or typescript is not installed. The command now exits with code 1 so CI fails instead of silently skipping type checking.

  • #18503 54fcdd5 Thanks @​SwastikTripathi! - Preserves the last-modified date of cached font files and unchanged public files when copying them into the build output. Public-file timestamp preservation respects the resolved public-directory configuration, follows source symlinks, and avoids backdating files overwritten by build plugins.

  • #18605 76cd239 Thanks @​astro-factory! - Fixes the glob() loader adding files from a folder excluded with a negation pattern such as !_docs when they change during astro dev

  • #18432 ed60d82 Thanks @​alexmv! - Improves the MissingSharp error to include the reason Sharp failed to load, such as its prebuilt binaries not supporting the current CPU

  • #18474 59543c3 Thanks @​miottid! - Fixes i18n fallback for on-demand rendered pages. A locale-prefixed request for a page that only exists in the fallback locale (for example /de/about with fallback: { de: 'en' }) was answered with status 302 and no Location header. Such requests are now rewritten or redirected to the fallback locale according to i18n.routing.fallbackType, including encoded paths and sites with a configured base. Query strings are preserved, and explicit page statuses and redirects are left unchanged.

  • #18541 cfa2d2b Thanks @​ump45nose! - Fixes matchAllRoutes to consider fallbackRoutes, matching matchRoute and the production router. Dev-server i18n fallback requests now resolve to the source route's metadata instead of the 404 route, and SSR-only fallback candidates can fall through the prerender handler.

  • #18602 d856064 Thanks @​astro-factory! - Fixes astro check losing the end of its output, including the Result summary, when stdout is piped to a slow reader. When the reader closes the pipe early, for example astro check | head, astro check now exits with code 1 instead of crashing with an EPIPE stack trace.

  • #18574 da0f149 Thanks @​astro-factory! - Fixes an unnecessary full page reload in astro dev when a content loader calls store.clear() or store.delete() and the content store has no asset imports

  • #18570 e71c038 Thanks @​astro-factory! - Fixes pages using <ClientRouter /> briefly showing the top of the page on reload before jumping back to the previous scroll position. Full reloads now use the browser's native scroll restoration.

  • #18531 f75553b Thanks @​praveen-kumary! - Fixes an unhandled TypeError: Cannot convert undefined or null to object when calling route.generate() without arguments on static routes

astro@7.4.5

Patch Changes

  • #18558 fac3c50 Thanks @​astro-factory! - Fixes astro dev status and other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process

  • #18559 10dae2f Thanks @​astro-factory! - Fixes import.meta.env values containing $ sequences (such as $$ or $&) being corrupted in astro build when server code reads the import.meta.env object directly, for example with const { MY_SECRET } = import.meta.env

  • #18544 e3bec3d Thanks @​skezo! - Fixes request paths with invalid percent-encoding (e.g. /%C0%AF or a bare %) being logged as an Invalid URL encoding error and routed with the undecoded path. These requests now return a 400, the same as a path that is encoded too many times.

  • #18520 e023aba Thanks @​matthewp! - Makes rendering of string tag names stricter and consistent across .astro dynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as / or = can no longer change the generated markup. A string that does not start with a valid element name (for example '!--' or '') now throws an error instead of producing invalid HTML.

astro@7.4.4

Patch Changes

... (truncated)

Changelog

Sourced from astro's changelog.

7.4.7

Patch Changes

  • 7da442b Thanks @​matthewp! - Fixes the image endpoint treating directories whose names differ only by letter case as being inside the build output directory on case-sensitive filesystems
  • Updated dependencies [7da442b]:
    • @​astrojs/internal-helpers@​0.13.1
    • @​astrojs/markdown-satteri@​0.4.7

7.4.6

Patch Changes

  • #18565 cd09986 Thanks @​praveen-kumary! - Avoids attributing client-only components or scripts to unrelated pages importing astro:i18n by bounding top-level page graph traversal at virtual page entries

  • #18608 babd96d Thanks @​umeraamir69! - Fixes an extra page reload on the first page load after starting astro dev without an existing .astro directory

  • #18589 402c0fa Thanks @​astro-factory! - Fixes astro check exiting with code 0 when @astrojs/check or typescript is not installed. The command now exits with code 1 so CI fails instead of silently skipping type checking.

  • #18503 54fcdd5 Thanks @​SwastikTripathi! - Preserves the last-modified date of cached font files and unchanged public files when copying them into the build output. Public-file timestamp preservation respects the resolved public-directory configuration, follows source symlinks, and avoids backdating files overwritten by build plugins.

  • #18605 76cd239 Thanks @​astro-factory! - Fixes the glob() loader adding files from a folder excluded with a negation pattern such as !_docs when they change during astro dev

  • #18432 ed60d82 Thanks @​alexmv! - Improves the MissingSharp error to include the reason Sharp failed to load, such as its prebuilt binaries not supporting the current CPU

  • #18474 59543c3 Thanks @​miottid! - Fixes i18n fallback for on-demand rendered pages. A locale-prefixed request for a page that only exists in the fallback locale (for example /de/about with fallback: { de: 'en' }) was answered with status 302 and no Location header. Such requests are now rewritten or redirected to the fallback locale according to i18n.routing.fallbackType, including encoded paths and sites with a configured base. Query strings are preserved, and explicit page statuses and redirects are left unchanged.

  • #18541 cfa2d2b Thanks @​ump45nose! - Fixes matchAllRoutes to consider fallbackRoutes, matching matchRoute and the production router. Dev-server i18n fallback requests now resolve to the source route's metadata instead of the 404 route, and SSR-only fallback candidates can fall through the prerender handler.

  • #18602 d856064 Thanks @​astro-factory! - Fixes astro check losing the end of its output, including the Result summary, when stdout is piped to a slow reader. When the reader closes the pipe early, for example astro check | head, astro check now exits with code 1 instead of crashing with an EPIPE stack trace.

  • #18574 da0f149 Thanks @​astro-factory! - Fixes an unnecessary full page reload in astro dev when a content loader calls store.clear() or store.delete() and the content store has no asset imports

  • #18570 e71c038 Thanks @​astro-factory! - Fixes pages using <ClientRouter /> briefly showing the top of the page on reload before jumping back to the previous scroll position. Full reloads now use the browser's native scroll restoration.

  • #18531 f75553b Thanks @​praveen-kumary! - Fixes an unhandled TypeError: Cannot convert undefined or null to object when calling route.generate() without arguments on static routes

7.4.5

Patch Changes

  • #18558 fac3c50 Thanks @​astro-factory! - Fixes astro dev status and other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process

  • #18559 10dae2f Thanks @​astro-factory! - Fixes import.meta.env values containing $ sequences (such as $$ or $&) being corrupted in astro build when server code reads the import.meta.env object directly, for example with const { MY_SECRET } = import.meta.env

  • #18544 e3bec3d Thanks @​skezo! - Fixes request paths with invalid percent-encoding (e.g. /%C0%AF or a bare %) being logged as an Invalid URL encoding error and routed with the undecoded path. These requests now return a 400, the same as a path that is encoded too many times.

  • #18520 e023aba Thanks @​matthewp! - Makes rendering of string tag names stricter and consistent across .astro dynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as / or = can no longer change the generated markup. A string that does not start with a valid element name (for example '!--' or '') now throws an error instead of producing invalid HTML.

7.4.4

... (truncated)

Commits
  • cd30ae2 [ci] release (#18637)
  • 7a1255f [ci] release (#18582)
  • 78eddf9 Update dependency p-queue to v10 (#18619)
  • ff1e2fb Update dependency undici to v8 [SECURITY] (#18519)
  • babd96d fix(astro): skip data-store full-reload when no clients are connected (#18608)
  • b64567f Update all non-major dependencies (#18615)
  • cfa2d2b fix(routing): consider fallbackRoutes in matchAllRoutes (#18541)
  • f75553b fix(routing): avoid TypeError when calling route generator without arguments ...
  • 59543c3 Fix i18n fallback for on-demand pages reached through a fallback route (#18474)
  • e71c038 ClientRouter no longer flashes the top of the page on full reload when scroll...
  • Additional commits viewable in compare view

Updates pagefind from 1.5.2 to 1.6.0

Release notes

Sourced from pagefind's releases.

v1.6.0

👋 A little overdue, but this release knocks out a healthy selection of bug reports, and includes a lot of work from the community. Thanks to everyone who contributed ❤️ - @​bglw

Multilingual Segmentation

Pagefind's extended build now segments Chinese, Japanese, and Thai pages with ICU4X, replacing the previous dependency (PR #1383). Alongside producing a smaller binary, ICU4X segments a lot closer to the Intl.Segmenter used in the browser on the search query (which is ICU4C). This closes out a mixture of latent and reported issues where the different segmentation between indexing and searching makes for iffy results. It's not perfect yet, but it's a darn sight closer.

Bonuses:

  • Segmentation is smarter in languages such as Thai, and doesn't break inside a grapheme cluster
  • Japanese katakana has special handling, but should still be improved over 1.5.2
  • Japanese voiced and semi-voiced sound marks are no longer normalized into each other

Fewer Fragment Files

Pagefind now has an option to limit the total number of fragment files produced, for hosting providers that cap the number of uploaded files. Contributed in PR #1020 — thanks @​yakovsh !

This limit is set with --max-fragments / max_fragments, and applies per language. When applied, multiple fragments are bundled together and loaded as a set when required.

See 📘 Max fragments.

Explicit Sub-Result Titles

Added support for explicit sub-result titles. Any element with both an id and a data-pagefind-title attribute can be used as a sub-result (PR #1282 — thanks @​samuel-williams-shopify !)

See 📘 Defining a sub result explicitly.

Component UI

  • Added a sort attribute to <pagefind-config>, to order results by a sort key (PR #1326)
  • Added a max-sub-results attribute to <pagefind-searchbox> (PR #1324)
  • Added a placeholder setter to <pagefind-searchbox> and <pagefind-modal-trigger> (PR #1321)
  • configureInstance now applies to an instance that already exists but has not loaded yet (PR #1323)
  • Fixed the UI language being resolved after the first render, which could flash the wrong translations (PR #1332)
  • Fixed component cleanup after being disconnected (PR #1322)
  • Fixed IME composition keystrokes support (PR #1284 — thanks @​oharu121 !)
  • Fixed the modal staying open when clicking a result for the current page (PR #1327)
  • Fixed the filter panel checkbox shrinking when its label wraps (PR #1166 — thanks @​mbrambilla !)
  • Hid the keyboard shortcut badge on touch-only devices (PR #1325)

Search Results & Options

  • Added an excerptEllipsis option to mark the truncated ends of excerpts (PR #1320)
  • Fixed phrase search across diacritic variants, so searching "cafe latte" can match a page containing café latte (PR #1386 — thanks @​sean0407 !)
  • Fixed filters not matching values containing escaped characters such as quotes or backslashes (PR #1392)
  • Fixed compound words being counted twice in metadata coverage, which could overvalue a metadata match (PR #1319)
  • Fixed a bug which could build excerpts from the wrong words (PR #1318)
  • Fixed decoding for HTML entities in the automatic image and image_alt metadata (PR #1393 — thanks @​digilist !)

... (truncated)

Changelog

Sourced from pagefind's changelog.

v1.6.0 (November 1, 2026)

👋 A little overdue, but this release knocks out a healthy selection of bug reports, and includes a lot of work from the community. Thanks to everyone who contributed ❤️ - @​bglw

Multilingual Segmentation

Pagefind's extended build now segments Chinese, Japanese, and Thai pages with ICU4X, replacing the previous dependency (PR #1383). Alongside producing a smaller binary, ICU4X segments a lot closer to the Intl.Segmenter used in the browser on the search query (which is ICU4C). This closes out a mixture of latent and reported issues where the different segmentation between indexing and searching makes for iffy results. It's not perfect yet, but it's a darn sight closer.

Bonuses:

  • Segmentation is smarter in languages such as Thai, and doesn't break inside a grapheme cluster
  • Japanese katakana has special handling, but should still be improved over 1.5.2
  • Japanese voiced and semi-voiced sound marks are no longer normalized into each other

Fewer Fragment Files

Pagefind now has an option to limit the total number of fragment files produced, for hosting providers that cap the number of uploaded files. Contributed in PR #1020 — thanks @​yakovsh !

This limit is set with --max-fragments / max_fragments, and applies per language. When applied, multiple fragments are bundled together and loaded as a set when required.

See 📘 Max fragments.

Explicit Sub-Result Titles

Added support for explicit sub-result titles. Any element with both an id and a data-pagefind-title attribute can be used as a sub-result (PR #1282 — thanks @​samuel-williams-shopify !)

See 📘 Defining a sub result explicitly.

Component UI

  • Added a sort attribute to <pagefind-config>, to order results by a sort key (PR #1326)
  • Added a max-sub-results attribute to <pagefind-searchbox> (PR #1324)
  • Added a placeholder setter to <pagefind-searchbox> and <pagefind-modal-trigger> (PR #1321)
  • configureInstance now applies to an instance that already exists but has not loaded yet (PR #1323)
  • Fixed the UI language being resolved after the first render, which could flash the wrong translations (PR #1332)
  • Fixed component cleanup after being disconnected (PR #1322)
  • Fixed IME composition keystrokes support (PR #1284 — thanks @​oharu121 !)
  • Fixed the modal staying open when clicking a result for the current page (PR #1327)
  • Fixed the filter panel checkbox shrinking when its label wraps (PR #1166 — thanks @​mbrambilla !)
  • Hid the keyboard shortcut badge on touch-only devices (PR #1325)

Search Results & Options

  • Added an excerptEllipsis option to mark the truncated ends of excerpts (PR #1320)
  • Fixed phrase search across diacritic variants, so searching "cafe latte" can match a page containing café latte (PR #1386 — thanks @​sean0407 !)
  • Fixed filters not matching values containing escaped characters such as quotes or backslashes (PR #1392)
  • Fixed compound words being counted twice in metadata coverage, which could overvalue a metadata match (PR #1319)
  • Fixed a bug which could build excerpts from the wrong words (PR #1318)
  • Fixed decoding for HTML entities in the automatic image and image_alt metadata (PR #1393 — thanks @​digilist !)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the site-dependencies group across 1 directory with…
3993de8 
… 2 updates

Bumps the site-dependencies group with 2 updates in the /site directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) and [pagefind](https://github.com/Pagefind/pagefind).


Updates `astro` from 7.2.9 to 7.4.7
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.4.7/packages/astro)

Updates `pagefind` from 1.5.2 to 1.6.0
- [Release notes](https://github.com/Pagefind/pagefind/releases)
- [Changelog](https://github.com/Pagefind/pagefind/blob/main/CHANGELOG.md)
- [Commits](Pagefind/pagefind@v1.5.2...v1.6.0)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 7.4.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: site-dependencies
- dependency-name: pagefind
  dependency-version: 1.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: site-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner November 9, 2026 09:20
@dependabot @github

dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, site. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

github-actions Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

🔍 Preview

Build and checks passed, but a live preview wasn't auto-deployed because Dependabot (@dependabot)[bot] isn't a member of forgebook-contributors yet. A maintainer can add you to the team and re-run this workflow to deploy the preview.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants