[dependabot]

Bumps the npm-dependencies group with 8 updates in the / directory:

Package	From	To
@astrojs/cloudflare	14.4.2	14.4.3
@astrojs/starlight	0.42.6	0.42.7
@iconify-json/lucide	1.2.147	1.2.149
@iconify-json/simple-icons	1.2.100	1.2.101
@wolfsblvt/icons	0.4.0	0.5.0
astro	7.4.2	7.4.4
ignore	7.0.13	7.0.14
wrangler	4.151.3	4.156.0

Updates @astrojs/cloudflare from 14.4.2 to 14.4.3

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.4.3

Patch Changes

• #18526 d0504c2 Thanks @​astro-factory! - Fixes process is not defined errors in client-side scripts and islands that reference process.env. The adapter's process.env define now applies only to the server output, so browser builds get Vite's default replacement.
• Updated dependencies []:
  • @​astrojs/underscore-redirects@​1.0.4

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.4.3

Patch Changes

• #18526 d0504c2 Thanks @​astro-factory! - Fixes process is not defined errors in client-side scripts and islands that reference process.env. The adapter's process.env define now applies only to the server output, so browser builds get Vite's default replacement.
• Updated dependencies []:
  • @​astrojs/underscore-redirects@​1.0.4

Commits

• fda754d [ci] release (#18478)
• d0504c2 fix(cloudflare): scope process.env define to server environments so client bu...
• 3773941 Restore CSS tree-shaking for unused barrel-imported Astro components (#18493)
• See full diff in compare view

Updates @astrojs/starlight from 0.42.6 to 0.42.7

Release notes

Sourced from @​astrojs/starlight's releases.

@​astrojs/starlight@​0.42.7

Patch Changes

• #4264 94e0985 Thanks @​chrispezza! - Fixes a layout shift where the table of contents could be painted at the start of the content area and then jump to the end when a page's HTML arrived in several chunks

• #4285 6f22edd Thanks @​tunetheweb! - Improves hero image loading by adding fetchpriority="high" hint for browsers

Changelog

Sourced from @​astrojs/starlight's changelog.

0.42.7

Patch Changes

• #4264 94e0985 Thanks @​chrispezza! - Fixes a layout shift where the table of contents could be painted at the start of the content area and then jump to the end when a page's HTML arrived in several chunks

• #4285 6f22edd Thanks @​tunetheweb! - Improves hero image loading by adding fetchpriority="high" hint for browsers

Commits

• e200e31 [ci] release (#4274)
• 6f22edd Add fetchpriority=high on Hero images (#4285)
• 6a06a01 Update to Vitest 5 (#4180)
• 94e0985 Fix table of contents layout shift while a page streams in (#4264)
• See full diff in compare view

Updates @iconify-json/lucide from 1.2.147 to 1.2.149

Commits

• See full diff in compare view

Updates @iconify-json/simple-icons from 1.2.100 to 1.2.101

Commits

• See full diff in compare view

Updates @wolfsblvt/icons from 0.4.0 to 0.5.0

Release notes

Sourced from @​wolfsblvt/icons's releases.

@​wolfsblvt/icons 0.5.0

The TunnelTend glyph arrives in the package. tunneltend/brand is now an available product icon, so the Works website's contact picker, and any other Works surface that shows TunnelTend, can take it from the shared catalogue instead of keeping a local copy.

Highlights

• tunneltend/brand is The Fold, TunnelTend's mark of two independent rounded paths nested in a stable turn, for picker, link and provider-style slots where the formal lockup does not fit. Its path data is TunnelTend's own tintable master, carried unchanged: it was already a 24×24, 2px round-stroke, currentColor line mark.
• The TunnelTend family map records the meaning, source commit and hash, usage rules, and a 16 to 32 px light and dark contact sheet beside Lucide references.

---
import { ProductIcon } from "@wolfsblvt/icons/astro";
---
<ProductIcon name="tunneltend/brand" label="TunnelTend" />

Upgrade

npm install @wolfsblvt/icons@0.5.0

No existing name changed meaning or geometry. 0.5.0 also carries everything from 0.4.0, including the Borrowed Coast Night Chart family.

Proof and current limits

The release source passed the repository verification suite, including a real Astro consumer build and a clean consumer that installs the packed tarball before building through its public exports. It is published from GitHub Actions through npm Trusted Publishing and carries npm provenance.

The package carries only the monochrome line glyph. The coloured Fold, wordmark, lockups, favicon and its heavier small-size variant stay in TunnelTend's own brand bundle. tunneltend/brand becomes compatibility-bearing once published. 0.5.0 is still an early package release, not a stability promise.

Licence

Original package code, documentation, and Works-authored glyphs are MIT-licensed. Third-party icon data and marks retain their own terms; see LICENSE.md and the third-party notices.

Commits

• c80e43b feat: add the TunnelTend product glyph and prepare 0.5.0 (#29)
• See full diff in compare view

Updates astro from 7.4.2 to 7.4.4

Release notes

Sourced from astro's releases.

astro@7.4.4

Patch Changes

• #18344 df838da Thanks @​edmundhung! - Allows astro add to configure tagged versions of official adapters

astro@7.4.4-beta.0

Patch Changes

• #18539 db62f3b Thanks @​matthewp! - Allows astro add to configure tagged versions of official adapters

astro@7.4.3

Patch Changes

• #18488 e4e25fa Thanks @​umeraamir69! - CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string into script-src and style-src.

• #18500 e5a3a1b Thanks @​astro-factory! - Fixes <Image> and <Picture> emitting duplicate srcset candidates when densities contains equivalent values such as 1 and '1x'

• #18517 c3185b7 Thanks @​okxint! - Fix unhandled AbortError rejection when ClientRouter skips a pending view transition

• #18497 c712113 Thanks @​astro-factory! - Fixes an uncaught TypeError in the browser when a server:defer island request fails due to a network error. The fallback content is kept, as it is for non-200 responses.

• #18525 d0240b9 Thanks @​astro-factory! - Fixes a DEP0190 deprecation warning printed by astro info on Node.js 24 and later

• #18522 776b9a6 Thanks @​astro-factory! - Fixes memoryCache() serving an empty body for cached pages that return an empty 404 or 500 response. These responses now render the 404 or 500 error page on every request.

• #18511 d060ff9 Thanks @​astro-factory! - Fixes transition:name styles missing in dev when the element is inside a component that is only rendered through another component with no styles or scripts

• #18494 5fe699c Thanks @​astro-factory! - Fixes the astro CLI refusing to run on StackBlitz by allowing Node.js >=22.22.0 inside WebContainers, whose Node.js version users cannot change

• #18506 bf43a60 Thanks @​astro-factory! - Fixes <ClientRouter /> animating scroll restoration on back/forward navigation when scroll-behavior: smooth is set. Saved scroll positions are now restored instantly, matching the browser's native behavior.

• #18476 8ea79a2 Thanks @​astro-factory! - Fixes a DataCloneError crash when building pages that render SVG imports with <Image /> or getImage() while experimental.parallelPrerender is enabled.

• #18504 6dbd737 Thanks @​astro-factory! - Fixes <Picture> emitting a duplicate 1x candidate in <source> srcset when densities includes 1

• #18524 7524889 Thanks @​astro-factory! - Fixes type errors reported in Astro's built-in <Image />, <Picture />, <Code />, <Debug /> and <ClientRouter /> components when type-checking a project that extends astro/tsconfigs/strictest with tsc and @astrojs/ts-content-mapper

• #18493 3773941 Thanks @​astro-factory! - Fixes scoped styles of unused Astro components being included in the build when those components are re-exported from a barrel file

• #18512 1151b9e Thanks @​jp-knj! - Fixes CSP hashes added with Astro.csp from components rendered inside <body> being left out of the CSP <meta> element in static builds, including MDX pages

• Updated dependencies [6cf3423, edfbf4a]:

  • @​astrojs/telemetry@​3.4.2
  • @​astrojs/markdown-satteri@​0.4.6

Changelog

Sourced from astro's changelog.

7.4.4

Patch Changes

• #18344 df838da Thanks @​edmundhung! - Allows astro add to configure tagged versions of official adapters

7.4.3

Patch Changes

• #18488 e4e25fa Thanks @​umeraamir69! - CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string into script-src and style-src.

• #18500 e5a3a1b Thanks @​astro-factory! - Fixes <Image> and <Picture> emitting duplicate srcset candidates when densities contains equivalent values such as 1 and '1x'

• #18517 c3185b7 Thanks @​okxint! - Fix unhandled AbortError rejection when ClientRouter skips a pending view transition

• #18497 c712113 Thanks @​astro-factory! - Fixes an uncaught TypeError in the browser when a server:defer island request fails due to a network error. The fallback content is kept, as it is for non-200 responses.

• #18525 d0240b9 Thanks @​astro-factory! - Fixes a DEP0190 deprecation warning printed by astro info on Node.js 24 and later

• #18522 776b9a6 Thanks @​astro-factory! - Fixes memoryCache() serving an empty body for cached pages that return an empty 404 or 500 response. These responses now render the 404 or 500 error page on every request.

• #18511 d060ff9 Thanks @​astro-factory! - Fixes transition:name styles missing in dev when the element is inside a component that is only rendered through another component with no styles or scripts

• #18494 5fe699c Thanks @​astro-factory! - Fixes the astro CLI refusing to run on StackBlitz by allowing Node.js >=22.22.0 inside WebContainers, whose Node.js version users cannot change

• #18506 bf43a60 Thanks @​astro-factory! - Fixes <ClientRouter /> animating scroll restoration on back/forward navigation when scroll-behavior: smooth is set. Saved scroll positions are now restored instantly, matching the browser's native behavior.

• #18476 8ea79a2 Thanks @​astro-factory! - Fixes a DataCloneError crash when building pages that render SVG imports with <Image /> or getImage() while experimental.parallelPrerender is enabled.

• #18504 6dbd737 Thanks @​astro-factory! - Fixes <Picture> emitting a duplicate 1x candidate in <source> srcset when densities includes 1

• #18524 7524889 Thanks @​astro-factory! - Fixes type errors reported in Astro's built-in <Image />, <Picture />, <Code />, <Debug /> and <ClientRouter /> components when type-checking a project that extends astro/tsconfigs/strictest with tsc and @astrojs/ts-content-mapper

• #18493 3773941 Thanks @​astro-factory! - Fixes scoped styles of unused Astro components being included in the build when those components are re-exported from a barrel file

• #18512 1151b9e Thanks @​jp-knj! - Fixes CSP hashes added with Astro.csp from components rendered inside <body> being left out of the CSP <meta> element in static builds, including MDX pages

• Updated dependencies [6cf3423, edfbf4a]:

  • @​astrojs/telemetry@​3.4.2
  • @​astrojs/markdown-satteri@​0.4.6

Commits

• 883e672 [ci] release (#18540)
• df838da astro add: configure tagged official adapters (#18344)
• fda754d [ci] release (#18478)
• 776b9a6 Prevent memory cache from storing empty 404/500 responses that would be rerou...
• d060ff9 Fix transition:name styles silently dropped in dev when component is nested u...
• 290b196 Merge commit from fork
• d0240b9 fix(cli): drop shell: true from astro info package manager calls to avoid DEP...
• 7524889 Fix type errors in shipped components under the strictest TypeScript preset...
• d53d823 [ci] format
• 6dbd737 fix(assets): avoid duplicate 1x candidate in Picture source srcset when densi...
• Additional commits viewable in compare view

Updates ignore from 7.0.13 to 7.0.14

Commits

• edbaa52 bump version 7.0.14
• 92c4cb7 test: compare checkIgnore() with git check-ignore -v line for line
• c0f0de9 fix: report the last rule to match, as git check-ignore -v does
• e5151b3 fix: let checkIgnore("dir/") read "//" as "/" does
• 6e6ce57 docs: say exactly what .checkIgnore() shares with git check-ignore -v
• 3c36daa fix: let "/" match every path, as "" does
• 8a910fc test: move [[:cntrl:]] into the fixtures, and drop a test git already covers
• ed46624 test: compare the three skipped fixtures with git too
• d990dc5 test: check #175's trailing run against git, through re-inclusion
• 8b3466b docs, test: finish #175 -- say what git does with a run of asterisks
• Additional commits viewable in compare view

Updates wrangler from 4.151.3 to 4.156.0

Release notes

Sourced from wrangler's releases.

wrangler@4.156.0

Minor Changes

• #16532 25802bc Thanks @​simonha9! - Allow the experimental wrangler d1 insights command to run across every D1 database in the account

  The database name is now optional. With no name, the command returns the top queries across every D1 database in the account, and each result gains a databaseId field.

Patch Changes

• #16369 ec0bea4 Thanks @​MattieTK! - Stop autoconfig in non-interactive runs when a project root holds both static files and a Pages functions directory

  When a project without a detected framework has a functions directory, autoconfig asks whether it is a Cloudflare Pages project. Non-interactive runs (CI and coding agents) assume it is not and continue as a static site. When the static files are in the project root, that deploys the root as static assets, and the Pages Functions (the project's API routes) are not deployed.

  In that case autoconfig now stops with an error explaining that Pages Functions cannot be migrated automatically yet. For Pages Functions it suggests moving the static files into a subdirectory and deploying with wrangler pages deploy, or migrating the Functions to a Worker; for a functions directory that is not Pages Functions, it suggests moving the static files into a subdirectory or adding a configuration file. Projects whose static files are already in a subdirectory, projects detected as Pages or with a detected framework, and interactive runs where the user answers the prompt are unaffected.

• #16367 b4653b4 Thanks @​MattieTK! - Write a protective .assetsignore when autoconfig uses the project root as the static assets directory

  Autoconfig is meant to write an .assetsignore when the project root itself is the assets directory, so that local files are not uploaded as public assets. The check compared the detected output directory, which is relative ("."), with the absolute project path, so it never matched and no .assetsignore was written. A static project with an index.html at its root (for example after wrangler setup or a zero-config wrangler deploy) then uploaded files such as .env, .dev.vars, .git and node_modules as public assets.

  The check now resolves the assets directory that the generated configuration uses and compares it with the project root, so frameworks that set their own build output directory (such as Nuxt or SvelteKit) do not get an unused root .assetsignore. The generated .assetsignore also covers what a Cloudflare Pages upload skips, alongside the existing .wrangler, .dev.vars* and .env* entries: /_worker.js, /_routes.json and /functions at the root (so nested paths such as blog/functions/index.html are still uploaded), node_modules, .git and .DS_Store at any depth, and .npmrc. If an existing .assetsignore only lists a narrower pattern such as .env, .env* is added so that files like .env.production are skipped too. When the project root of an assets-only project contains a Pages functions directory or _worker.js, autoconfig now warns that it will not be deployed, since it is excluded from the assets and not run as server code.

• #16532 25802bc Thanks @​simonha9! - Fail the experimental wrangler d1 insights command with an actionable error when the GraphQL Analytics API rejects the request

  Previously the command printed an empty []. Rate limit errors now say how long to wait before retrying, and authorization errors name the "Account Analytics: Read" permission the API token needs.

• #16013 8b64bec Thanks @​swalker326! - Fix Durable Object self-references in tests and container validation

  Durable Object bindings that explicitly name the Worker itself now resolve to the test runner in @cloudflare/vitest-plugin, for both cloudflare.config.ts and Wrangler configuration files. Named Wrangler environments use their effective Worker name, keeping bindings to the base Worker external. Container validation also accepts these self-references, using the effective deployment name to distinguish local and external bindings.

  Explicit binding targets remain intact during configuration conversion, so deploying with --name or a CI name override preserves the intended Durable Object target.

• Updated dependencies [15fbaed, d8899ac]:

  • miniflare@5.20261023.3-beta

wrangler@4.155.0

Minor Changes

• #16536 a95d647 Thanks @​WalshyDev! - Support remote Analytics Engine bindings in local development

  Setting remote: true on an Analytics Engine dataset now sends writeDataPoint() calls from wrangler dev and the Vite plugin to the real dataset. Without it, writes are still dropped locally.

  {
    "analytics_engine_datasets": [
      {
        "binding": "EVENTS",
        "dataset": "my-dataset",
        "remote": true
      }
    ]

... (truncated)

Commits

• b1ced56 Version Packages (#16556)
• 8b64bec [config] Fix Durable Object self-references without changing deployment targe...
• 25802bc [wrangler] Run wrangler d1 insights account-wide (#16532)
• b4653b4 [autoconfig] Write a protective .assetsignore when the project root is the as...
• a09957a Version Packages (#16553)
• c7a3373 Revert "Version Packages" (#16554)
• a95d647 [wrangler] Support remote Analytics Engine bindings in local dev (#16536)
• 52315bd Version Packages (#16529)
• dba0e81 [wrangler] Escape terminal controls in tail output (#16526)
• fc57bc0 [miniflare] Enable local Flagship management without Worker bindings (#16489)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions