Skip to content

chore(deps): bump astro from 7.2.7 to 7.2.9 in /web - #668

Merged
rainmanjam merged 3 commits into
mainfrom
dependabot/npm_and_yarn/web/astro-7.2.9
Sep 4, 2026
Merged

chore(deps): bump astro from 7.2.7 to 7.2.9 in /web#668
rainmanjam merged 3 commits into
mainfrom
dependabot/npm_and_yarn/web/astro-7.2.9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Bumps astro from 7.2.7 to 7.2.9.

Release notes

Sourced from astro's releases.

astro@7.2.9

Patch Changes

astro@7.2.8

Patch Changes

Changelog

Sourced from astro's changelog.

7.2.9

Patch Changes

7.2.8

Patch Changes

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 7.2.7 to 7.2.9.
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.9/packages/astro)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 7.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 2, 2026
@socket-security

socket-security Bot commented Sep 2, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​astro@​7.2.7 ⏵ 7.2.998 +110088 +198100

View full report

rainmanjam added a commit that referenced this pull request Sep 4, 2026
…exec failure (#696)

* fix(ffmpeg): an interrupted header read arrived as an unrecognisable exec failure

Found as an intermittent macos-latest failure on #668, a pull request that
changes nothing but a JavaScript dependency:

    rawes_test.go:331: error = signal: killed, want the context error in the
    chain so the caller can recognise an interruption

ProbeFile runs ffprobe for the header and then, when there is no duration,
ffmpeg to count one. The COUNT branch folds ctx.Err() into its error and
explains at length why it has to: killing a child through CommandContext yields
a plain *exec.ExitError saying "signal: killed" and carrying NO context error to
match on -- measured there, in that comment.

The HEADER READ did not, while its own comment claimed the property:

    // %w on both branches. The caller has to be able to tell an interrupted
    // probe from a file ffprobe disliked -- one of those must not delete the
    // operator's upload -- and flattening the error with %s took that
    // distinction away.

%w on the run error cannot deliver that, for exactly the reason the count branch
recorded fifty lines below. So the requirement was right, the mechanism was
wrong, and the comment asserted the outcome -- which is worse than saying
nothing, because it is what the next reader relies on.

MILDER THAN IT LOOKS, and worth saying so rather than overselling the fix: a
bare *exec.ExitError matches none of Refused's sentinels, so the upload is not
deleted. What is lost is the caller's ability to tell why the probe ended, and a
log reader's.

WHY IT FLAKES. TestACountThatWasCutShortIsNotAVerdictAboutTheFile cancels at
200ms meaning to land inside the count, and on a loaded runner ffprobe has not
finished by then -- so the cancellation lands in the header read instead and the
assertion runs against the branch that had nothing to find.

THE NEW TEST'S FIRST VERSION WAS VACUOUS and is recorded here rather than
quietly replaced. It used a context cancelled up front, and exec.Cmd.Start
returns ctx.Err() DIRECTLY when the context is already done -- so
context.Canceled was in the chain no matter what this code did. A mutation that
wrapped the run error instead left it green. It now uses a slow stand-in ffprobe
cancelled mid-flight, which is the shape that actually produces a bare
"signal: killed", and both mutations turn it red.

Claude-Session: https://claude.ai/code/session_01A8N3W5ct9SZtHK9sCDD9cL

* test: skip the POSIX-only stand-in on Windows

Missed on the first push and caught by the Windows leg. The new test writes a
`#!/bin/sh` script to stand in for ffprobe, which Windows cannot exec -- so
instead of being killed mid-flight the stand-in failed to start, the count
branch was reached with no context error, and the assertion failed against a
situation the test was not written about.

Its sibling already carries exactly this skip and says why: "the branch it pins
is not platform-specific; the stand-in is." I added the test beside it and did
not read that far.

Claude-Session: https://claude.ai/code/session_01A8N3W5ct9SZtHK9sCDD9cL

* test: raise the skip budget by hand for the Windows stand-in

The skip census refused the previous commit: 101 sites against a committed 100,
internal/ffmpeg 25 against 24. Correctly -- a new skip is a new test that can
decline to run and still print ok.

This one is environmental and is the SAME skip its sibling already carries for
the same stand-in: the fixture is a #!/bin/sh script that sleeps until it is
killed, chosen so the cancellation lands inside the header read rather than
racing a real ffprobe's exit, and Windows will not execute it. The branch under
test is not platform-specific; the stand-in is. Issue #190 already names this
family and its real fix -- a small helper binary built by the test -- which
would take this site back out along with the two it lists.

RAISED BY HAND, WHICH IS THE POINT. `-update-skips` regenerates the counts and
DROPS the raisedBy array -- 142 lines recording why each previous raise was
allowed. Running it as the message suggests would have silently destroyed the
audit trail that makes this budget reviewable at all, which is the opposite of
what the guard is for. The counts here are edited directly and the entry is
appended, so the record of every raise survives.

That regeneration behaviour is worth its own issue rather than a workaround
buried here.

Claude-Session: https://claude.ai/code/session_01A8N3W5ct9SZtHK9sCDD9cL
@sonarqubecloud

sonarqubecloud Bot commented Sep 4, 2026

Copy link
Copy Markdown

@rainmanjam
rainmanjam merged commit 41f3b01 into main Sep 4, 2026
37 checks passed
@rainmanjam
rainmanjam deleted the dependabot/npm_and_yarn/web/astro-7.2.9 branch September 4, 2026 12:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant