[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/check (source)	0.9.11 → 0.9.12
@playwright/test (source)	1.64.1 → 1.65.0
@types/node (source)	26.6.5 → 26.6.6
astro (source)	7.4.1 → 7.4.8
eslint (source)	10.13.0 → 10.14.0
postcss (source)	8.5.31 → 8.5.32
typescript-eslint (source)	8.72.0 → 8.72.2
wrangler (source)	4.151.2 → 4.159.0

---

Release Notes

withastro/astro (@​astrojs/check)

v0.9.12

Compare Source

Patch Changes

• #​18455 7af66fc Thanks @​astro-factory! - Fixes the astro-check binary ignoring its first two command-line arguments, so flags such as --help, --root, --watch, and --tsconfig are respected again. If your scripts padded the arguments to work around this (for example, astro-check -- -- --tsconfig ./tsconfig.app.json), remove the padding.
• Updated dependencies [044148d]:
  • @​astrojs/language-server@2.17.3

microsoft/playwright (@​playwright/test)

v1.65.0

Compare Source

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

• There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
• Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
• Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
• Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';

export default defineConfig({
  reporter: [
    ['failures'],
    ['html', { onlyFailures: true }],
  ],
});

🎯 Test runner

• New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

  test('restart the server', { lock: '-exclusive-' }, async () => {
    // No other test runs while this one is running.
  });

• test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

  test('upload a file', async ({ page }) => {
    test.skip('Not implemented yet');
  });

• New PLAYWRIGHT_TRANSFORM_CACHE_DIR environment variable sets the directory for transpiled test files, for example on a Linux machine shared with other users.

New APIs

• New options timeout and signal in cdpSession.send().
• New testRun.mode() returns the execution mode of a suite during reporter.preprocess().

Notable Changes ⚠️

• TypeScript class fields now follow useDefineForClassFields from your tsconfig.json, the same as tsc. It is enabled for ES2022 and later targets, and when target is not specified. A field initializer that reads a constructor parameter property now fails, because the initializer runs first:

  class LoginPage {
    // TypeError: Cannot read properties of undefined (reading 'getByRole')
    readonly submit = this.page.getByRole('button', { name: 'Submit' });
  
    constructor(private readonly page: Page) {}
  }

  Move the initialization to the constructor, or set "useDefineForClassFields": false in your tsconfig.json.

• Actions such as locator.click(), locator.check(), locator.tap(), locator.fill(), locator.clear() and locator.selectOption() now wait for the element to be not inert. An action on an element with the inert attribute, or inside such an element, now times out if the element stays inert.

• A sharded run now fails with "No tests found" when no tests match across all shards. Pass --pass-with-no-tests to allow this. An empty shard still passes when other shards have tests.

• Cookie matching now follows RFC 6265. With a URL, browserContext.cookies() and apiRequestContext.cookies() no longer return host-only cookies for subdomains or Path=/api cookies for /apiv2, and a Path=/foo/ cookie does not match /foo. APIRequestContext sends a cookie without a name as Cookie: x instead of Cookie: =x, and stores Set-Cookie: token as a cookie without a name.

• Proxy credentials are no longer sent to websites. The credentials in the proxy option now answer only proxy challenges. To authenticate on a website, use httpCredentials.

• Text that the browser does not render, such as text that is not assigned to a slot or text directly inside a closed <details>, is no longer part of accessible names and aria snapshots. This can change the results of page.getByRole() with a name, locator.ariaSnapshot() and expect(locator).toMatchAriaSnapshot().

• String and URLSearchParams values of the params option in APIRequestContext requests are now appended to the query that the URL already has, instead of replacing it.

• .css, .less and .scss imports in test files now load as empty modules instead of being removed, so the imported file must exist.

• The blob reporter again deletes the content of its output directory before it writes the report. Playwright 1.64 kept reports with other names.

• Test locations of imported calls such as test( in CommonJS output now point to the start of the callee, for example a.spec.ts:3:7 instead of a.spec.ts:3:11. This is the same as in ESM.

Announcements

• ⚠️ Playwright no longer tests on Node.js 20. Use Node.js 22, 24 or 26, as listed in the system requirements.
• 🐳 Docker images now include Node.js 26 instead of Node.js 24, and the latest patch of Chromium on the same branch.

Browser Versions

• Chromium 158.0.8127.18
• Mozilla Firefox 159.0
• WebKit 27.2

This version was also tested against the following stable channels:

• Google Chrome 157
• Microsoft Edge 156

withastro/astro (astro)

v7.4.8

Compare Source

Patch Changes

• #​18616 d747a53 Thanks @​florian-lefebvre! - Updates CLI argument parsing

v7.4.7

Compare Source

Patch Changes

• 7da442b Thanks @​matthewp! - Fixes the image endpoint treating directories whose names differ only by letter case as being inside the build output directory on case-sensitive filesystems
• Updated dependencies [7da442b]:
  • @​astrojs/internal-helpers@0.13.1
  • @​astrojs/markdown-satteri@0.4.7

v7.4.6

Compare Source

Patch Changes

• #​18565 cd09986 Thanks @​praveen-kumary! - Avoids attributing client-only components or scripts to unrelated pages importing astro:i18n by bounding top-level page graph traversal at virtual page entries

• #​18608 babd96d Thanks @​umeraamir69! - Fixes an extra page reload on the first page load after starting astro dev without an existing .astro directory

• #​18589 402c0fa Thanks @​astro-factory! - Fixes astro check exiting with code 0 when @astrojs/check or typescript is not installed. The command now exits with code 1 so CI fails instead of silently skipping type checking.

• #​18503 54fcdd5 Thanks @​SwastikTripathi! - Preserves the last-modified date of cached font files and unchanged public files when copying them into the build output. Public-file timestamp preservation respects the resolved public-directory configuration, follows source symlinks, and avoids backdating files overwritten by build plugins.

• #​18605 76cd239 Thanks @​astro-factory! - Fixes the glob() loader adding files from a folder excluded with a negation pattern such as !_docs when they change during astro dev

• #​18432 ed60d82 Thanks @​alexmv! - Improves the MissingSharp error to include the reason Sharp failed to load, such as its prebuilt binaries not supporting the current CPU

• #​18474 59543c3 Thanks @​miottid! - Fixes i18n fallback for on-demand rendered pages. A locale-prefixed request for a page that only exists in the fallback locale (for example /de/about with fallback: { de: 'en' }) was answered with status 302 and no Location header. Such requests are now rewritten or redirected to the fallback locale according to i18n.routing.fallbackType, including encoded paths and sites with a configured base. Query strings are preserved, and explicit page statuses and redirects are left unchanged.

• #​18541 cfa2d2b Thanks @​ump45nose! - Fixes matchAllRoutes to consider fallbackRoutes, matching matchRoute and the production router. Dev-server i18n fallback requests now resolve to the source route's metadata instead of the 404 route, and SSR-only fallback candidates can fall through the prerender handler.

• #​18602 d856064 Thanks @​astro-factory! - Fixes astro check losing the end of its output, including the Result summary, when stdout is piped to a slow reader. When the reader closes the pipe early, for example astro check | head, astro check now exits with code 1 instead of crashing with an EPIPE stack trace.

• #​18574 da0f149 Thanks @​astro-factory! - Fixes an unnecessary full page reload in astro dev when a content loader calls store.clear() or store.delete() and the content store has no asset imports

• #​18570 e71c038 Thanks @​astro-factory! - Fixes pages using <ClientRouter /> briefly showing the top of the page on reload before jumping back to the previous scroll position. Full reloads now use the browser's native scroll restoration.

• #​18531 f75553b Thanks @​praveen-kumary! - Fixes an unhandled TypeError: Cannot convert undefined or null to object when calling route.generate() without arguments on static routes

v7.4.5

Compare Source

Patch Changes

• #​18558 fac3c50 Thanks @​astro-factory! - Fixes astro dev status and other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process

• #​18559 10dae2f Thanks @​astro-factory! - Fixes import.meta.env values containing $ sequences (such as $$ or $&) being corrupted in astro build when server code reads the import.meta.env object directly, for example with const { MY_SECRET } = import.meta.env

• #​18544 e3bec3d Thanks @​skezo! - Fixes request paths with invalid percent-encoding (e.g. /%C0%AF or a bare %) being logged as an Invalid URL encoding error and routed with the undecoded path. These requests now return a 400, the same as a path that is encoded too many times.

• #​18520 e023aba Thanks @​matthewp! - Makes rendering of string tag names stricter and consistent across .astro dynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as / or = can no longer change the generated markup. A string that does not start with a valid element name (for example '!--' or '') now throws an error instead of producing invalid HTML.

v7.4.4

Compare Source

Patch Changes

• #​18344 df838da Thanks @​edmundhung! - Allows astro add to configure tagged versions of official adapters

v7.4.3

Compare Source

Patch Changes

• #​18488 e4e25fa Thanks @​umeraamir69! - CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string into script-src and style-src.

• #​18500 e5a3a1b Thanks @​astro-factory! - Fixes <Image> and <Picture> emitting duplicate srcset candidates when densities contains equivalent values such as 1 and '1x'

• #​18517 c3185b7 Thanks @​okxint! - Fix unhandled AbortError rejection when ClientRouter skips a pending view transition

• #​18497 c712113 Thanks @​astro-factory! - Fixes an uncaught TypeError in the browser when a server:defer island request fails due to a network error. The fallback content is kept, as it is for non-200 responses.

• #​18525 d0240b9 Thanks @​astro-factory! - Fixes a DEP0190 deprecation warning printed by astro info on Node.js 24 and later

• #​18522 776b9a6 Thanks @​astro-factory! - Fixes memoryCache() serving an empty body for cached pages that return an empty 404 or 500 response. These responses now render the 404 or 500 error page on every request.

• #​18511 d060ff9 Thanks @​astro-factory! - Fixes transition:name styles missing in dev when the element is inside a component that is only rendered through another component with no styles or scripts

• #​18494 5fe699c Thanks @​astro-factory! - Fixes the astro CLI refusing to run on StackBlitz by allowing Node.js >=22.22.0 inside WebContainers, whose Node.js version users cannot change

• #​18506 bf43a60 Thanks @​astro-factory! - Fixes <ClientRouter /> animating scroll restoration on back/forward navigation when scroll-behavior: smooth is set. Saved scroll positions are now restored instantly, matching the browser's native behavior.

• #​18476 8ea79a2 Thanks @​astro-factory! - Fixes a DataCloneError crash when building pages that render SVG imports with <Image /> or getImage() while experimental.parallelPrerender is enabled.

• #​18504 6dbd737 Thanks @​astro-factory! - Fixes <Picture> emitting a duplicate 1x candidate in <source> srcset when densities includes 1

• #​18524 7524889 Thanks @​astro-factory! - Fixes type errors reported in Astro's built-in <Image />, <Picture />, <Code />, <Debug /> and <ClientRouter /> components when type-checking a project that extends astro/tsconfigs/strictest with tsc and @astrojs/ts-content-mapper

• #​18493 3773941 Thanks @​astro-factory! - Fixes scoped styles of unused Astro components being included in the build when those components are re-exported from a barrel file

• #​18512 1151b9e Thanks @​jp-knj! - Fixes CSP hashes added with Astro.csp from components rendered inside <body> being left out of the CSP <meta> element in static builds, including MDX pages

• Updated dependencies [6cf3423, edfbf4a]:

  • @​astrojs/telemetry@3.4.2
  • @​astrojs/markdown-satteri@0.4.6

v7.4.2

Compare Source

Patch Changes

• #​18430 dda9ec3 Thanks @​Abhirup-99! - Speeds up content sync with experimental.collectionStorage: "chunked" by computing each character's UTF-8 width from its code point instead of encoding every character through TextEncoder. On a store of ~44k entries this cuts the chunking step from about 60 seconds to well under a second, with byte-identical output.

• #​18438 5e0eaa4 Thanks @​astro-factory! - Fixes astro dev with @astrojs/cloudflare failing with Calling `require` for "node-fetch" when a server dependency such as cross-fetch requires node-fetch

• #​18376 a4e201d Thanks @​okxint! - Fixes astro dev treating a stale lock file containing a Linux thread ID as a running Astro server. A successful process lookup with no matching PID now marks the lock as stale, preventing astro dev stop and astro dev --force from killing the unrelated process that owns the thread.

• #​18467 d1fb7d3 Thanks @​astro-factory! - Fixes the defineConfig() types for i18n.defaultLocale, i18n.fallback, and i18n.domains so they accept a custom locale's path instead of its codes, matching how Astro validates and uses these values

• #​18475 cf27e70 Thanks @​ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

  This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

• #​18451 7a0ba6f Thanks @​DenisCDev! - Fixes astro sync, astro check and astro build replacing the optimized dependencies of a dev server running in the same project, which broke framework islands in that dev server until it was restarted with --force

• #​18336 e943003 Thanks @​astro-factory! - Fixes inline styles in dev so that framework-transformed CSS is used, such as scoped styles and v-bind() in Vue single-file components

• #​18399 829fc00 Thanks @​astro-factory! - Fixes a dev server error (Could not find server component name) for a server:defer island that imports astro:actions or astro:config/server, when its page was not the first island page loaded after starting the server

• #​18330 4db9e0d Thanks @​Samuteg! - Fixes the astro:env/server virtual module being generated with invalid JS in dev when any environment variable contains $ replacement patterns ($`, $&, $', $1, …). The inlined env JSON was passed as a string to String.replace, so e.g. the KITTY_PUBLIC_KEY value set by default in Kitty terminals corrupted the module and broke dev with Failed to parse source for import analysis

• Updated dependencies [cf27e70]:

  • @​astrojs/telemetry@3.4.1
  • @​astrojs/markdown-satteri@0.4.5

eslint/eslint (eslint)

v10.14.0

Compare Source

Features

• d23a7f9 feat: fix property descriptor handling in func-name-matching (#​21400) (xbinaryx)

Bug Fixes

• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#​21460) (lumir)
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#​21449) (xbinaryx)
• 161558a fix: handle LS, PS and empty hashbang comments (#​21419) (lumir)
• 6194939 fix: no-invalid-this crash on accessor fields without initializer (#​21442) (xbinaryx)
• 9155e14 fix: Update @​humanfs/node dependency version (#​21434) (Nicholas C. Zakas)
• cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#​21323) (dvd233)
• 5ee3915 fix: yoda invalid autofix at statement start (#​21424) (Daniel Pinto)

Documentation

• 0f94f47 docs: remove zh-hans from docs language switcher (#​21437) (lumir)
• dab466e docs: Update README (GitHub Actions Bot)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#​21452) (Pixel)
• 7697550 docs: Update README (GitHub Actions Bot)
• 0c699d5 docs: Remove Tidelift commercial support (#​21416) (Milos Djermanovic)
• 0880666 docs: update loadESLint() documentation for v10 (#​21374) (Minseon Kim)
• e06fe87 docs: Revise AI acknowledgment options in PR template (#​21414) (Nicholas C. Zakas)

Chores

• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#​21462) (Francesco Trotta)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#​21450) (renovate[bot])
• a031c40 chore: update ecosystem plugins (#​21445) (ESLint Bot)
• 67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#​21429) (Milos Djermanovic)
• 276021d chore: update github/codeql-action action to v4.39.0 (#​21432) (renovate[bot])
• 449724e chore: update ecosystem plugins (#​21420) (ESLint Bot)
• 8ffeb8c chore: update dependency prettier to v3.9.10 (#​21417) (renovate[bot])

postcss/postcss (postcss)

v8.5.32

Compare Source

• Fixed Input#origin() without opts.from (by @​wleeaf).
• Fixed final-word lookup without source offsets (by @​Don-Yin).
• Fixed explicit start in Warning#toString() (by @​Don-Yin).
• Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

typescript-eslint/typescript-eslint (typescript-eslint)

v8.72.2

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.72.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

cloudflare/workers-sdk (wrangler)

v4.159.0

Compare Source

Minor Changes

• #​16737 a589d23 Thanks @​jamesopstad! - Store experimental cf-wrangler dev state in .cloudflare/state

  Persist local resource data in .cloudflare/state relative to the configuration file. Direct Wrangler usage continues to default to .wrangler/state.

• #​16663 fe69809 Thanks @​FlorentCollin! - Add --compatibility flag to wrangler d1 export

  You can now export a remote D1 database that contains virtual tables, such as FTS5 or R*Tree tables:

  wrangler d1 export my-database --remote --output dump.sql --compatibility sqlite3_cli_only

  It accepts d1 (the default) and sqlite3_cli_only. With sqlite3_cli_only, the dump matches the output of the sqlite3 .dump command, including virtual tables. D1 cannot import this dump. sqlite3_cli_only is only supported for remote exports.

• #​16599 dee7a1d Thanks @​petebacondarwin! - Support CLOUDFLARE_AUTH_PROFILE for shared authentication profile selection

  Cloudflare tooling can pass a selected profile to child processes through CLOUDFLARE_AUTH_PROFILE. Explicit profile arguments take precedence over the variable, followed by directory bindings and the default profile. The cf-wrangler development delegate also initializes cf authentication so it reads the selected cf credentials.

  Experimental cf development delegates inherit the selected profile without additional command-line flags. Vite refreshes remote authentication when the resolved profile changes, and cf-wrangler keeps its authentication scoped to the delegate invocation.

• #​15615 c64fdfb Thanks @​svetch! - Support jurisdiction when automatically provisioning D1 databases

  Set jurisdiction on a D1 binding without a database_id to create the database in that jurisdiction during deployment. For example, {"d1_databases":[{"binding":"DB","jurisdiction":"eu"}]} creates an EU-jurisdiction database.

• #​16066 4112820 Thanks @​petebacondarwin! - Add an explicit opt-out for main module imports in generated Worker types

  Use wrangler types --include-main-module=false when the Worker entrypoint is generated build output that should not be type-checked as application source. The corresponding includeMainModule option is available in the experimental type-generation API. The option is preserved by --check and automatic regeneration. Omitting the import opts out of module-derived ctx.exports typing while preserving runtime types, environment bindings, and Durable Object namespace declarations.

  New SvelteKit Workers projects created with C3 use this option so their generated declarations remain stable before and after a build. Imports needed to type Durable Object, service, and Workflow bindings are unaffected.

Patch Changes

• #​16648 56459a5 Thanks @​dario-piotrowicz! - Update bundled third-party dependencies with known security fixes

  Local development and Workers Vitest tests now include security fixes for their bundled dependencies. Local browser rendering also includes security fixes for browser downloads, archive extraction, and proxy support.

  Miniflare and Wrangler now require Node.js 22.12.0 or later, matching the supported runtime range of the new browser installer.

• #​16746 abf924e Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-06

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16792 de10016 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-09

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16746 abf924e Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261104.1	^5.20261106.1
  workerd	1.20261104.1	1.20261106.1

• #​16792 [de10016](https://redirect.github.com/cloudflare/workers-sdk/commit/de100160f2434513554

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.