chore(deps): bump the production-dependencies group across 1 directory with 40 updates

[dependabot]

Bumps the production-dependencies group with 40 updates in the / directory:

Package	From	To
typescript	6.0.3	7.0.2
@astrojs/cloudflare	14.1.4	14.3.1
@hugeicons/core-free-icons	4.2.3	4.3.2
@sentry/browser	10.67.0	10.74.0
@tabler/icons	3.45.0	3.46.0
@tanstack/virtual-core	3.17.5	3.17.9
astro	7.1.3	7.3.2
posthog-js	1.405.3	1.430.1
tailwind-variants	3.2.2	3.3.1
@astrojs/react	6.0.1	6.0.5
@base-ui/react	1.6.0	1.8.0
@tanstack/react-virtual	3.14.7	3.14.11
lucide-react	1.25.0	1.44.0
react	19.2.7	19.3.0
react-dom	19.2.7	19.3.0
shadcn	4.13.1	4.21.0
sonner	2.0.7	2.0.8
@astrojs/starlight	0.41.3	0.42.0
sharp	0.35.3	0.35.4
three	0.185.1	0.186.0
@modelcontextprotocol/sdk	1.29.0	1.30.0
pg	8.22.0	8.23.0
@apidevtools/swagger-parser	12.1.0	13.0.0
@aws-sdk/client-s3	3.1091.0	3.1130.0
@babel/parser	8.0.4	8.0.5
@fastify/busboy	3.2.0	3.2.2
@hono/mcp	0.3.1	0.3.2
@hono/node-server	2.0.11	2.1.1
@hono/zod-openapi	1.5.1	1.6.3
@libsql/client	0.17.4	0.18.0
@sentry/bun	10.67.0	10.74.0
@sentry/node	10.67.0	10.74.0
@ungap/structured-clone	1.3.3	1.4.0
add-mcp	1.13.0	2.4.0
hono	4.12.31	4.13.7
posthog-node	5.46.0	5.52.1
whatwg-url	17.1.0	17.1.1
ws	8.21.1	8.21.3
zod	4.4.3	4.6.2
@astrojs/language-server	2.16.12	2.16.16

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates @astrojs/cloudflare from 14.1.4 to 14.3.1

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.3.1

Patch Changes

• #17914 a400504 Thanks @​astro-factory! - Fixes a build crash when a custom worker entrypoint exports Durable Object classes alongside prerendered pages. The prerender worker no longer inherits durable_objects, migrations, or workflows from the entry worker config.

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.3.0

Minor Changes

• #17795 15e2deb Thanks @​matthewp! - Adds concurrent rendering support for experimental.incrementalBuild, including when using @astrojs/cloudflare

  Incremental builds no longer disable caching when build.concurrency is greater than 1. Projects that set build.concurrency: 1 to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.

• #17887 35aa62e Thanks @​matthewp! - Adds a Cloudflare finalize() response handler for custom request handlers

  Call finalize() to apply cookies and Cloudflare CDN cache defaults to the response from an astro/fetch pipeline:

  import { astro, FetchState } from 'astro/fetch';
  import { cf, finalize } from '@astrojs/cloudflare/fetch';
  export default {
  async fetch(request: Request, env: Env, context: ExecutionContext) {
  const state = new FetchState(request);
  const asset = await cf(state, env, context);
  if (asset) return asset;
  return finalize(state, await astro(state));
  
  },
  };

  The @astrojs/cloudflare/hono middleware applies these response headers automatically. Cloudflare custom entrypoints also fall back to static assets when no Astro route matches and use the default server entrypoint when prerendering through workerd.

Patch Changes

• #17895 41b88ac Thanks @​astro-factory! - Fixes cold astro dev crashes by adding astro/app/manifest and @astrojs/cloudflare/cache/provider to the optimizeDeps.include list

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.2.6

Patch Changes

• #17854 07b919f Thanks @​ematipico! - Added @astrojs/prism to the list of dependencies to optimise. The dev server is now faster for sites that use Prism as code highlighter.

• #17850 1301c37 Thanks @​matthewp! - Fixes React SSR failures on the first Cloudflare dev request when JSON logging is enabled

... (truncated)

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.3.1

Patch Changes

• #17914 a400504 Thanks @​astro-factory! - Fixes a build crash when a custom worker entrypoint exports Durable Object classes alongside prerendered pages. The prerender worker no longer inherits durable_objects, migrations, or workflows from the entry worker config.

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

14.3.0

Minor Changes

• #17795 15e2deb Thanks @​matthewp! - Adds concurrent rendering support for experimental.incrementalBuild, including when using @astrojs/cloudflare

  Incremental builds no longer disable caching when build.concurrency is greater than 1. Projects that set build.concurrency: 1 to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.

• #17887 35aa62e Thanks @​matthewp! - Adds a Cloudflare finalize() response handler for custom request handlers

  Call finalize() to apply cookies and Cloudflare CDN cache defaults to the response from an astro/fetch pipeline:

  import { astro, FetchState } from 'astro/fetch';
  import { cf, finalize } from '@astrojs/cloudflare/fetch';
  export default {
  async fetch(request: Request, env: Env, context: ExecutionContext) {
  const state = new FetchState(request);
  const asset = await cf(state, env, context);
  if (asset) return asset;
  return finalize(state, await astro(state));
  
  },
  };

  The @astrojs/cloudflare/hono middleware applies these response headers automatically. Cloudflare custom entrypoints also fall back to static assets when no Astro route matches and use the default server entrypoint when prerendering through workerd.

Patch Changes

• #17895 41b88ac Thanks @​astro-factory! - Fixes cold astro dev crashes by adding astro/app/manifest and @astrojs/cloudflare/cache/provider to the optimizeDeps.include list

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

14.2.6

Patch Changes

• #17854 07b919f Thanks @​ematipico! - Added @astrojs/prism to the list of dependencies to optimise. The dev server is now faster for sites that use Prism as code highlighter.

... (truncated)

Commits

• aa4949e [ci] release (#17915)
• 4b92ddc Guard setFetchHandler call in non-runnable dev entrypoint to fix sessions + m...
• 9870f95 [ci] format
• a400504 fix(cloudflare): exclude durable_objects, migrations, and workflows from prer...
• f800de1 [ci] release (#17881)
• 41b88ac fix(cloudflare): prebundle astro/app/manifest and cache provider in optimizeD...
• 35aa62e Add finalize() fetch handler to Cloudflare (#17887)
• 15e2deb Support build concurrency with the incremental build cache (#17795)
• 2fdf731 [ci] release (#17849)
• 76eff3d fix: cache headers (#17878)
• Additional commits viewable in compare view

Updates @hugeicons/core-free-icons from 4.2.3 to 4.3.2

Updates @sentry/browser from 10.67.0 to 10.74.0

Release notes

Sourced from @​sentry/browser's releases.

10.74.0

• feat(v10): Streamline isolation scope handling & reset in isolation scopes (#24152)
• fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (#23433)
• fix(v10/browser): Set user_agent.original on all spans for consistent filtering (#24226)
• fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entry (#24181)
• fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)
• fix(v10/core): Match wrapped Facebook Mobile browser errors in DEFAULT_IGNORE_ERRORS (#23877)
• fix(v10/core): Resolve MCP capture policy per operation (#23796)
• fix(v10/nextjs): Fix SDK import crashing under jsdom/happy-dom (#23906)
• fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundles (#24223)
• fix(v10/nextjs): Register Vercel AI span processors on Next.js (#23773)
• fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute for C:\ (#24026)
• fix(v10/profiling-node): Bump @​sentry/node-cpu-profiler to 2.4.4 (#24238)
• fix(v10/sveltekit): Handle SvelteKit 3 error kinds in handleErrorWithSentry (#23995)
• fix(v10/sveltekit): Read Cloudflare execution context from platform.ctx (#23994)
• fix(v10/sveltekit): Read SvelteKit config from the Vite plugin (#23998)

• test(e2e): Assert Next.js Cloudflare worker bundle stays free of orchestrion bundler plugins (#23910)

Work in this release was contributed by @​halillusion and @​zkasuran. Thank you for your contributions!

Bundle size 📦

Path	Size
@​sentry/browser	27.12 KB
@​sentry/browser - with treeshaking flags	25.59 KB
@​sentry/browser (incl. Tracing)	45.53 KB
@​sentry/browser (incl. Tracing + Span Streaming)	47.29 KB
@​sentry/browser (incl. Tracing, Profiling)	50.18 KB
@​sentry/browser (incl. Tracing, Replay)	83.87 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	73.74 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	88.49 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	100.82 KB
@​sentry/browser (incl. Feedback)	43.89 KB
@​sentry/browser (incl. sendFeedback)	31.8 KB
@​sentry/browser (incl. FeedbackAsync)	36.82 KB
@​sentry/browser (incl. Metrics)	28.19 KB
@​sentry/browser (incl. Logs)	28.41 KB
@​sentry/browser (incl. Metrics & Logs)	29.09 KB
@​sentry/react	28.89 KB
@​sentry/react (incl. Tracing)	47.74 KB
@​sentry/vue	32.42 KB
@​sentry/vue (incl. Tracing)	47.47 KB
@​sentry/svelte	27.15 KB

... (truncated)

Changelog

Sourced from @​sentry/browser's changelog.

10.74.0

• feat(v10): Streamline isolation scope handling & reset in isolation scopes (#24152)
• fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (#23433)
• fix(v10/browser): Set user_agent.original on all spans for consistent filtering (#24226)
• fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entry (#24181)
• fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)
• fix(v10/core): Match wrapped Facebook Mobile browser errors in DEFAULT_IGNORE_ERRORS (#23877)
• fix(v10/core): Resolve MCP capture policy per operation (#23796)
• fix(v10/nextjs): Fix SDK import crashing under jsdom/happy-dom (#23906)
• fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundles (#24223)
• fix(v10/nextjs): Register Vercel AI span processors on Next.js (#23773)
• fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute for C:\ (#24026)
• fix(v10/profiling-node): Bump @​sentry/node-cpu-profiler to 2.4.4 (#24238)
• fix(v10/sveltekit): Handle SvelteKit 3 error kinds in handleErrorWithSentry (#23995)
• fix(v10/sveltekit): Read Cloudflare execution context from platform.ctx (#23994)
• fix(v10/sveltekit): Read SvelteKit config from the Vite plugin (#23998)

• test(e2e): Assert Next.js Cloudflare worker bundle stays free of orchestrion bundler plugins (#23910)

Work in this release was contributed by @​halillusion and @​zkasuran. Thank you for your contributions!

10.73.0

Important Changes

• feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)

  withSentryConfig is now available from @sentry/nextjs/config, the path it moves to in v11. Importing it from @sentry/nextjs still works on v10 but logs a warning once, so you can change your next.config file today and upgrade to v11 without touching it again.

  // next.config.mjs
  - import { withSentryConfig } from '@sentry/nextjs';
  + import { withSentryConfig } from '@sentry/nextjs/config';

Other Changes

• feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler and setupFasitfyErrorHandler (#23734)
• fix(v10/cloudflare): Instrument Durable Object handlers installed as read-only properties (#23769)

• test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)

... (truncated)

Commits

• ce5009a release: 10.74.0
• 4b24ddd meta(changelog): Update changelog for 10.74.0 (#24252)
• 371ed5d fix(v10/profiling-node): Bump @​sentry/node-cpu-profiler to 2.4.4 (#24238)
• 9f38e48 fix(v10/browser): Set user_agent.original on all spans for consistent filte...
• 264f990 fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entr...
• c89f6e6 fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundl...
• de25dcb fix(v10/core): Guard loadModule default parameter against ESM scope (#24154)
• b627037 feat(v10): Streamline isolation scope handling & reset in isolation scopes (#...
• 2ce0ea1 fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute f...
• 3e0eccc fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage (...
• Additional commits viewable in compare view

Updates @tabler/icons from 3.45.0 to 3.46.0

Release notes

Sourced from @​tabler/icons's releases.

Release 3.46.0

18 new icons:

• outline/play-bug
• outline/play-bugs
• outline/remote-control
• outline/rocking-chair
• outline/run-sprint
• outline/sparkles-2-off
• outline/tabs
• outline/tags-chevron-down
• outline/tags-chevron-left
• outline/tags-chevron-right
• outline/tags-chevron-up
• outline/thinking-high
• outline/thinking-low
• outline/thinking-medium
• outline/treasure-chest
• outline/twig
• outline/vault
• outline/yarn

Fixed icons: outline/credits, outline/currency-tether, outline/device-3d-camera, outline/device-screen, outline/home-lock, outline/map-lock, outline/notdef, outline/queue-pop-in, outline/server-bolt, outline/server, outline/sparkles-2, outline/transform-point-bottom-left, outline/transform-point-bottom-right, outline/transform-point-top-left, outline/transform-point-top-right

Commits

• 8ac7d81 Release 3.46.0
• 2727ba9 Enhance release process in package.json: add GitHub authentication check and ...
• 4ff4802 Add npm login check before release-it initialization in package.json
• 74a7690 Merge branch 'main' of https://github.com/tabler/tabler-icons
• f828849 Update dependencies in package.json and pnpm-lock.yaml: remove @​release-it-pl...
• 1a39582 Fix rect width/height swap in optimize script (#1570)
• 54bac86 Secure PR validation: run fork code without privileges (#1569)
• eaaf32d Update Turbo package to version 2.10.7 and adjust schema reference in turbo.json
• 2cfcde7 Remove unused AI tag generation script and related package dependency from pr...
• be0e5a8 Refactor SVG paths for several icons to improve structure and consistency: `o...
• Additional commits viewable in compare view

Updates @tanstack/virtual-core from 3.17.5 to 3.17.9

Release notes

Sourced from @​tanstack/virtual-core's releases.

@​tanstack/virtual-core@​3.17.9

Patch Changes

• #1260 4a0adf3 - Recover the bottom pin when the browser clamps an end-anchored scroll compensation write. resizeItem compensates a size change by writing scrollTop before the consumer has committed the new total size, so when the grown item does not itself extend the scroll range the browser clamps the write to the old maximum and the viewport is left short of the end with no scroll event to correct it. Two cases hit this: paddingEnd > 0 with a growing last item, where the overflowing item only extends scrollHeight to its own end and the clamp lands exactly paddingEnd short (#1258); and a row above the last one growing while the last row keeps its size, under directDomUpdates (#1266). A compensation write whose target exceeds the scroll maximum at write time is now recorded as clamped and re-issued once the sizer has grown — right after notify for consumers that size the container synchronously in onChange, and from _willUpdate for consumers that size it during a render. The clamped read-back keeps the retry pending; any other scroll event cancels it, so a user reading history is never yanked.

@​tanstack/virtual-core@​3.17.8

Patch Changes

• #1256 a0a411e - Cancel the pending isScrolling reset when a scroll observer is torn down, and reset isScrolling and scrollDirection in cleanup() so they don't stay stuck after the scroll element changes or is removed.

• #1246 d2cf98b - Ignore connected measurement nodes whose indexes are outside the current item count.

@​tanstack/virtual-core@​3.17.7

Patch Changes

• #1239 a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

@​tanstack/virtual-core@​3.17.6

Patch Changes

• #1236 7ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.

Changelog

Sourced from @​tanstack/virtual-core's changelog.

3.17.9

Patch Changes

• #1260 4a0adf3 - Recover the bottom pin when the browser clamps an end-anchored scroll compensation write. resizeItem compensates a size change by writing scrollTop before the consumer has committed the new total size, so when the grown item does not itself extend the scroll range the browser clamps the write to the old maximum and the viewport is left short of the end with no scroll event to correct it. Two cases hit this: paddingEnd > 0 with a growing last item, where the overflowing item only extends scrollHeight to its own end and the clamp lands exactly paddingEnd short (#1258); and a row above the last one growing while the last row keeps its size, under directDomUpdates (#1266). A compensation write whose target exceeds the scroll maximum at write time is now recorded as clamped and re-issued once the sizer has grown — right after notify for consumers that size the container synchronously in onChange, and from _willUpdate for consumers that size it during a render. The clamped read-back keeps the retry pending; any other scroll event cancels it, so a user reading history is never yanked.

3.17.8

Patch Changes

• #1256 a0a411e - Cancel the pending isScrolling reset when a scroll observer is torn down, and reset isScrolling and scrollDirection in cleanup() so they don't stay stuck after the scroll element changes or is removed.

• #1246 d2cf98b - Ignore connected measurement nodes whose indexes are outside the current item count.

3.17.7

Patch Changes

• #1239 a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

3.17.6

Patch Changes

• #1236 7ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.

Commits

• 171029d ci: Version Packages (#1269)
• 4a0adf3 fix(virtual-core): re-issue clamped end-anchor compensation once the sizer gr...
• e9874f0 ci: Version Packages (#1247)
• a0a411e fix(virtual-core): cancel the isScrolling debounce on scroll-observer cleanup...
• d2cf98b fix(virtual-core): ignore stale connected measurements (#1246)
• deca524 ci: Version Packages (#1240)
• a5417b4 fix(virtual-core): notify synchronously after above-viewport resize compensat...
• 32b2f2b ci: Version Packages (#1238)
• ef6e92a docs(virtual-core): clarify shouldAdjustScrollPositionOnItemSizeChange usage ...
• 7ae32b5 fix(virtual-core): stop viewport-spanning item growth from drifting scroll (#...
• See full diff in compare view

Updates astro from 7.1.3 to 7.3.2

Release notes

Sourced from astro's releases.

astro@7.3.2

Patch Changes

• #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

• #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

• #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

• #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

• Updated dependencies [a548223]:

  • @​astrojs/markdown-satteri@​0.4.1

astro@7.3.1

Patch Changes

• #17899 0389640 Thanks @​ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

astro@7.3.0

Minor Changes

• #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

  Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { LocalImageService } from 'astro';
  const service: LocalImageService = {
  // ...
  async transform(inputBuffer, transform, imageConfig, logger) {
  logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
  return { data: inputBuffer, format: 'png' };
  },
  };

  Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

  Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { CacheProvider } from 'astro';
  const provider: CacheProvider = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.2

Patch Changes

• #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

• #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

• #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

• #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

• Updated dependencies [a548223]:

  • @​astrojs/markdown-satteri@​0.4.1

7.3.1

Patch Changes

• #17899 0389640 Thanks @​ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

7.3.0

Minor Changes

• #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

  Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { LocalImageService } from 'astro';
  const service: LocalImageService = {
  // ...
  async transform(inputBuffer, transform, imageConfig, logger) {
  logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
  return { data: inputBuffer, format: 'png' };
  },
  };

  Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

  Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

... (truncated)

Commits

• aa4949e [ci] release (#17915)
• 42e9188 fix(i18n): replace locale segment by index in fallback routing (#17907) (#17908)
• 4b92ddc Guard setFetchHandler call in non-runnable dev entrypoint to fix sessions + m...
• c1a6a89 fix: include .astro files in client optimizeDeps entries to prevent 504 on la...
• a548223 Only treat literal script/style content as raw in MDX rendering (#17896)
• 92f23cc [ci] release (#17900)
• 0389640 fix: dont use internal paths (#17899)
• f800de1 [ci] release (#17881)
• 1e0b7e6 [ci] format
• 4671a5c chore(deps): update react to v19 in 0-css fixture (#17888)
• Additional commits viewable in compare view

Updates posthog-js from 1.405.3 to 1.430.1

Release notes

Sourced from posthog-js's releases.

posthog-js@1.430.1

1.430.1

Patch Changes

• #4913 0224a83 Thanks @​github-actions! - Fix scroll depth metrics carrying over between pages after client-side navigation. (2026-09-11)

posthog-js@1.430.0

1.430.0

Minor Changes

• #4834 5f2b0fe Thanks @​posthog! - Add posthog-js/full, posthog-js/no-external and posthog-js/full/no-external entry points, so desktop apps and other CSP-restricted builds can require a bundle instead of deep-importing an ES module from dist/ (2026-09-11)

Patch Changes

• #4860 8207df8 Thanks @​posthog! - Back off automatic feature flag refreshes on idle visible pages only when remote_config_refresh_interval_ms is omitted, preserving explicitly configured intervals. (2026-09-11)

• #4901 65aafcc Thanks @​marandaneto! - Preserve batched event timestamps so delayed retries do not shift event times and prevent deduplication. (2026-09-11)

• Updated dependencies [8207df8]:

  • @​posthog/types@​1.411.1

posthog-js@1.429.5

1.429.5

Patch Changes

• #4579 19e78cc Thanks @​turnipdabeets! - Cap the retry delay for log exports at 30 seconds, the ceiling the logs contract states. It previously doubled to 64 times the flush interval — 192s on web, 640s on React Native — so a log export now resumes within 30 seconds of a failing endpoint recovering, at the cost of more retry requests while that endpoint is down. (2026-09-10)

• #4579 19e78cc Thanks @​turnipdabeets! - Keep backing off a failing log flush while new records ...

  Description has been truncated

[greptile-apps]

PR author is in the excluded authors list.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: ac9b3dd5-d41c-4a23-94e1-169fd320a413

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​tanstack/​react-virtual@​3.14.7 ⏵ 3.14.11	+1		+1	+1
	@​base-ui/​react@​1.6.0 ⏵ 1.8.0			+1	+2
	@​tanstack/​virtual-core@​3.17.5 ⏵ 3.17.9	+1		+1	+1
	@​types/​pg@​8.20.0 ⏵ 8.23.1	+1		+1
	@​types/​react-dom@​19.2.3 ⏵ 19.3.0	+1		+1
	@​types/​react@​19.2.17 ⏵ 19.3.0	+1		+1
	posthog-node@​5.46.0 ⏵ 5.52.1	+20		+1
	@​babel/​parser@​8.0.4 ⏵ 8.0.5				-3
	@​astrojs/​language-server@​2.16.12 ⏵ 2.16.16			+1	+1
	lucide-react@​1.25.0 ⏵ 1.44.0			+1	+1
	@​astrojs/​react@​6.0.1 ⏵ 6.0.5				+1
	posthog-js@​1.405.3 ⏵ 1.430.1			+2
	sonner@​2.0.7 ⏵ 2.0.8			+1
	@​apidevtools/​swagger-parser@​12.1.0 ⏵ 13.0.0				-5
	react@​19.2.7 ⏵ 19.3.0	+1		+1
	@​astrojs/​cloudflare@​14.1.4 ⏵ 14.3.1	+1		+1	+1
	@​astrojs/​starlight@​0.41.3 ⏵ 0.42.0			+1	+2
	pg@​8.22.0 ⏵ 8.23.0	+1		+1	-1
	@​hono/​mcp@​0.3.1 ⏵ 0.3.2			+1	-4
	@​libsql/​client@​0.17.4 ⏵ 0.18.0	+1		+1
	astro@​7.1.3 ⏵ 7.3.2		+75	+1	+1
	@​ungap/​structured-clone@​1.3.3 ⏵ 1.4.0	+1		+1
	@​sentry/​bun@​10.67.0 ⏵ 10.74.0			+1
	@​tabler/​icons@​3.45.0 ⏵ 3.46.0			+1
	ws@​8.21.3
	@​sentry/​browser@​10.67.0 ⏵ 10.74.0	+19		+1
	shadcn@​4.13.1 ⏵ 4.21.0			+1	+1
	tailwind-variants@​3.2.2 ⏵ 3.3.1	+1		+1	+7
	@​fastify/​busboy@​3.2.0 ⏵ 3.2.2	+1
	three@​0.185.1 ⏵ 0.186.0
	@​hono/​node-server@​2.0.11 ⏵ 2.1.1	+1			-1
See 9 more rows in the dashboard

View full report