chore(deps): bump the all-deps group with 5 updates

[dependabot]

Bumps the all-deps group with 5 updates:

Package	From	To
@astrojs/react	5.0.7	6.0.2
astro	6.4.8	7.2.0
@types/node	26.1.2	26.2.0
vitest	3.2.7	4.1.10
wrangler	4.119.0	4.120.0

Updates @astrojs/react from 5.0.7 to 6.0.2

Release notes

Sourced from @​astrojs/react's releases.

@​astrojs/react@​6.0.2

Patch Changes

• Updated dependencies [c895b12]:
  • @​astrojs/internal-helpers@​0.10.2

@​astrojs/react@​6.0.1

Patch Changes

• Updated dependencies [eb6f97e]:
  • @​astrojs/internal-helpers@​0.10.1

@​astrojs/react@​6.0.0

Major Changes

• #15819 cafec4e Thanks @​delucis! - Upgrade to Vite v8

Minor Changes

• #17093 4585fe5 Thanks @​Princesseuh! - Replaces the import entrypoint of getContainerRenderer()

  A new container-renderer entrypoint exporting getContainerRenderer() has been added to the following integrations: React, Preact, Svelte, SolidJS, Vue, and MDX. This prevents bundlers from trying to bundle unrelated exports from the package root when only the Container API is used.

  If you are using the Container API, update your import statements to use the new entrypoint. The following example updates the getContainerRenderer() import for React:

  - import { getContainerRenderer } from '@astrojs/react';
  + import { getContainerRenderer } from '@astrojs/react/container-renderer';

  Importing getContainerRenderer() from the package root still works, but is now deprecated and logs a warning.

Patch Changes

• #17027 241250b Thanks @​ocavue! - Triggers beta prereleases for packages that are still on alpha

Changelog

Sourced from @​astrojs/react's changelog.

6.0.2

Patch Changes

• Updated dependencies [c895b12]:
  • @​astrojs/internal-helpers@​0.10.2

6.0.1

Patch Changes

• Updated dependencies [eb6f97e]:
  • @​astrojs/internal-helpers@​0.10.1

6.0.0

Major Changes

• #15819 cafec4e Thanks @​delucis! - Upgrade to Vite v8

Minor Changes

• #17093 4585fe5 Thanks @​Princesseuh! - Replaces the import entrypoint of getContainerRenderer()

  A new container-renderer entrypoint exporting getContainerRenderer() has been added to the following integrations: React, Preact, Svelte, SolidJS, Vue, and MDX. This prevents bundlers from trying to bundle unrelated exports from the package root when only the Container API is used.

  If you are using the Container API, update your import statements to use the new entrypoint. The following example updates the getContainerRenderer() import for React:

  - import { getContainerRenderer } from '@astrojs/react';
  + import { getContainerRenderer } from '@astrojs/react/container-renderer';

  Importing getContainerRenderer() from the package root still works, but is now deprecated and logs a warning.

Patch Changes

• #17027 241250b Thanks @​ocavue! - Triggers beta prereleases for packages that are still on alpha

6.0.0-beta.2

Minor Changes

• #17093 4585fe5 Thanks @​Princesseuh! - Replaces the import entrypoint of getContainerRenderer()

  A new container-renderer entrypoint exporting getContainerRenderer() has been added to the following integrations: React, Preact, Svelte, SolidJS, Vue, and MDX. This prevents bundlers from trying to bundle unrelated exports from the package root when only the Container API is used.

  If you are using the Container API, update your import statements to use the new entrypoint. The following example updates the getContainerRenderer() import for React:

... (truncated)

Commits

• b0535ca [ci] release (#17528)
• a86160e [ci] release (#17256)
• 2bfb179 chore: simpler package.json types (#17229)
• f55ba4c [ci] release (#17132)
• 0da0678 [ci] release (beta) (#17089)
• 4585fe5 fix(integrations): Export container renderers from a dedicated export path to...
• 08b84d6 [ci] release (beta) (#17045)
• 75cfa52 chore: merge main into next
• 9c2b95b Merge remote-tracking branch 'origin/main' into chore/merge-main-into-next
• 3652d1c chore: merge main into next
• Additional commits viewable in compare view

Updates astro from 6.4.8 to 7.2.0

Release notes

Sourced from astro's releases.

astro@7.2.0

Minor Changes

• #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

  This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

  astro preview --background

  When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

  astro preview status
  astro preview logs
  astro preview logs --follow
  astro preview stop

  If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

  To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

• #17532 7f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

  Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  logger: {
  
  entrypoint: new URL('./src/logger.js', import.meta.url),
  
  
  entrypoint: './src/logger.js',
  },
  });

Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

#17084 961bbe5 Thanks @​matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

import type { AstroPrerenderer, PrerenderResult } from 'astro';
const prerenderer: AstroPrerenderer = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.0

Minor Changes

• #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

  This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

  astro preview --background

  When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

  astro preview status
  astro preview logs
  astro preview logs --follow
  astro preview stop

  If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

  To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

• #17532 7f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

  Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  logger: {
  
  entrypoint: new URL('./src/logger.js', import.meta.url),
  
  
  entrypoint: './src/logger.js',
  },
  });

Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

#17084 961bbe5 Thanks @​matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

import type { AstroPrerenderer, PrerenderResult } from 'astro';

... (truncated)

Commits

• 60e9432 [ci] release (#17558)
• af92694 docs: slightly reword session options description (#17607)
• caace2e [ci] format
• 0224a3a Add background mode for astro preview (#17174)
• 961bbe5 Experimental incremental static builds (#17084)
• 7f94895 feat(logger): allow passing relative string entrypoints (#17532)
• 90c98ae feat(session): add session: false to opt out of session support (#16871)
• 3ea55ce Support detect devEngines for installs (#17579)
• 0089f83 Fix Content Layer build crash when neotraverse 0.6.x is hoisted by another de...
• f4150da [ci] format
• Additional commits viewable in compare view

Updates @types/node from 26.1.2 to 26.2.0

Commits

• See full diff in compare view

Updates vitest from 3.2.7 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

• Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)
• browser:
  • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)
  • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)
• mocker:
  • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)
• pool:
  • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

• runner: Limit concurrency per task branch in addition to per leaf callbacks (backport)  -  by @​hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

• browser: Provide project reference in ToMatchScreenshotResolvePath  -  by @​macarie and @​sheremet-va in vitest-dev/vitest#10138 (31882)
• Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options  -  by @​hi-ogawa, Codex and @​sheremet-va in vitest-dev/vitest#10196 (2847d)
• browser: Simplify orchestrator otel carrier  -  by @​hi-ogawa in vitest-dev/vitest#10285 (18af9)

   🏎 Performance

• Stringify diff objects only once  -  by @​sheremet-va in vitest-dev/vitest#10276 (9f7b1)

    View changes on GitHub

... (truncated)

Commits

• db616d2 chore: release v4.1.10 (#10718)
• bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
• a7a61e7 chore: release v4.1.9 (#10598)
• 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
• 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
• a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
• e61f2dd chore: release v4.1.8
• e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
• a09d472 chore: release v4.1.7
• a8fd24c chore: release v4.1.6
• Additional commits viewable in compare view

Updates wrangler from 4.119.0 to 4.120.0

Release notes

Sourced from wrangler's releases.

wrangler@4.120.0

Minor Changes

• #15008 35c87e9 Thanks @​skepticfx! - Adds the ability to find container instances by exact ID or name

  wrangler containers instances <application_id> --search <instance_id_or_name> now searches every page and returns exact matches in human-readable or JSON output. JSON returns a top-level array, including an empty array when there is no match, while human-readable output prints a no-match message. If multiple instances have the same exact name, every matching instance is returned.

• #15008 35c87e9 Thanks @​skepticfx! - Add explicit pagination to container instance JSON output

  Use wrangler containers instances <application_id> --json --per-page <size> to return one page with machine-readable result_info, then pass its next_page_token to --page-token to retrieve the next page. Plain --json remains backward-compatible: it requests the complete list and returns the existing top-level array.

Patch Changes

• #15013 8cf78c8 Thanks @​dario-piotrowicz! - Update undici from 7.28.0 to 7.29.0

• #15015 a60ff4d Thanks @​nickpatt! - Cut the per-request cost of local observability capture

  Every tail event was written to the trace store as its own Durable Object call, so a request paid two or three round-trips per span. On a module-heavy app under the Vite plugin that dominated dev request latency. Rows are now buffered and written in batches, taking a request from roughly thirty calls to three.

  Work in progress still shows up as it happens: the root span is written immediately, console logs and exceptions as they arrive, and a span's completion is written on the next event once 100ms has passed. An invocation that goes completely quiet writes nothing further until it ends, since the flush is driven by tail events rather than a timer.

  The Vite plugin's own router, asset and proxy workers are also no longer captured. Their traces were noise the Observability views already hid, and skipping them cuts the spans recorded per request — a side benefit being that a trace's root is now your Worker rather than __router-worker__.

• Updated dependencies [b4f0c97, 8cf78c8, a60ff4d, 99eb50c]:

  • miniflare@5.20260801.1-alpha

Commits

• b0aea76 Version Packages (#15036)
• 386ff6e [miniflare] Register workers in the dev registry by default (#15061)
• 35c87e9 CC-8338, CC-8340: Improve Wrangler container instance listings (#15008)
• 99eb50c [miniflare] Restrict dev registry registration to user workers (#15040)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​3.2.7 ⏵ 4.1.10	+1		+1	+2
	@​types/​node@​26.1.2 ⏵ 26.2.0	+1		+1
	@​astrojs/​react@​5.0.7 ⏵ 6.0.2	+1		+1	+2
	astro@​6.4.8 ⏵ 7.2.0	+10	+4	+1	-1
	wrangler@​4.119.0 ⏵ 4.120.0	+1			+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/astro@7.2.0 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report