deps: bump astro from 6.4.8 to 7.1.1

[dependabot]

Bumps astro from 6.4.8 to 7.1.1.

Release notes

Sourced from astro's releases.

astro@7.1.1

Patch Changes

• #17399 4b03702 Thanks @​matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

astro@7.1.0

Minor Changes

• #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

  When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

  This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

  // src/content.config.ts
  import { defineCollection } from 'astro:content';
  import { glob } from 'astro/loaders';
  const docs = defineCollection({
  loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
  });

  By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

• #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

  By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

  Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  experimental: {
  collectionStorage: 'chunked',
  },
  });

  Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

• #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

  Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

  Scoping sources and hashes in your config

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.1

Patch Changes

• #17399 4b03702 Thanks @​matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

7.1.0

Minor Changes

• #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

  When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

  This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

  // src/content.config.ts
  import { defineCollection } from 'astro:content';
  import { glob } from 'astro/loaders';
  const docs = defineCollection({
  loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
  });

  By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

• #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

  By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

  Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  experimental: {
  collectionStorage: 'chunked',
  },
  });

  Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

• #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

  Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

... (truncated)

Commits

• 91c645a [ci] release (#17403)
• 4b03702 Normalize domain-based i18n request paths consistently (#17399)
• fdd673c [ci] release (#17387)
• d9f99e1 Preserve CSP resource defaults for element directives (#17394)
• 092da56 Add more escaping for rendered content (#17393)
• 186a1e7 fix(logger): allows setting in updateConfig() (#17391)
• 4407483 fix(logger): use console API in JSON logger for cross-runtime compatibility...
• 16de021 feat(logger): allow passing entrypoint as URL (#17389)
• ed71eaf fix(logger): make AstroLoggerDestination not generic (#17390)
• 30698a2 feat: chunk data store (#17296)
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	astro@​5.18.2 ⏵ 7.1.1		+28	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm astro is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/astro@7.1.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/astro@7.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[itoqa]

🤖 Ito did not review this pull request because it was opened by a bot (dependabot[bot]). This repository is set to skip bot-authored PRs.

Want Ito to review bot PRs? Ask the Ito team to turn off Ignore Bot PRs for this repository — that setting isn't self-serve yet.

[github-actions]

🦙 MegaLinter status: ⚠️ WARNING

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	5		0	0	0.28s
✅ COPYPASTE	jscpd	yes		no	no	1.97s
⚠️ CSS	stylelint	1	1	38	0	2.91s
⚠️ HTML	djlint	1		2	0	1.39s
⚠️ HTML	htmlhint	1		1	0	0.48s
✅ JSON	jsonlint	4		0	0	0.26s
✅ JSON	npm-package-json-lint	yes		no	no	0.6s
✅ JSON	prettier	4	1	0	0	0.52s
✅ JSON	v8r	4		0	0	7.41s
⚠️ MARKDOWN	markdownlint	5	2	2	0	0.88s
⚠️ MARKDOWN	markdown-link-check	5		3	0	3.59s
✅ MARKDOWN	markdown-table-formatter	5	2	0	0	0.35s
⚠️ REPOSITORY	checkov	yes		1	no	15.46s
⚠️ REPOSITORY	devskim	yes		6	no	1.15s
✅ REPOSITORY	dustilock	yes		no	no	0.09s
✅ REPOSITORY	gitleaks	yes		no	no	0.15s
✅ REPOSITORY	git_diff	yes		no	no	0.01s
⚠️ REPOSITORY	grype	yes		1	no	16.36s
⚠️ REPOSITORY	kics	yes		7	no	0.58s
✅ REPOSITORY	secretlint	yes		no	no	0.49s
✅ REPOSITORY	syft	yes		no	no	2.42s
⚠️ REPOSITORY	trivy	yes		1	no	8.51s
✅ REPOSITORY	trivy-sbom	yes		no	no	6.76s
✅ REPOSITORY	trufflehog	yes		no	no	2.19s
⚠️ SPELL	cspell	32		524	0	15.57s
⚠️ SPELL	lychee	20		49	0	1.41s
⚠️ TYPESCRIPT	ts-standard	3	0	1	0	5.15s
✅ YAML	prettier	10	5	0	0	2.7s
⚠️ YAML	v8r	10		1	0	6.87s
⚠️ YAML	yamllint	10		17	0	3.65s

See detailed report in MegaLinter reports