chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
astro (source)	^4.5.16 -> ^4.6.1
pnpm (source)	8.15.6 -> 8.15.7

---

Release Notes

withastro/astro (astro)

v4.6.1

Compare Source

Patch Changes

• #​10708 742866c5669a2be4f8b5a4c861cadb933c381415 Thanks @​horo-fox! - Limits parallel imports within getCollection() to prevent EMFILE errors when accessing files

• #​10755 c6d59b6fb7db20af957a8706c8159c50619235ef Thanks @​ematipico! - Fixes a case where the i18n fallback failed to correctly redirect to the index page with SSR enabled

v4.6.0

Compare Source

Minor Changes

• #​10591 39988ef8e2c4c4888543c973e06d9b9939e4ac95 Thanks @​mingjunlu! - Adds a new dev toolbar settings option to change the horizontal placement of the dev toolbar on your screen: bottom left, bottom center, or bottom right.

• #​10689 683d51a5eecafbbfbfed3910a3f1fbf0b3531b99 Thanks @​ematipico! - Deprecate support for versions of Node.js older than v18.17.1 for Node.js 18, older than v20.0.3 for Node.js 20, and the complete Node.js v19 release line.

  This change is in line with Astro's Node.js support policy.

• #​10678 2e53b5fff6d292b7acdf8c30a6ecf5e5696846a1 Thanks @​ematipico! - Adds a new experimental security option to prevent Cross-Site Request Forgery (CSRF) attacks. This feature is available only for pages rendered on demand:

  import { defineConfig } from 'astro/config';
  export default defineConfig({
    experimental: {
      security: {
        csrfProtection: {
          origin: true,
        },
      },
    },
  });

  Enabling this setting performs a check that the "origin" header, automatically passed by all modern browsers, matches the URL sent by each Request.

  This experimental "origin" check is executed only for pages rendered on demand, and only for the requests POST, PATCH, DELETEandPUTwith one of the followingcontent-type` headers: 'application/x-www-form-urlencoded', 'multipart/form-data', 'text/plain'.

  It the "origin" header doesn't match the pathname of the request, Astro will return a 403 status code and won't render the page.

• #​10193 440681e7b74511a17b152af0fd6e0e4dc4014025 Thanks @​ematipico! - Adds a new i18n routing option manual to allow you to write your own i18n middleware:

  import { defineConfig } from 'astro/config';
  // astro.config.mjs
  export default defineConfig({
    i18n: {
      locales: ['en', 'fr'],
      defaultLocale: 'fr',
      routing: 'manual',
    },
  });

  Adding routing: "manual" to your i18n config disables Astro's own i18n middleware and provides you with helper functions to write your own: redirectToDefaultLocale, notFound, and redirectToFallback:

  // middleware.js
  import { redirectToDefaultLocale } from 'astro:i18n';
  export const onRequest = defineMiddleware(async (context, next) => {
    if (context.url.startsWith('/about')) {
      return next();
    } else {
      return redirectToDefaultLocale(context, 302);
    }
  });

  Also adds a middleware function that manually creates Astro's i18n middleware. This allows you to extend Astro's i18n routing instead of completely replacing it. Run middleware in combination with your own middleware, using the sequence utility to determine the order:

  import { defineMiddleware, sequence } from 'astro:middleware';
  import { middleware } from 'astro:i18n'; // Astro's own i18n routing config
  
  export const userMiddleware = defineMiddleware();
  
  export const onRequest = sequence(
    userMiddleware,
    middleware({
      redirectToDefaultLocale: false,
      prefixDefaultLocale: true,
    })
  );

• #​10671 9e14a78cb05667af9821948c630786f74680090d Thanks @​fshafiee! - Adds the httpOnly, sameSite, and secure options when deleting a cookie

Patch Changes

• #​10747 994337c99f84304df1147a14504659439a9a7326 Thanks @​lilnasy! - Fixes an issue where functions could not be used as named slots.

• #​10750 7e825604ddf90c989537e07939a39dc249343897 Thanks @​OliverSpeir! - Fixes a false positive for "Invalid tabindex on non-interactive element" rule for roleless elements ( div and span ).

• #​10745 d51951ce6278d4b59deed938d65e1cb72b5102df Thanks @​lilnasy! - Fixes an issue where CLI commands could not report the reason for failure before exiting.

• #​10661 e2cd7f4291912dadd4a654bc7917856c58a72a97 Thanks @​liruifengv! - Fixed errorOverlay theme toggle bug.

• Updated dependencies [ccafa8d230f65c9302421a0ce0a0adc5824bfd55, 683d51a5eecafbbfbfed3910a3f1fbf0b3531b99]:

  • @​astrojs/markdown-remark@​5.1.0
  • @​astrojs/telemetry@​3.1.0

v4.5.18

Compare Source

Patch Changes

• #​10728 f508c4b7d54316e737f454a3777204b23636d4a0 Thanks @​ematipico! - Fixes a regression where some very specific code rendered using expressive-code was not escaped properly.

• #​10737 8a30f257b1f3618b01212a591b82ad7a63c82fbb Thanks @​lilnasy! - Fixes a regression where constructing and returning 404 responses from a middleware resulted in the dev server getting stuck in a loop.

• #​10719 b21b3ba307235510707ee9f5bd49f71473a07004 Thanks @​ematipico! - Fixes a false positive for div and span elements when running the Dev Toolbar accessibility audits.

  Those are special elements that don't have an interaction assigned by default. Instead, it is assigned through the role attribute. This means that cases like the following are now deemed correct:

  <div role="tablist"></div>
  <span role="button" onclick="" onkeydown=""></span>

v4.5.17

Compare Source

Patch Changes

• #​10688 799f6f3f29a3ef4f76347870a209ffa89651adfa Thanks @​bluwy! - Marks renderer jsxImportSource and jsxTransformOptions options as deprecated as they are no longer used since Astro 3.0

• #​10657 93d353528fa1a85b67e3f1e9514ed2a1b42dfd94 Thanks @​natemoo-re! - Improves the color contrast for notification badges on dev toolbar apps

• #​10693 1d26e9c7f7d8f47e33bc68d3b30bbffce25c7b63 Thanks @​apetta! - Adds the disableremoteplayback attribute to MediaHTMLAttributes interface

• #​10695 a15975e41cb5eaf6ed8eb3ebaee676a17e433052 Thanks @​bluwy! - Skips prerender chunk if building with static output

• #​10707 5e044a5eafaa206d2ef8b62c37d1bcd37f0a4078 Thanks @​horo-fox! - Logs an error when a page's getStaticPaths fails

• #​10686 fa0f593890502faf5709ab881fe0e45519d2f7af Thanks @​bluwy! - Prevents inlining scripts if used by other chunks when using the experimental.directRenderScript option

pnpm/pnpm (pnpm)

v8.15.7

Compare Source

---

Configuration

📅 Schedule: Branch creation - "on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.