Skip to content

Bump the npm_and_yarn group across 1 directory with 6 updates#101

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-6f745ddd27
Open

Bump the npm_and_yarn group across 1 directory with 6 updates#101
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-6f745ddd27

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Jan 21, 2026 •
edited
Loading

Bumps the npm_and_yarn group with 2 updates in the / directory: astro and mdast-util-to-hast.

Updates astro from 5.10.0 to 5.16.12

Release notes

Sourced from astro's releases.

astro@5.16.12

Patch Changes

  • #15175 47ae148 Thanks @​florian-lefebvre! - Allows experimental Font providers to specify family options

    Previously, an Astro FontProvider could only accept options at the provider level when called. That could result in weird data structures for family-specific options.

    Astro FontProviders can now declare family-specific options, by specifying a generic:

    // font-provider.ts
import type { FontProvider } from "astro";
import { retrieveFonts, type Fonts } from "./utils.js",
interface Config {
token: string;
}
+interface FamilyOptions {

minimal?: boolean;
+}

-export function registryFontProvider(config: Config): FontProvider {
+export function registryFontProvider(config: Config): FontProvider<FamilyOptions> {
let data: Fonts = {}
return {
name: "registry",
config,
init: async () => {
data = await retrieveFonts(token);
},
listFonts: () => {
return Object.keys(data);
},

resolveFont: ({ familyName, ...rest }) => {


// options is typed as FamilyOptions
resolveFont: ({ familyName, options, ...rest }) => {
const fonts = data[familyName];
if (fonts) {
return { fonts };
}
return undefined;
},
};
}

Once the font provider is registered in the Astro config, types are automatically inferred:

... (truncated)

Changelog

Sourced from astro's changelog.

5.16.12

Patch Changes

  • #15175 47ae148 Thanks @​florian-lefebvre! - Allows experimental Font providers to specify family options

    Previously, an Astro FontProvider could only accept options at the provider level when called. That could result in weird data structures for family-specific options.

    Astro FontProviders can now declare family-specific options, by specifying a generic:

    // font-provider.ts
import type { FontProvider } from "astro";
import { retrieveFonts, type Fonts } from "./utils.js",
interface Config {
token: string;
}
+interface FamilyOptions {

minimal?: boolean;
+}

-export function registryFontProvider(config: Config): FontProvider {
+export function registryFontProvider(config: Config): FontProvider<FamilyOptions> {
let data: Fonts = {}
return {
name: "registry",
config,
init: async () => {
data = await retrieveFonts(token);
},
listFonts: () => {
return Object.keys(data);
},

resolveFont: ({ familyName, ...rest }) => {


// options is typed as FamilyOptions
resolveFont: ({ familyName, options, ...rest }) => {
const fonts = data[familyName];
if (fonts) {
return { fonts };
}
return undefined;
},
};
}

Once the font provider is registered in the Astro config, types are automatically inferred:

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for astro since your current version.


Updates devalue from 5.1.1 to 5.6.2

Release notes

Sourced from devalue's releases.

v5.6.2

Patch Changes

  • 1175584: fix: validate input for ArrayBuffer parsing
  • e46afa6: fix: validate input for typed arrays
  • 1175584: fix: more helpful errors for inputs causing stack overflows

v5.6.1

Patch Changes

  • 2161d44: fix: add hasOwn check before calling reviver

v5.6.0

Minor Changes

  • a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses
  • a3d09d4: feat: add value and root properties in DevalueError instances

v5.5.0

Minor Changes

  • 828fa1c: Enable support for custom reducer/reviver for "function" values

v5.4.2

Patch Changes

  • 5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

v5.4.1

Patch Changes

  • ca3c7b6: chore: Remove impossible void type from replacer's uneval

v5.4.0

Minor Changes

  • 9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

  • b617c7c: perf: shrink uneval output with null-proto objects

v5.3.2

Patch Changes

  • 0623a47: fix: disallow array method access when parsing
  • 0623a47: fix: disallow __proto__ properties on objects

v5.3.1

Patch Changes

... (truncated)

Changelog

Sourced from devalue's changelog.

5.6.2

Patch Changes

  • 1175584: fix: validate input for ArrayBuffer parsing
  • e46afa6: fix: validate input for typed arrays
  • 1175584: fix: more helpful errors for inputs causing stack overflows

5.6.1

Patch Changes

  • 2161d44: fix: add hasOwn check before calling reviver

5.6.0

Minor Changes

  • a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses
  • a3d09d4: feat: add value and root properties in DevalueError instances

5.5.0

Minor Changes

  • 828fa1c: Enable support for custom reducer/reviver for "function" values

5.4.2

Patch Changes

  • 5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

5.4.1

Patch Changes

  • ca3c7b6: chore: Remove impossible void type from replacer's uneval

5.4.0

Minor Changes

  • 9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

  • b617c7c: perf: shrink uneval output with null-proto objects

5.3.2

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for devalue since your current version.


Updates h3 from 1.15.3 to 1.15.5

Release notes

Sourced from h3's releases.

v1.15.5

compare changes

[!IMPORTANT] Security: Fixed a bug in readBody(event) and readRawBody(event) utils where certain Transfer-Encoding header formats could cause the request body to be ignored.

In some deployments (for example, behind TCP load balancers or non-normalizing proxies), this could allow request smuggling. The handling is now safe and fully compliant. (read more)

🩹 Fixes

  • readRawBody: Fix case-sensitive Transfer-Encoding check causing request smuggling risk (618ccf4)

v1.15.4

compare changes

🩹 Fixes

  • getRequestHost: Return first host from x-forwarded-host (#1175)

💅 Refactors

  • useSession: Backport SessionManager interface to fix types (#1058)

🏡 Chore

  • docs: Fix typos (#1108)

❤️ Contributors

Changelog

Sourced from h3's changelog.

v1.15.5

compare changes

🩹 Fixes

  • readRawBody: Fix case-sensitive Transfer-Encoding check causing request smuggling risk (618ccf4)

🏡 Chore

🤖 CI

❤️ Contributors

v1.15.4

compare changes

🩹 Fixes

  • serveStatic: Omit decoded id from statusMessage (#1044)
  • getRequestHost: Return first host from x-forwarded-host (#1175)

💅 Refactors

  • useSession: Backport SessionManager interface to fix types (#1058)

📦 Build

  • Update repository field (d94b09a)

🏡 Chore

... (truncated)

Commits
  • 24231b9 chore(release): v1.15.5
  • bd92b74 chore: fix more ts/lint issues
  • d18c074 chore: update deps
  • c9ebf80 chore: fix ts issue
  • 618ccf4 fix(readRawBody): fix case-sensitive Transfer-Encoding check causing reques...
  • 401c9b8 ci: fix publish tag
  • 589625c chore: update publish tag to 1.x
  • b4dce71 chore: update ci
  • 0a4a115 chore: add test:types script
  • c934599 chore: update ci
  • Additional commits viewable in compare view

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Updates mdast-util-to-hast from 13.2.0 to 13.2.1

Release notes

Sourced from mdast-util-to-hast's releases.

13.2.1

Fix

  • ab3a795 Fix support for spaces in class names

Types

  • efb5312 Refactor to use @imports
  • a5bc210 Add declaration maps

Full Changelog: syntax-tree/mdast-util-to-hast@13.2.0...13.2.1

Commits

Updates vite from 6.3.5 to 6.4.1

Release notes

Sourced from vite's releases.

create-vite@6.4.1

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

create-vite@6.4.0

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

v6.3.6

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.0-beta.8 (2026-01-15)

⚠ BREAKING CHANGES

  • remove import.meta.hot.accept resolution fallback (#21382)

Features

Bug Fixes

Code Refactoring

  • remove import.meta.hot.accept resolution fallback (#21382) (71d0797)

8.0.0-beta.7 (2026-01-08)

Features

Bug Fixes

8.0.0-beta.6 (2026-01-07)

Features

Bug Fixes

  • deps: update all non-major dependencies (#21321) (9bc7c2e)
  • import-analysis: avoid cjs interop for built browser external module (#21333) (dc5a2fb)

Miscellaneous Chores

8.0.0-beta.5 (2025-12-25)

Features

... (truncated)

Commits
  • 0a0c50a refactor: simplify pluginFilter implementation (#19828)
  • 59d0b35 perf(css): avoid constructing renderedModules (#19775)
  • 175a839 fix: reject requests with # in request-target (#19830)
  • e2e11b1 fix(module-runner): allow already resolved id as entry (#19768)
  • 7200dee fix: correct the behavior when multiple transform filter options are specifie...
  • b125172 fix(css): remove empty chunk imports correctly when chunk file name contained...
  • 8fe3538 test: tweak generateCodeFrame test (#19812)
  • 36935b5 fix(types): remove the keepProcessEnv from the DefaultEnvironmentOptions ...
  • a0e1a04 docs(vite): fix description of transformIndexHtml hook (#19799)
  • 71227be fix: unbundle fdir to fix commonjsOptions.dynamicRequireTargets (#19791)
  • Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.
Open with Devin

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
Bump the npm_and_yarn group across 1 directory with 6 updates
13d0af0 
Bumps the npm_and_yarn group with 2 updates in the / directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) and [mdast-util-to-hast](https://github.com/syntax-tree/mdast-util-to-hast).


Updates `astro` from 5.10.0 to 5.16.12
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@5.16.12/packages/astro)

Updates `devalue` from 5.1.1 to 5.6.2
- [Release notes](https://github.com/sveltejs/devalue/releases)
- [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md)
- [Commits](sveltejs/devalue@v5.1.1...v5.6.2)

Updates `h3` from 1.15.3 to 1.15.5
- [Release notes](https://github.com/h3js/h3/releases)
- [Changelog](https://github.com/h3js/h3/blob/v1.15.5/CHANGELOG.md)
- [Commits](h3js/h3@v1.15.3...v1.15.5)

Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `mdast-util-to-hast` from 13.2.0 to 13.2.1
- [Release notes](https://github.com/syntax-tree/mdast-util-to-hast/releases)
- [Commits](syntax-tree/mdast-util-to-hast@13.2.0...13.2.1)

Updates `vite` from 6.3.5 to 6.4.1
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@6.4.1/packages/vite)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 5.16.12
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: devalue
  dependency-version: 5.6.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: h3
  dependency-version: 1.15.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: mdast-util-to-hast
  dependency-version: 13.2.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 6.4.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 21, 2026
@dependabot dependabot bot mentioned this pull request Jan 21, 2026
Closed
devin-ai-integration[bot]
devin-ai-integration bot reviewed Jan 21, 2026
View reviewed changes
Copy link
Copy Markdown

@devin-ai-integration devin-ai-integration bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Open in Devin Review

@socket-security
Copy link
Copy Markdown

socket-security bot commented Jan 21, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedastro@​5.10.0 ⏵ 5.16.1297100 +2688 +198100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@devin-ai-integration devin-ai-integration[bot] devin-ai-integration[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants