[dependabot]

Bumps the npm_and_yarn group with 1 update in the /docs directory: astro.

Updates astro from 7.3.5 to 7.4.12

Release notes

Sourced from astro's releases.

astro@7.4.12

Patch Changes

• #18409 2917650 Thanks @​matthewp! - Fixes a typo in the error message shown when a font cssVariable is invalid

• #18709 6f1a2a8 Thanks @​ematipico! - Reduces memory usage during astro build by releasing content collection entries from memory once the content layer sync is complete.

• #18713 59052e7 Thanks @​delucis! - Unpins @astrojs/* dependencies to allow versions matching the ^ range to be installed

• Updated dependencies [59052e7]:

  • @​astrojs/markdown-satteri@​0.4.10
  • @​astrojs/vite-plugin-astro@​0.1.3

astro@7.4.11

Patch Changes

• #18641 08e2cee Thanks @​astro-factory! - Validates the protocol, host and port from X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port together against each security.allowedDomains entry, instead of one at a time:

  • A forwarded protocol is only applied when an entry allows it for the host in use.
  • A forwarded port is only applied when the entry for that host lists it.
  • A forwarded host without a forwarded protocol is validated with the protocol of the server.
  • An entry with port: '443' (or '80' for http) now matches a host that doesn't include a port.

• #18651 93a9057 Thanks @​umeraamir69! - Returns 400 Bad Request for malformed percent-encoded paths in the dev server and static preview instead of bubbling into a 500

• #18672 e901468 Thanks @​astro-factory! - Fixes astro check reporting @astrojs/check as missing when the package is installed but throws while loading. The original error is now shown instead of an install prompt.

• #18641 08e2cee Thanks @​astro-factory! - Fixes security.allowedDomains accepting non-HTTP(S) X-Forwarded-Proto values (such as ftp or ws) when the list mixes patterns with and without a protocol

• #18686 62bb716 Thanks @​astro-factory! - Fixes astro build deleting the license file generated by Vite's build.license option. Astro now removes only its own Vite manifest from the .vite/ output folder.

• #18629 e9916e1 Thanks @​decrek! - Fixes spreading an object onto an element with scoped styles changing that object. When the same object was spread on every render, for example a constant imported from another module, its class grew with every request.

• #18641 08e2cee Thanks @​astro-factory! - Tightens how security.allowedDomains validates the Host and X-Forwarded-Host headers. Only a plain hostname with an optional port is accepted, and the validated host is applied to Astro.url exactly as it was matched.

• Updated dependencies [d13beeb, e9916e1]:

  • @​astrojs/markdown-satteri@​0.4.9
  • @​astrojs/runtime@​0.1.1
  • @​astrojs/vite-plugin-astro@​0.1.2

astro@7.4.10

Patch Changes

• #18621 8a61493 Thanks @​marcalexiei! - Fixes the dev toolbar's audit freezing an image's CSS animations in Safari, by reading the image's size from the request that loaded it instead of fetching it again

• #18691 f787792 Thanks @​ematipico! - Improves startup time of astro commands by loading SVGO only when svgoOptimizer() optimizes an SVG, instead of whenever astro/config is imported

• #18678 ea63d76 Thanks @​astro-factory! - Fixes duplicate CSS loading for hydrated islands that share modules or are imported through a path alias. The client build no longer emits and preloads stylesheets that are already linked on the page by the server build.

• Updated dependencies [57137ed]:

  • @​astrojs/internal-helpers@​0.13.2
  • @​astrojs/markdown-satteri@​0.4.8
  • @​astrojs/vite-plugin-astro@​0.1.1

... (truncated)

Changelog

Sourced from astro's changelog.

7.4.12

Patch Changes

• #18409 2917650 Thanks @​matthewp! - Fixes a typo in the error message shown when a font cssVariable is invalid

• #18709 6f1a2a8 Thanks @​ematipico! - Reduces memory usage during astro build by releasing content collection entries from memory once the content layer sync is complete.

• #18713 59052e7 Thanks @​delucis! - Unpins @astrojs/* dependencies to allow versions matching the ^ range to be installed

• Updated dependencies [59052e7]:

  • @​astrojs/markdown-satteri@​0.4.10
  • @​astrojs/vite-plugin-astro@​0.1.3

7.4.11

Patch Changes

• #18641 08e2cee Thanks @​astro-factory! - Validates the protocol, host and port from X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port together against each security.allowedDomains entry, instead of one at a time:

  • A forwarded protocol is only applied when an entry allows it for the host in use.
  • A forwarded port is only applied when the entry for that host lists it.
  • A forwarded host without a forwarded protocol is validated with the protocol of the server.
  • An entry with port: '443' (or '80' for http) now matches a host that doesn't include a port.

• #18651 93a9057 Thanks @​umeraamir69! - Returns 400 Bad Request for malformed percent-encoded paths in the dev server and static preview instead of bubbling into a 500

• #18672 e901468 Thanks @​astro-factory! - Fixes astro check reporting @astrojs/check as missing when the package is installed but throws while loading. The original error is now shown instead of an install prompt.

• #18641 08e2cee Thanks @​astro-factory! - Fixes security.allowedDomains accepting non-HTTP(S) X-Forwarded-Proto values (such as ftp or ws) when the list mixes patterns with and without a protocol

• #18686 62bb716 Thanks @​astro-factory! - Fixes astro build deleting the license file generated by Vite's build.license option. Astro now removes only its own Vite manifest from the .vite/ output folder.

• #18629 e9916e1 Thanks @​decrek! - Fixes spreading an object onto an element with scoped styles changing that object. When the same object was spread on every render, for example a constant imported from another module, its class grew with every request.

• #18641 08e2cee Thanks @​astro-factory! - Tightens how security.allowedDomains validates the Host and X-Forwarded-Host headers. Only a plain hostname with an optional port is accepted, and the validated host is applied to Astro.url exactly as it was matched.

• Updated dependencies [d13beeb, e9916e1]:

  • @​astrojs/markdown-satteri@​0.4.9
  • @​astrojs/runtime@​0.1.1
  • @​astrojs/vite-plugin-astro@​0.1.2

7.4.10

Patch Changes

• #18621 8a61493 Thanks @​marcalexiei! - Fixes the dev toolbar's audit freezing an image's CSS animations in Safari, by reading the image's size from the request that loaded it instead of fetching it again

• #18691 f787792 Thanks @​ematipico! - Improves startup time of astro commands by loading SVGO only when svgoOptimizer() optimizes an SVG, instead of whenever astro/config is imported

• #18678 ea63d76 Thanks @​astro-factory! - Fixes duplicate CSS loading for hydrated islands that share modules or are imported through a path alias. The client build no longer emits and preloads stylesheets that are already linked on the page by the server build.

• Updated dependencies [57137ed]:

... (truncated)

Commits

• 5b7c327 [ci] release (#18714)
• 6f1a2a8 fix(content): release the content layer after sync in builds (#18709)
• f9a1062 docs: correct build.client and build.server @​default to include trailing slas...
• 59052e7 Use workspace:^ for monorepo deps (#18713)
• d68e4f6 [ci] release (#18699)
• 2e83637 [ci] format
• 93a9057 fix(astro): return 400 for malformed paths in dev and static preview (#18651)
• 08e2cee Mixed allowedDomains patterns no longer accept non-http(s) X-Forwarded-Proto ...
• e9916e1 fix: don't mutate objects spread onto elements with scoped styles (#18629)
• e901468 Show real import errors instead of a false missing-package prompt in `astro c...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Copilot]

🔵 Needs a closer look

The Astro upgrade changes the build pipeline and Node requirements beneath unchanged Starlight integrations, leaving compatibility unverified without a dependency-enabled docs build.

No open issues 🎉

1 file not reviewed

• docs/package-lock.json: Generated file

What changed in this PR

Updates the Astro tooling used by gh-stack’s documentation site, with no changes to CLI code or site content.

Changes:

• Bumps Astro from 7.3.5 to 7.4.12.
• Refreshes the lockfile with updated transitive dependencies and Astro’s higher Node.js requirement (>=22.23.4).

File	Description
docs/​package.json	Raises the Astro dependency range to ^7.4.12.
docs/​package-lock.json	Locks Astro 7.4.12 and its updated dependency tree.

_{Review effort: Max}