[dependabot]

Bumps the astro group with 3 updates in the / directory: @astrojs/markdown-remark, @astrojs/vercel and astro.

Updates @astrojs/markdown-remark from 7.3.4 to 7.3.5

Release notes

Sourced from @​astrojs/markdown-remark's releases.

@​astrojs/markdown-remark@​7.3.5

Patch Changes

• edfbf4a Thanks @​matthewp! - Fixes Prism code blocks for languages Prism doesn't support, such as vue or svelte. Their code is now displayed as plain text instead of being rendered as HTML. Also correctly escapes the code block language in the generated class and data-language attributes.
• Updated dependencies [edfbf4a]:
  • @​astrojs/prism@​4.1.2

Changelog

Sourced from @​astrojs/markdown-remark's changelog.

7.3.5

Patch Changes

• edfbf4a Thanks @​matthewp! - Fixes Prism code blocks for languages Prism doesn't support, such as vue or svelte. Their code is now displayed as plain text instead of being rendered as HTML. Also correctly escapes the code block language in the generated class and data-language attributes.
• Updated dependencies [edfbf4a]:
  • @​astrojs/prism@​4.1.2

Commits

• fda754d [ci] release (#18478)
• edfbf4a Merge commit from fork
• See full diff in compare view

Updates @astrojs/vercel from 11.0.16 to 11.0.18

Release notes

Sourced from @​astrojs/vercel's releases.

@​astrojs/vercel@​11.0.18

Patch Changes

• #18554 3ef9fea Thanks @​florian-lefebvre! - Fixes NFT tracing so dynamic path segments no longer glob the whole workspace, which could include unrelated files in function bundles for monorepo projects

@​astrojs/vercel@​11.0.18-beta.0

Patch Changes

• Updated dependencies [db62f3b]:
  • astro@7.4.4-beta.0

@​astrojs/vercel@​11.0.17

Patch Changes

• #18085 785473b Thanks @​nikolas-sapa! - Fix redirects never matching on Vercel when trailingSlash: 'always' is set. Redirect sources now include the trailing slash so they match the normalized request path. Sources whose last segment contains a dot are left unslashed, and dynamic or spread sources emit both the slashed and unslashed form, because Vercel only normalizes paths without a dot.

Changelog

Sourced from @​astrojs/vercel's changelog.

11.0.18

Patch Changes

• #18554 3ef9fea Thanks @​florian-lefebvre! - Fixes NFT tracing so dynamic path segments no longer glob the whole workspace, which could include unrelated files in function bundles for monorepo projects

11.0.17

Patch Changes

• #18085 785473b Thanks @​nikolas-sapa! - Fix redirects never matching on Vercel when trailingSlash: 'always' is set. Redirect sources now include the trailing slash so they match the normalized request path. Sources whose last segment contains a dot are left unslashed, and dynamic or spread sources emit both the slashed and unslashed form, because Vercel only normalizes paths without a dot.

Commits

• d354ffb [ci] release (#18547)
• 3ef9fea Fix NFT over-tracing in monorepo projects (#18554)
• fda754d [ci] release (#18478)
• 785473b fix(@​astrojs/vercel): make redirects match when trailingSlash is always/never...
• See full diff in compare view

Updates astro from 7.4.2 to 7.4.5

Release notes

Sourced from astro's releases.

astro@7.4.5

Patch Changes

• #18558 fac3c50 Thanks @​astro-factory! - Fixes astro dev status and other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process

• #18559 10dae2f Thanks @​astro-factory! - Fixes import.meta.env values containing $ sequences (such as $$ or $&) being corrupted in astro build when server code reads the import.meta.env object directly, for example with const { MY_SECRET } = import.meta.env

• #18544 e3bec3d Thanks @​skezo! - Fixes request paths with invalid percent-encoding (e.g. /%C0%AF or a bare %) being logged as an Invalid URL encoding error and routed with the undecoded path. These requests now return a 400, the same as a path that is encoded too many times.

• #18520 e023aba Thanks @​matthewp! - Makes rendering of string tag names stricter and consistent across .astro dynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as / or = can no longer change the generated markup. A string that does not start with a valid element name (for example '!--' or '') now throws an error instead of producing invalid HTML.

astro@7.4.4

Patch Changes

• #18344 df838da Thanks @​edmundhung! - Allows astro add to configure tagged versions of official adapters

astro@7.4.4-beta.0

Patch Changes

• #18539 db62f3b Thanks @​matthewp! - Allows astro add to configure tagged versions of official adapters

astro@7.4.3

Patch Changes

• #18488 e4e25fa Thanks @​umeraamir69! - CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string into script-src and style-src.

• #18500 e5a3a1b Thanks @​astro-factory! - Fixes <Image> and <Picture> emitting duplicate srcset candidates when densities contains equivalent values such as 1 and '1x'

• #18517 c3185b7 Thanks @​okxint! - Fix unhandled AbortError rejection when ClientRouter skips a pending view transition

• #18497 c712113 Thanks @​astro-factory! - Fixes an uncaught TypeError in the browser when a server:defer island request fails due to a network error. The fallback content is kept, as it is for non-200 responses.

• #18525 d0240b9 Thanks @​astro-factory! - Fixes a DEP0190 deprecation warning printed by astro info on Node.js 24 and later

• #18522 776b9a6 Thanks @​astro-factory! - Fixes memoryCache() serving an empty body for cached pages that return an empty 404 or 500 response. These responses now render the 404 or 500 error page on every request.

• #18511 d060ff9 Thanks @​astro-factory! - Fixes transition:name styles missing in dev when the element is inside a component that is only rendered through another component with no styles or scripts

• #18494 5fe699c Thanks @​astro-factory! - Fixes the astro CLI refusing to run on StackBlitz by allowing Node.js >=22.22.0 inside WebContainers, whose Node.js version users cannot change

• #18506 bf43a60 Thanks @​astro-factory! - Fixes <ClientRouter /> animating scroll restoration on back/forward navigation when scroll-behavior: smooth is set. Saved scroll positions are now restored instantly, matching the browser's native behavior.

• #18476 8ea79a2 Thanks @​astro-factory! - Fixes a DataCloneError crash when building pages that render SVG imports with <Image /> or getImage() while experimental.parallelPrerender is enabled.

• #18504 6dbd737 Thanks @​astro-factory! - Fixes <Picture> emitting a duplicate 1x candidate in <source> srcset when densities includes 1

• #18524 7524889 Thanks @​astro-factory! - Fixes type errors reported in Astro's built-in <Image />, <Picture />, <Code />, <Debug /> and <ClientRouter /> components when type-checking a project that extends astro/tsconfigs/strictest with tsc and @astrojs/ts-content-mapper

• #18493 3773941 Thanks @​astro-factory! - Fixes scoped styles of unused Astro components being included in the build when those components are re-exported from a barrel file

... (truncated)

Changelog

Sourced from astro's changelog.

7.4.5

Patch Changes

• #18558 fac3c50 Thanks @​astro-factory! - Fixes astro dev status and other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process

• #18559 10dae2f Thanks @​astro-factory! - Fixes import.meta.env values containing $ sequences (such as $$ or $&) being corrupted in astro build when server code reads the import.meta.env object directly, for example with const { MY_SECRET } = import.meta.env

• #18544 e3bec3d Thanks @​skezo! - Fixes request paths with invalid percent-encoding (e.g. /%C0%AF or a bare %) being logged as an Invalid URL encoding error and routed with the undecoded path. These requests now return a 400, the same as a path that is encoded too many times.

• #18520 e023aba Thanks @​matthewp! - Makes rendering of string tag names stricter and consistent across .astro dynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as / or = can no longer change the generated markup. A string that does not start with a valid element name (for example '!--' or '') now throws an error instead of producing invalid HTML.

7.4.4

Patch Changes

• #18344 df838da Thanks @​edmundhung! - Allows astro add to configure tagged versions of official adapters

7.4.3

Patch Changes

• #18488 e4e25fa Thanks @​umeraamir69! - CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string into script-src and style-src.

• #18500 e5a3a1b Thanks @​astro-factory! - Fixes <Image> and <Picture> emitting duplicate srcset candidates when densities contains equivalent values such as 1 and '1x'

• #18517 c3185b7 Thanks @​okxint! - Fix unhandled AbortError rejection when ClientRouter skips a pending view transition

• #18497 c712113 Thanks @​astro-factory! - Fixes an uncaught TypeError in the browser when a server:defer island request fails due to a network error. The fallback content is kept, as it is for non-200 responses.

• #18525 d0240b9 Thanks @​astro-factory! - Fixes a DEP0190 deprecation warning printed by astro info on Node.js 24 and later

• #18522 776b9a6 Thanks @​astro-factory! - Fixes memoryCache() serving an empty body for cached pages that return an empty 404 or 500 response. These responses now render the 404 or 500 error page on every request.

• #18511 d060ff9 Thanks @​astro-factory! - Fixes transition:name styles missing in dev when the element is inside a component that is only rendered through another component with no styles or scripts

• #18494 5fe699c Thanks @​astro-factory! - Fixes the astro CLI refusing to run on StackBlitz by allowing Node.js >=22.22.0 inside WebContainers, whose Node.js version users cannot change

• #18506 bf43a60 Thanks @​astro-factory! - Fixes <ClientRouter /> animating scroll restoration on back/forward navigation when scroll-behavior: smooth is set. Saved scroll positions are now restored instantly, matching the browser's native behavior.

• #18476 8ea79a2 Thanks @​astro-factory! - Fixes a DataCloneError crash when building pages that render SVG imports with <Image /> or getImage() while experimental.parallelPrerender is enabled.

• #18504 6dbd737 Thanks @​astro-factory! - Fixes <Picture> emitting a duplicate 1x candidate in <source> srcset when densities includes 1

• #18524 7524889 Thanks @​astro-factory! - Fixes type errors reported in Astro's built-in <Image />, <Picture />, <Code />, <Debug /> and <ClientRouter /> components when type-checking a project that extends astro/tsconfigs/strictest with tsc and @astrojs/ts-content-mapper

• #18493 3773941 Thanks @​astro-factory! - Fixes scoped styles of unused Astro components being included in the build when those components are re-exported from a barrel file

• #18512 1151b9e Thanks @​jp-knj! - Fixes CSP hashes added with Astro.csp from components rendered inside <body> being left out of the CSP <meta> element in static builds, including MDX pages

• Updated dependencies [6cf3423, edfbf4a]:

... (truncated)

Commits

• d354ffb [ci] release (#18547)
• 10dae2f fix(env): preserve $ in import.meta.env values when the env object is inlin...
• fac3c50 Preserve dev server lock file when process signal check returns EPERM (#18558)
• e023aba Make string tag name rendering stricter and consistent (#18520)
• e3bec3d Reject request paths with invalid percent-encoding with a 400 (#18544)
• 883e672 [ci] release (#18540)
• df838da astro add: configure tagged official adapters (#18344)
• fda754d [ci] release (#18478)
• 776b9a6 Prevent memory cache from storing empty 404/500 responses that would be rerou...
• d060ff9 Fix transition:name styles silently dropped in dev when component is nested u...
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
website	Ready	Preview	Nov 6, 2026 3:02am UTC

[dependabot]

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[dongjiang1989]

@dependabot recreate