Skip to content

feat(deps): bump js-yaml, @astrojs/starlight and astro in /src/starlight - #650

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/starlight/multi-ed5e892bea
Open

feat(deps): bump js-yaml, @astrojs/starlight and astro in /src/starlight#650
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/starlight/multi-ed5e892bea

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 8, 2026

Copy link
Copy Markdown
Contributor

Bumps js-yaml to 4.3.1 and updates ancestor dependencies js-yaml, @astrojs/starlight and astro. These dependencies need to be updated together.

Updates js-yaml from 3.14.1 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • 6842ef6 doc polish
  • 590dbab 4.2.0 released
  • Additional commits viewable in compare view

Updates @astrojs/starlight from 0.19.1 to 0.41.7

Release notes

Sourced from @​astrojs/starlight's releases.

@​astrojs/starlight@​0.41.7

Patch Changes

  • #4114 3e486fb Thanks @​delucis! - Fixes processing of code examples in RTL languages when using Astro’s Sätteri Markdown processor

@​astrojs/starlight@​0.41.6

Patch Changes

@​astrojs/starlight@​0.41.5

Patch Changes

@​astrojs/starlight@​0.41.4

Patch Changes

@​astrojs/starlight@​0.41.3

Patch Changes

  • #3911 1686ecc Thanks @​timothyjordan! - Keeps keyboard focus inside the mobile menu while it is open, preventing focus moving to hidden interactive elements in page content.

@​astrojs/starlight@​0.41.2

Patch Changes

  • #4008 58a3520 Thanks @​FrancoKaddour! - Fixes the table of contents overflowing the right edge of the viewport when a custom --sl-content-width value exceeds available space

  • #4015 bdbfffc Thanks @​delucis! - Fixes an issue where aside icons were rendered incorrectly in projects where Astro’s MDX integration had optimization disabled

@​astrojs/starlight@​0.41.1

Patch Changes

@​astrojs/starlight@​0.41.0

Minor Changes

... (truncated)

Changelog

Sourced from @​astrojs/starlight's changelog.

0.41.7

Patch Changes

  • #4114 3e486fb Thanks @​delucis! - Fixes processing of code examples in RTL languages when using Astro’s Sätteri Markdown processor

0.41.6

Patch Changes

0.41.5

Patch Changes

0.41.4

Patch Changes

0.41.3

Patch Changes

  • #3911 1686ecc Thanks @​timothyjordan! - Keeps keyboard focus inside the mobile menu while it is open, preventing focus moving to hidden interactive elements in page content.

0.41.2

Patch Changes

  • #4008 58a3520 Thanks @​FrancoKaddour! - Fixes the table of contents overflowing the right edge of the viewport when a custom --sl-content-width value exceeds available space

  • #4015 bdbfffc Thanks @​delucis! - Fixes an issue where aside icons were rendered incorrectly in projects where Astro’s MDX integration had optimization disabled

0.41.1

Patch Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​astrojs/starlight since your current version.


Updates astro from 4.4.3 to 7.2.0

Release notes

Sourced from astro's releases.

astro@7.2.0

Minor Changes

  • #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

    This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

    astro preview --background

    When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

    astro preview status
astro preview logs
astro preview logs --follow
astro preview stop

    If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

    To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

  • #17532 7f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

    Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

    // astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
logger: {

entrypoint: new URL('./src/logger.js', import.meta.url),


entrypoint: './src/logger.js',
},
});

Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

  • #17084 961bbe5 Thanks @​matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

    A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

    import type { AstroPrerenderer, PrerenderResult } from 'astro';
const prerenderer: AstroPrerenderer = {

    • ... (truncated)

    Changelog

    Sourced from astro's changelog.

    4.16.16

    Patch Changes

    4.16.15

    Patch Changes

    4.16.14

    Patch Changes

    4.16.13

    Patch Changes

    • #12436 453ec6b Thanks @​martrapp! - Fixes a potential null access in the clientside router

    • #12392 0462219 Thanks @​apatel369! - Fixes an issue where scripts were not correctly injected during the build. The issue was triggered when there were injected routes with the same entrypoint and different pattern

    4.16.12

    Patch Changes

    • #12420 acac0af Thanks @​ematipico! - Fixes an issue where the dev server returns a 404 status code when a user middleware returns a valid Response.

    4.16.11

    Patch Changes

    ... (truncated)

    Commits
    Maintainer changes

    This version was pushed to npm by GitHub Actions, a new releaser for astro since your current version.


    Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

    Dependabot commands and options

    You can trigger Dependabot actions by commenting on this PR:

    • @dependabot rebase will rebase this PR
    • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
      You can disable automated security fix PRs for this repo from the Security Alerts page.

    @dependabot
    feat(deps): bump js-yaml, @astrojs/starlight and astro in /src/starlight
    55c470f 
    Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.3.1 and updates ancestor dependencies [js-yaml](https://github.com/nodeca/js-yaml), [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) and [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). These dependencies need to be updated together.


Updates `js-yaml` from 3.14.1 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...4.3.1)

Updates `@astrojs/starlight` from 0.19.1 to 0.41.7
- [Release notes](https://github.com/withastro/starlight/releases)
- [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md)
- [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.7/packages/starlight)

Updates `astro` from 4.4.3 to 7.2.0
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG-v4.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.0/packages/astro)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
- dependency-name: "@astrojs/starlight"
  dependency-version: 0.41.7
  dependency-type: direct:production
- dependency-name: astro
  dependency-version: 7.2.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
    @dependabot dependabot Bot added scope: code An issue related to source code. scope: deps An issue related to dependencies. type: improvement A new improvement proposal. labels Aug 8, 2026
    @dependabot dependabot Bot mentioned this pull request Aug 8, 2026
    Closed
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Reviewers

    @kamilsk kamilsk kamilsk approved these changes

    Assignees

    No one assigned

    Labels

    scope: code An issue related to source code. scope: deps An issue related to dependencies. type: improvement A new improvement proposal.

    Projects

    None yet

    Milestone

    No milestone

    Development

    Successfully merging this pull request may close these issues.

    1 participant

    @kamilsk