chore(deps): update astro, vitest, prettier-plugin-astro, svelte, and 8 others

[tommyp]

Summary

Dependency update across the board, plus a fix for the failing Netlify build. pnpm audit goes from 41 advisories (25 high) to 2 high, neither with a published fix. Taken: vitest 4 → 5 and prettier-plugin-astro 0.14 → 1.x majors (no code changes needed). TypeScript stays on 6 — astro check refuses TS 7 ("install TypeScript 6 instead"), and its suggested replacement @astrojs/ts-content-mapper needs TS 7.1+, which isn't out.

Netlify build fix

Netlify has failed on main since 815a5db: src/content.config.ts imported the project's own zod (4.4.3) while Astro's defineCollection is typed against its bundled zod 4.6, so astro check failed with '_zod.version.minor' … Type '4' is not assignable to type '6'. Reproduced with a clean pnpm install --frozen-lockfile of main. The schema now imports z from astro/zod so it always matches Astro's copy, and the direct zod dependency is removed (nothing else used it).

Packaging fix

@astrojs/check pulled @astrojs/language-server 2.16.15 → 2.17.2, which adds @astrojs/astro2tsx@0.1.2. That package declares @emnapi/runtime only as a devDependency, so pnpm satisfied @napi-rs/wasm-runtime's peer with a stray 2.0.0-alpha.3 that's incompatible with its @emnapi/core@1.11.3, crashing astro check (this.bridge.setLastError is not a function). Added a packageExtensions entry in pnpm-workspace.yaml declaring @emnapi/runtime: 1.11.3 for @astrojs/astro2tsx@0.1.2; it's version-scoped, so it stops applying once astro2tsx updates and can be removed then.

Security

• devalue (high/moderate/low) — fixed, 5.9.1 → 5.9.4 via astro
• undici (high/moderate/low) — fixed, 8.10.0 → 8.11.2 via astro → unifont
• http-cache-semantics (high) — fixed, 4.2.0 → 4.3.0 via astro
• js-yaml (high) — fixed, no longer in the tree
• smol-toml (moderate) — fixed, 1.8.0 → 1.9.1
• fast-uri (high/moderate) — fixed, 3.1.6 → 3.1.8 via @astrojs/check
• markdown-it (moderate, direct) — fixed, 15.0.0 → 15.0.2
• sharp (high) — fixed, 0.35.3 → 0.35.5 (within the existing sharp: ^0.35.3 override)
• toml (high ×2), brace-expansion (high/moderate), source-map-js (high) — fixed via the @netlify/dev stack bump
• extract-zip, image-size (high) — fixed, no longer in the tree
• braces <=3.0.3 (high) — unresolved: advisory names 3.0.4 as patched but it isn't published to npm; pulled in by @netlify/zip-it-and-ship-it → fast-glob → micromatch (local Netlify dev tooling only)
• node-forge <=1.4.0 (high) — unresolved: 1.4.1 isn't published to npm; pulled in by @netlify/images → ipx → listhen (local Netlify dev tooling only)

Direct dependencies

astro 7.3.2 → 7.3.8
diff · changelog

• Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler (Astro.cache is now defined when the 404/500 page is rendered by error handlers withastro/astro#18293)
• Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. (Replace esbuild with Vite and Rolldown APIs withastro/astro#18263)
• Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob (Glob loader watcher now recognises extglob negations as positive patterns withastro/astro#18290)
• Fixes security.checkOrigin rejecting cross-origin requests with non-form content types such as application/json. (Restore content-type gate in security.checkOrigin so JSON requests are not blocked withastro/astro#18268)
• Fixes Astro.cookies.get() returning undefined for request cookies with empty values (fix(cookies): read empty request cookie values withastro/astro#18226)
• Improves CSRF protection by taking modern browsers headers into account (Port Go's csrf protection withastro/astro#15595)
• Fixes nondeterministic ordering of the server manifest's assets array, ensuring builds with identical inputs produce byte-identical output (Sort server manifest assets array for deterministic builds withastro/astro#18155)
• Improves the astro check error shown for TypeScript 7. (fix(check): explain TypeScript 7 support withastro/astro#18053)
• Fix double-escaped ampersands in Markdown image alt and title attributes. (Fix double-escaped ampersands in Markdown image alt and title attributes withastro/astro#18086)
• Updates svgo to 4.0.2 to resolve a security advisory (fix(deps): update svgo to 4.0.2 withastro/astro#17531)
• Improves dev server startup time and rendering performance (Speed up dev server startup by deferring server app and content config compilation withastro/astro#17955, perf(runtime): improve rendering performance withastro/astro#17857)

@astrojs/netlify 8.2.5 → 8.2.9
diff · changelog

• Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. (Replace esbuild with Vite and Rolldown APIs withastro/astro#18263)
• Fixes Netlify Image CDN patterns generated from image.remotePatterns pathnames ending in /** so they only match paths below that directory (Fix Netlify Image CDN patterns matching sibling paths for /** pathnames withastro/astro#18180)
• Fixes skew protection to include the build assets directory (/_astro/ by default) in skew-protection.json patterns (Pin build assets directory in Netlify skew-protection config withastro/astro#17978)
• Moves to the @netlify/vite-plugin 3.x / @netlify/dev 5.x stack (see transitive section)

@astrojs/ts-plugin 1.10.11 → 1.10.12
diff · changelog

• Refactors internal version handling to use a smaller, ESM-native dependency (Replace semver with verkit withastro/astro#17651)

svelte 5.56.10 → 5.57.2
diff · changelog

• feat: export RenderOutput, SyncRenderOutput, Csp and Sha256Source from svelte/server (feat: export RenderOutput, SyncRenderOutput, Csp and Sha256Source from svelte/server sveltejs/svelte#18648)
• feat: support defaultValue on <select> (feat: support defaultValue on <select> sveltejs/svelte#18591)
• feat: add getOrInsert/getOrInsertComputed to SvelteMap (feat: add getOrInsert/getOrInsertComputed to SvelteMap sveltejs/svelte#18728)
• fix: attach event handlers that are assigned after a top-level await in production (fix: attach event handlers that are assigned after a top-level await in production sveltejs/svelte#18933)
• fix: serialize input default values during server rendering (fix: serialize input default values during SSR sveltejs/svelte#18733)
• perf: speed up parser interactions with Acorn or avoid them where possible (perf: build identifier and member chain expressions without acorn sveltejs/svelte#18740)
• ~80 further fixes across 5.57.0–5.57.2

vitest 4.1.11 → 5.0.3 (major)
diff · changelog · v5.0.0 breaking changes

• Breaking: Require Node.js 22 and Vite 6.4 (feat!: require Node.js 22 and Vite 6.4 vitest-dev/vitest#10178)
• Breaking: Clear mocks by default before each test (feat!: clear mocks by default before each test vitest-dev/vitest#10613)
• Breaking: Don't lookup config file from ancestor directories (fix!: don't lookup config file from ancestor directories vitest-dev/vitest#10428)
• Breaking: Remove sequential test/suite options in favor of concurrent (refactor!: remove sequential test/suite options in favor of concurrent vitest-dev/vitest#10198)
• Breaking: Inline expect and @vitest/runner packages
• 5.0.3: Isolate result.status between repeats runs; Revalidate imports of cached modules (fix: isolate result.status between repeats runs vitest-dev/vitest#11218, fix(cache): revalidate imports of cached modules vitest-dev/vitest#11381)
• None of the breaking changes affect this repo's tests: same 2 files / 5 tests pass, and a deliberate failing test is still reported

prettier-plugin-astro 0.14.1 → 1.1.1 (major)
diff · changelog

• Raises the minimum supported Node version to 22.12.0.
• The plugin has been fully rewritten on top of Astro 7's new Rust compiler; whitespace formatting now matches Astro's whitespace handling, and a new astroCompressHTML option has been added.
• 1.1.0: Adds support for three astroAllowShorthand formatting modes
• 1.1.1: Fixes a TypeError when a comment appears before a statement inside a template expression.

prettier 3.9.6 → 3.9.10 (exact pin kept)
diff · changelog

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (Update micromark-extension-gfm-table to fix the table parse issue on performance prettier/prettier#20266)
• Markdown: Fix text with $ been incorrectly parsed as math syntax (Disable singleDollarTextMath in mdast-util-math prettier/prettier#20140)
• Markdown: Don't let Liquid objects interrupt paragraphs ([3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs prettier/prettier#20087)

markdown-it 15.0.0 → 15.0.2
diff · changelog

• Security: Fixed quadratic complexity in smartquotes when quote types don't match (Fix quadratic complexity in smartquotes rule when quote types don't match markdown-it/markdown-it#1209)
• Security: Fixed quadratic complexity when replacing fuzzy links, and in scheme backscan (inline linkify rule)
• Fixed code span parsing after lookaheads for unclosed link and image labels (Unclosed link/image label suppresses a later inline code span markdown-it/markdown-it#1201)
• Preserve brackets around IPv6 address literals when normalizing links (fix: preserve IPv6 brackets in normalizeLink markdown-it/markdown-it#1204)

sanitize-html 2.17.7 → 2.18.0
diff · changelog

• Added a logger option: pass any console-shaped object and sanitize-html's own diagnostics are delivered to it rather than to the console
• allowedSchemesByTag is now applied to srcset and imagesrcset URLs
• Security: the destination URL of a <meta http-equiv="refresh"> is now checked against allowedSchemes
• Security: noscript in nonTextTags and namespace-prefixed SVG animation elements (svg:animate) are now handled correctly

sass 1.103.1 → 1.105.1
diff · changelog

• Add support for first-class modules, accessed with the new meta.load() and meta.get-module() functions; add the meta.css() mixin
• Potentially breaking compatibility fix: Colors now convert the special values NaN and negative zero (and infinities for polar-hue channels) to 0 as per the CSS spec.
• Fix a bug where loud comments before @use rules could be emitted multiple times
• Improve error messages for @extends across different media queries.

astro-og-canvas 0.13.0 → 0.13.2
diff · changelog

• Updates internal dependency canvaskit-wasm to ^0.42.0 (Update dependency canvaskit-wasm to ^0.42.0 delucis/astro-og-canvas#216), which drops the duplicate canvaskit-wasm 0.41.1 from the tree
• Updates dependency entities to ^8.1.0 (Update dependency entities to ^8.1.0 delucis/astro-og-canvas#225)

@types/sanitize-html 2.16.1 → 2.16.2
diff — no changelog found (DefinitelyTyped)

zod 4.4.3 → removed — no longer a direct dependency; astro/zod is used instead (see Netlify build fix). Astro's bundled copy is now 4.6.6 — changelog

typescript — held at 6.0.3 (7.0.2 not supported by astro check)

Transitive dependencies

@netlify/vite-plugin 2.12.9 → 3.0.1 — diff — via @astrojs/netlify; brings majors across the Netlify dev stack (@netlify/dev 4 → 5, @netlify/functions 5 → 6, @netlify/blobs 10 → 11, @netlify/zip-it-and-ship-it 15 → 16, @netlify/edge-bundler 15 → 16 and others) — clears most of the audit
@astrojs/language-server 2.16.15 → 2.17.2 — diff — adds @astrojs/astro2tsx 0.1.2 (see packaging fix)
devalue 5.9.1 → 5.9.4 — diff — audit fix
undici 8.10.0 → 8.11.2 — diff — audit fix
http-cache-semantics 4.2.0 → 4.3.0 — diff — audit fix
fast-uri 3.1.6 → 3.1.8 — diff — audit fix
smol-toml 1.8.0 → 1.9.1 — diff — audit fix
sharp 0.35.3 → 0.35.5 — diff — audit fix
toml 3.0.0 → 4.3.0 — diff — audit fix (major)
brace-expansion 2.1.4, 5.0.9 → 5.0.12 — audit fix
source-map-js 1.2.1 → 1.2.2 — diff — audit fix
js-yaml, extract-zip, image-size — removed from the tree (audit fix)

237 other transitive updates

• @astrojs/astro2tsx — → 0.1.2
• @astrojs/compiler-binding 0.4.0 → 0.4.1, 0.5.1
• @astrojs/compiler-binding-android-arm64 — → 0.4.1, 0.5.1
• @astrojs/compiler-binding-darwin-arm64 0.4.0 → 0.4.1, 0.5.1
• @astrojs/compiler-binding-darwin-x64 0.4.0 → 0.4.1, 0.5.1
• @astrojs/compiler-binding-linux-arm64-gnu 0.4.0 → 0.4.1, 0.5.1
• @astrojs/compiler-binding-linux-arm64-musl 0.4.0 → 0.4.1, 0.5.1
• @astrojs/compiler-binding-linux-x64-gnu 0.4.0 → 0.4.1, 0.5.1
• @astrojs/compiler-binding-linux-x64-musl 0.4.0 → 0.4.1, 0.5.1
• @astrojs/compiler-binding-wasm32-wasi 0.4.0 → 0.4.1, 0.5.1
• @astrojs/compiler-binding-win32-arm64-msvc 0.4.0 → 0.4.1, 0.5.1
• @astrojs/compiler-binding-win32-x64-msvc 0.4.0 → 0.4.1, 0.5.1
• @astrojs/compiler-rs 0.4.0 → 0.4.1, 0.5.1
• @astrojs/internal-helpers 0.11.0 → 0.12.0
• @astrojs/markdown-satteri 0.4.1 → 0.4.3
• @babel/parser 7.29.8 → 7.29.9
• @clack/core 1.4.3 → 1.5.1
• @clack/prompts 1.7.0 → 1.8.1
• @colors/colors 1.6.0 → 1.6.0, 1.6.1
• @dabh/diagnostics 2.0.8 → 2.0.9
• @emnapi/core 1.11.1, 2.0.0-alpha.3 → 1.11.1, 1.11.3, 2.0.0-alpha.3
• @emnapi/wasi-threads 1.2.2, 2.0.1 → 1.2.2, 1.2.3, 2.0.1
• @envelop/instrumentation 1.0.0 → 1.0.1
• @fastify/accept-negotiator 2.1.0 → 2.1.1
• @fastify/busboy 3.2.2 → 3.2.3
• @img/sharp-darwin-arm64 0.35.3 → 0.35.5
• @img/sharp-darwin-x64 0.35.3 → 0.35.5
• @img/sharp-freebsd-wasm32 0.35.3 → 0.35.5
• @img/sharp-libvips-darwin-arm64 1.3.2 → 1.3.4
• @img/sharp-libvips-darwin-x64 1.3.2 → 1.3.4
• @img/sharp-libvips-linux-arm 1.3.2 → 1.3.4
• @img/sharp-libvips-linux-arm64 1.3.2 → 1.3.4
• @img/sharp-libvips-linux-ppc64 1.3.2 → 1.3.4
• @img/sharp-libvips-linux-riscv64 1.3.2 → 1.3.4
• @img/sharp-libvips-linux-s390x 1.3.2 → 1.3.4
• @img/sharp-libvips-linux-x64 1.3.2 → 1.3.4
• @img/sharp-libvips-linuxmusl-arm64 1.3.2 → 1.3.4
• @img/sharp-libvips-linuxmusl-x64 1.3.2 → 1.3.4
• @img/sharp-linux-arm 0.35.3 → 0.35.5
• @img/sharp-linux-arm64 0.35.3 → 0.35.5
• @img/sharp-linux-ppc64 0.35.3 → 0.35.5
• @img/sharp-linux-riscv64 0.35.3 → 0.35.5
• @img/sharp-linux-s390x 0.35.3 → 0.35.5
• @img/sharp-linux-x64 0.35.3 → 0.35.5
• @img/sharp-linuxmusl-arm64 0.35.3 → 0.35.5
• @img/sharp-linuxmusl-x64 0.35.3 → 0.35.5
• @img/sharp-wasm32 0.35.3 → 0.35.5
• @img/sharp-webcontainers-wasm32 0.35.3 → 0.35.5
• @img/sharp-win32-arm64 0.35.3 → 0.35.5
• @img/sharp-win32-ia32 0.35.3 → 0.35.5
• @img/sharp-win32-x64 0.35.3 → 0.35.5
• @isaacs/cliui 8.0.2 → removed
• @jridgewell/sourcemap-codec 1.5.5 → 1.6.0
• @napi-rs/wasm-runtime 1.2.3 → 1.2.4, 1.2.5
• @netlify/ai 0.4.4 → 1.0.1
• @netlify/blobs 10.7.13 → 11.1.4
• @netlify/cache 3.4.10 → 4.0.2
• @netlify/config 25.2.3 → 25.2.6
• @netlify/database-dev 0.10.1 → 1.0.1
• @netlify/dev 4.18.13 → 5.1.7
• @netlify/dev-utils 4.4.7, 5.0.0 → 6.0.3
• @netlify/edge-bundler 15.1.1 → 16.1.3
• @netlify/edge-functions 3.0.8 → 4.0.2
• @netlify/edge-functions-dev 1.0.24 → 2.0.3
• @netlify/functions 5.3.0 → 6.0.2
• @netlify/functions-dev 1.3.5 → 2.0.11
• @netlify/headers 2.1.13 → 3.0.3
• @netlify/images 1.3.12 → 2.0.3
• @netlify/open-api 2.57.0 → 2.60.0
• @netlify/otel 6.0.6 → 7.0.4
• @netlify/redirect-matcher — → 0.4.2
• @netlify/redirects 3.1.15 → 4.1.0
• @netlify/runtime 4.1.29 → 5.0.8
• @netlify/runtime-utils 2.3.0 → 3.0.0
• @netlify/server-dev — → 0.1.3
• @netlify/serverless-functions-api 2.18.0 → 2.24.0
• @netlify/static 3.1.12 → 4.0.0
• @netlify/types 2.8.0 → 2.8.0, 3.2.0
• @netlify/zip-it-and-ship-it 15.4.0 → 16.3.0
• @nodable/entities 3.0.0 → 3.1.0
• @opentelemetry/api 1.8.0, 1.9.1 → 1.9.1
• @opentelemetry/api-logs 0.220.0 → 0.221.0
• @opentelemetry/context-async-hooks 2.9.0 → 2.10.0
• @opentelemetry/core 2.8.0, 2.9.0 → 2.10.0
• @opentelemetry/instrumentation 0.220.0 → 0.221.0
• @opentelemetry/resources 2.9.0 → 2.10.0
• @opentelemetry/sdk-trace 2.9.0 → 2.10.0
• @opentelemetry/sdk-trace-base 2.9.0 → 2.10.0
• @opentelemetry/sdk-trace-node 2.9.0 → 2.10.0
• @oxc-project/types 0.146.0 → 0.153.0
• @pkgjs/parseargs 0.11.0 → removed
• @prettier/parse-srcset — → 3.1.0
• @rolldown/binding-android-arm-eabi 1.2.5 → 1.2.13
• @rolldown/binding-android-arm64 1.2.5 → 1.2.13
• @rolldown/binding-darwin-arm64 1.2.5 → 1.2.13
• @rolldown/binding-darwin-x64 1.2.5 → 1.2.13
• @rolldown/binding-freebsd-x64 1.2.5 → 1.2.13
• @rolldown/binding-linux-arm-gnueabihf 1.2.5 → 1.2.13
• @rolldown/binding-linux-arm64-gnu 1.2.5 → 1.2.13
• @rolldown/binding-linux-arm64-musl 1.2.5 → 1.2.13
• @rolldown/binding-linux-ppc64-gnu 1.2.5 → 1.2.13
• @rolldown/binding-linux-s390x-gnu 1.2.5 → 1.2.13
• @rolldown/binding-linux-x64-gnu 1.2.5 → 1.2.13
• @rolldown/binding-linux-x64-musl 1.2.5 → 1.2.13
• @rolldown/binding-openharmony-arm64 1.2.5 → 1.2.13
• @rolldown/binding-win32-arm64-msvc 1.2.5 → 1.2.13
• @rolldown/binding-win32-x64-msvc 1.2.5 → 1.2.13
• @shikijs/core 4.4.3 → 4.5.0
• @shikijs/engine-javascript 4.4.3 → 4.5.0
• @shikijs/engine-oniguruma 4.4.3 → 4.5.0
• @shikijs/langs 4.4.3 → 4.5.0
• @shikijs/primitive 4.4.3 → 4.5.0
• @shikijs/themes 4.4.3 → 4.5.0
• @shikijs/types 4.4.3 → 4.5.0
• @standard-schema/spec 1.1.0 → removed
• @sveltejs/vite-plugin-svelte 7.3.0 → 7.3.1
• @tybys/wasm-util 0.10.3 → 0.10.4
• @types/trusted-types 2.0.7 → removed
• @types/yauzl 2.10.3 → removed
• @typescript-eslint/project-service 8.68.0 → 8.71.1
• @typescript-eslint/tsconfig-utils 8.68.0 → 8.71.1
• @typescript-eslint/types 8.68.0 → 8.71.1
• @typescript-eslint/typescript-estree 8.68.0 → 8.71.1
• @typescript-eslint/visitor-keys 8.68.0 → 8.71.1
• @ungap/structured-clone 1.3.3 → 1.4.0
• @vercel/nft 0.29.4, 1.11.0 → 1.11.0, 1.3.1
• @vitest/expect 4.1.11 → removed
• @vitest/mocker 4.1.11 → 5.0.3
• @vitest/pretty-format 4.1.11 → removed
• @vitest/runner 4.1.11 → removed
• @vitest/snapshot 4.1.11 → removed
• @vitest/spy 4.1.11 → 5.0.3
• @vitest/utils 4.1.11 → removed
• @vue/compiler-core 3.5.41 → 3.5.43
• @vue/compiler-dom 3.5.41 → 3.5.43
• @vue/compiler-sfc 3.5.41 → 3.5.43
• @vue/compiler-ssr 3.5.41 → 3.5.43
• @vue/shared 3.5.41 → 3.5.43
• acorn 8.18.0 → 8.19.0
• am-i-vibing 0.4.0 → 0.5.0
• ansi-regex 5.0.1, 6.3.0 → 5.0.1, 6.4.0
• ansis 4.3.1 → 4.4.0
• argparse 2.0.1, 3.0.1 → 3.0.2
• b4a 1.8.1 → 1.9.0
• balanced-match 1.0.2, 4.0.4 → 4.0.4
• bare-events 2.9.1 → 2.9.2
• bare-fs 4.8.1 → 4.8.4
• bare-path 3.1.1 → 3.1.2
• bare-stream 2.13.3 → 2.13.4
• bare-url 2.5.2 → 2.5.4
• buffer-crc32 0.2.13, 1.0.0 → 1.0.0
• chai 6.2.2 → 6.3.0
• chalk 4.1.2, 5.6.2 → 4.1.2, 6.0.1
• cjs-module-lexer 2.2.1 → 2.3.0
• convert-source-map 2.0.0 → removed
• cookie 1.1.1, 2.0.1 → 2.0.1
• cron-parser 4.9.0 → 5.10.2
• crossws 0.3.5, 0.4.12 → 0.3.5, 0.4.15
• eastasianwidth 0.2.0 → removed
• emoji-regex 10.6.0, 8.0.0, 9.2.2 → 10.6.0, 8.0.0
• empathic 2.0.1 → 2.1.0
• end-of-stream 1.4.5 → removed
• entities 4.5.0, 7.0.1, 8.0.0 → 4.5.0, 7.0.1, 8.1.0
• es-module-lexer 1.7.0, 2.3.2 → 1.7.0, 2.3.2, 3.0.3
• esrap 2.3.6 → 2.4.0
• fast-xml-parser 5.11.0 → 5.11.2
• fastq 1.20.1 → 1.20.3
• fd-slicer 1.1.0 → removed
• find-proc 0.1.0 → 0.2.0
• foreground-child 3.3.1 → removed
• get-east-asian-width 1.6.0 → 1.7.0
• get-stream 5.2.0, 8.0.1 → 8.0.1
• get-tsconfig 5.0.0-beta.4 → 5.0.0-beta.6
• glob 10.5.0, 13.0.6 → 13.0.6
• hosted-git-info 7.0.2 → 7.0.2, 9.0.3
• htmlparser2 10.1.0, 12.0.0 → 12.0.0
• import-in-the-middle 3.3.3 → 3.5.2
• is-core-module 2.16.2 → 2.17.0
• jackspeak 3.4.3 → removed
• jpeg-js 0.4.4 → removed
• js-image-generator 1.0.4 → removed
• launder 1.7.1 → 1.7.2
• lru-cache 10.4.3, 11.5.2 → 10.4.3, 11.5.3
• magic-string 0.30.21, 1.2.2 → 0.30.21, 1.4.3
• magicast 0.5.4 → 0.5.5
• micromark-util-types 2.0.2 → 2.0.3
• minimatch 10.2.6, 9.0.9 → 10.2.6
• nanoid 3.3.18 → 3.3.20
• netlify-redirector 0.5.0 → removed
• normalize-package-data 6.0.2 → 6.0.2, 8.0.0
• obug 2.1.4 → 2.2.1, 3.0.0
• once 1.4.0 → removed
• p-limit 4.0.0, 7.3.1 → 4.0.0, 7.3.3
• p-map 7.0.6 → 7.1.1
• p-queue 9.3.3 → 9.3.5
• p-timeout 6.1.4, 7.0.1 → 6.1.4, 7.0.2
• p-wait-for 5.0.2 → removed
• package-json-from-dist 1.0.1 → removed
• package-manager-detector 1.8.0 → 1.9.0
• path-scurry 1.11.1, 2.0.2 → 2.0.2
• postcss 8.5.26 → 8.5.29
• pump 3.0.4 → removed
• read-package-up 11.0.0 → 11.0.0, 12.0.0
• read-pkg 9.0.1 → 10.1.0, 9.0.1
• readable-stream 2.3.8, 3.6.2, 4.7.0 → 2.3.8, 3.6.2, 4.8.0
• rolldown 1.2.5 → 1.2.13
• sass-formatter 0.7.9 → 0.8.0
• shiki 4.4.3 → 4.5.0
• siginfo 2.0.0 → removed
• spdx-license-ids 3.0.23 → 3.0.24
• stackback 0.0.2 → removed
• std-env 4.2.0 → 4.3.0
• string-width 4.2.3, 5.1.2, 7.2.0, 8.2.2 → 4.2.3, 7.2.0, 8.3.0
• strnum 2.4.2 → 2.5.1
• tagged-tag — → 1.0.0
• tar-stream 3.2.1 → 3.2.2
• tinybench 2.9.0 → 6.2.2
• tinyclip 0.1.15 → 0.1.15, 1.0.3
• tinyexec 1.3.0 → 1.3.1
• tinyrainbow 3.1.1 → removed
• type-fest 4.41.0 → 4.41.0, 5.10.0
• typed-array-byte-offset 1.0.4 → 1.0.5
• unicorn-magic 0.1.0 → 0.1.0, 0.4.1
• verkit — → 0.5.0
• vite 8.2.2 → 8.3.4
• vscode-jsonrpc 8.2.0, 9.0.1 → 8.2.0, 9.0.3
• vscode-languageserver-protocol 3.17.5, 3.18.2 → 3.17.5, 3.18.4
• vscode-languageserver-textdocument 1.0.13 → 1.0.15
• vscode-languageserver-types 3.17.5, 3.18.0 → 3.17.5, 3.18.4
• which-typed-array 1.1.22 → 1.1.24
• why-is-node-running 2.3.0 → 3.2.1
• wrap-ansi 7.0.0, 8.1.0, 9.0.2 → 7.0.0, 9.0.2
• wrappy 1.0.2 → removed
• yaml 2.8.3, 2.9.0 → 2.8.3, 2.9.1
• yargs 17.7.3, 18.1.0 → 17.7.3, 18.2.0
• yauzl 2.10.0 → 3.4.0
• zimmerframe 1.1.4 → 1.1.5

Notes

• pnpm peers check still reports @emnapi/core/@emnapi/runtime 2.0.0-alpha.3 not matching @napi-rs/wasm-runtime@1.2.5 (optional wasm fallbacks, unused on native platforms; present before this PR too), and @netlify/blobs 11 outside unstorage@1.17.5's peer range.
• Pre-existing, not changed here: .prettierrc uses pluginSearchDirs, which Prettier 3 ignores, so prettier-plugin-astro isn't loaded from config. Verified 1.1.1 formats correctly via --plugin.

Verification

• pnpm build (astro check && astro build): 0 errors, build complete
• pnpm vitest run: 2 files, 5 tests pass
• main reproduced failing on clean install; this branch passes

[netlify]

✅ Deploy Preview for tommyp ready!

Name	Link
🔨 Latest commit	b9bde5d
🔍 Latest deploy log	https://app.netlify.com/projects/tommyp/deploys/6acd1756f4f1ef61f78064e6
😎 Deploy Preview	https://deploy-preview-23--tommyp.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.