Skip to content

chore(deps): bump astro from 6.4.6 to 7.1.1 in /docs - #202

Merged
Roger-luo merged 1 commit into
mainfrom
dependabot/npm_and_yarn/docs/astro-7.1.1
Jul 30, 2026
Merged

chore(deps): bump astro from 6.4.6 to 7.1.1 in /docs#202
Roger-luo merged 1 commit into
mainfrom
dependabot/npm_and_yarn/docs/astro-7.1.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown
Contributor

Bumps astro from 6.4.6 to 7.1.1.

Release notes

Sourced from astro's releases.

astro@7.1.1

Patch Changes

astro@7.1.0

Minor Changes

  • #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

    // src/content.config.ts
    import { defineCollection } from 'astro:content';
    import { glob } from 'astro/loaders';
    const docs = defineCollection({
    loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
    });

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

  • #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

    Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

    // astro.config.mjs
    import { defineConfig } from 'astro/config';
    export default defineConfig({
    experimental: {
    collectionStorage: 'chunked',
    },
    });

    Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

  • #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

    Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

    Scoping sources and hashes in your config

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.1

Patch Changes

7.1.0

Minor Changes

  • #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

    // src/content.config.ts
    import { defineCollection } from 'astro:content';
    import { glob } from 'astro/loaders';
    const docs = defineCollection({
    loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
    });

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

  • #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

    Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

    // astro.config.mjs
    import { defineConfig } from 'astro/config';
    export default defineConfig({
    experimental: {
    collectionStorage: 'chunked',
    },
    });

    Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

  • #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

    Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 30, 2026
@github-actions

github-actions Bot commented Jul 30, 2026

Copy link
Copy Markdown
PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-07-30 20:00 UTC

Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 6.4.6 to 7.1.1.
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.1/packages/astro)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 7.1.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/docs/astro-7.1.1 branch from 64db84a to 64c781f Compare July 30, 2026 19:54
@Roger-luo
Roger-luo enabled auto-merge (squash) July 30, 2026 19:56
@Roger-luo

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@Roger-luo
Roger-luo merged commit cb28211 into main Jul 30, 2026
13 checks passed
@Roger-luo
Roger-luo deleted the dependabot/npm_and_yarn/docs/astro-7.1.1 branch July 30, 2026 20:00
Roger-luo added a commit that referenced this pull request Jul 30, 2026
…arp 0.35.3) (#203)

Bumps the two direct `docs/` dependencies to their latest releases and
regenerates the lockfile, pulling transitive deps forward.

| Package | From | To |
|---------|------|-----|
| astro | 7.1.1 | **7.1.6** |
| marked | 18.0.3 | **18.0.7** |
| sharp (transitive) | 0.34.5 | **0.35.3** |

### Why sharp matters
sharp 0.34.5 carries a **high-severity** libvips advisory —
[GHSA-f88m-g3jw-g9cj](GHSA-f88m-g3jw-g9cj)
(CVE-2026-33327 / 33328 / 35590 / 35591). Bumping astro alone did not
pull sharp forward, so `npm audit fix` was used to force 0.35.3. `npm
audit` now reports **0 vulnerabilities**.

### Supersedes
Consolidates the Dependabot updates that were auto-closed as "updatable
in another way" after the lockfile shifted:
- #197 (sharp + astro)
- #192 (esbuild + astro) — the esbuild 0.28.1 security fix already
landed transitively via #202.

The postcss (#201), astro→7.1.1 (#202), svgo (#194), and vite bumps
already merged / resolved on main.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant