Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 30 updates - #262

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-ae6341cb07
Open

chore(deps): bump the production-dependencies group across 1 directory with 30 updates#262
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-ae6341cb07

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 30 updates in the / directory:

Package From To
typescript 6.0.3 7.0.2
@astrojs/cloudflare 14.1.4 14.2.1
@sentry/browser 10.67.0 10.70.0
@tabler/icons 3.45.0 3.46.0
@tanstack/virtual-core 3.17.5 3.17.7
astro 7.1.3 7.2.2
posthog-js 1.405.3 1.417.0
tailwind-variants 3.2.2 3.3.1
@astrojs/react 6.0.1 6.0.2
@base-ui/react 1.6.0 1.7.0
@tanstack/react-virtual 3.14.7 3.14.9
lucide-react 1.25.0 1.31.0
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
shadcn 4.13.1 4.18.0
sonner 2.0.7 2.0.8
@astrojs/starlight 0.41.3 0.41.7
@modelcontextprotocol/sdk 1.29.0 1.30.0
pg 8.22.0 8.23.0
@aws-sdk/client-s3 3.1091.0 3.1110.0
@fastify/busboy 3.2.0 3.2.1
@hono/node-server 2.0.11 2.1.1
@hono/zod-openapi 1.5.1 1.6.0
@sentry/bun 10.67.0 10.70.0
@sentry/node 10.67.0 10.70.0
add-mcp 1.13.0 2.0.0
hono 4.12.31 4.13.2
posthog-node 5.46.0 5.49.0
ws 8.21.1 8.21.3
@astrojs/language-server 2.16.12 2.16.14

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @astrojs/cloudflare from 14.1.4 to 14.2.1

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.2.1

Patch Changes

  • #17627 ba6a9f6 Thanks @​astrobot-houston! - Fixes the astro peer dependency range from ^7.0.0 to ^7.2.0. The adapter imports symbols (beginContentEntryCollection, beginImageCollection, endContentEntryCollection, endImageCollection) from astro/app that were added in Astro 7.2.0, so earlier versions fail at build time with a MISSING_EXPORT error.

  • Updated dependencies [0891ac9]:

    • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.2.0

Minor Changes

  • #16194 2a59663 Thanks @​Daedalus-Icarus! - Adds opt-in build-time image optimization for the cloudflare-binding image service.

    When enabled, the Cloudflare IMAGES binding transforms static images in the workerd prerender environment, and the optimized bytes are written directly to the output directory. If the binding fails, it falls back to Sharp.

    To opt in, use the compound configuration form:

    export default defineConfig({
  adapter: cloudflare({
    imageService: { build: 'cloudflare-binding', runtime: 'cloudflare-binding' },
  }),
});

    The string shorthand imageService: 'cloudflare-binding' preserves the current runtime-only behavior and is unaffected.

  • #16871 90c98ae Thanks @​adamchal! - When session: false is set in astro.config, the adapter no longer auto-wires the Cloudflare KV session driver. Combined with the matching astro change, this lets the session runtime tree-shake out of the Worker bundle.

  • #17084 961bbe5 Thanks @​matthewp! - Supports Astro's experimental incremental static builds. When experimental.incrementalBuild is enabled, the adapter skips unchanged pages between builds.

Patch Changes

  • #17576 0a79753 Thanks @​alexanderniebuhr! - Fixes /_image returning 500 in dev mode when using imageService: 'custom'. Astro's default dev image endpoint imports vite and node:fs, which cannot be loaded inside workerd. The custom and fallback cases now use the generic fetch-based endpoint in dev, matching the other image service modes. A user-configured image.endpoint is left untouched.

    Additionally, a dev-time warning is now logged when imageService: 'custom' resolves to the Sharp service (including when no image.service is configured), since Sharp's native binding cannot run inside workerd in dev or production.

  • #17481 0c32649 Thanks @​ondraulehla! - Fixes a crash on /_image cache hits when the Cloudflare cache provider is enabled. Responses served from the Workers Cache API have immutable headers, and the request handler crashed with "Can't modify immutable headers" when applying its default Cloudflare-CDN-Cache-Control: no-store header to them. The handler now rebuilds the response with mutable headers when needed.

  • #17347 ce83c39 Thanks @​astrobot-houston! - Fixes imageService: 'compile' producing unoptimized images when prerenderEnvironment is set to 'node'

  • #17594 2b8915a Thanks @​astrobot-houston! - Fixes a type-checking error when using app.use(cf()) from @astrojs/cloudflare/hono in projects with wrangler types-generated ExecutionContext declarations

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

@​astrojs/cloudflare@​14.1.7

Patch Changes

  • #17543 bbc1ec9 Thanks @​ematipico! - Fixes a bug where Cloudflare couldn't load chunked collections via experimental.collectionStorage: 'chunked'.

... (truncated)

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.2.1

Patch Changes

  • #17627 ba6a9f6 Thanks @​astrobot-houston! - Fixes the astro peer dependency range from ^7.0.0 to ^7.2.0. The adapter imports symbols (beginContentEntryCollection, beginImageCollection, endContentEntryCollection, endImageCollection) from astro/app that were added in Astro 7.2.0, so earlier versions fail at build time with a MISSING_EXPORT error.

  • Updated dependencies [0891ac9]:

    • @​astrojs/underscore-redirects@​1.0.4

14.2.0

Minor Changes

  • #16194 2a59663 Thanks @​Daedalus-Icarus! - Adds opt-in build-time image optimization for the cloudflare-binding image service.

    When enabled, the Cloudflare IMAGES binding transforms static images in the workerd prerender environment, and the optimized bytes are written directly to the output directory. If the binding fails, it falls back to Sharp.

    To opt in, use the compound configuration form:

    export default defineConfig({
  adapter: cloudflare({
    imageService: { build: 'cloudflare-binding', runtime: 'cloudflare-binding' },
  }),
});

    The string shorthand imageService: 'cloudflare-binding' preserves the current runtime-only behavior and is unaffected.

  • #16871 90c98ae Thanks @​adamchal! - When session: false is set in astro.config, the adapter no longer auto-wires the Cloudflare KV session driver. Combined with the matching astro change, this lets the session runtime tree-shake out of the Worker bundle.

  • #17084 961bbe5 Thanks @​matthewp! - Supports Astro's experimental incremental static builds. When experimental.incrementalBuild is enabled, the adapter skips unchanged pages between builds.

Patch Changes

  • #17576 0a79753 Thanks @​alexanderniebuhr! - Fixes /_image returning 500 in dev mode when using imageService: 'custom'. Astro's default dev image endpoint imports vite and node:fs, which cannot be loaded inside workerd. The custom and fallback cases now use the generic fetch-based endpoint in dev, matching the other image service modes. A user-configured image.endpoint is left untouched.

    Additionally, a dev-time warning is now logged when imageService: 'custom' resolves to the Sharp service (including when no image.service is configured), since Sharp's native binding cannot run inside workerd in dev or production.

  • #17481 0c32649 Thanks @​ondraulehla! - Fixes a crash on /_image cache hits when the Cloudflare cache provider is enabled. Responses served from the Workers Cache API have immutable headers, and the request handler crashed with "Can't modify immutable headers" when applying its default Cloudflare-CDN-Cache-Control: no-store header to them. The handler now rebuilds the response with mutable headers when needed.

  • #17347 ce83c39 Thanks @​astrobot-houston! - Fixes imageService: 'compile' producing unoptimized images when prerenderEnvironment is set to 'node'

  • #17594 2b8915a Thanks @​astrobot-houston! - Fixes a type-checking error when using app.use(cf()) from @astrojs/cloudflare/hono in projects with wrangler types-generated ExecutionContext declarations

  • Updated dependencies []:

    • @​astrojs/underscore-redirects@​1.0.3

14.1.7

... (truncated)

Commits
  • d081033 [ci] release (#17608)
  • 7c4bf1b Add Cloudflare Actions build regression coverage (#17137)
  • ba6a9f6 fix(cloudflare): bump astro peer dependency to ^7.2.0 (#17627)
  • 4328c73 Fix /_image 500 when catch-all prerendered route is combined with prerenderEn...
  • 60e9432 [ci] release (#17558)
  • a2240c4 fix(test): provide experimental config in Cloudflare session-false test (#17606)
  • 961bbe5 Experimental incremental static builds (#17084)
  • 90c98ae feat(session): add session: false to opt out of session support (#16871)
  • 2b8915a fix(cloudflare): inline executionCtx type in HonoCloudflareContextLike to avo...
  • 0a79753 fix(cloudflare): use workerd-safe dev image endpoint for custom image service...
  • Additional commits viewable in compare view

Updates @sentry/browser from 10.67.0 to 10.70.0

Release notes

Sourced from @​sentry/browser's releases.

10.70.0

  • feat(v10/core): Support stable MCP SDK v2 (#22986)
  • feat(v10/deps): Bump @sentry/node-cpu-profiler to 2.4.3 (#22992)
  • feat(v10/solid,solidstart): Support @solidjs/router v1 (#23163)
  • fix(v10/cloudflare): Fork the isolation scope for Durable Object methods (#23189)
  • fix(v10/cloudflare): Get original waituntil in workflows (#23192)
  • fix(v10/cloudflare): Instrument DO RPC methods on the prototype, not a Proxy (#23190)
  • fix(v10/cloudflare): Set agent conversation id on the onRequest path (#22985)
  • fix(v10/cloudflare): Set conversation id independent of session name (#23193)
  • fix(v10/cloudflare): Try/catch on non-configurable prototypes (#23191)
  • fix(v10/cloudflare): Use gen_ai.agent.name for class names (#22987)
  • fix(v10/core,browser): Handle errors from other realms (#23201)
  • fix(v10/core): Sample errors after beforeSend while preserving session updates (#22819)
  • fix(v10/hono): Include originalException in captured exception hint (#22990)
  • fix(v10/nextjs): meriyah issue for standalone build (#23055)
  • fix(v10/nextjs): Remove tracing from middleware wrappers (#22904)
  • fix(v10/profiling-node): Respect profileSessionSampleRate in trace profile lifecycle (#22940)
  • fix(v10/react-router): Preserve sourcemaps.disable when unstable_sentryVitePluginOptions is set (#22966)
  • fix(v10/react): Remove routes from shared set on <Routes> unmount (#22948)
  • fix(v10/sveltekit): Export metrics from worker entry point (#23027)
  • test(v10/e2e): Add missing @sentry/core dep to nextjs-16-userfeedback (#23009)
  • test(v10/e2e): Fix failing sveltekit-3 test (#23016)
  • test(v10/e2e): Fix type error in nextjs ai-error tests (#23011)
  • test(v10/e2e): Pin tanstackstart-react e2e deps to unblock tunnel tests (#23048)

Work in this release was contributed by @​davidmurdoch, @​Jxxunnn, and @​kamilogorek. Thank you for your contributions!

Bundle size 📦

Path Size
@​sentry/browser 27.09 KB
@​sentry/browser - with treeshaking flags 25.58 KB
@​sentry/browser (incl. Tracing) 45.5 KB
@​sentry/browser (incl. Tracing + Span Streaming) 47.24 KB
@​sentry/browser (incl. Tracing, Profiling) 50.13 KB
@​sentry/browser (incl. Tracing, Replay) 83.82 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 73.7 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 88.42 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 100.78 KB
@​sentry/browser (incl. Feedback) 43.87 KB
@​sentry/browser (incl. sendFeedback) 31.78 KB
@​sentry/browser (incl. FeedbackAsync) 36.79 KB
@​sentry/browser (incl. Metrics) 28.16 KB

... (truncated)

Changelog

Sourced from @​sentry/browser's changelog.

10.70.0

  • feat(v10/core): Support stable MCP SDK v2 (#22986)
  • feat(v10/deps): Bump @sentry/node-cpu-profiler to 2.4.3 (#22992)
  • feat(v10/solid,solidstart): Support @solidjs/router v1 (#23163)
  • fix(v10/cloudflare): Fork the isolation scope for Durable Object methods (#23189)
  • fix(v10/cloudflare): Get original waituntil in workflows (#23192)
  • fix(v10/cloudflare): Instrument DO RPC methods on the prototype, not a Proxy (#23190)
  • fix(v10/cloudflare): Set agent conversation id on the onRequest path (#22985)
  • fix(v10/cloudflare): Set conversation id independent of session name (#23193)
  • fix(v10/cloudflare): Try/catch on non-configurable prototypes (#23191)
  • fix(v10/cloudflare): Use gen_ai.agent.name for class names (#22987)
  • fix(v10/core,browser): Handle errors from other realms (#23201)
  • fix(v10/core): Sample errors after beforeSend while preserving session updates (#22819)
  • fix(v10/hono): Include originalException in captured exception hint (#22990)
  • fix(v10/nextjs): meriyah issue for standalone build (#23055)
  • fix(v10/nextjs): Remove tracing from middleware wrappers (#22904)
  • fix(v10/profiling-node): Respect profileSessionSampleRate in trace profile lifecycle (#22940)
  • fix(v10/react-router): Preserve sourcemaps.disable when unstable_sentryVitePluginOptions is set (#22966)
  • fix(v10/react): Remove routes from shared set on <Routes> unmount (#22948)
  • fix(v10/sveltekit): Export metrics from worker entry point (#23027)
  • test(v10/e2e): Add missing @sentry/core dep to nextjs-16-userfeedback (#23009)
  • test(v10/e2e): Fix failing sveltekit-3 test (#23016)
  • test(v10/e2e): Fix type error in nextjs ai-error tests (#23011)
  • test(v10/e2e): Pin tanstackstart-react e2e deps to unblock tunnel tests (#23048)

Work in this release was contributed by @​davidmurdoch, @​Jxxunnn, and @​kamilogorek. Thank you for your contributions!

10.69.0

Important Changes

  • feat(v10/cloudflare): Add instrumentAgentWithSentry for Cloudflare Agents (#22786)

The Cloudflare SDK adds a new instrumentAgentWithSentry API for Cloudflare Agents. It works like instrumentDurableObjectWithSentry for Agent classes from the agents SDK and additionally creates spans for @callable RPC methods and automatically sets the conversationId based on the agent's name. When building with the Sentry Vite plugin, Agents are instrumented automatically (#22788).

Other Changes

  • feat(v10/cloudflare): Add Spotlight integration for local dev event forwarding (#22796)
  • feat(v10/cloudflare): Add wranglerConfigPath to Vite options (#22803)
  • feat(v10/cloudflare): Filter framework-internal Durable Object storage spans (#22770)
  • feat(v10/cloudflare): Instrument Agents automatically (#22788)
  • feat(v10/cloudflare): Rotate agent conversation id on chat clear (#22787)
  • fix(v10/cloudflare): Also skip cf: prefixed DOs (#22802)

... (truncated)

Commits
  • 0356ffd release: 10.70.0
  • c2ac1be meta(changelog): Update changelog for 10.70.0 (#23217)
  • 9c2f31d fix(v10/core,browser): Handle errors from other realms (#23201)
  • 8ad6cd1 fix(v10/cloudflare): Try/catch on non-configurable prototypes (#23191)
  • 4b5e80a fix(v10/cloudflare): Instrument DO RPC methods on the prototype, not a Proxy ...
  • 91af62c fix(v10/cloudflare): Set conversation id independent of session name (#23193)
  • 2096839 fix(v10/cloudflare): Get original waituntil in workflows (#23192)
  • 0062819 fix(v10/cloudflare): Fork the isolation scope for Durable Object methods (#23...
  • 390b05a feat(v10/core): Support stable MCP SDK v2 (#22986)
  • 3b56ecb feat(v10/solid,solidstart): Support @solidjs/router v1 (#23163)
  • Additional commits viewable in compare view

Updates @tabler/icons from 3.45.0 to 3.46.0

Release notes

Sourced from @​tabler/icons's releases.

Release 3.46.0

18 new icons:

  • outline/play-bug
  • outline/play-bugs
  • outline/remote-control
  • outline/rocking-chair
  • outline/run-sprint
  • outline/sparkles-2-off
  • outline/tabs
  • outline/tags-chevron-down
  • outline/tags-chevron-left
  • outline/tags-chevron-right
  • outline/tags-chevron-up
  • outline/thinking-high
  • outline/thinking-low
  • outline/thinking-medium
  • outline/treasure-chest
  • outline/twig
  • outline/vault
  • outline/yarn

Fixed icons: outline/credits, outline/currency-tether, outline/device-3d-camera, outline/device-screen, outline/home-lock, outline/map-lock, outline/notdef, outline/queue-pop-in, outline/server-bolt, outline/server, outline/sparkles-2, outline/transform-point-bottom-left, outline/transform-point-bottom-right, outline/transform-point-top-left, outline/transform-point-top-right

Commits
  • 8ac7d81 Release 3.46.0
  • 2727ba9 Enhance release process in package.json: add GitHub authentication check and ...
  • 4ff4802 Add npm login check before release-it initialization in package.json
  • 74a7690 Merge branch 'main' of https://github.com/tabler/tabler-icons
  • f828849 Update dependencies in package.json and pnpm-lock.yaml: remove @​release-it-pl...
  • 1a39582 Fix rect width/height swap in optimize script (#1570)
  • 54bac86 Secure PR validation: run fork code without privileges (#1569)
  • eaaf32d Update Turbo package to version 2.10.7 and adjust schema reference in turbo.json
  • 2cfcde7 Remove unused AI tag generation script and related package dependency from pr...
  • be0e5a8 Refactor SVG paths for several icons to improve structure and consistency: `o...
  • Additional commits viewable in compare view

Updates @tanstack/virtual-core from 3.17.5 to 3.17.7

Release notes

Sourced from @​tanstack/virtual-core's releases.

@​tanstack/virtual-core@​3.17.7

Patch Changes

  • #1239 a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

@​tanstack/virtual-core@​3.17.6

Patch Changes

  • #1236 7ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.
Changelog

Sourced from @​tanstack/virtual-core's changelog.

3.17.7

Patch Changes

  • #1239 a5417b4 - Fix a one-frame viewport jump when above-viewport rows resize while scrolling up (#1227). resizeItem writes scrollTop synchronously inside the ResizeObserver callback to compensate for the size change, but then notified asynchronously — so the browser could paint a frame with the new scrollTop and the old item transforms, making the content jerk by the resize delta and snap back. When a compensation actually moves the scroll position, resizeItem now notifies synchronously so the transform commit lands in the same paint as the scroll write. Resizes that don't move the scroll position (below-fold measurements, iOS-deferred adjustments) keep the cheaper async notify.

3.17.6

Patch Changes

  • #1236 7ae32b5 - Stop the default scroll-adjustment heuristic from drifting the viewport when a viewport-spanning item grows. Previously any item whose top sat above the fold (itemStart < scrollOffset) had its size delta compensated on every re-measure — including a streaming chat message that spans the fold and grows at its bottom, dragging scrollTop downward token by token (#1218). Re-measurements now only compensate items that are entirely above the fold (itemStart + itemSize <= scrollOffset); growth below the anchor point leaves the scroll position untouched. First measurements (estimate→actual) still compensate any above-fold item, and a custom shouldAdjustScrollPositionOnItemSizeChange still overrides the default.
Commits
  • deca524 ci: Version Packages (#1240)
  • a5417b4 fix(virtual-core): notify synchronously after above-viewport resize compensat...
  • 32b2f2b ci: Version Packages (#1238)
  • ef6e92a docs(virtual-core): clarify shouldAdjustScrollPositionOnItemSizeChange usage ...
  • 7ae32b5 fix(virtual-core): stop viewport-spanning item growth from drifting scroll (#...
  • See full diff in compare view

Updates astro from 7.1.3 to 7.2.2

Release notes

Sourced from astro's releases.

astro@7.2.2

Patch Changes

  • #17611 9bc3207 Thanks @​thelazylamaGit! - Fixes component styles rendered from content entries remaining stale until a second save when an adapter uses Astro's fallback development environment

  • #17634 2267eee Thanks @​astrobot-houston! - Fixes incremental builds dropping optimized images for cached pages when using a collectStaticImages prerenderer (e.g. @astrojs/cloudflare with compile-time image optimization)

  • #17650 4cdf128 Thanks @​astrobot-houston! - Fixes intermittent ImageNotFound errors during build on projects with many images. The build now limits concurrent image file reads to avoid exhausting OS file descriptors (EMFILE) and retries transient I/O errors with backoff. Non-transient errors are no longer silently swallowed.

  • #17683 2378221 Thanks @​astrobot-houston! - Fixes prerenderConflictBehavior not applying to content collection duplicate ID warnings in the glob() and file() loaders. Setting it to 'error' now throws during content sync, and 'ignore' suppresses the warning.

  • #17659 90c6ea4 Thanks @​astrobot-houston! - Fixes the Fonts API breaking experimental.incrementalBuild caching by embedding a build-local, randomly-assigned server port in generated code used for the dependency hash

  • #17630 fd1d9ee Thanks @​ericclemmons! - Fixes incremental builds becoming prohibitively slow for sites with many pages or content entries that share a large dependency graph.

  • #17690 93beecc Thanks @​NgoQuocViet2001! - Prevents files in directories whose names start with pages from being treated as page routes

  • #17671 09f0dc7 Thanks @​tarikermis! - Fixes astro dev refusing to start after a Docker container restart when an unrelated process reuses the PID from a persisted lock file. Astro now checks the process command across platforms, so stale lock files are cleaned up and --force does not signal the unrelated process.

astro@7.2.1

Patch Changes

  • #17612 7133730 Thanks @​thelazylamaGit! - Fixes CSS hot module replacement after navigating between pages with ClientRouter

  • #17628 4ada248 Thanks @​astrobot-houston! - Fixes a CSP violation when using both security.csp and experimental.clientPrerender with data-astro-prefetch links. The dynamically injected <script type="speculationrules"> now uses a static "source": "document" approach with a CSS selector, producing a deterministic payload that is hashed and included in the CSP script-src directive at build time.

  • #17605 89e4647 Thanks @​ashleigh-yeoman! - Fixes middleware HMR not responding to changes in imported modules. Previously, only direct edits to the middleware file would trigger a reload.

  • #17582 bd2c1a5 Thanks @​astrobot-houston! - Fixes a regression where content collection reference() fields silently accepted entry IDs that don't exist, such as an ID that doesn't match a loader's slugified version of it. Astro now logs an error for references that point to a missing entry after all loaders finish syncing.

  • #17661 97b0cc7 Thanks @​ArmandPhilippot! - Improves Markdown options documentation with links to the Markdown guide and official processors.

  • #17349 4328c73 Thanks @​astrobot-houston! - Fixes an issue where requests handled by the dev prerender environment (e.g. /_image with @astrojs/cloudflare's prerenderEnvironment: 'node') returned a 500 when a prerendered catch-all route existed, because non-prerendered route modules were imported in an environment where their runtime-specific APIs are unavailable

  • #17603 722eed6 Thanks @​astrobot-houston! - Fixes <video> and <audio> elements being non-functional after navigating via view transitions (<ClientRouter />)

  • #17616 3a890d2 Thanks @​lazerg! - Fixes experimental.incrementalBuild re-rendering unchanged routes that import more than one asset. The route's dependency hash depended on the order the assets finished building, so two builds of identical sources could produce different hashes. The hash is now based on the file name each asset resolves to.

  • #17547 fba468c Thanks @​dmgawel! - Improves getCollection() and getEntry() performance for entries without local image references

  • #17602 16e0d9d Thanks @​astrobot-houston! - Fixes a build error caused by hash collisions in generated content collection image import identifiers

astro@7.2.0

Minor Changes

  • #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

    This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

    

    • 






... (truncated)





Changelog

Sourced from astro's changelog.




7.2.2


Patch Changes


    

  • 

    #17611 9bc3207 Thanks @​thelazylamaGit! - Fixes component styles rendered from content entries remaining stale until a second save when an adapter uses Astro's fallback development environment
    

    • 

  • 

    #17634 2267eee Thanks @​astrobot-houston! - Fixes incremental builds dropping optimized images for cached pages when using a collectStaticImages prerenderer (e.g. @astrojs/cloudflare with compile-time image optimization)
    

    • 

  • 

    #17650 4cdf128 Thanks @​astrobot-houston! - Fixes intermittent ImageNotFound errors during build on projects with many images. The build now limits concurrent image file reads to avoid exhausting OS file descriptors (EMFILE) and retries transient I/O errors with backoff. Non-transient errors are no longer silently swallowed.
    

    • 

  • 

    #17683 2378221 Thanks @​astrobot-houston! - Fixes prerenderConflictBehavior not applying to content collection duplicate ID warnings in the glob() and file() loaders. Setting it to 'error' now throws during content sync, and 'ignore' suppresses the warning.
    

    • 

  • 

    #17659 90c6ea4 Thanks @​astrobot-houston! - Fixes the Fonts API breaking experimental.incrementalBuild caching by embedding a build-local, randomly-assigned server port in generated code used for the dependency hash
    

    • 

  • 

    #17630 fd1d9ee Thanks @​ericclemmons! - Fixes incremental builds becoming prohibitively slow for sites with many pages or content entries that share a large dependency graph.
    

    • 

  • 

    #17690 93beecc Thanks @​NgoQuocViet2001! - Prevents files in directories whose names start with pages from being treated as page routes
    

    • 

  • 

    #17671 09f0dc7 Thanks @​tarikermis! - Fixes astro dev refusing to start after a Docker container restart when an unrelated process reuses the PID from a persisted lock file. Astro now checks the process command across platforms, so stale lock files are cleaned up and --force does not signal the unrelated process.
    

    • 



7.2.1


Patch Changes


    

  • 

    #17612 7133730 Thanks @​thelazylamaGit! - Fixes CSS hot module replacement after navigating between pages with ClientRouter
    

    • 

  • 

    #17628 4ada248 Thanks @​astrobot-houston! - Fixes a CSP violation when using both security.csp and experimental.clientPrerender with data-astro-prefetch links. The dynamically injected <script type="speculationrules"> now uses a static "source": "document" approach with a CSS selector, producing a deterministic payload that is hashed and included in the CSP script-src directive at build time.
    

    • 

  • 

    #17605 89e4647 Thanks @​ashleigh-yeoman! - Fixes middleware HMR not responding to changes in imported modules. Previously, only direct edits to the middleware file would trigger a reload.
    

    • 

  • 

    #17582 bd2c1a5 Thanks @​astrobot-houston! - Fixes a regression where content collection reference() fields silently accepted entry IDs that don't exist, such as an ID that doesn't match a loader's slugified version of it. Astro now logs an error for references that point to a missing entry after all loaders finish syncing.
    

    • 

  • 

    #17661 97b0cc7 Thanks @​ArmandPhilippot! - Improves Markdown options documentation with links to the Markdown guide and official processors.
    

    • 

  • 

    #17349 4328c73 Thanks @​astrobot-houston! - Fixes an issue where requests handled by the dev prerender environment (e.g. /_image with @astrojs/cloudflare's prerenderEnvironment: 'node') returned a 500 when a prerendered catch-all route existed, because non-prerendered route modules were imported in an environment where their runtime-specific APIs are unavailable
    

    • 

  • 

    #17603 722eed6 Thanks @​astrobot-houston! - Fixes <video> and <audio> elements being non-functional after navigating via view transitions (<ClientRouter />)
    

    • 

  • 

    #17616 3a890d2 Thanks @​lazerg! - Fixes experimental.incrementalBuild re-rendering unchanged routes that import more than one asset. The route's dependency hash depended on the order the assets finished building, so two builds of identical sources could produce different hashes. The hash is now based on the file name each asset resolves to.
    

    • 

  • 

    #17547 fba468c Thanks @​dmgawel! - Improves getCollection() and getEntry() performance for entries without local image references
    

    • 

  • 

    #17602 16e0d9d Thanks @​astrobot-houston! - Fixes a build error caused by hash collisions in generated content collection image import identifiers
    

    • 



7.2.0


Minor Changes



    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          chore(deps): bump the production-dependencies group across 1 director…
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          e99c315
        
      

    

  

    

      
…y with 30 updates

Bumps the production-dependencies group with 30 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) | `14.1.4` | `14.2.1` |
| [@sentry/browser](https://github.com/getsentry/sentry-javascript) | `10.67.0` | `10.70.0` |
| [@tabler/icons](https://github.com/tabler/tabler-icons) | `3.45.0` | `3.46.0` |
| [@tanstack/virtual-core](https://github.com/TanStack/virtual/tree/HEAD/packages/virtual-core) | `3.17.5` | `3.17.7` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.3` | `7.2.2` |
| [posthog-js](https://github.com/PostHog/posthog-js) | `1.405.3` | `1.417.0` |
| [tailwind-variants](https://github.com/heroui-inc/tailwind-variants) | `3.2.2` | `3.3.1` |
| [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react) | `6.0.1` | `6.0.2` |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.6.0` | `1.7.0` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.7` | `3.14.9` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.31.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [shadcn](https://github.com/shadcn-ui/ui/tree/HEAD/packages/shadcn) | `4.13.1` | `4.18.0` |
| [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` |
| [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.41.3` | `0.41.7` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1091.0` | `3.1110.0` |
| [@fastify/busboy](https://github.com/fastify/busboy) | `3.2.0` | `3.2.1` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.0.11` | `2.1.1` |
| [@hono/zod-openapi](https://github.com/honojs/middleware/tree/HEAD/packages/zod-openapi) | `1.5.1` | `1.6.0` |
| [@sentry/bun](https://github.com/getsentry/sentry-javascript) | `10.67.0` | `10.70.0` |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `10.67.0` | `10.70.0` |
| [add-mcp](https://github.com/neon-solutions/add-mcp) | `1.13.0` | `2.0.0` |
| [hono](https://github.com/honojs/hono) | `4.12.31` | `4.13.2` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.46.0` | `5.49.0` |
| [ws](https://github.com/websockets/ws) | `8.21.1` | `8.21.3` |
| [@astrojs/language-server](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/language-server) | `2.16.12` | `2.16.14` |



Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `@astrojs/cloudflare` from 14.1.4 to 14.2.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@14.2.1/packages/integrations/cloudflare)

Updates `@sentry/browser` from 10.67.0 to 10.70.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.70.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.67.0...10.70.0)

Updates `@tabler/icons` from 3.45.0 to 3.46.0
- [Release notes](https://github.com/tabler/tabler-icons/releases)
- [Commits](tabler/tabler-icons@v3.45.0...v3.46.0)

Updates `@tanstack/virtual-core` from 3.17.5 to 3.17.7
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/virtual-core/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/virtual-core@3.17.7/packages/virtual-core)

Updates `astro` from 7.1.3 to 7.2.2
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.2/packages/astro)

Updates `posthog-js` from 1.405.3 to 1.417.0
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.405.3...posthog-js@1.417.0)

Updates `tailwind-variants` from 3.2.2 to 3.3.1
- [Release notes](https://github.com/heroui-inc/tailwind-variants/releases)
- [Changelog](https://github.com/heroui-inc/tailwind-variants/blob/main/CHANGELOG.md)
- [Commits](heroui-inc/tailwind-variants@v3.2.2...v3.3.1)

Updates `@astrojs/react` from 6.0.1 to 6.0.2
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/react@6.0.2/packages/integrations/react)

Updates `@base-ui/react` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.7.0/packages/react)

Updates `@tanstack/react-virtual` from 3.14.7 to 3.14.9
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.9/packages/react-virtual)

Updates `lucide-react` from 1.25.0 to 1.31.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.31.0/packages/lucide-react)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `shadcn` from 4.13.1 to 4.18.0
- [Release notes](https://github.com/shadcn-ui/ui/releases)
- [Changelog](https://github.com/shadcn-ui/ui/blob/main/packages/shadcn/CHANGELOG.md)
- [Commits](https://github.com/shadcn-ui/ui/commits/shadcn@4.18.0/packages/shadcn)

Updates `sonner` from 2.0.7 to 2.0.8
- [Release notes](https://github.com/emilkowalski/sonner/releases)
- [Commits](emilkowalski/sonner@v2.0.7...v2.0.8)

Updates `@astrojs/starlight` from 0.41.3 to 0.41.7
- [Release notes](https://github.com/withastro/starlight/releases)
- [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md)
- [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.41.7/packages/starlight)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `pg` from 8.22.0 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

Updates `@aws-sdk/client-s3` from 3.1091.0 to 3.1110.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1110.0/clients/client-s3)

Updates `@fastify/busboy` from 3.2.0 to 3.2.1
- [Release notes](https://github.com/fastify/busboy/releases)
- [Commits](fastify/busboy@v3.2.0...v3.2.1)

Updates `@hono/node-server` from 2.0.11 to 2.1.1
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.0.11...v2.1.1)

Updates `@hono/zod-openapi` from 1.5.1 to 1.6.0
- [Release notes](https://github.com/honojs/middleware/releases)
- [Changelog](https://github.com/honojs/middleware/blob/main/packages/zod-openapi/CHANGELOG.md)
- [Commits](https://github.com/honojs/middleware/commits/@hono/zod-openapi@1.6.0/packages/zod-openapi)

Updates `@sentry/bun` from 10.67.0 to 10.70.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.70.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.67.0...10.70.0)

Updates `@sentry/node` from 10.67.0 to 10.70.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/10.70.0/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@10.67.0...10.70.0)

Updates `add-mcp` from 1.13.0 to 2.0.0
- [Release notes](https://github.com/neon-solutions/add-mcp/releases)
- [Changelog](https://github.com/neon-solutions/add-mcp/blob/main/CHANGELOG.md)
- [Commits](neon-solutions/add-mcp@v1.13.0...v2.0.0)

Updates `hono` from 4.12.31 to 4.13.2
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.31...v4.13.2)

Updates `posthog-node` from 5.46.0 to 5.49.0
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.49.0/packages/node)

Updates `ws` from 8.21.1 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.1...8.21.3)

Updates `@astrojs/language-server` from 2.16.12 to 2.16.14
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/language-server/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/language-server@2.16.14/packages/language-tools/language-server)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@astrojs/cloudflare"
  dependency-version: 14.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sentry/browser"
  dependency-version: 10.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tabler/icons"
  dependency-version: 3.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tanstack/virtual-core"
  dependency-version: 3.17.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: astro
  dependency-version: 7.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: posthog-js
  dependency-version: 1.417.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: tailwind-variants
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@astrojs/react"
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@base-ui/react"
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: shadcn
  dependency-version: 4.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: sonner
  dependency-version: 2.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@astrojs/starlight"
  dependency-version: 0.41.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1110.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@fastify/busboy"
  dependency-version: 3.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@hono/zod-openapi"
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sentry/bun"
  dependency-version: 10.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@sentry/node"
  dependency-version: 10.70.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: add-mcp
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: hono
  dependency-version: 4.13.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: posthog-node
  dependency-version: 5.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@astrojs/language-server"
  dependency-version: 2.16.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      
  dependencies

  Pull requests that update a dependency file

      
  javascript

  Pull requests that update javascript code

  labels


      Aug 17, 2026

    

  








      

  
      



  

  @greptile-apps






  



    

      

  

    

      
          
      

      
            greptile-apps
    Bot

      

      

      commented


        Aug 17, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        

  
    Contributor


        

    

  





      


        



  
    

      
          

PR author is in the excluded authors list.


      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
      



  

  @socket-security






  



    

      

  

    

      
          
      

      
            socket-security
    Bot

      

      

      commented


        Aug 17, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        



        

    

  





      


        



  
    

      
          
Review the following changes in direct dependencies. Learn more about Socket for GitHub.






Diff
Package
Supply Chain
Security		
Vulnerability
Quality
Maintenance
License





Addedposthog-js@​1.417.04710080100100


Added@​tanstack/​react-virtual@​3.14.91001006896100


Added@​tanstack/​virtual-core@​3.17.7991007396100


Added@​types/​pg@​8.21.01001007393100


Added@​types/​react-dom@​19.2.41001007588100


Addedadd-mcp@​2.0.07610010096100


Added@​sentry/​browser@​10.70.0781009196100


Added@​types/​react@​19.2.181001007992100


Addedposthog-node@​5.49.09210079100100


Added@​astrojs/​language-server@​2.16.14981008096100


Addedlucide-react@​1.31.0100100989580


Added@​astrojs/​react@​6.0.2991008296100


Addedsonner@​2.0.81001008385100


Addedreact@​19.2.81001008497100


Added@​astrojs/​cloudflare@​14.2.11001008498100


Added@​astrojs/​starlight@​0.41.7981008596100


Addedastro@​7.2.2981008898100


Added@​base-ui/​react@​1.7.0891008995100


Added@​sentry/​bun@​10.70.0991009096100


Addedshadcn@​4.18.0981009197100


Addedpg@​8.23.09910010091100


Addedtailwind-variants@​3.3.110010010091100


Added@​fastify/​busboy@​3.2.110010010092100


Addedreact-dom@​19.2.81001009298100


Added@​tabler/​icons@​3.46.010010010093100


Addedws@​8.21.39910010093100


Added@​hono/​zod-openapi@​1.6.010010010095100


Added@​sentry/​node@​10.70.0981009596100


Added@​hono/​node-server@​2.1.110010010096100


Addedhono@​4.13.21001009796100


Added@​aws-sdk/​client-s3@​3.1110.010010010098100





View full report



      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
      



  

  @socket-security






  



    

      

  

    

      
          
      

      
            socket-security
    Bot

      

      

      commented


        Aug 17, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        



        

    

  





      


        



  
    

      
          
Warning
Review the following alerts detected in dependencies.


According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.








Action
Severity
Alert  (click "▶" to expand/collapse)






Warn
High

Obfuscated code:  npm @sentry/node-core is 60.0% likely obfuscated



Confidence: 0.60
 

Location: Package overview
 

From: pnpm-lock.yaml → npm/@sentry/node@10.70.0 → npm/@sentry/node-core@10.70.0


ℹ Read more on: This package | This alert | What is obfuscated code?





  Next steps: Take a moment to review the security alert above. Review
  the linked package source code to understand the potential risk. Ensure the
  package is not malicious before proceeding. If you're unsure how to proceed,
  reach out to your security team or ask the Socket team for help at
  support@socket.dev.



Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.



    Mark the package as acceptable risk. To ignore this alert only
    in this pull request, reply with the comment
    @SocketSecurity ignore npm/@sentry/node-core@10.70.0. You can
    also ignore all packages with @SocketSecurity ignore-all.
    To ignore an alert for all future pull requests, use Socket's Dashboard to
    change the triage state of this alert.
  











View full report


      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    
















  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










    
        

  

    
    

    

  

    Reviewers
  


    

    No reviews







  
      

  


      
  

    Assignees
  



        


    No one assigned







  
        


  


  

    Labels
  



    

      
    dependencies

  Pull requests that update a dependency file
  
    javascript

  Pull requests that update javascript code








  
        

  

    

        

    Projects
  


        




    None yet




  



  
        


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

  
  
        

  

    

      0 participants