chore(deps): Bump the npm_and_yarn group across 17 directories with 6 updates

Closed

Number: #210
Type: Pull Request
State: Closed

Author:

dependabot[bot]
Association: Unknown
Comments: 2

Created: May 14, 2026 at 11:14 PM UTC
(about 1 month ago)

Updated: May 15, 2026 at 09:17 AM UTC
(about 1 month ago)

Closed: May 15, 2026 at 09:17 AM UTC
(about 1 month ago)

Time to Close: about 10 hours

Labels:
dependencies javascript

Description:

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
astro	`3.5.0`	`6.1.10`
next	`14.2.35`	`15.5.18`
svelte	`3.59.2`	`5.55.7`
langsmith	`0.3.74`	`0.3.87`
protobufjs	`7.5.5`	`7.5.8`

Bumps the npm_and_yarn group with 1 update in the /dev-packages/e2e-tests/test-applications/astro-4 directory: astro.
Bumps the npm_and_yarn group with 1 update in the /dev-packages/e2e-tests/test-applications/astro-5 directory: astro.
Bumps the npm_and_yarn group with 1 update in the /dev-packages/e2e-tests/test-applications/astro-5-cf-workers directory: astro.
Bumps the npm_and_yarn group with 1 update in the /dev-packages/e2e-tests/test-applications/nextjs-15 directory: next.
Bumps the npm_and_yarn group with 1 update in the /dev-packages/e2e-tests/test-applications/nextjs-15-intl directory: next.
Bumps the npm_and_yarn group with 1 update in the /dev-packages/e2e-tests/test-applications/nextjs-16 directory: next.
Bumps the npm_and_yarn group with 1 update in the /dev-packages/e2e-tests/test-applications/nextjs-16-bun directory: next.
Bumps the npm_and_yarn group with 1 update in the /dev-packages/e2e-tests/test-applications/nextjs-16-cacheComponents directory: next.
Bumps the npm_and_yarn group with 1 update in the /dev-packages/e2e-tests/test-applications/nextjs-16-cf-workers directory: next.
Bumps the npm_and_yarn group with 1 update in the /dev-packages/e2e-tests/test-applications/nextjs-16-trailing-slash directory: next.
Bumps the npm_and_yarn group with 1 update in the /dev-packages/e2e-tests/test-applications/nextjs-16-tunnel directory: next.
Bumps the npm_and_yarn group with 1 update in the /dev-packages/e2e-tests/test-applications/nextjs-sourcemaps directory: next.
Bumps the npm_and_yarn group with 1 update in the /dev-packages/e2e-tests/test-applications/sveltekit-2 directory: svelte.
Bumps the npm_and_yarn group with 1 update in the /packages/astro directory: astro.
Bumps the npm_and_yarn group with 1 update in the /packages/svelte directory: svelte.
Bumps the npm_and_yarn group with 1 update in the /packages/sveltekit directory: svelte.

Updates astro from 3.5.0 to 6.1.10

Release notes

Sourced from astro's releases.

astro@6.1.10

Patch Changes

#16479 1058428 Thanks @matthewp! - Fixes a spurious [WARN] [content] Content config not loaded warning during astro dev for projects that don't use content collections

#16457 3d82220 Thanks @matthewp! - Hardens server island encryption to prevent encrypted data from one island component being replayed against a different one

#16481 152700e Thanks @matthewp! - Fixes a spurious 404 request for a dev toolbar sourcemap during astro dev caused by the browser mis-resolving a relative sourceMappingURL from the /@id/ URL prefix

#16480 1bcb43b Thanks @matthewp! - Fixes an unnecessary full page reload on first navigation during dev

astro@6.1.9

Patch Changes

#16448 99464ed Thanks @matthewp! - Updates vite, picomatch, and unstorage to latest patch versions

#16422 a3951d7 Thanks @matthewp! - Hardens astro-island export resolution and hydration error handling for malformed component metadata

#16420 e21de1d Thanks @matthewp! - Hardens Astro's error overlay and server logging paths to avoid unsafe HTML insertion and format-string interpolation

#16419 f3485c3 Thanks @matthewp! - Hardens nested object and package metadata lookups to ignore prototype keys in content handling and project scaffolding

#16022 a002540 Thanks @mathieumaf! - Fixes an issue where i18n domains would return 404 when trailingSlash is set to never.

Updated dependencies [99464ed, f3485c3]:

@astrojs/internal-helpers@0.9.0

@astrojs/markdown-remark@7.1.1

astro@6.1.8

Patch Changes

#16367 a6866a7 Thanks @ematipico! - Fixes an issue where build output files could contain special characters (!, ~, {, }) in their names, causing deploy failures on platforms like Netlify.

#16381 217c5b3 Thanks @ematipico! - Slightly improved the performance of the dev server by caching the internal crawling of the dependencies of a project.

#16348 7d26cd7 Thanks @ocavue! - Fixes a bug where emitted assets during a client build would contain always fresh, new hashes in their name. Now the build should be more stable.

#16317 d012bfe Thanks @das-peter! - Fixes a bug where allowedDomains weren't correctly propagated when using the development server.

#16379 5a84551 Thanks @martrapp! - Improves Vue scoped style handling in DEV mode during client router navigation.

#16317 d012bfe Thanks @das-peter! - Adds tests to verify settings are properly propagated when using the development server.

#16282 5b0fdaa Thanks @jmurty! - Fixes build errors on platforms with skew protection enabled (e.g. Vercel, Netlify) for inter-chunk Javascript using dynamic imports

Updated dependencies [e0b240e]:

@astrojs/telemetry@3.3.1

astro@6.1.7

Patch Changes

... (truncated)

Changelog

Sourced from astro's changelog.

3.6.4

Patch Changes
#9226 8f8a40e93 Thanks @outofambit! - Fix i18n fallback routing with routing strategy of always-prefix

#9179 3f28336d9 Thanks @lilnasy! - Fixes an issue where the presence of a slot in a page led to an error.

#9219 067a65f5b Thanks @natemoo-re! - Fix edge case where <style> updates inside of .astro files would occasionally fail to update without reloading the page.
#9236 27d3e86e4 Thanks @ematipico! - The configuration i18n.routingStrategy has been replaced with an object called routing.
export default defineConfig({
  experimental: {
      i18n: {
-          routingStrategy: "prefix-always",
+          routing: {
+              prefixDefaultLocale: true,
+          }
      }
  }
})
export default defineConfig({
  experimental: {
      i18n: {
-          routingStrategy: "prefix-other-locales",
+          routing: {
+              prefixDefaultLocale: false,
+          }
      }
  }
})
3.6.3

Patch Changes

#9193 0dc99c9a2 Thanks @florian-lefebvre! - Prevents the Code component from crashing if the lang isn't supported by falling back to plaintext.

3.6.2

Patch Changes

#9189 d90714fc3 Thanks @SpencerWhitehead7! - Fixes an issue where links with the same pathname as the current page, but different search params, were not prefetched.

... (truncated)

Commits

c1f2e4f [ci] release (#16467)
345fb9e chore: fix flaky dev toolbar render time test (#16500)
5120ecd [ci] format
3d82220 Add AEAD context binding to server island encryption (#16457)
1bcb43b Prebundle dev toolbar entrypoint in client environment (#16480)
93101cc [ci] format
152700e fix: strip sourceMappingURL from dev toolbar entrypoint during dep optimizati...
bc83041 refactor(astro): migrate test utils to typescript (#16492)
5c543c5 refactor(astro): add internal entry points for test (#16473)
1058428 Suppress content config warning for projects without content collections (#16...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for astro since your current version.

Updates next from 14.2.35 to 15.5.18

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.16

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

v15.5.14

[!NOTE]

... (truncated)

Commits

9ff92ce v15.5.18
00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
62c97ab v15.5.17
423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
fa78739 Turbopack: Fix middleware matcher suffix (#93590)
36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
36589b5 [backport][test] Pin package manager to patch versions (#93596)
ad6fd4e v15.5.16
79d7dff Ignore malformed CSP nonce headers (#103)
c4f6908 router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates svelte from 3.59.2 to 5.55.7

Release notes

Sourced from svelte's releases.

svelte@5.55.7

Patch Changes

fix: prevent XSS on hydratable from user contents (a16ebc67bbcf8f708360195687e1b2719463e1a4)

chore: bump devalue (#18219)

fix: disallow empty attribute names during SSR (547853e2406a2147ad7fb5ffeba95b01bd9642da)

fix: harden regex (d2375e2ebcab5c88feb5652f1a9d621b8f06b259)

fix: move Svelte runtime properties to symbols (e1cbbd96441e82c9eb8a23a2903c0d06d3cda991)

svelte@5.55.6

Patch Changes

fix: leave stale promises to wait for a later resolution, instead of rejecting (#18180)

fix: keep dependencies of $state.eager/pending (#18218)

fix: reapply context after transforming error during SSR (#18099)

fix: don't rebase just-created batches (#18117)

chore: allow null for pending in typings (#18201)

fix: flush eager effects in production (#18107)

fix: rethrow error of failed iterable after calling return() (#18169)

fix: account for proxified instance when updating bind:this (#18147)

fix: ensure scheduled batch is flushed if not obsolete (#18131)

fix: resolve stale deriveds with latest value (#18167)

chore: remove unnecessary increment_pending calls (#18183)

fix: correctly compile component member expressions for SSR (#18192)

fix: reset source.updated stack traces after flush (#18196)

fix: replacing async 'blocking' strategy with 'merging' (#18205)

fix: allow @debug tags to reference awaited variables (#18138)

fix: re-run fallback props if dependencies update (#18146)

fix: abort running obsolete async branches (#18118)

... (truncated)

Changelog

Sourced from svelte's changelog.

svelte

4.2.3

Patch Changes

fix: improve a11y-click-events-have-key-events message (#9358)

fix: more robust hydration of html tag (#9184)

4.2.2

Patch Changes

fix: support camelCase properties on custom elements (#9328)

fix: add missing plaintext-only value to contenteditable type (#9242)

chore: upgrade magic-string to 0.30.4 (#9292)

fix: ignore trailing comments when comparing nodes (#9197)

4.2.1

Patch Changes

fix: update style directive when style attribute is present and is updated via an object prop (#9187)

fix: css sourcemap generation with unicode filenames (#9120)

fix: do not add module declared variables as dependencies (#9122)

fix: handle svelte:element with dynamic this and spread attributes (#9112)

fix: silence false positive reactive component warning (#9094)

fix: head duplication when binding is present (#9124)

fix: take custom attribute name into account when reflecting property (#9140)

fix: add indeterminate to the list of HTMLAttributes (#9180)

fix: recognize option value on spread attribute (#9125)

4.2.0

Minor Changes

feat: move svelteHTML from language-tools into core to load the correct svelte/element types (#9070)

... (truncated)

Commits

4d8f99a Version Packages (#18220)
0552308 chore: bump devalue (#18219)
e1cbbd9 Merge commit from fork
a16ebc6 Merge commit from fork
d2375e2 Merge commit from fork
547853e Merge commit from fork
55f9c85 Version Packages (#18158)
a10e8e4 fix: keep dependencies of $state.eager/pending (alternative approach) (#1...
ef4b97d fix: duplicated "of" in events.js comment (#18217)
5122936 fix: treat batches as a linked list (#18205)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svelte since your current version.

Updates devalue from 4.3.3 to 5.8.1

Release notes

Sourced from devalue's releases.

v5.8.1

Patch Changes

206ca67: fix: force sparse arrays to allocate sparsely

v5.8.0

Minor Changes

c5115b0: feat: add stringifyAsync for async serialization

v5.7.1

Patch Changes

8becc7c: fix: handle regexes consistently in uneval's value and reference formats

v5.7.0

Minor Changes

df2e284: feat: use native alternatives to encode/decode base64

498656e: feat: add DataView support

a210130: feat: whitelist Float16Array

df2e284: feat: simplify TypedArray slices

Patch Changes

5590634: fix: get uneval type handling up to parity with stringify

57f73fc: fix: correctly support boxed bigints and sentinel values

v5.6.4

Patch Changes

87c1f3c: fix: reject __proto__ keys in malformed Object wrapper payloads

This validates the "Object" parse path and throws when the wrapped value has an own __proto__ key.

40f1db1: fix: ensure sparse array indices are integers

87c1f3c: fix: disallow __proto__ keys in null-prototype object parsing

This disallows __proto__ keys in the "null" parse path so null-prototype object hydration cannot carry that key through parse/unflatten.

v5.6.3

Patch Changes

0f04d4d: fix: Properly handle __proto__

819f1ac: fix: better encoding for sparse arrays

v5.6.2

Patch Changes

... (truncated)

Changelog

Sourced from devalue's changelog.

5.8.1

Patch Changes

206ca67: fix: force sparse arrays to allocate sparsely

5.8.0

Minor Changes

c5115b0: feat: add stringifyAsync for async serialization

5.7.1

Patch Changes

8becc7c: fix: handle regexes consistently in uneval's value and reference formats

5.7.0

Minor Changes

df2e284: feat: use native alternatives to encode/decode base64

498656e: feat: add DataView support

a210130: feat: whitelist Float16Array

df2e284: feat: simplify TypedArray slices

Patch Changes

5590634: fix: get uneval type handling up to parity with stringify

57f73fc: fix: correctly support boxed bigints and sentinel values

5.6.4

Patch Changes

87c1f3c: fix: reject __proto__ keys in malformed Object wrapper payloads

This validates the "Object" parse path and throws when the wrapped value has an own __proto__ key.

40f1db1: fix: ensure sparse array indices are integers

87c1f3c: fix: disallow __proto__ keys in null-prototype object parsing

This disallows __proto__ keys in the "null" parse path so null-prototype object hydration cannot carry that key through parse/unflatten.

5.6.3

Patch Changes

0f04d4d: fix: Properly handle __proto__

819f1ac: fix: better encoding for sparse arrays

5.6.2

... (truncated)

Commits

796ea83 Version Packages (#152)
206ca67 Merge commit from fork
14933f7 Version Packages (#151)
c5115b0 feat: stringifyAsync (#150)
67dad45 docs: update README to reflect serialization stability non-goal (#147)
6eb920a Version Packages (#146)
8becc7c fix: handle regexes consistently in uneval's value and reference formats (#145)
2eee2e4 Version Packages (#144)
498656e DataView support (#143)
5590634 Improve platform types support (#142)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for devalue since your current version.

Updates langsmith from 0.3.74 to 0.3.87

Commits

See full diff in compare view

Updates protobufjs from 7.5.5 to 7.5.8

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.5.8

7.5.8 (2026-05-12)

Bug Fixes

Backport parser hardening to 7.x (#2245) (54b593f)

protobufjs: v7.5.7

7.5.7 (2026-05-09)

Bug Fixes

Restore first-match namespace lookup (#2236) (cc7d595)

protobufjs: v7.5.6

7.5.6 (2026-04-27)

Bug Fixes

Backport input hardening and CLI fixes to 7.x (#2173) (75392ea)

Changelog

Sourced from protobufjs's changelog.

7.5.8 (2026-05-12)

Bug Fixes

Backport parser hardening to 7.x (#2245) (54b593f)

7.5.7 (2026-05-09)

Bug Fixes

Restore first-match namespace lookup (#2236) (cc7d595)

7.5.6 (2026-04-27)

Bug Fixes

Backport input hardening and CLI fixes to 7.x (#2173) (75392ea)

7.5.4 (2025-08-15)

Bug Fixes

invalid syntax in descriptor.proto (#2092) (5a3769a)

7.5.3 (2025-05-28)

Bug Fixes

descriptor extensions handling post-editions (#2075) (6e255d4)

7.5.2 (2025-05-14)

Bug Fixes

ensure that types are always resolved (#2068) (4b51cb2)

7.5.1 (2025-05-08)

Bug Fixes

optimize regressions from editions implementations (#2066) (6406d4c)

reserved field inside group blocks fail parsing (#2058) (56782bf)

... (truncated)

Commits

d7035f9 chore: release protobufjs-v7.x (#2248)
54b593f fix: Backport parser hardening to 7.x (#2245)
e88fcea chore: release protobufjs-v7.x (#2239)
cc7d595 fix: Restore first-match namespace lookup (#2236)
3abc9b5 chore: release protobufjs-v7.x (#2190)
a0bf2df fix: Update CLI peer dependency (7.x) (#2189)
2189e5b chore: release protobufjs-v7.x (#2174)
75392ea fix: Backport input hardening and CLI fixes to 7.x (#2173)
8af8d7c chore(ci): Fix 7.x release please configuration (#2169)
e92ca42 chore(ci): Enable release-please for 7.x (#2166)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for protobufjs since your current version.

Updates astro from 4.16.19 to 6.1.10

Release notes

Sourced from astro's releases.

astro@6.1.10

Patch Changes

#16479 1058428 Thanks @matthewp! - Fixes a spurious [WARN] [content] Content config not loaded warning during astro dev for projects that don't use content collections

#16457 3d82220 Thanks @matthewp! - Hardens server island encryption to prevent encrypted data from one island component being replayed against a different one

#16481 152700e Thanks @matthewp! - Fixes a spurious 404 request for a dev toolbar sourcemap during astro dev caused by the browser mis-resolving a relative sourceMappingURL from the /@id/ URL prefix

#16480 1bcb43b Thanks @matthewp! - Fixes an unnecessary full page reload on first navigation during dev

astro@6.1.9

Patch Changes

#16448 99464ed Thanks @matthewp! - Updates vite, picomatch, and unstorage to latest patch versions

#16422 a3951d7 Thanks @matthewp! - Hardens astro-island export resolution and hydration error handling for malformed component metadata

#16420 e21de1d Thanks @matthewp! - Hardens Astro's error overlay and server logging paths to avoid unsafe HTML insertion and format-string interpolation

#16419 f3485c3 Thanks @matthewp! - Hardens nested object and package metadata lookups to ignore prototype keys in content handling and project scaffolding

#16022 a002540 Thanks @mathieumaf! - Fixes an issue where i18n domains would return 404 when trailingSlash is set to never.

Updated dependencies [99464ed, f3485c3]:

@astrojs/internal-helpers@0.9.0

@astrojs/markdown-remark@7.1.1

astro@6.1.8

Patch Changes

#16367 a6866a7 Thanks @ematipico! - Fixes an issue where build output files could contain special characters (!, ~, {, }) in their names, causing deploy failures on platforms like Netlify.

#16381 217c5b3 Thanks @ematipico! - Slightly improved the performance of the dev server by caching the internal crawling of the dependencies of a project.

#16348 7d26cd7 Thanks @ocavue! - Fixes a bug where emitted assets during a client build would contain always fresh, new hashes in their name. Now the build should be more stable.

#16317 d012bfe Thanks @das-peter! - Fixes a bug where allowedDomains weren't correctly propagated when using the development server.

#16379 5a84551 Thanks @martrapp! - Improves Vue scoped style handling in DEV mode during client router navigation.

#16317 d012bfe Thanks @das-peter! - Adds tests to verify settings are properly propagated when using the development server.

#16282 5b0fdaa Thanks @jmurty! - Fixes build errors on platforms with skew protection enabled (e.g. Vercel, Netlify) for inter-chunk Javascript using dynamic imports

Updated dependencies [e0b240e]:

@astrojs/telemetry@3.3.1

astro@6.1.7

Patch Changes

... (truncated)

Changelog

Sourced from astro's changelog.

3.6.4

Patch Changes
#9226 8f8a40e93 Thanks @outofambit! - Fix i18n fallback routing with routing strategy of always-prefix

#9179 3f28336d9 Thanks @lilnasy! - Fixes an issue where the presence of a slot in a page led to an error.

#9219 067a65f5b Thanks @natemoo-re! - Fix edge case where <style> updates inside of .astro files would occasionally fail to update without reloading the page.
#9236 27d3e86e4 Thanks @ematipico! - The configuration i18n.routingStrategy has been replaced with an object called routing.
export default defineConfig({
  experimental: {
      i18n: {
-          routingStrategy: "prefix-always",
+          routing: {
+              prefixDefaultLocale: true,
+          }
      }
  }
})
export default defineConfig({
  experimental: {
      i18n: {
-          routingStrategy: "prefix-other-locales",
+          routing: {
+              prefixDefaultLocale: false,
+          }
      }
  }
})
3.6.3

Patch Changes

#9193 0dc99c9a2 Thanks @florian-lefebvre! - Prevents the Code component from crashing if the lang isn't supported by falling back to plaintext.

3.6.2

Patch Changes

#9189 d90714fc3 Thanks @SpencerWhitehead7! - Fixes an issue where links with the same pathname as the current page, but different search params, were not prefetched.

... (truncated)

Commits

c1f2e4f [ci] release (#16467)
345fb9e chore: fix flaky dev toolbar render time test (#16500)
5120ecd [ci] format
3d82220 Add AEAD context binding to server island encryption (#16457)
1bcb43b Prebundle dev toolbar entrypoint in client environment (#16480)
93101cc [ci] format
152700e fix: strip sourceMappingURL from dev toolbar entrypoint during dep optimizati...
bc83041 refactor(astro): migrate test utils to typescript (#16492)
5c543c5 refactor(astro): add internal entry points for test (#16473)
1058428 Suppress content config warning for projects without content collections (#16...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for astro since your current version.

Updates astro from 5.18.1 to 6.3.3

Release notes

Sourced from astro's releases.

astro@6.1.10

Patch Changes

#16479 1058428 Thanks @matthewp! - Fixes a spurious [WARN] [content] Content config not loaded warning during astro dev for projects that don't use content collections

#16457 3d82220 Thanks @matthewp! - Hardens server island encryption to prevent encrypted data from one island component being replayed against a different one

#16481 152700e Thanks @matthewp! - Fixes a spurious 404 request for a dev toolbar sourcemap during astro dev caused by the browser mis-resolving a relative sourceMappingURL from the /@id/ URL prefix

#16480 1bcb43b Thanks @matt...
Description has been truncated


          
            
              
              Package Dependencies
            
          
          
              
                
                  
                    Package:

                    
                      astro
                  
                  
                  
                    Ecosystem:

                    npm
                  
                  
                    
                      Version Change:

                      3.5.0 → 6.1.10
                    
                  
                    
                      Update Type:

                      
                        Major
                      
                    
                  
                
              
              
                
                  
                    Package:

                    
                      next
                  
                  
                  
                    Ecosystem:

                    npm
                  
                  
                    
                      Version Change:

                      14.2.35 → 15.5.18
                    
                  
                    
                      Update Type:

                      
                        Major
                      
                    
                  
                
              
              
                
                  
                    Package:

                    
                      svelte
                  
                  
                  
                    Ecosystem:

                    npm
                  
                  
                    
                      Version Change:

                      3.59.2 → 5.55.7
                    
                  
                    
                      Update Type:

                      
                        Major
                      
                    
                  
                
              
              
                
                  
                    Package:

                    
                      protobufjs
                  
                  
                  
                    Ecosystem:

                    npm
                  
                  
                    
                      Version Change:

                      7.5.5 → 7.5.8
                    
                  
                    
                      Update Type:

                      
                        Patch
                      
                    
                  
                
              
              
                
                  
                    Package:

                    
                      langsmith
                  
                  
                  
                    Ecosystem:

                    npm
                  
                  
                    
                      Version Change:

                      0.3.74 → 0.3.87
                    
                  
                    
                      Update Type:

                      
                        Patch
                      
                    
                  
                
              
          
        

      
        
          
            
              
              Security Advisories
            
          
          
              
                
                  
                    
                      Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces
                      
                      
                          GHSA-ffhc-5mcf-pf4q
                          CVE-2026-44581
                        
                          
                            MODERATE
                          
                      
                      
                        
                          ### Impact

App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived...
                        
                    
                  
                
              
                
                  
                    
                      Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting
                      
                      
                          GHSA-vfv6-92ff-j949
                          CVE-2026-44582
                        
                          
                            LOW
                          
                      
                      
                        
                          ### Impact

React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisio...
                        
                    
                  
                
              
                
                  
                    
                      Next.js has cross-site scripting in beforeInteractive scripts with untrusted input
                      
                      
                          GHSA-gx5p-jg67-6x7h
                          CVE-2026-44580
                        
                          
                            MODERATE
                          
                      
                      
                        
                          ### Impact

Applications that use `beforeInteractive` scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not esca...
                        
                    
                  
                
              
                
                  
                    
                      Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components
                      
                      
                          GHSA-mg66-mrh9-m8jx
                          CVE-2026-44579
                        
                          
                            HIGH
                          
                      
                      
                        
                          ### Impact

Applications using Partial Prerendering through the Cache Components feature can be vulnerable to connection exhaustion through crafted POST requests to a server action. In affected con...
                        
                    
                  
                
              
                
                  
                    
                      Next.js has a Denial of Service in the Image Optimization API
                      
                      
                          GHSA-h64f-5h5j-jqjh
                          CVE-2026-44577
                        
                          
                            MODERATE
                          
                      
                      
                        
                          ### Impact

When self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could c...
                        
                    
                  
                
              
                
                  
                    
                      Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades
                      
                      
                          GHSA-c4j6-fc7j-m34r
                          CVE-2026-44578
                        
                          
                            HIGH
                          
                      
                      
                        
                          ### Impact

Self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server ...
                        
                    
                  
                
              
                
                  
                    
                      Next.js vulnerable to cache poisoning in React Server Component responses
                      
                      
                          GHSA-wfc6-r584-vfw7
                          CVE-2026-44576
                        
                          
                            MODERATE
                          
                      
                      
                        
                          ### Impact

Applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker c...
                        
                    
                  
                
              
                
                  
                    
                      Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes
                      
                      
                          GHSA-267c-6grr-h53f
                          CVE-2026-44575
                        
                          
                            HIGH
                          
                      
                      
                        
                          ### Impact

App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetch...
                        
                    
                  
                
              
                
                  
                    
                      Next.js has a Middleware / Proxy bypass through dynamic route parameter injection
                      
                      
                          GHSA-492v-c6pp-mqqv
                          CVE-2026-44574
                        
                          
                            HIGH
                          
                      
                      
                        
                          ### Impact

Applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynam...
                        
                    
                  
                
              
                
                  
                    
                      Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n
                      
                      
                          GHSA-36qx-fr4f-26g5
                          CVE-2026-44573
                        
                          
                            HIGH
                          
                      
                      
                        
                          ### Impact

Applications using the Pages Router with `i18n` configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less `/_next/data...
                        
                    
                  
                
              
                
                  
                    
                      Next.js Vulnerable to Denial of Service with Server Components
                      
                      
                          GHSA-8h8q-6873-q5fj
                        
                          
                            HIGH
                          
                      
                      
                        
                          A vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. ...
                        
                    
                  
                
              
                
                  
                    
                      Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
                      
                      
                          GHSA-26hh-7cqf-hhc6
                          CVE-2026-45109
                        
                          
                            HIGH
                          
                      
                      
                        
                          ### Impact


It was found that the fix addressing [CVE-2026-44575](https://github.com/vercel/next.js/security/advisories/GHSA-267c-6grr-h53f) did not apply to `middleware.ts` with Turbopack. Refer ...
                        
                    
                  
                
              
                
                  
                    
                      Next.js's Middleware / Proxy redirects can be cache-poisoned
                      
                      
                          GHSA-3g8h-86w9-wvmq
                          CVE-2026-44572
                        
                          
                            LOW
                          
                      
                      
                        
                          ### Impact

Next.js uses the `x-nextjs-data` request header for internal data requests. On affected versions, an external client could send this header on a normal request to a path handled by midd...



    
    
      
        
          Actions
        
        
          
            
            View on GitHub
          
          
            
            View Repository
          
          
            
            All Dependabot PRs
        
      

      
        
          Technical Details
        
        
          
            
              ID:
              15807728
            
            
              UUID:
              4450010537
            
            
              Node ID:
              PR_kwDONhlJ1c7buDa3
            
            
              Host:
              GitHub
            
            
              Repository:
              SherfeyInv/sentry-javascript

ID:	`15807728`
UUID:	`4450010537`
Node ID:	`PR_kwDONhlJ1c7buDa3`
Host:	GitHub
Repository:	SherfeyInv/sentry-javascript