chore(deps): update astro monorepo (major) by renovate[bot] · Pull Request #28 · mojisdev/mojis.dev

renovate · 2026-03-17T21:28:17Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/cloudflare (source)	`^12.6.4` → `^13.0.0`
@astrojs/react (source)	`^4.3.0` → `^5.0.0`
astro (source)	`^5.13.2` → `^6.0.0`

Release Notes

withastro/astro (@astrojs/cloudflare)

`v13.1.2`

Compare Source

Patch Changes

#15888 925252e Thanks @matthewp! - Fixes a bug where dependencies imported by prerender-only server:defer islands could remain as bare imports in server output, causing module resolution failures in preview and Cloudflare Workers.
#15934 6f8f0bc Thanks @ematipico! - Updates the Astro peerDependencies#astro to be 6.0.0.
#15875 c43ef8a Thanks @matthewp! - Include workerd response details in Cloudflare prerenderer errors to make getStaticPaths() failures easier to diagnose.
Updated dependencies []:
- @astrojs/underscore-redirects@1.0.1

`v13.1.1`

Compare Source

Patch Changes

#15815 d1872ee Thanks @matthewp! - Prebundle additional Astro runtime dependencies for Cloudflare development server, speeding up initial start time and preventing required restarts.
#15872 3b47b89 Thanks @Princesseuh! - Fixes images not working in dev mode when using the cloudflare option
Updated dependencies []:
- @astrojs/underscore-redirects@1.0.1

`v13.1.0`

Compare Source

Minor Changes

#15711 b2bd27b Thanks @OliverSpeir! - Adds a prerenderEnvironment option to the Cloudflare adapter.

By default, Cloudflare uses its workerd runtime for prerendering static pages. Set prerenderEnvironment to 'node' to use Astro's built-in Node.js prerender environment instead, giving prerendered pages access to the full Node.js ecosystem during both build and dev. This is useful when your prerendered pages depend on Node.js-specific APIs or NPM packages that aren't compatible with workerd.
```
// astro.config.mjs
import cloudflare from '@&#8203;astrojs/cloudflare';
import { defineConfig } from 'astro/config';

export default defineConfig({
  adapter: cloudflare({
    prerenderEnvironment: 'node',
  }),
});
```

Patch Changes

#15845 50fcc8b Thanks @aqiray! - fix: show actionable error when running astro preview without prior build
#15794 d1ac58e Thanks @OliverSpeir! - Fixes image serving in passthrough mode by using the Cloudflare ASSETS binding instead of generic fetch, which does not work in Workers for local assets
#15850 660da74 Thanks @tristanbes! - fix(cloudflare): forward configPath and other PluginConfig options to the Cloudflare Vite Plugin

Options like configPath, inspectorPort, persistState, remoteBindings, and auxiliaryWorkers were accepted by the type system but never forwarded to cfVitePlugin(), making them silently ignored.

Also fixes addWatchFile for configPath which resolved the path relative to the adapter's node_modules directory instead of the project root.
#15843 fcd237d Thanks @Calvin-LL! - fix cloudflare image transform ignoring quality parameter
Updated dependencies []:
- @astrojs/underscore-redirects@1.0.1

`v13.0.2`

Patch Changes

#15832 95e12a2 Thanks @Princesseuh! - Fixes return; syntax not working in the frontmatter correctly in certain contexts
#15803 e42b015 Thanks @merlinnot! - Fixes the Cloudflare adapter adding a SESSION KV binding even when sessions are explicitly configured to use a different driver, such as unstorage/drivers/null.
Updated dependencies []:
- @astrojs/underscore-redirects@1.0.1

`v13.0.1`

Patch Changes

Updated dependencies [e20474b]:
- @astrojs/underscore-redirects@1.0.1

`v13.0.0`

Compare Source

Major Changes

#14306 141c4a2 Thanks @ematipico! - Changes the API for creating a custom entrypoint, replacing the createExports() function with a direct export pattern.

What should I do?

If you're using a custom entryPoint in your Cloudflare adapter config, update your existing worker file that uses createExports() to reflect the new, simplified pattern:

my-entry.ts

import type { SSRManifest } from 'astro';
import { App } from 'astro/app';
import { handle } from '@&#8203;astrojs/cloudflare/handler';
import { DurableObject } from 'cloudflare:workers';

class MyDurableObject extends DurableObject<Env> {
  constructor(ctx: DurableObjectState, env: Env) {
    super(ctx, env);
  }
}

export function createExports(manifest: SSRManifest) {
  const app = new App(manifest);
  return {
    default: {
      async fetch(request, env, ctx) {
        await env.MY_QUEUE.send('log');
        return handle(manifest, app, request, env, ctx);
      },
      async queue(batch, _env) {
        let messages = JSON.stringify(batch.messages);
        console.log(`consumed from our queue: ${messages}`);
      },
    } satisfies ExportedHandler<Env>,
    MyDurableObject: MyDurableObject,
  };
}

To create the same custom entrypoint using the updated API, export the following function instead:

my-entry.ts

import { handle } from '@&#8203;astrojs/cloudflare/utils/handler';

export default {
  async fetch(request, env, ctx) {
    await env.MY_QUEUE.send("log");
    return handle(manifest, app, request, env, ctx);
  },
  async queue(batch, _env) {
    let messages = JSON.stringify(batch.messages);
    console.log(`consumed from our queue: ${messages}`);
  }
} satisfies ExportedHandler<Env>,

The manifest is now created internally by the adapter.

#15435 957b9fe Thanks @rururux! - Changes the default image service from compile to cloudflare-binding. Image services options that resulted in broken images in development due to Node JS incompatiblities have now been updated to use the noop passthrough image service in dev mode. - (Cloudflare v13 and Astro6 upgrade guidance)
#15400 41eb284 Thanks @florian-lefebvre! - Removes the workerEntryPoint option, which wasn't used anymore. Set the main field of your wrangler config instead

See how to migrate
#14306 141c4a2 Thanks @ematipico! - Development server now runs in workerd

astro dev now runs your Cloudflare application using Cloudflare's workerd runtime instead of Node.js. This means your development environment is now a near-exact replica of your production environment—the same JavaScript engine, the same APIs, the same behavior. You'll catch issues during development that would have only appeared in production, and features like Durable Objects, Workers Analytics Engine, and R2 bindings work exactly as they do on Cloudflare's platform.

New runtime

Previously, Astro.locals.runtime provided access to Cloudflare-specific APIs. These APIs have now moved to align with Cloudflare's native patterns.

What should I do?

Update occurrences of Astro.locals.runtime:

Astro.locals.runtime.env → Import env from cloudflare:workers
Astro.locals.runtime.cf → Access via Astro.request.cf
Astro.locals.runtime.caches → Use the global caches object
Astro.locals.runtime (for ExecutionContext) → Use Astro.locals.cfContext

Here's an example showing how to update your code:

Before:

---
const { env, cf, caches, ctx } = Astro.locals.runtime;
const value = await env.MY_KV.get('key');
const country = cf.country;
await caches.default.put(request, response);
ctx.waitUntil(promise);
---

<h1>Country: {country}</h1>

After:

---
import { env } from 'cloudflare:workers';

const value = await env.MY_KV.get('key');
const country = Astro.request.cf.country;
await caches.default.put(request, response);
Astro.locals.cfContext.waitUntil(promise);
---

<h1>Country: {country}</h1>

#15345 840fbf9 Thanks @matthewp! - Removes the cloudflareModules adapter option

The cloudflareModules option has been removed because it is no longer necessary. Cloudflare natively supports importing .sql, .wasm, and other module types.

What should I do?

Remove the cloudflareModules option from your Cloudflare adapter configuration if you were using it:

import cloudflare from '@&#8203;astrojs/cloudflare';

export default defineConfig({
  adapter: cloudflare({
-   cloudflareModules: true
  })
});

#14445 ecb0b98 Thanks @florian-lefebvre! - Astro v6.0 upgrades to Vite v7.0 as the development server and production bundler - (v6 upgrade guidance)
#15037 8641805 Thanks @matthewp! - Updates the Wrangler entrypoint

Previously, the main field in wrangler.jsonc pointed to the built output, since Wrangler only ran in production after the build completed:
```
{
  "main": "dist/_worker.js/index.js",
}
```
Now that Wrangler runs in both development (via workerd) and production, Astro provides a default entrypoint that works for both scenarios.

What should I do?

Update your wrangler.jsonc to use the new entrypoint:
```
{
  "main": "@&#8203;astrojs/cloudflare/entrypoints/server",
}
```
This single entrypoint handles both astro dev and production deployments.
#15480 e118214 Thanks @alexanderniebuhr! - Drops official support for Cloudflare Pages in favor of Cloudflare Workers

The Astro Cloudflare adapter now only supports deployment to Cloudflare Workers by default in order to comply with Cloudflare's recommendations for new projects. If you are currently deploying to Cloudflare Pages, consider migrating to Workers by following the Cloudflare guide for an optimal experience and full feature support.

Minor Changes

#15435 957b9fe Thanks @rururux! - Adds support for configuring the image service as an object with separate build and runtime options

It is now possible to set both a build-time and runtime service independently. Currently, 'compile' is the only available build time option. The supported runtime options are 'passthrough' (default) and 'cloudflare-binding':
```
import { defineConfig } from 'astro/config';
import cloudflare from '@&#8203;astrojs/cloudflare';

export default defineConfig({
  adapter: cloudflare({
    imageService: { build: 'compile', runtime: 'cloudflare-binding' },
  }),
});
```
See the Cloudflare adapter imageService docs for more information about configuring your image service.
#15077 a164c77 Thanks @matthewp! - Adds support for prerendering pages using the workerd runtime.

The Cloudflare adapter now uses the new setPrerenderer() API to prerender pages via HTTP requests to a local preview server running workerd, instead of using Node.js. This ensures prerendered pages are built using the same runtime that serves them in production.
#14306 141c4a2 Thanks @ematipico! - Adds support for astro preview command

Developers can now use astro preview to test their Cloudflare Workers application locally before deploying. The preview runs using Cloudflare's workerd runtime, giving you a staging environment that matches production exactly—including support for KV namespaces, environment variables, and other Cloudflare-specific features.
#15037 8641805 Thanks @matthewp! - The Wrangler configuration file is now optional. If you don't have custom Cloudflare bindings (KV, D1, Durable Objects, etc.), Astro will automatically generate a default configuration for you.

What should I do?

If your wrangler.jsonc only contains basic configuration like this:
```
{
  "main": "@&#8203;astrojs/cloudflare/entrypoints/server",
  "compatibility_date": "2026-01-28",
  "assets": {
    "directory": "./dist",
    "binding": "ASSETS",
  },
}
```
You can safely delete the file. Astro will handle this configuration automatically.

You only need a wrangler config file if you're using:
- KV namespaces
- D1 databases
- Durable Objects
- R2 buckets
- Environment variables
- Custom compatibility flags
- Other Cloudflare-specific features
#15006 f361730 Thanks @florian-lefebvre! - Adds new session driver object shape

For greater flexibility and improved consistency with other Astro code, session drivers are now specified as an object:
```
-import { defineConfig } from 'astro/config'
+import { defineConfig, sessionDrivers } from 'astro/config'

export default defineConfig({
  session: {
-    driver: 'redis',
-    options: {
-      url: process.env.REDIS_URL
-    },
+    driver: sessionDrivers.redis({
+      url: process.env.REDIS_URL
+    }),
  }
})
```
Specifying the session driver as a string has been deprecated, but will continue to work until this feature is removed completely in a future major version. The object shape is the current recommended and documented way to configure a session driver.
#15556 8fb329b Thanks @florian-lefebvre! - Adds support for more @cloudflare/vite-plugin options

The adapter now accepts the following options from Cloudflare's Vite plugin:
- auxiliaryWorkers
- configPath
- inspectorPort
- persistState
- remoteBindings
- experimental.headersAndRedirectsDevModeSupport
For example, you can now set inspectorPort to provide a custom port for debugging your Workers:
```
// astro.config.mjs
import { defineConfig } from 'astro/config';
import cloudflare from '@&#8203;astrojs/cloudflare';

export default defineConfig({
  adapter: cloudflare({
    inspectorPort: 3456,
  }),
});
```

Patch Changes

#15044 7cac71b Thanks @florian-lefebvre! - Removes an exposed internal API of the preview server
#15080 f67b738 Thanks @gameroman! - Updates wrangler dependency to be a peerDependency over a dependency
#15039 6cc96e7 Thanks @matthewp! - Fixes static content deployment by moving it to another folder, so Wrangler can tell the static and worker content apart
#15452 e1aa3f3 Thanks @matthewp! - Fixes server-side dependencies not being discovered ahead of time during development

Previously, imports in .astro file frontmatter were not scanned by Vite's dependency optimizer, causing a "new dependencies optimized" message and page reload when the dependency was first encountered. Astro is now able to scan these dependencies ahead of time.
#15391 5d996cc Thanks @florian-lefebvre! - Fixes types of the handle() function exported from /handler, that could be incompatible with types generated by wrangler types
#15696 a9fd221 Thanks @Princesseuh! - Fixes duplicate logging showing up in some cases when prerendering pages
#15309 4b9c8b8 Thanks @ematipico! - Update the underneath @cloudflare/workers-types library to address a warning emitted by the package manager during the installation.
#15079 4463a55 Thanks @ascorbic! - Fixes auto-provisioning of default bindings (SESSION KV, IMAGES, and ASSETS). Default bindings are now correctly applied whether or not you have a wrangler.json file.
Previously, these bindings were only added when no wrangler config file existed. Now they are added in both cases, unless you've already defined them yourself.
#15694 66449c9 Thanks @matthewp! - Fixes deployment of static sites with the Cloudflare adapter

Fixes an issue with detecting and building fully static sites that caused deployment errors when using output: 'static' with the Cloudflare adapter
#15565 30cd6db Thanks @ematipico! - Fixes an issue where the use of the Code component would result in an unexpected error.
#15121 06261e0 Thanks @ematipico! - Fixes a bug where the Astro, with the Cloudflare integration, couldn't correctly serve certain routes in the development server.
#15026 90c608c Thanks @matthewp! - Improves prebundling of internal Astro modules
#15778 4ebc1e3 Thanks @ematipico! - Fixes an issue where the computed clientAddress was incorrect in cases of a Request header with multiple values. The clientAddress is now also validated to contain only characters valid in IP addresses, rejecting injection payloads.
#15669 d5a888b Thanks @florian-lefebvre! - Removes the cssesc dependency

This CommonJS dependency could sometimes cause errors because Astro is ESM-only. It is now replaced with a built-in ESM-friendly implementation.
#15075 ee2c260 Thanks @matthewp! - Adds deprecation errors for Astro.locals.runtime properties to help migrate from Astro v5 to v6

When accessing the removed Astro.locals.runtime properties on Cloudflare, developers now receive clear error messages explaining the migration path:
- Astro.locals.runtime.env → Use import { env } from "cloudflare:workers"
- Astro.locals.runtime.cf → Use Astro.request.cf
- Astro.locals.runtime.caches → Use the global caches object
- Astro.locals.runtime.ctx → Use Astro.locals.cfContext
#15336 9cce92e Thanks @ascorbic! - Fixes a dev server issue where framework components from linked packages would fail to load with a 504 error.

This could occur when using client:only or other client directives with components from monorepo packages (linked via file: or workspace protocol). The first request would trigger Vite's dependency optimizer mid-request, causing concurrent client module requests to fail.
#15255 a66783a Thanks @florian-lefebvre! - Fixes a case where the types of handle() could mismatch with the ones from the user's project. They now rely on globals, that can be obtained by running wrangler types
#15045 31074fc Thanks @ematipico! - Fixes an issue where using the Vue integration with the Cloudflare adapter resulted in some runtime errors.
#15386 a0234a3 Thanks @OliverSpeir! - Updates astro add cloudflare to use the latest valid compatibility_date in the wrangler config, if available
#15432 e2ad69e Thanks @OliverSpeir! - Removes unnecessary warning about sharp from being printed at start of dev server and build
#15588 425ea16 Thanks @rururux! - Fixes an issue where esbuild would throw a "Top-level return cannot be used inside an ECMAScript module" error during dependency scanning in certain environments.
#15450 50c9129 Thanks @florian-lefebvre! - Fixes a case where build.serverEntry would not be respected when using the new Adapter API
#15030 b5aa52b Thanks @ematipico! - Fixed an issue where the feature experimental.chromeDevtoolsWorkspace wasn't supported by the new version of the adapter.
#15648 802426b Thanks @rururux! - Restore and fix <Code /> component functionality on Cloudflare Workers.
#15478 ee519e5 Thanks @matthewp! - Fixes fully static sites to not output server-side worker code. When all routes are prerendered, the _worker.js directory is now removed from the build output.
#15636 5ecd04c Thanks @florian-lefebvre! - Adds an error when running on Stackblitz, since workerd doesn't support it
#15269 6f82aae Thanks @ematipico! - Fixes a regression where build.serverEntry stopped working as expected.
#15798 05771cf Thanks @rururux! - Fixes a regression where using the adapter would throw an error when using an integration that uses JSX.
#15053 674b63f Thanks @matthewp! - Excludes astro:* and virtual:astro:* from client optimizeDeps in core. Needed for prefetch users since virtual modules are now in the dependency graph.
#15495 5b99e90 Thanks @leekeh! - Refactors to use middlewareMode adapter feature (set to classic)
Updated dependencies [4ebc1e3, 4e7f3e8, a164c77, cf6ea6b, a18d727, 240c317, 745e632]:
- @astrojs/internal-helpers@0.8.0
- @astrojs/underscore-redirects@1.0.0

Patch Changes

#14777 9720b70 Thanks @iclectic! - Updates assets handling to use @astrojs/internal-helpers
Updated dependencies []:
- @astrojs/underscore-redirects@1.0.0

`v12.6.11`

Compare Source

Patch Changes

Updated dependencies [9e9c528, 0f75f6b]:
- @astrojs/internal-helpers@0.7.5
- @astrojs/underscore-redirects@1.0.0

`v12.6.10`

Compare Source

Patch Changes

b8ca69b Thanks @ascorbic! - Refactor remote path detection
Updated dependencies [b8ca69b]:
- @astrojs/internal-helpers@0.7.4
- @astrojs/underscore-redirects@1.0.0

`v12.6.9`

Compare Source

Patch Changes

Updated dependencies [1e2499e]:
- @astrojs/internal-helpers@0.7.3
- @astrojs/underscore-redirects@1.0.0

`v12.6.8`

Compare Source

Patch Changes

#14326 c24a8f4 Thanks @jsparkdev! - Updates vite version to fix CVE
Updated dependencies []:
- @astrojs/underscore-redirects@1.0.0

withastro/astro (@astrojs/react)

`v5.0.1`

Compare Source

Patch Changes

#15864 d3c7de9 Thanks @florian-lefebvre! - Removes temporary support for Node >=20.19.1 because Stackblitz now uses Node 22 by default

`v5.0.0`

Compare Source

Major Changes

#14427 e131261 Thanks @florian-lefebvre! - Increases minimum Node.js version to 22.12.0 - (v6 upgrade guidance)
#14445 ecb0b98 Thanks @florian-lefebvre! - Astro v6.0 upgrades to Vite v7.0 as the development server and production bundler - (v6 upgrade guidance)

Minor Changes

#15312 72f7960 Thanks @ocavue! - Update @vitejs/plugin-react to v5.

Patch Changes

#15187 bbb5811 Thanks @matthewp! - Update to Astro 6 beta
#15264 11efb05 Thanks @florian-lefebvre! - Lower the Node version requirement to allow running on Stackblitz until it supports v22
#15700 4e7f3e8 Thanks @ocavue! - Improves how React components are identified when setting the include and/or exclude options in projects where multiple JSX frameworks are used together
Updated dependencies [4ebc1e3, 4e7f3e8, a164c77, cf6ea6b, a18d727, 240c317, 745e632]:
- @astrojs/internal-helpers@0.8.0

`v4.4.2`

Compare Source

Patch Changes

#14715 3d55c5d Thanks @ascorbic! - Adds support for client hydration in getContainerRenderer()

The getContainerRenderer() function is exported by Astro framework integrations to simplify the process of rendering framework components when using the experimental Container API inside a Vite or Vitest environment. This update adds the client hydration entrypoint to the returned object, enabling client-side interactivity for components rendered using this function. Previously this required users to manually call container.addClientRenderer() with the appropriate client renderer entrypoint.

See the container-with-vitest demo for a usage example, and the Container API documentation for more information on using framework components with the experimental Container API.

`v4.4.1`

Compare Source

Patch Changes

#14621 e3175d9 Thanks @GameRoMan! - Updates vite version to fix CVE

`v4.4.0`

Compare Source

Minor Changes

#14386 f75f446 Thanks @yanthomasdev! - Stabilizes the formerly experimental getActionState() and withState() functions introduced in @astrojs/react v3.4.0 used to integrate Astro Actions with React 19's useActionState() hook.

This example calls a like action that accepts a postId and returns the number of likes. Pass this action to the withState() function to apply progressive enhancement info, and apply to useActionState() to track the result:

import { actions } from 'astro:actions';
import { withState } from '@&#8203;astrojs/react/actions';
import { useActionState } from 'react';

export function Like({ postId }: { postId: string }) {
  const [state, action, pending] = useActionState(
    withState(actions.like),
    0, // initial likes
  );

  return (
    <form action={action}>
      <input type="hidden" name="postId" value={postId} />
      <button disabled={pending}>{state} ❤️</button>
    </form>
  );
}

You can also access the state stored by useActionState() from your action handler. Call getActionState() with the API context, and optionally apply a type to the result:

import { defineAction } from 'astro:actions';
import { z } from 'astro:schema';
import { getActionState } from '@&#8203;astrojs/react/actions';

export const server = {
  like: defineAction({
    input: z.object({
      postId: z.string(),
    }),
    handler: async ({ postId }, ctx) => {
      const currentLikes = getActionState<number>(ctx);
      // write to database
      return currentLikes + 1;
    },
  }),
};

If you were previously using this experimental feature, you will need to update your code to use the new stable exports:

// src/components/Form.jsx
import { actions } from 'astro:actions';
-import { experimental_withState } from '@&#8203;astrojs/react/actions';
+import { withState } from '@&#8203;astrojs/react/actions';
import { useActionState } from "react";

// src/actions/index.ts
import { defineAction, type SafeResult } from 'astro:actions';
import { z } from 'astro:schema';
-import { experimental_getActionState } from '@&#8203;astrojs/react/actions';
+import { getActionState } from '@&#8203;astrojs/react/actions';

`v4.3.1`

Compare Source

Patch Changes

#14326 c24a8f4 Thanks @jsparkdev! - Updates vite version to fix CVE

withastro/astro (astro)

`v6.0.6`

Compare Source

Patch Changes

#15965 2dca307 Thanks @matthewp! - Fixes client hydration for components imported through Node.js subpath imports (package.json#imports, e.g. #components/*), for example when using the Cloudflare adapter in development.
#15770 6102ca2 Thanks @jpc-ae! - Updates the create astro welcome message to highlight the graceful dev/preview server quit command rather than the kill process shortcut
#15953 7eddf22 Thanks @Desel72! - fix(hmr): eagerly recompile on style-only change to prevent stale slots render
#15916 5201ed4 Thanks @trueberryless! - Fixes InferLoaderSchema type inference for content collections defined with a loader that includes a schema
#15864 d3c7de9 Thanks @florian-lefebvre! - Removes temporary support for Node >=20.19.1 because Stackblitz now uses Node 22 by default
#15944 a5e1acd Thanks @fkatsuhiro! - Fixes SSR dynamic routes with .html extension (e.g. [slug].html.astro) not working
#15937 d236245 Thanks @ematipico! - Fixes an issue where HMR didn't correctly work on Windows when adding/changing/deleting routes in pages/.
#15931 98dfb61 Thanks @Strernd! - Fix skew protection query params not being applied to island hydration component-url and renderer-url, and ensure query params are appended safely for asset URLs with existing search/hash parts.
Updated dependencies []:
- @astrojs/markdown-remark@7.0.1

`v6.0.5`

Compare Source

Patch Changes

#15891 b889231 Thanks @matthewp! - Fix dev routing for server:defer islands when adapters opt into handling prerendered routes in Astro core. Server island requests are now treated as prerender-handler eligible so prerendered pages using prerenderEnvironment: 'node' can load island content without 400 errors.
#15890 765a887 Thanks @matthewp! - Fixes astro:actions validation to check resolved routes, so projects using default static output with at least one prerender = false page or endpoint no longer fail during startup.
#15884 dcd2c8e Thanks @matthewp! - Avoid a MaxListenersExceededWarning during astro dev startup by increasing the shared Vite watcher listener limit when attaching content server listeners.
#15904 23d5244 Thanks @jlukic! - Emit the before-hydration script chunk for the client Vite environment. The chunk was only emitted for prerender and ssr environments, causing a 404 when browsers tried to load it. This broke hydration for any integration using injectScript('before-hydration', ...), including Lit SSR.
#15933 325901e Thanks @ematipico! - Fixes an issue where <style> tags inside SVG components weren't correctly tracked when enabling CSP.
#15875 c43ef8a Thanks @matthewp! - Ensure custom prerenderers are always torn down during build, even when getStaticPaths() throws.
#15887 1861fed Thanks @ematipico! - Fixes an issue where the build incorrectly leaked server entrypoint into the client environment, causing adapters to emit warnings during the build.
#15888 925252e Thanks @matthewp! - Fix a bug where server:defer could fail at runtime in prerendered pages for some adapters (including Cloudflare), causing errors like serverIslandMap?.get is not a function.
#15901 07c1002 Thanks @delucis! - Fixes JSON schema generation for content collection schemas that have differences between their input and output shapes.
#15882 759f946 Thanks @matthewp! - Fix Astro.url.pathname for the root page when using build.format: "file" so it resolves to /index.html instead of /.html during builds.

`v6.0.4`

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

cloudflare-workers-and-pages · 2026-03-17T21:28:25Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
🔵 In progress View logs	mojis-dev	`0b6839a`	Mar 25 2026, 05:54 PM

socket-security · 2026-03-17T21:29:15Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@astrojs/react@4.3.0 ⏵ 5.0.1		⁺¹	⁺⁵
@astrojs/cloudflare@12.6.7 ⏵ 13.1.3	⁺¹	⁺²
astro@5.15.9 ⏵ 6.0.8	⁺¹	⁺¹	⁺¹

View full report

socket-security · 2026-03-17T21:29:16Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `miniflare` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/@astrojs/cloudflare@13.1.3` → `npm/miniflare@4.20260317.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/miniflare@4.20260317.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

renovate bot added the dependencies Pull requests that update a dependency label Mar 17, 2026

renovate bot force-pushed the renovate/major-astro-monorepo branch 2 times, most recently from e19b896 to 9d2f625 Compare March 23, 2026 13:53

chore(deps): update astro monorepo

0b6839a

renovate bot force-pushed the renovate/major-astro-monorepo branch from 9d2f625 to 0b6839a Compare March 25, 2026 17:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update astro monorepo (major)#28

chore(deps): update astro monorepo (major)#28
renovate[bot] wants to merge 1 commit intomainfrom
renovate/major-astro-monorepo

renovate bot commented Mar 17, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages bot commented Mar 17, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Mar 17, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Mar 17, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Major Changes

What should I do?

New runtime

What should I do?

What should I do?

What should I do?

Minor Changes

What should I do?

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Major Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

cloudflare-workers-and-pages bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

socket-security bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Mar 17, 2026 •

edited

Loading

cloudflare-workers-and-pages bot commented Mar 17, 2026 •

edited

Loading

socket-security bot commented Mar 17, 2026 •

edited

Loading

socket-security bot commented Mar 17, 2026 •

edited

Loading