fix(deps): update dependency astro to v6.3.5 by renovate[bot] · Pull Request #304 · sourcectl/webpage

renovate · 2026-05-16T21:24:27Z

This PR contains the following updates:

Package	Change	Age	Confidence
astro (source)	`6.3.1` → `6.3.5`

Release Notes

withastro/astro (astro)

`v6.3.5`

Compare Source

Patch Changes

#16771 07c8805 Thanks @ematipico! - Fixes position prop on <Image> and <Picture> components breaking Content Security Policy (CSP).
#16593 50924ce Thanks @yanthomasdev! - Improves error messages with more consistent and correct writing.
#16757 5d661cd Thanks @astrobot-houston! - Fixes dev server serving stale content when SSR-only modules change (e.g. .astro files outside the project root in a monorepo, or dynamically imported components).

Previously, the astro:hmr-reload plugin returned an empty array after detecting SSR-only module changes, which prevented Vite's updateModules from propagating the invalidation to the SSR module runner. The runner's evaluated module cache stayed stale, so subsequent requests continued returning old content.

Now the plugin returns the SSR-only modules so Vite can process them through updateModules, which properly invalidates the module runner's cache and ensures fresh content on the next request.

`v6.3.4`

Compare Source

Patch Changes

#16723 0f10bfe Thanks @matthewp! - Adds fetchFile option to experimental.advancedRouting to customize or disable the entrypoint file

export default defineConfig({
  experimental: {
    advancedRouting: {
      fetchFile: 'fetch.ts',
    },
  },
});

#16723 0f10bfe Thanks @matthewp! - Fixes Hono cache() middleware to follow the standard wrapper pattern

#16723 0f10bfe Thanks @matthewp! - Adds App.Providers interface for typing custom context providers on Astro and ctx

declare namespace App {
  interface Providers {
    oauth: import('./lib/oauth').OAuthSession;
  }
}

#16723 0f10bfe Thanks @matthewp! - Adds FetchState.response property, set automatically after pages() or middleware() completes
```
const response = await middleware(state, (s) => pages(s));
console.log(state.response === response); // true
```

#16723 0f10bfe Thanks @matthewp! - Adds Fetchable type export for typing the advanced routing entrypoint

import type { Fetchable } from 'astro';

export default {
  async fetch(request) {
    return new Response('ok');
  },
} satisfies Fetchable;

#16572 4a5a077 Thanks @DORI2001! - Suppresses [WARN] Vite warning: unused imports from "@astrojs/internal-helpers/remote" during prerender builds. The package is now bundled alongside astro in the prerender environment, matching how it is handled in the SSR environment.
#16756 b6ee23d Thanks @astrobot-houston! - Fixes styles from Markdoc/MDX custom components not being extracted to <head> in the dev server when using the Cloudflare adapter with prerenderEnvironment: 'node' and rendering content through a wrapper component.
#16747 904d19a Thanks @astrobot-houston! - Fixes Astro action requests failing in astro dev when using the Cloudflare adapter with prerenderEnvironment: 'node' alongside a prerendered catch-all route such as [...page].astro.

Actions and other SSR POST endpoints now continue to work in dev instead of returning an HTTP 500 error.
#16701 3495ce4 Thanks @demaisj! - Fix Map and Set instances saved in a content collection being broken when retrieving entries.
#16614 fca1c32 Thanks @Eptagone! - Fixes entry.data type inference when a live collection is configured without a schema.
#16661 03b8f7f Thanks @ocavue! - Updates typescript to v6. No changes are needed from users.
#16681 c22770a Thanks @dotnetCarpenter! - Fixes an issue where SVG images with width="0" or height="0" incorrectly threw a NoImageMetadata error instead of being treated as valid dimensions.

`v6.3.3`

Compare Source

Patch Changes

#16737 bd84f33 Thanks @matthewp! - Fixes a reflected XSS vulnerability where slot names on hydrated components were not HTML-escaped in SSR output

`v6.3.2`

Compare Source

Patch Changes

#16675 11d4592 Thanks @ascorbic! - Fixes a regression where Astro.cache was undefined when experimental.cache was not configured.

The previous documented behavior is for Astro.cache to always be defined as a no-op shim: cache.set() warns once, cache.invalidate() throws and cache.enabled can be used to gate. This allows library and user code can call cache methods without conditional checks. The cache provider registration was being gated at the call site on experimental.cache being configured, which meant the disabled shim branch inside the provider was unreachable and the Astro.cache getter was never attached to the context.
#16691 0f0a4ce Thanks @matthewp! - Fixes HTMLElement is not defined error during HMR when using components with client-side scripts (e.g. Starlight <Tabs>) and the Cloudflare adapter
#16562 07529ec Thanks @matthewp! - Fixes non-prerendered routes failing when a dynamic prerendered route exists in the same project with prerenderEnvironment: 'node'
#16638 272185b Thanks @ematipico! - Fixes a bug where the Astro compiler wasn't freed at the end of the build. After the fix, the memory used by the compiler is now correctly freed at the end of the build.
#16544 d365c97 Thanks @matthewp! - Tightens isRemotePath() to reject control characters after a leading slash and fixes the dev image endpoint origin check
#16685 889e748 Thanks @farrosfr! - Improve validation messages for security.csp.directives when script-src or style-src are incorrectly placed in the directives array.
#16605 772f13a Thanks @rururux! - Fixes assetsPrefix not being available on build from astro:config/server.
#16556 f38dec7 Thanks @matthewp! - Rejects double-encoded URL paths with a 400 response instead of silently falling back to partial decoding
#16659 38bcb25 Thanks @jsparkdev! - Fixes & characters appearing as raw entity strings (e.g. &#38;) in <meta> tags when viewed in link previews or raw HTML.
Updated dependencies [d365c97, 9256345]:
- @astrojs/internal-helpers@0.9.1
- @astrojs/markdown-remark@7.1.2

Configuration

📅 Schedule: (UTC)

Branch creation
- Only on Sunday and Saturday (* * * * 0,6)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

netlify · 2026-05-16T21:24:32Z

✅ Deploy Preview for lively-frangollo-e43a02 ready!

Name	Link
🔨 Latest commit	`9e6be17`
🔍 Latest deploy log	https://app.netlify.com/projects/lively-frangollo-e43a02/deploys/6a0f7b836620ee0008ded915
😎 Deploy Preview	https://deploy-preview-304--lively-frangollo-e43a02.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

renovate Bot added the dependencies Pull requests that update a dependency file label May 16, 2026

renovate Bot assigned andygrunwald May 16, 2026

renovate Bot added the dependencies Pull requests that update a dependency file label May 16, 2026

renovate Bot force-pushed the renovate/astro-monorepo branch from 270c21a to d76cc83 Compare May 17, 2026 17:14

renovate Bot changed the title ~~fix(deps): update dependency astro to v6.3.2~~ fix(deps): update dependency astro to v6.3.3 May 17, 2026

renovate Bot force-pushed the renovate/astro-monorepo branch from d76cc83 to a75335d Compare May 21, 2026 16:49

renovate Bot changed the title ~~fix(deps): update dependency astro to v6.3.3~~ fix(deps): update dependency astro to v6.3.4 May 21, 2026

fix(deps): update dependency astro to v6.3.5

9e6be17

renovate Bot force-pushed the renovate/astro-monorepo branch from a75335d to 9e6be17 Compare May 21, 2026 21:39

renovate Bot changed the title ~~fix(deps): update dependency astro to v6.3.4~~ fix(deps): update dependency astro to v6.3.5 May 21, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency astro to v6.3.5#304

fix(deps): update dependency astro to v6.3.5#304
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/astro-monorepo

renovate Bot commented May 16, 2026 •

edited

Loading

Uh oh!

netlify Bot commented May 16, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented May 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v6.3.5

Patch Changes

v6.3.4

Patch Changes

v6.3.3

Patch Changes

v6.3.2

Patch Changes

Configuration

Uh oh!

netlify Bot commented May 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for lively-frangollo-e43a02 ready!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented May 16, 2026 •

edited

Loading

`v6.3.5`

`v6.3.4`

`v6.3.3`

`v6.3.2`

netlify Bot commented May 16, 2026 •

edited

Loading