Bump the npm_and_yarn group across 16 directories with 5 updates by dependabot[bot] · Pull Request #17 · NeuroLift-Technologies/templates

dependabot · 2026-05-14T23:14:03Z

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
@astrojs/cloudflare	`12.6.0`	`13.1.10`
astro	`5.10.1`	`6.1.10`
hono	`4.8.2`	`4.12.18`
next	`15.3.3`	`15.5.18`
devalue	`4.3.3`	`5.8.1`

Bumps the npm_and_yarn group with 2 updates in the /astro-blog-starter-template directory: @astrojs/cloudflare and astro.
Bumps the npm_and_yarn group with 2 updates in the /chanfana-openapi-template directory: hono and devalue.
Bumps the npm_and_yarn group with 1 update in the /containers-template directory: hono.
Bumps the npm_and_yarn group with 1 update in the /d1-starter-sessions-api-template directory: devalue.
Bumps the npm_and_yarn group with 1 update in the /llm-chat-app-template directory: devalue.
Bumps the npm_and_yarn group with 1 update in the /mysql-hyperdrive-template directory: devalue.
Bumps the npm_and_yarn group with 1 update in the /next-starter-template directory: next.
Bumps the npm_and_yarn group with 1 update in the /openauth-template directory: hono.
Bumps the npm_and_yarn group with 1 update in the /postgres-hyperdrive-template directory: devalue.
Bumps the npm_and_yarn group with 1 update in the /r2-explorer-template directory: hono.
Bumps the npm_and_yarn group with 1 update in the /react-postgres-fullstack-template directory: hono.
Bumps the npm_and_yarn group with 1 update in the /react-router-hono-fullstack-template directory: hono.
Bumps the npm_and_yarn group with 1 update in the /react-router-postgres-ssr-template directory: hono.
Bumps the npm_and_yarn group with 3 updates in the /saas-admin-template directory: @astrojs/cloudflare, astro and devalue.
Bumps the npm_and_yarn group with 1 update in the /vite-react-template directory: hono.

Updates @astrojs/cloudflare from 12.6.0 to 13.1.10

Release notes

Sourced from @astrojs/cloudflare's releases.

@astrojs/cloudflare@13.1.10

Patch Changes

#16320 a43eb4b Thanks @matthewp! - Uses redirect: 'manual' for remote image fetches in the Cloudflare binding image transform, consistent with all other image fetch paths

#16307 a81dd3e Thanks @matthewp! - Surfaces console.log and console.warn output from workerd during prerendering

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

@astrojs/cloudflare@13.1.9

Patch Changes

#16210 e030bd0 Thanks @matthewp! - Fixes .svelte files in node_modules failing with Unknown file extension ".svelte" when using the Cloudflare adapter with prerenderEnvironment: 'node'

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

@astrojs/cloudflare@13.1.8

Patch Changes

#16225 756e7be Thanks @travisbreaks! - Fixes ERR_MULTIPLE_CONSUMERS error when using Cloudflare Queues with prerendered pages. The prerender worker config callback now excludes queues.consumers from the entry worker config, since the prerender worker only renders static HTML and should not register as a queue consumer. Queue producers (bindings) are preserved.

#16192 79d86b8 Thanks @alexanderniebuhr! - Removes an unused function re-export from the /info package path

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

@astrojs/cloudflare@13.1.7

Patch Changes

Updated dependencies [814406d]:

@astrojs/underscore-redirects@1.0.3

@astrojs/cloudflare@13.1.6

Patch Changes

#16151 4978165 Thanks @matthewp! - Fixes a dev-mode crash loop in the Cloudflare adapter when using Starlight by excluding @astrojs/starlight from SSR dependency optimization

@astrojs/cloudflare@13.1.5

Patch Changes

#16109 c887b4a Thanks @matthewp! - Fix HMR crash when editing content collection files caused by Vite's SSR transform colliding with zod v4's meta export

Updated dependencies []:

@astrojs/underscore-redirects@1.0.2

Changelog

Sourced from @astrojs/cloudflare's changelog.

13.1.10

Patch Changes

#16320 a43eb4b Thanks @matthewp! - Uses redirect: 'manual' for remote image fetches in the Cloudflare binding image transform, consistent with all other image fetch paths

#16307 a81dd3e Thanks @matthewp! - Surfaces console.log and console.warn output from workerd during prerendering

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

13.1.9

Patch Changes

#16210 e030bd0 Thanks @matthewp! - Fixes .svelte files in node_modules failing with Unknown file extension ".svelte" when using the Cloudflare adapter with prerenderEnvironment: 'node'

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

13.1.8

Patch Changes

#16225 756e7be Thanks @travisbreaks! - Fixes ERR_MULTIPLE_CONSUMERS error when using Cloudflare Queues with prerendered pages. The prerender worker config callback now excludes queues.consumers from the entry worker config, since the prerender worker only renders static HTML and should not register as a queue consumer. Queue producers (bindings) are preserved.

#16192 79d86b8 Thanks @alexanderniebuhr! - Removes an unused function re-export from the /info package path

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

13.1.7

Patch Changes

Updated dependencies [814406d]:

@astrojs/underscore-redirects@1.0.3

13.1.6

Patch Changes

#16151 4978165 Thanks @matthewp! - Fixes a dev-mode crash loop in the Cloudflare adapter when using Starlight by excluding @astrojs/starlight from SSR dependency optimization

13.1.5

Patch Changes

#16109 c887b4a Thanks @matthewp! - Fix HMR crash when editing content collection files caused by Vite's SSR transform colliding with zod v4's meta export

... (truncated)

Commits

eca29c1 [ci] release (#16314)
a43eb4b Use redirect: manual in Cloudflare image binding transform (#16320)
a81dd3e Surface console output from workerd during Cloudflare prerendering (#16307)
1945a93 [ci] release (#16281)
e030bd0 Fix .svelte files in node_modules with Cloudflare prerenderEnvironment: node ...
92fc030 refactor(core): rename logger internal types (#16271)
673a871 [ci] release (#16244)
79d86b8 chore: adapt code to upstream deprecation (#16192)
756e7be fix(cloudflare): exclude queue consumers from prerender worker (#16225)
b5b8093 [ci] release (#16159)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @astrojs/cloudflare since your current version.

Updates astro from 5.10.1 to 6.1.10

Release notes

Sourced from astro's releases.

astro@6.1.10

Patch Changes

#16479 1058428 Thanks @matthewp! - Fixes a spurious [WARN] [content] Content config not loaded warning during astro dev for projects that don't use content collections

#16457 3d82220 Thanks @matthewp! - Hardens server island encryption to prevent encrypted data from one island component being replayed against a different one

#16481 152700e Thanks @matthewp! - Fixes a spurious 404 request for a dev toolbar sourcemap during astro dev caused by the browser mis-resolving a relative sourceMappingURL from the /@id/ URL prefix

#16480 1bcb43b Thanks @matthewp! - Fixes an unnecessary full page reload on first navigation during dev

astro@6.1.9

Patch Changes

#16448 99464ed Thanks @matthewp! - Updates vite, picomatch, and unstorage to latest patch versions

#16422 a3951d7 Thanks @matthewp! - Hardens astro-island export resolution and hydration error handling for malformed component metadata

#16420 e21de1d Thanks @matthewp! - Hardens Astro's error overlay and server logging paths to avoid unsafe HTML insertion and format-string interpolation

#16419 f3485c3 Thanks @matthewp! - Hardens nested object and package metadata lookups to ignore prototype keys in content handling and project scaffolding

#16022 a002540 Thanks @mathieumaf! - Fixes an issue where i18n domains would return 404 when trailingSlash is set to never.

Updated dependencies [99464ed, f3485c3]:

@astrojs/internal-helpers@0.9.0

@astrojs/markdown-remark@7.1.1

astro@6.1.8

Patch Changes

#16367 a6866a7 Thanks @ematipico! - Fixes an issue where build output files could contain special characters (!, ~, {, }) in their names, causing deploy failures on platforms like Netlify.

#16381 217c5b3 Thanks @ematipico! - Slightly improved the performance of the dev server by caching the internal crawling of the dependencies of a project.

#16348 7d26cd7 Thanks @ocavue! - Fixes a bug where emitted assets during a client build would contain always fresh, new hashes in their name. Now the build should be more stable.

#16317 d012bfe Thanks @das-peter! - Fixes a bug where allowedDomains weren't correctly propagated when using the development server.

#16379 5a84551 Thanks @martrapp! - Improves Vue scoped style handling in DEV mode during client router navigation.

#16317 d012bfe Thanks @das-peter! - Adds tests to verify settings are properly propagated when using the development server.

#16282 5b0fdaa Thanks @jmurty! - Fixes build errors on platforms with skew protection enabled (e.g. Vercel, Netlify) for inter-chunk Javascript using dynamic imports

Updated dependencies [e0b240e]:

@astrojs/telemetry@3.3.1

astro@6.1.7

Patch Changes

... (truncated)

Changelog

Sourced from astro's changelog.

6.1.10

Patch Changes

#16479 1058428 Thanks @matthewp! - Fixes a spurious [WARN] [content] Content config not loaded warning during astro dev for projects that don't use content collections

#16457 3d82220 Thanks @matthewp! - Hardens server island encryption to prevent encrypted data from one island component being replayed against a different one

#16481 152700e Thanks @matthewp! - Fixes a spurious 404 request for a dev toolbar sourcemap during astro dev caused by the browser mis-resolving a relative sourceMappingURL from the /@id/ URL prefix

#16480 1bcb43b Thanks @matthewp! - Fixes an unnecessary full page reload on first navigation during dev

6.1.9

Patch Changes

#16448 99464ed Thanks @matthewp! - Updates vite, picomatch, and unstorage to latest patch versions

#16422 a3951d7 Thanks @matthewp! - Hardens astro-island export resolution and hydration error handling for malformed component metadata

#16420 e21de1d Thanks @matthewp! - Hardens Astro's error overlay and server logging paths to avoid unsafe HTML insertion and format-string interpolation

#16419 f3485c3 Thanks @matthewp! - Hardens nested object and package metadata lookups to ignore prototype keys in content handling and project scaffolding

#16022 a002540 Thanks @mathieumaf! - Fixes an issue where i18n domains would return 404 when trailingSlash is set to never.

Updated dependencies [99464ed, f3485c3]:

@astrojs/internal-helpers@0.9.0

@astrojs/markdown-remark@7.1.1

6.1.8

Patch Changes

#16367 a6866a7 Thanks @ematipico! - Fixes an issue where build output files could contain special characters (!, ~, {, }) in their names, causing deploy failures on platforms like Netlify.

#16381 217c5b3 Thanks @ematipico! - Slightly improved the performance of the dev server by caching the internal crawling of the dependencies of a project.

#16348 7d26cd7 Thanks @ocavue! - Fixes a bug where emitted assets during a client build would contain always fresh, new hashes in their name. Now the build should be more stable.

#16317 d012bfe Thanks @das-peter! - Fixes a bug where allowedDomains weren't correctly propagated when using the development server.

#16379 5a84551 Thanks @martrapp! - Improves Vue scoped style handling in DEV mode during client router navigation.

#16317 d012bfe Thanks @das-peter! - Adds tests to verify settings are properly propagated when using the development server.

#16282 5b0fdaa Thanks @jmurty! - Fixes build errors on platforms with skew protection enabled (e.g. Vercel, Netlify) for inter-chunk Javascript using dynamic imports

Updated dependencies [e0b240e]:

@astrojs/telemetry@3.3.1

... (truncated)

Commits

c1f2e4f [ci] release (#16467)
345fb9e chore: fix flaky dev toolbar render time test (#16500)
5120ecd [ci] format
3d82220 Add AEAD context binding to server island encryption (#16457)
1bcb43b Prebundle dev toolbar entrypoint in client environment (#16480)
93101cc [ci] format
152700e fix: strip sourceMappingURL from dev toolbar entrypoint during dep optimizati...
bc83041 refactor(astro): migrate test utils to typescript (#16492)
5c543c5 refactor(astro): add internal entry points for test (#16473)
1058428 Suppress content config warning for projects without content collections (#16...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for astro since your current version.

Updates hono from 4.8.2 to 4.12.18

Release notes

Sourced from hono's releases.

v4.12.18

Security fixes

This release includes fixes for the following security issues:

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

Affects: Cache Middleware. Fixes missing cache-skip handling for Vary: Authorization and Vary: Cookie, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rm

CSS Declaration Injection via Style Object Values in JSX SSR

Affects: hono/jsx. Fixes a missing CSS-context escape for style object values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7p

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

Affects: hono/utils/jwt. Fixes improper validation of exp, nbf, and iat claims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36

Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.

v4.12.17

What's Changed

fix(jsx): normalize SVG attributes on the root element by @kfly8 in honojs/hono#4893

fix(ssg): add atom+xml and rss+xml to defaultExtensionMap by @yuintei in honojs/hono#4899

fix(cors): make origin optional in CORSOptions by @truffle-dev in honojs/hono#4905

fix(types): propagate middleware response types to app.on overloads by @T4ko0522 in honojs/hono#4906

New Contributors

@kfly8 made their first contribution in honojs/hono#4893

@truffle-dev made their first contribution in honojs/hono#4905

Full Changelog: honojs/hono@v4.12.16...v4.12.17

v4.12.16

Security fixes

This release includes fixes for the following security issues:

Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

Affects: hono/jsx. Fixes missing validation of JSX tag names when using jsx() or createElement(), which could allow HTML injection if untrusted input is used as the tag name. GHSA-69xw-7hcm-h432

bodyLimit() can be bypassed for chunked / unknown-length requests

Affects: Body Limit Middleware. Fixes late enforcement for request bodies without a reliable Content-Length (e.g. chunked requests), where oversized requests could reach handlers and return successful responses before being rejected. GHSA-9vqf-7f2p-gf9v

v4.12.15

What's Changed

fix(jwt): support single-line PEM keys by @hiendv in honojs/hono#4889

... (truncated)

Commits

f10dee8 4.12.18
a5bd9eb Merge commit from fork
58d3d3a Merge commit from fork
568c2ec Merge commit from fork
ff2b3d3 4.12.17
52aaaf9 fix(types): propagate middleware response types to app.on overloads (#4906)
76d5589 fix(cors): make origin optional in CORSOptions (#4905)
8f027e5 fix(ssg): add atom+xml and rss+xml to defaultExtensionMap (#4899)
bfba97c fix(jsx): normalize SVG attributes on the <svg> root element (#4893)
90d4182 4.12.16
Additional commits viewable in compare view

Updates next from 15.3.3 to 15.5.18

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.16

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

v15.5.14

[!NOTE]

... (truncated)

Commits

9ff92ce v15.5.18
00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
62c97ab v15.5.17
423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
fa78739 Turbopack: Fix middleware matcher suffix (#93590)
36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
36589b5 [backport][test] Pin package manager to patch versions (#93596)
ad6fd4e v15.5.16
79d7dff Ignore malformed CSP nonce headers (#103)
c4f6908 router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates devalue from 4.3.3 to 5.8.1

Release notes

Sourced from devalue's releases.

v5.8.1

Patch Changes

206ca67: fix: force sparse arrays to allocate sparsely

v5.8.0

Minor Changes

c5115b0: feat: add stringifyAsync for async serialization

v5.7.1

Patch Changes

8becc7c: fix: handle regexes consistently in uneval's value and reference formats

v5.7.0

Minor Changes

df2e284: feat: use native alternatives to encode/decode base64

498656e: feat: add DataView support

a210130: feat: whitelist Float16Array

df2e284: feat: simplify TypedArray slices

Patch Changes

5590634: fix: get uneval type handling up to parity with stringify

57f73fc: fix: correctly support boxed bigints and sentinel values

v5.6.4

Patch Changes

87c1f3c: fix: reject __proto__ keys in malformed Object wrapper payloads

This validates the "Object" parse path and throws when the wrapped value has an own __proto__ key.

40f1db1: fix: ensure sparse array indices are integers

87c1f3c: fix: disallow __proto__ keys in null-prototype object parsing

This disallows __proto__ keys in the "null" parse path so null-prototype object hydration cannot carry that key through parse/unflatten.

v5.6.3

Patch Changes

0f04d4d: fix: Properly handle __proto__

819f1ac: fix: better encoding for sparse arrays

v5.6.2

Patch Changes

... (truncated)

Changelog

Sourced from devalue's changelog.

5.8.1

Patch Changes

206ca67: fix: force sparse arrays to allocate sparsely

5.8.0

Minor Changes

c5115b0: feat: add stringifyAsync for async serialization

5.7.1

Patch Changes

8becc7c: fix: handle regexes consistently in uneval's value and reference formats

5.7.0

Minor Changes

df2e284: feat: use native alternatives to encode/decode base64

498656e: feat: add DataView support

a210130: feat: whitelist Float16Array

df2e284: feat: simplify TypedArray slices

Patch Changes

5590634: fix: get uneval type handling up to parity with stringify

57f73fc: fix: correctly support boxed bigints and sentinel values

5.6.4

Patch Changes

87c1f3c: fix: reject __proto__ keys in malformed Object wrapper payloads

This validates the "Object" parse path and throws when the wrapped value has an own __proto__ key.

40f1db1: fix: ensure sparse array indices are integers

87c1f3c: fix: disallow __proto__ keys in null-prototype object parsing

This disallows __proto__ keys in the "null" parse path so null-prototype object hydration cannot carry that key through parse/unflatten.

5.6.3

Patch Changes

0f04d4d: fix: Properly handle __proto__

819f1ac: fix: better encoding for sparse arrays

5.6.2

... (truncated)

Commits

796ea83 Version Packages (#152)
206ca67 Merge commit from fork
14933f7 Version Packages (#151)
c5115b0 feat: stringifyAsync (#150)
67dad45 docs: update README to reflect serialization stability non-goal (#147)
6eb920a Version Packages (#146)
8becc7c fix: handle regexes consistently in uneval's value and reference formats (#145)
2eee2e4 Version Packages (#144)
498656e DataView support (#143)
5590634 Improve platform types support (#142)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for devalue since your current version.

Updates @astrojs/cloudflare from 12.6.0 to 13.1.10

Release notes

Sourced from @astrojs/cloudflare's releases.

@astrojs/cloudflare@13.1.10

Patch Changes

#16320 a43eb4b Thanks @matthewp! - Uses redirect: 'manual' for remote image fetches in the Cloudflare binding image transform, consistent with all other image fetch paths

#16307 a81dd3e Thanks @matthewp! - Surfaces console.log and console.warn output from workerd during prerendering

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

@astrojs/cloudflare@13.1.9

Patch Changes

#16210 e030bd0 Thanks @matthewp! - Fixes .svelte files in node_modules failing with Unknown file extension ".svelte" when using the Cloudflare adapter with prerenderEnvironment: 'node'

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

@astrojs/cloudflare@13.1.8

Patch Changes

#16225 756e7be Thanks @travisbreaks! - Fixes ERR_MULTIPLE_CONSUMERS error when using Cloudflare Queues with prerendered pages. The prerender worker config callback now excludes queues.consumers from the entry worker config, since the prerender worker only renders static HTML and should not register as a queue consumer. Queue producers (bindings) are preserved.

#16192 79d86b8 Thanks @alexanderniebuhr! - Removes an unused function re-export from the /info package path

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

@astrojs/cloudflare@13.1.7

Patch Changes

Updated dependencies [814406d]:

@astrojs/underscore-redirects@1.0.3

@astrojs/cloudflare@13.1.6

Patch Changes

#16151 4978165 Thanks @matthewp! - Fixes a dev-mode crash loop in the Cloudflare adapter when using Starlight by excluding @astrojs/starlight from SSR dependency optimization

@astrojs/cloudflare@13.1.5

Patch Changes

#16109 c887b4a Thanks @matthewp! - Fix HMR crash when editing content collection files caused by Vite's SSR transform colliding with zod v4's meta export

Updated dependencies []:

@astrojs/underscore-redirects@1.0.2

Changelog

Sourced from @astrojs/cloudflare's changelog.

13.1.10

Patch Changes

#16320 a43eb4b Thanks @matthewp! - Uses redirect: 'manual' for remote image fetches in the Cloudflare binding image transform, consistent with all other image fetch paths

#16307 a81dd3e Thanks @matthewp! - Surfaces console.log and console.warn output from workerd during prerendering

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

13.1.9

Patch Changes

#16210 e030bd0 Thanks @matthewp! - Fixes .svelte files in node_modules failing with Unknown file extension ".svelte" when using the Cloudflare adapter with prerenderEnvironment: 'node'

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

13.1.8

Patch Changes

#16225 756e7be Thanks @travisbreaks! - Fixes ERR_MULTIPLE_CONSUMERS error when using Cloudflare Queues with prerendered pages. The prerender worker config callback now excludes queues.consumers from the entry worker config, since the prerender worker only renders static HTML and should not register as a queue consumer. Queue producers (bindings) are preserved.

#16192 79d86b8 Thanks @alexanderniebuhr! - Removes an unused function re-export from the /info package path

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

13.1.7

Patch Changes

Updated dependencies [814406d]:

@astrojs/underscore-redirects@1.0.3

13.1.6

Patch Changes

#16151 4978165 Thanks @matthewp! - Fixes a dev-mode crash loop in the Cloudflare adapter when using Starlight by excluding @astrojs/starlight from SSR dependency optimization

13.1.5

Patch Changes

#16109 c887b4a Thanks @matthewp! - Fix HMR crash when editing content collection files caused by Vite's SSR transform colliding with zod v4's meta export

... (truncated)

Commits

eca29c1 [ci] release (#16314)
a43eb4b Use redirect: manual in Cloudflare image binding transform (

Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) | `12.6.0` | `13.1.10` | | [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `5.10.1` | `6.1.10` | | [hono](https://github.com/honojs/hono) | `4.8.2` | `4.12.18` | | [next](https://github.com/vercel/next.js) | `15.3.3` | `15.5.18` | | [devalue](https://github.com/sveltejs/devalue) | `4.3.3` | `5.8.1` | Bumps the npm_and_yarn group with 2 updates in the /astro-blog-starter-template directory: [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) and [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). Bumps the npm_and_yarn group with 2 updates in the /chanfana-openapi-template directory: [hono](https://github.com/honojs/hono) and [devalue](https://github.com/sveltejs/devalue). Bumps the npm_and_yarn group with 1 update in the /containers-template directory: [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 1 update in the /d1-starter-sessions-api-template directory: [devalue](https://github.com/sveltejs/devalue). Bumps the npm_and_yarn group with 1 update in the /llm-chat-app-template directory: [devalue](https://github.com/sveltejs/devalue). Bumps the npm_and_yarn group with 1 update in the /mysql-hyperdrive-template directory: [devalue](https://github.com/sveltejs/devalue). Bumps the npm_and_yarn group with 1 update in the /next-starter-template directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /openauth-template directory: [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 1 update in the /postgres-hyperdrive-template directory: [devalue](https://github.com/sveltejs/devalue). Bumps the npm_and_yarn group with 1 update in the /r2-explorer-template directory: [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 1 update in the /react-postgres-fullstack-template directory: [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 1 update in the /react-router-hono-fullstack-template directory: [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 1 update in the /react-router-postgres-ssr-template directory: [hono](https://github.com/honojs/hono). Bumps the npm_and_yarn group with 3 updates in the /saas-admin-template directory: [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare), [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) and [devalue](https://github.com/sveltejs/devalue). Bumps the npm_and_yarn group with 1 update in the /vite-react-template directory: [hono](https://github.com/honojs/hono). Updates `@astrojs/cloudflare` from 12.6.0 to 13.1.10 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@13.1.10/packages/integrations/cloudflare) Updates `astro` from 5.10.1 to 6.1.10 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@6.1.10/packages/astro) Updates `hono` from 4.8.2 to 4.12.18 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.8.2...v4.12.18) Updates `next` from 15.3.3 to 15.5.18 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.3.3...v15.5.18) Updates `devalue` from 4.3.3 to 5.8.1 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v4.3.3...v5.8.1) Updates `@astrojs/cloudflare` from 12.6.0 to 13.1.10 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@13.1.10/packages/integrations/cloudflare) Updates `astro` from 5.10.1 to 6.3.3 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@6.1.10/packages/astro) Updates `hono` from 4.8.2 to 4.12.18 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.8.2...v4.12.18) Updates `devalue` from 4.3.3 to 5.8.1 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v4.3.3...v5.8.1) Updates `hono` from 4.8.2 to 4.12.18 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.8.2...v4.12.18) Updates `devalue` from 4.3.3 to 5.8.1 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v4.3.3...v5.8.1) Updates `devalue` from 4.3.3 to 5.8.1 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v4.3.3...v5.8.1) Updates `devalue` from 4.3.3 to 5.8.1 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v4.3.3...v5.8.1) Updates `next` from 15.3.3 to 15.5.18 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v15.3.3...v15.5.18) Updates `hono` from 4.9.12 to 4.12.18 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.8.2...v4.12.18) Updates `devalue` from 4.3.3 to 5.8.1 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v4.3.3...v5.8.1) Updates `hono` from 4.9.12 to 4.12.18 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.8.2...v4.12.18) Updates `hono` from 4.8.2 to 4.12.18 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.8.2...v4.12.18) Updates `hono` from 4.8.2 to 4.12.18 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.8.2...v4.12.18) Updates `hono` from 4.8.2 to 4.12.18 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.8.2...v4.12.18) Updates `@astrojs/cloudflare` from 12.6.0 to 13.1.10 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@13.1.10/packages/integrations/cloudflare) Updates `astro` from 5.18.1 to 6.1.10 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@6.1.10/packages/astro) Updates `devalue` from 5.6.4 to 5.8.1 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v4.3.3...v5.8.1) Updates `hono` from 4.12.7 to 4.12.18 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.8.2...v4.12.18) --- updated-dependencies: - dependency-name: "@astrojs/cloudflare" dependency-version: 13.1.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: astro dependency-version: 6.1.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.8.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@astrojs/cloudflare" dependency-version: 13.1.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: astro dependency-version: 6.3.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.8.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.8.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.8.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.8.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: next dependency-version: 15.5.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.8.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.18 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.18 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.18 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@astrojs/cloudflare" dependency-version: 13.1.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: astro dependency-version: 6.1.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.8.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.12.18 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 14, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 16 directories with 5 updates#17

Bump the npm_and_yarn group across 16 directories with 5 updates#17
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-fb03341cf3

dependabot Bot commented on behalf of github May 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 14, 2026

@​astrojs/cloudflare@​13.1.10

Patch Changes

@​astrojs/cloudflare@​13.1.9

Patch Changes

@​astrojs/cloudflare@​13.1.8

Patch Changes

@​astrojs/cloudflare@​13.1.7

Patch Changes

@​astrojs/cloudflare@​13.1.6

Patch Changes

@​astrojs/cloudflare@​13.1.5

Patch Changes

13.1.10

Patch Changes

13.1.9

Patch Changes

13.1.8

Patch Changes

13.1.7

Patch Changes

13.1.6

Patch Changes

13.1.5

Patch Changes

astro@6.1.10

Patch Changes

astro@6.1.9

Patch Changes

astro@6.1.8

Patch Changes

astro@6.1.7

Patch Changes

6.1.10

Patch Changes

6.1.9

Patch Changes

6.1.8

Patch Changes

v4.12.18

Security fixes

Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

CSS Declaration Injection via Style Object Values in JSX SSR

Improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

v4.12.17

What's Changed

New Contributors

v4.12.16

Security fixes

Unvalidated JSX Tag Names in hono/jsx May Allow HTML Injection

bodyLimit() can be bypassed for chunked / unknown-length requests

v4.12.15

What's Changed

v15.5.18

v15.5.16

v15.5.15

v15.5.14

v5.8.1

Patch Changes

v5.8.0

Minor Changes

v5.7.1

Patch Changes

v5.7.0

Minor Changes

Patch Changes

v5.6.4

Patch Changes

v5.6.3

Patch Changes

v5.6.2

Patch Changes

5.8.1

Patch Changes

5.8.0

Minor Changes

5.7.1

Patch Changes

5.7.0

`@astrojs/cloudflare@13`.1.10

`@astrojs/cloudflare@13`.1.9

`@astrojs/cloudflare@13`.1.8

`@astrojs/cloudflare@13`.1.7

`@astrojs/cloudflare@13`.1.6

`@astrojs/cloudflare@13`.1.5

`@astrojs/cloudflare@13`.1.10

`@astrojs/cloudflare@13`.1.9

`@astrojs/cloudflare@13`.1.8

`@astrojs/cloudflare@13`.1.7

`@astrojs/cloudflare@13`.1.6

`@astrojs/cloudflare@13`.1.5