build(deps): bump astro from 5.5.5 to 7.1.0 in /test #60

Open

dependabot[bot] wants to merge 1 commit from dependabot/npm_and_yarn/test/astro-7.1.0 into local/mlkem-default

dependabot[bot] commented

2026-07-20 22:02:08 -04:00

(Migrated from github.com)

Bumps astro from 5.5.5 to 7.1.0.

Release notes

Sourced from astro's releases.

astro@7.1.0

Minor Changes
#17302 5f4dc03 Thanks @astrobot-houston! - Adds a new deferRender option to the glob() content loader

When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
#17296 30698a2 Thanks @ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.
#17214 44c4989 Thanks @ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

Scoping sources and hashes in your config

Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.
// astro.config.mjs

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.0

Minor Changes
#17302 5f4dc03 Thanks @astrobot-houston! - Adds a new deferRender option to the glob() content loader

When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.
// src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});
By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.
#17296 30698a2 Thanks @ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:
// astro.config.mjs
import { defineConfig } from 'astro/config';
export default defineConfig({
experimental: {
collectionStorage: 'chunked',
},
});
Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.
#17214 44c4989 Thanks @ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

Scoping sources and hashes in your config

Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.

... (truncated)

Commits

fdd673c [ci] release (#17387)
d9f99e1 Preserve CSP resource defaults for element directives (#17394)
092da56 Add more escaping for rendered content (#17393)
186a1e7 fix(logger): allows setting in updateConfig() (#17391)
4407483 fix(logger): use console API in JSON logger for cross-runtime compatibility...
16de021 feat(logger): allow passing entrypoint as URL (#17389)
ed71eaf fix(logger): make AstroLoggerDestination not generic (#17390)
30698a2 feat: chunk data store (#17296)
44c4989 feat(csp): support for -elem and -attr directives (#17214)
7db6420 Add --ignore-lock flag to run multiple dev servers (#17331)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for astro since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 5.5.5 to 7.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/withastro/astro/releases">astro's releases</a>.</em></p> <blockquote> <h2>astro@7.1.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17302">#17302</a> <a href="https://github.com/withastro/astro/commit/5f4dc0356f2c2ecf98fa88a257908c9226fac9f1"><code>5f4dc03</code></a> Thanks <a href="https://github.com/astrobot-houston"><code>@astrobot-houston</code></a>! - Adds a new <code>deferRender</code> option to the <code>glob()</code> content loader</p> <p>When set to <code>true</code>, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that <code>.mdx</code> files already use.</p> <p>This reduces memory usage during <code>astro build</code> for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like <code>rehype-katex</code>. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.</p> <pre lang="js"><code>// src/content.config.ts import { defineCollection } from 'astro:content'; import { glob } from 'astro/loaders'; <p>const docs = defineCollection({ loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }), }); </code></pre></p> <p>By default <code>deferRender</code> is <code>false</code>, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.</p> </li> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17296">#17296</a> <a href="https://github.com/withastro/astro/commit/30698a2ed525497cdc0fce16d25d1cde0c21473c"><code>30698a2</code></a> Thanks <a href="https://github.com/ematipico"><code>@ematipico</code></a>! - Adds a new experimental <code>collectionStorage</code> option for controlling how the content layer persists its data store</p> <p>By default, Astro serializes the entire content layer data store to a single file (<code>.astro/data-store.json</code>). For very large content collections, this file can grow large enough to hit platform file-size limits.</p> <p>Set <code>experimental.collectionStorage: 'chunked'</code> to instead split the data store across many smaller, content-addressed files inside a <code>.astro/data-store/</code> directory, described by a manifest:</p> <pre lang="js"><code>// astro.config.mjs import { defineConfig } from 'astro/config'; <p>export default defineConfig({ experimental: { collectionStorage: 'chunked', }, }); </code></pre></p> <p>Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is <code>'single-file'</code>, which preserves the current behavior.</p> </li> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17214">#17214</a> <a href="https://github.com/withastro/astro/commit/44c4989139e84951c6579db9975a659765cf2b6c"><code>44c4989</code></a> Thanks <a href="https://github.com/ematipico"><code>@ematipico</code></a>! - Adds support for the more specific CSP directives <code>script-src-elem</code>, <code>script-src-attr</code>, <code>style-src-elem</code>, and <code>style-src-attr</code> through a new <code>kind</code> option.</p> <p>Previously, <a href="https://docs.astro.build/en/reference/configuration-reference/#securitycsp"><code>CSP</code></a> was only scoped to generic <code>script-src</code>/<code>style-src</code> directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline <code>style</code> attributes (such as those from <code>define:vars</code> or Shiki) without loosening the policy for your <code><style></code> and <code><link></code> elements.</p> <h4>Scoping sources and hashes in your config</h4> <p>Each entry in <code>resources</code> and <code>hashes</code> can be an object with a <code>kind</code> property. Depending on whether you use <code>scriptDirective</code> or <code>styleDirective</code>, <code>"element"</code> targets <code>script-src-elem</code> or <code>style-src-elem</code>, <code>"attribute"</code> targets <code>script-src-attr</code> or <code>style-src-attr</code>, and <code>"default"</code> (the same as a bare string or hash) targets <code>script-src</code> or <code>style-src</code>.</p> <pre lang="js"><code>// astro.config.mjs </code></pre> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md">astro's changelog</a>.</em></p> <blockquote> <h2>7.1.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17302">#17302</a> <a href="https://github.com/withastro/astro/commit/5f4dc0356f2c2ecf98fa88a257908c9226fac9f1"><code>5f4dc03</code></a> Thanks <a href="https://github.com/astrobot-houston"><code>@astrobot-houston</code></a>! - Adds a new <code>deferRender</code> option to the <code>glob()</code> content loader</p> <p>When set to <code>true</code>, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that <code>.mdx</code> files already use.</p> <p>This reduces memory usage during <code>astro build</code> for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like <code>rehype-katex</code>. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.</p> <pre lang="js"><code>// src/content.config.ts import { defineCollection } from 'astro:content'; import { glob } from 'astro/loaders'; <p>const docs = defineCollection({ loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }), }); </code></pre></p> <p>By default <code>deferRender</code> is <code>false</code>, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.</p> </li> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17296">#17296</a> <a href="https://github.com/withastro/astro/commit/30698a2ed525497cdc0fce16d25d1cde0c21473c"><code>30698a2</code></a> Thanks <a href="https://github.com/ematipico"><code>@ematipico</code></a>! - Adds a new experimental <code>collectionStorage</code> option for controlling how the content layer persists its data store</p> <p>By default, Astro serializes the entire content layer data store to a single file (<code>.astro/data-store.json</code>). For very large content collections, this file can grow large enough to hit platform file-size limits.</p> <p>Set <code>experimental.collectionStorage: 'chunked'</code> to instead split the data store across many smaller, content-addressed files inside a <code>.astro/data-store/</code> directory, described by a manifest:</p> <pre lang="js"><code>// astro.config.mjs import { defineConfig } from 'astro/config'; <p>export default defineConfig({ experimental: { collectionStorage: 'chunked', }, }); </code></pre></p> <p>Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is <code>'single-file'</code>, which preserves the current behavior.</p> </li> <li> <p><a href="https://redirect.github.com/withastro/astro/pull/17214">#17214</a> <a href="https://github.com/withastro/astro/commit/44c4989139e84951c6579db9975a659765cf2b6c"><code>44c4989</code></a> Thanks <a href="https://github.com/ematipico"><code>@ematipico</code></a>! - Adds support for the more specific CSP directives <code>script-src-elem</code>, <code>script-src-attr</code>, <code>style-src-elem</code>, and <code>style-src-attr</code> through a new <code>kind</code> option.</p> <p>Previously, <a href="https://docs.astro.build/en/reference/configuration-reference/#securitycsp"><code>CSP</code></a> was only scoped to generic <code>script-src</code>/<code>style-src</code> directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline <code>style</code> attributes (such as those from <code>define:vars</code> or Shiki) without loosening the policy for your <code><style></code> and <code><link></code> elements.</p> <h4>Scoping sources and hashes in your config</h4> <p>Each entry in <code>resources</code> and <code>hashes</code> can be an object with a <code>kind</code> property. Depending on whether you use <code>scriptDirective</code> or <code>styleDirective</code>, <code>"element"</code> targets <code>script-src-elem</code> or <code>style-src-elem</code>, <code>"attribute"</code> targets <code>script-src-attr</code> or <code>style-src-attr</code>, and <code>"default"</code> (the same as a bare string or hash) targets <code>script-src</code> or <code>style-src</code>.</p> <pre lang="js"><code></code></pre> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/withastro/astro/commit/fdd673cc193734d7818fe5ace39c86b9500b2754"><code>fdd673c</code></a> [ci] release (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17387">#17387</a>)</li> <li><a href="https://github.com/withastro/astro/commit/d9f99e19e4045da75c7f38650a0f2eeb5c79892b"><code>d9f99e1</code></a> Preserve CSP resource defaults for element directives (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17394">#17394</a>)</li> <li><a href="https://github.com/withastro/astro/commit/092da560eea77ee63a3e2c583c80d8238544e42b"><code>092da56</code></a> Add more escaping for rendered content (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17393">#17393</a>)</li> <li><a href="https://github.com/withastro/astro/commit/186a1e74c2eb342ea35a73fc2c0b1930b3c08921"><code>186a1e7</code></a> fix(logger): allows setting in updateConfig() (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17391">#17391</a>)</li> <li><a href="https://github.com/withastro/astro/commit/4407483e6f9e159164fec83c36d66259baa87e1f"><code>4407483</code></a> fix(logger): use <code>console</code> API in JSON logger for cross-runtime compatibility...</li> <li><a href="https://github.com/withastro/astro/commit/16de02130575c61eb294b382e09bc863cf935ec3"><code>16de021</code></a> feat(logger): allow passing entrypoint as URL (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17389">#17389</a>)</li> <li><a href="https://github.com/withastro/astro/commit/ed71eaf2b5eaa837de438eb252e8651a2aa086f6"><code>ed71eaf</code></a> fix(logger): make AstroLoggerDestination not generic (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17390">#17390</a>)</li> <li><a href="https://github.com/withastro/astro/commit/30698a2ed525497cdc0fce16d25d1cde0c21473c"><code>30698a2</code></a> feat: chunk data store (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17296">#17296</a>)</li> <li><a href="https://github.com/withastro/astro/commit/44c4989139e84951c6579db9975a659765cf2b6c"><code>44c4989</code></a> feat(csp): support for -elem and -attr directives (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17214">#17214</a>)</li> <li><a href="https://github.com/withastro/astro/commit/7db6420d482fc649886148acaf13e5fbf809db87"><code>7db6420</code></a> Add --ignore-lock flag to run multiple dev servers (<a href="https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/17331">#17331</a>)</li> <li>Additional commits viewable in <a href="https://github.com/withastro/astro/commits/astro@7.1.0/packages/astro">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for astro since your current version.</p> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=astro&package-manager=npm_and_yarn&previous-version=5.5.5&new-version=7.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/orpheuslummis/bun-mlkem/network/alerts). </details>

autofix-troubleshooter commented

2026-07-20 22:03:51 -04:00

(Migrated from github.com)

Hi! I'm the autofix.ci troubleshooter bot.

It looks like you correctly set up a CI job that uses the autofix.ci GitHub Action, but the autofix.ci GitHub App has not been installed for this repository. This means that autofix.ci unfortunately does not have the permissions to fix this pull request. If you are the repository owner, please install the app and then restart the CI workflow! 😃

Hi! I'm the <a href="https://autofix.ci"><img alt="autofix logo" src="https://autofix.ci/logo/logo.svg" width="16"><strong>autofix.ci</strong></a> troubleshooter bot. It looks like you correctly set up a CI job that uses the autofix.ci GitHub Action, but the [**autofix.ci GitHub App**](https://github.com/apps/autofix-ci/) has not been installed for this repository. This means that autofix.ci unfortunately does not have the permissions to fix this pull request. If you are the repository owner, please install the app and then restart the CI workflow! 😃

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin dependabot/npm_and_yarn/test/astro-7.1.0:dependabot/npm_and_yarn/test/astro-7.1.0

git switch dependabot/npm_and_yarn/test/astro-7.1.0

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch local/mlkem-default

git merge --no-ff dependabot/npm_and_yarn/test/astro-7.1.0

git switch dependabot/npm_and_yarn/test/astro-7.1.0

git rebase local/mlkem-default

git switch local/mlkem-default

git merge --ff-only dependabot/npm_and_yarn/test/astro-7.1.0

git switch dependabot/npm_and_yarn/test/astro-7.1.0

git rebase local/mlkem-default

git switch local/mlkem-default

git merge --no-ff dependabot/npm_and_yarn/test/astro-7.1.0

git switch local/mlkem-default

git merge --squash dependabot/npm_and_yarn/test/astro-7.1.0