chore(deps)(deps): bump astro from 6.4.8 to 7.1.3

[dependabot]

Bumps astro from 6.4.8 to 7.1.3.

Release notes

Sourced from astro's releases.

astro@7.1.3

Patch Changes

• #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

astro@7.1.2

Patch Changes

• #17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

• #17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

• #17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

astro@7.1.1

Patch Changes

• #17399 4b03702 Thanks @​matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

astro@7.1.0

Minor Changes

• #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

  When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

  This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

  // src/content.config.ts
  import { defineCollection } from 'astro:content';
  import { glob } from 'astro/loaders';
  const docs = defineCollection({
  loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
  });

  By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

• #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

  By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

  Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

  // astro.config.mjs

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.3

Patch Changes

• #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

7.1.2

Patch Changes

• #17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

• #17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

• #17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

7.1.1

Patch Changes

• #17399 4b03702 Thanks @​matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

7.1.0

Minor Changes

• #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

  When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

  This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

  // src/content.config.ts
  import { defineCollection } from 'astro:content';
  import { glob } from 'astro/loaders';
  const docs = defineCollection({
  loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
  });

  By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

• #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

  By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

... (truncated)

Commits

• cf9ffc7 [ci] release (#17455)
• 630b382 Use os.availableParallelism() for image optimization queue to fix OOM in CP...
• 8a7f7e0 [ci] release (#17411)
• ebbd793 chore(deps): update astro-embed (#17436)
• 311e42c [ci] format
• 1d62202 chore(deps): update neotraverse to v1 (#17446)
• a5f7230 fix(astro): update cookie to v2 (#17445)
• 91992ef fix(prefetch): swallow fetch-fallback rejection to avoid unhandled 'Load fail...
• a89c137 fix(astro): propagate mutated locals to custom error pages (#17402)
• 91c645a [ci] release (#17403)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cursor]

Security review: no high-confidence vulnerabilities introduced

Scope: package.json + package-lock.json only — astro ^6.4.8 → ^7.1.3. No application, config, or workflow code changes.

Summary

This dependency-only PR does not introduce new exploitable attack surface in the repository. It is a net security improvement by clearing Astro advisories that affected <=7.0.9 (including reflected XSS in View Transition animation properties, GHSA-4g3v-8h47-v7g6).

npm audit --omit=dev on the PR lockfile: 35 findings (6 high), down from 36 (7 high) on base; the astro package is no longer flagged.

---

Checklist (no confirmed issues)

Area	Result
Injection (SQL/cmd/template/path)	N/A — no runtime code changes
Authn/authz bypass	N/A — static site; no auth logic touched
Secrets / token leakage	None — no secrets, logging, or env handling changes
Deserialization / SSRF / CSRF	N/A — no request-handling code changes
XSS	Improved — Astro View Transition XSS patched; site uses ClientRouter but does not pass user-controlled animation values
Supply chain	Acceptable — routine Dependabot major bump; lockfile resolves astro@7.1.3 from npm registry

---

Confirmed vulnerabilities introduced by this PR

None.

---

Pre-existing / out-of-scope notes (not blockers for this PR)

These transitive advisories remain in the lockfile and were not introduced by this bump (same packages/versions on base where applicable):

• sharp@0.34.5 (<0.35.0) — build-time image processing
• js-yaml, shell-quote, svgo, brace-expansion, fast-uri — dev/build toolchain
• hono advisories — dev dependency; project already pins hono@^4.12.26 via overrides; static production output is unaffected
• esbuild dev-server file-read (GHSA-g7r4-m6w7-qqqr) — dev-only, Windows-specific

Remediation (separate PRs): run npm audit fix where non-breaking, bump sharp when Astro permits, and keep audit:ci in CI.

---

Uncertain / low-risk observations

1. Major-version Astro upgrade (6→7): No new server-mode, Actions, or on-demand endpoints appear in this diff. Residual risk is limited to framework behavior changes during astro build / astro dev, not deployed static HTML.
2. View Transition XSS exploitability on base: src/layouts/Layout.astro uses <ClientRouter /> with default transitions and no attacker-controlled TransitionAnimation props, so practical exploitability on main was already low; upgrading is still the correct fix.

---

Verdict: ✅ Approve from a security perspective — merge after functional CI passes.

  

_{Sent by Cursor Automation: Find vulnerabilities}

[dependabot]

Superseded by #218.