Skip to content

chore(deps): bump @astrojs/react from 5.0.6 to 6.0.1#114

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/astrojs/react-6.0.1
Closed

chore(deps): bump @astrojs/react from 5.0.6 to 6.0.1#114
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/astrojs/react-6.0.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps @astrojs/react from 5.0.6 to 6.0.1.

Release notes

Sourced from @​astrojs/react's releases.

@​astrojs/react@​6.0.1

Patch Changes

  • Updated dependencies [eb6f97e]:
    • @​astrojs/internal-helpers@​0.10.1

@​astrojs/react@​6.0.0

Major Changes

Minor Changes

  • #17093 4585fe5 Thanks @​Princesseuh! - Replaces the import entrypoint of getContainerRenderer()

    A new container-renderer entrypoint exporting getContainerRenderer() has been added to the following integrations: React, Preact, Svelte, SolidJS, Vue, and MDX. This prevents bundlers from trying to bundle unrelated exports from the package root when only the Container API is used.

    If you are using the Container API, update your import statements to use the new entrypoint. The following example updates the getContainerRenderer() import for React:

    - import { getContainerRenderer } from '@astrojs/react';
+ import { getContainerRenderer } from '@astrojs/react/container-renderer';

    Importing getContainerRenderer() from the package root still works, but is now deprecated and logs a warning.

Patch Changes

@​astrojs/react@​6.0.0-beta.2

Minor Changes

  • #17093 4585fe5 Thanks @​Princesseuh! - Replaces the import entrypoint of getContainerRenderer()

    A new container-renderer entrypoint exporting getContainerRenderer() has been added to the following integrations: React, Preact, Svelte, SolidJS, Vue, and MDX. This prevents bundlers from trying to bundle unrelated exports from the package root when only the Container API is used.

    If you are using the Container API, update your import statements to use the new entrypoint. The following example updates the getContainerRenderer() import for React:

    - import { getContainerRenderer } from '@astrojs/react';
+ import { getContainerRenderer } from '@astrojs/react/container-renderer';

    Importing getContainerRenderer() from the package root still works, but is now deprecated and logs a warning.

@​astrojs/react@​6.0.0-beta.1

Patch Changes

Changelog

Sourced from @​astrojs/react's changelog.

6.0.1

Patch Changes

  • Updated dependencies [eb6f97e]:
    • @​astrojs/internal-helpers@​0.10.1

6.0.0

Major Changes

Minor Changes

  • #17093 4585fe5 Thanks @​Princesseuh! - Replaces the import entrypoint of getContainerRenderer()

    A new container-renderer entrypoint exporting getContainerRenderer() has been added to the following integrations: React, Preact, Svelte, SolidJS, Vue, and MDX. This prevents bundlers from trying to bundle unrelated exports from the package root when only the Container API is used.

    If you are using the Container API, update your import statements to use the new entrypoint. The following example updates the getContainerRenderer() import for React:

    - import { getContainerRenderer } from '@astrojs/react';
+ import { getContainerRenderer } from '@astrojs/react/container-renderer';

    Importing getContainerRenderer() from the package root still works, but is now deprecated and logs a warning.

Patch Changes

6.0.0-beta.2

Minor Changes

  • #17093 4585fe5 Thanks @​Princesseuh! - Replaces the import entrypoint of getContainerRenderer()

    A new container-renderer entrypoint exporting getContainerRenderer() has been added to the following integrations: React, Preact, Svelte, SolidJS, Vue, and MDX. This prevents bundlers from trying to bundle unrelated exports from the package root when only the Container API is used.

    If you are using the Container API, update your import statements to use the new entrypoint. The following example updates the getContainerRenderer() import for React:

    - import { getContainerRenderer } from '@astrojs/react';
+ import { getContainerRenderer } from '@astrojs/react/container-renderer';

    Importing getContainerRenderer() from the package root still works, but is now deprecated and logs a warning.

6.0.0-beta.1

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 17, 2026
@dependabot
chore(deps): bump @astrojs/react from 5.0.6 to 6.0.1
2a522b6 
Bumps [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react) from 5.0.6 to 6.0.1.
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/react@6.0.1/packages/integrations/react)

---
updated-dependencies:
- dependency-name: "@astrojs/react"
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/astrojs/react-6.0.1 branch from 83b8d66 to 2a522b6 Compare July 17, 2026 20:20
agjs added a commit that referenced this pull request Jul 20, 2026
@agjs
chore(deps): consolidate the 14 dependabot bumps (#164)
b7f8bfa 
* chore(deps): consolidate the 14 open dependabot bumps

Single PR superseding the open dependabot PRs:
- fast-check 3.23.2 → 4.9.0 (packages/core) — full suite green on v4 (#93/#99)
- astro 7.0.9 → 7.1.3 (root + apps/docs) — clears GHSA-4g3v-8h47-v7g6 (#158/#162)
- @astrojs/react 5.0.6 → 6.0.1 (#114), @astrojs/sitemap 3.7.2 → 3.7.3 (#116)
- astro-mermaid 2.0.1 → 2.1.0 (#119)
- tailwindcss + @tailwindcss/vite 4.3.2 → 4.3.3 (#115/#117)
- wrangler 4.110.0/4.111.0 → 4.112.0 (#161), @ast-grep/cli 0.43.0 → 0.44.1 (#118)

Validated: typecheck + lint + full suite (2820) green. Docs build + osv run by CI.
NOTE: the transitive brace-expansion CVE (not a dependabot PR) is separate and may
still need an override; GH Actions bumps (#160 checkout, #112 lychee) are workflow
YAML, follow-up.

* fix(deps): pin brace-expansion to patched 5.0.7 (CVE-2026-13149)

New high-severity ReDoS advisory CVE-2026-13149 / GHSA-3jxr-9vmj-r5cp (published
~2026-07-20 21:00) affects brace-expansion <1.1.16 / <2.1.2 / <5.0.7. The lockfile
had 1.1.15 and 5.0.6 (transitive via eslint→minimatch/glob — a real runtime dep of
the published package, so it is FIXED, not ignored). Override forces all instances
to 5.0.7 (patched; API is a single stable expand() fn across majors). typecheck +
lint (uses minimatch/glob) + full suite green.

* fix(deps): pin js-yaml to patched 4.3.0 (GHSA-52cp-r559-cp3m)

The astro/tooling bumps pulled js-yaml 4.2.0 (High ReDoS, GHSA-52cp-r559-cp3m,
fixed 4.3.0). Transitive, 4.x only (no 3.x consumers) → override to 4.3.0.
osv-scanner local run: 'No issues found', exit 0. typecheck + lint + full suite green.
@agjs

agjs commented Jul 20, 2026

Copy link
Copy Markdown
Owner

Superseded by #164 (consolidated dependabot bumps), merged to main.

@agjs agjs closed this Jul 20, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/astrojs/react-6.0.1 branch July 20, 2026 22:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@agjs