Skip to content

chore(deps): update all non-major dependencies - #1281

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#1281
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Nov 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@astrojs/starlight (source) 0.42.8 → 0.42.10 age confidence dependencies patch 0.42.11
postcss-selector-parser 6.1.5 → 6.1.6 age confidence pnpm-workspace.overrides patch
proptest (source) 1.11.0 → 1.12.0 age confidence dev-dependencies minor
undici (source) 8.12.3 → 8.12.4 age confidence pnpm-workspace.overrides patch
vite (source) 8.3.5 → 8.3.7 age confidence pnpm-workspace.overrides patch 8.3.8

Release Notes

withastro/starlight (@​astrojs/starlight)

v0.42.10

Compare Source

Patch Changes

  • #​4354 56b8587 Thanks @​jasikpark! - Improves the color contrast of the search input placeholder text

  • #​4337 c5d0a7f Thanks @​moonmeister! - Fixes search not loading when the search script runs after the page has finished loading, for example when a Content Security Policy requires scripts to be added dynamically

  • #​4352 3edab29 Thanks @​delucis! - Fixes the Astro trailingSlash and build.format options not being applied correctly to sidebar links that include a query string or hash

v0.42.9

Compare Source

Patch Changes

  • #​4218 effea21 Thanks @​delucis! - Reduces install size by ~400 KB by switching the YAML parser used internally for projects using Astro 7.3.6 or later

  • #​4316 8679b1c Thanks @​clean99! - Fixes localized routes and language switcher links for pages in directories named like Object.prototype properties, such as constructor.

  • #​4341 e1ac1b4 Thanks @​delucis! - Prevents tables overflowing and clipping when printing a page

postcss/postcss-selector-parser (postcss-selector-parser)

v6.1.6

Compare Source

  • fix: parse selectors in linear time on four more kinds of crafted input, closing a CPU exhaustion vulnerability (reported by @​zachariah-mithani)
  • chore: replace the cssesc dependency with an internal copy, whose redundant space removal is linear
proptest-rs/proptest (proptest)

v1.12.0

Compare Source

nodejs/undici (undici)

v8.12.4

Compare Source

⚠️ Security Fixes

This release fixes six vulnerabilities.

CVE-2026-116592 / GHSA-mqg3-3v4r-cm32 (high)

Undici 8.12.2 and 8.12.3 could cache the final response from a redirect chain under the original request key without applying the origin, cache policy, freshness, or Vary requirements of every intermediate hop. This could poison a cache or expose one user's response to another user. The fix validates every redirect hop, combines their Vary fields, limits freshness and stale serving to the most restrictive hop, and invalidates persistent SQLite entries written by vulnerable releases.

CVE-2026-120474 / GHSA-7xg3-fphp-28hg (medium)

A shared cache used with compose(redirect(), cache()) could store a credential-dependent response from a same-origin redirect under the original URL. A later authenticated or unauthenticated request could then receive another user's response. Redirected requests carrying Authorization, Cookie, or Proxy-Authorization are no longer stored under the original alias key.

CVE-2026-116630 / GHSA-5rm8-gv32-r954 (medium)

A cross-origin redirect during cache revalidation could let a 304 Not Modified response from the redirect target validate a cached response from the original origin. Undici now checks that the revalidation target matches the cached URL and that any returned validator matches the stored representation before replaying the cached body.

CVE-2026-120415 / GHSA-9v6h-8rgp-m69f (medium)

The redirect interceptor did not strip credentials correctly when request headers were supplied as an array of [name, value] pairs. With a header-normalizing interceptor outside redirect(), credentials could be sent to a cross-origin redirect target. Undici now handles both tuple arrays and flat header arrays when removing sensitive headers.

CVE-2026-120222 / GHSA-3g9m-rv3r-w5w2 (medium)

A downstream handler exception during cache replay could escape as an uncaught exception or unhandled promise rejection and terminate the process. This included dump size-limit failures, excessive Content-Encoding values in decompress, asynchronous cache-store failures, and cached-body replay after a 304. These failures are now reported as request errors.

CVE-2026-120423 / GHSA-r4pc-4jcp-7pqc (medium)

fetch() could skip Subresource Integrity verification when valid integrity metadata was separated or surrounded by ASCII whitespace other than a space, including a horizontal tab. Integrity metadata is now split on all ASCII whitespace before SHA-256, SHA-384, or SHA-512 verification.

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.12.3...v8.12.4

vitejs/vite (vite)

v8.3.7

Compare Source

Bug Fixes
Miscellaneous Chores
Tests
Build System

v8.3.6

Compare Source

Bug Fixes
Performance Improvements
Miscellaneous Chores
Build System
  • generate sourcemaps in import-meta-current-dirname plugin (#​23904) (20d355a)

Configuration

📅 Schedule: (in timezone Etc/UTC)

  • Branch creation
    • "every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from edithatogo as a code owner November 7, 2026 00:28
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Nov 7, 2026
@codecov

codecov Bot commented Nov 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from bfbbb6f to f37e63f Compare November 7, 2026 20:27
@renovate renovate Bot changed the title chore(deps): update rust crate proptest to v1.12.0 chore(deps): update all non-major dependencies Nov 7, 2026
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 046a288 to 786c6ac Compare November 13, 2026 10:54
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 786c6ac to 393c228 Compare November 13, 2026 12:12

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@edithatogo edithatogo Awaiting requested review from edithatogo edithatogo is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants