Skip to content

chore(deps): bump the nonmajor group across 1 directory with 11 updates#159

Open
dependabot[bot] wants to merge 1 commit intostagingfrom
dependabot/npm_and_yarn/staging/nonmajor-edfea1abd4
Open

chore(deps): bump the nonmajor group across 1 directory with 11 updates#159
dependabot[bot] wants to merge 1 commit intostagingfrom
dependabot/npm_and_yarn/staging/nonmajor-edfea1abd4

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 5, 2026 •
edited
Loading

Bumps the nonmajor group with 11 updates in the / directory:

Package From To
@iconify-json/lucide 1.2.90 1.2.95
@iconify-json/simple-icons 1.2.70 1.2.72
astro 5.17.2 5.18.0
astro-compressor 1.2.0 1.3.0
fs-extra 11.3.3 11.3.4
google-auth-library 10.5.0 10.6.1
postcss-custom-media 12.0.0 12.0.1
postcss-preset-env 11.1.3 11.2.0
@types/node 25.2.3 25.3.3
autoprefixer 10.4.24 10.4.27
postcss 8.5.6 8.5.8

Updates @iconify-json/lucide from 1.2.90 to 1.2.95

Commits

Updates @iconify-json/simple-icons from 1.2.70 to 1.2.72

Commits

Updates astro from 5.17.2 to 5.18.0

Release notes

Sourced from astro's releases.

astro@5.18.0

Minor Changes

  • #15589 b7dd447 Thanks @​qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.

    This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.

    If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.

    // astro.config.mjs
export default defineConfig({
  security: {
    actionBodySizeLimit: 10 * 1024 * 1024, // set to 10 MB
  },
});

Patch Changes

  • #15594 efae11c Thanks @​qzio! - Fix X-Forwarded-Proto validation when allowedDomains includes both protocol and hostname fields. The protocol check no longer fails due to hostname mismatch against the hardcoded test URL.

astro@5.17.3

Patch Changes

  • #15564 522f880 Thanks @​matthewp! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.

  • #15569 e01e98b Thanks @​matthewp! - Respect image allowlists when inferring remote image sizes and reject remote redirects.

Changelog

Sourced from astro's changelog.

5.18.0

Minor Changes

  • #15589 b7dd447 Thanks @​qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.

    This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.

    If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.

    // astro.config.mjs
export default defineConfig({
  security: {
    actionBodySizeLimit: 10 * 1024 * 1024, // set to 10 MB
  },
});

Patch Changes

  • #15594 efae11c Thanks @​qzio! - Fix X-Forwarded-Proto validation when allowedDomains includes both protocol and hostname fields. The protocol check no longer fails due to hostname mismatch against the hardcoded test URL.

5.17.3

Patch Changes

  • #15564 522f880 Thanks @​matthewp! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.

  • #15569 e01e98b Thanks @​matthewp! - Respect image allowlists when inferring remote image sizes and reject remote redirects.

Commits

Updates astro-compressor from 1.2.0 to 1.3.0

Release notes

Sourced from astro-compressor's releases.

v1.3.0

2026-03-04

Summary

This release adds better default compression for zstd and brotli, and better handling of compression options. Thanks to @​Daniel15 for this contribution.

Commits

Changelog

Sourced from astro-compressor's changelog.

v1.3.0

2026-03-04

Summary

This release adds better default compression for zstd and brotli, and better handling of compression options. Thanks to @​Daniel15 for this contribution.

Commits

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for astro-compressor since your current version.


Updates fs-extra from 11.3.3 to 11.3.4

Changelog

Sourced from fs-extra's changelog.

11.3.4 / 2026-03-03

  • Fix bug where calling ensureSymlink/ensureSymlinkSync with a relative srcPath would fail if the symlink already existed (#1038, #1064)
Commits

Updates google-auth-library from 10.5.0 to 10.6.1

Release notes

Sourced from google-auth-library's releases.

google-auth-library: v10.6.1

10.6.1 (2026-02-20)

Bug Fixes

  • DefaultAwsSecurityCredentialSupplier fetches aws-credentials correctly from credential-url (#901) (8c50526)

google-auth-library: v10.6.0

10.6.0 (2025-12-17)

Features

  • auth: Use gtoken from internal class instead of dependency (#815) (a38857c)
Changelog

Sourced from google-auth-library's changelog.

10.6.1 (2026-02-20)

Bug Fixes

  • DefaultAwsSecurityCredentialSupplier fetches aws-credentials correctly from credential-url (#901) (8c50526)

10.6.0 (2025-12-17)

Features

  • auth: Use gtoken from internal class instead of dependency (#815) (a38857c)
Commits
  • 8144256 chore: release main
  • 8c50526 fix: defaultAwsSecurityCredentialSupplier fetches aws-credentials correctly f...
  • d173996 chore(deps): update dependency mocha to v10 (#878)
  • ee618f6 delete more configs
  • 93ca4c5 chore: upgrade sinon, node types (#864)
  • 383aa51 chore: release main
  • a38857c feat(auth): use gtoken from internal class instead of dependency (#815)
  • c27f023 build(auth): added full implementation of GoogleToken (#814)
  • 8f8b2a5 build(auth): add token handler for GoogleToken. (#805)
  • 552f153 build(auth): add getToken function for the usage of GoogleToken (#806)
  • Additional commits viewable in compare view

Updates postcss-custom-media from 12.0.0 to 12.0.1

Changelog

Sourced from postcss-custom-media's changelog.

12.0.1

February 21, 2026

  • Fix importance of custom media in anonymous cascade layers.
Commits

Updates postcss-preset-env from 11.1.3 to 11.2.0

Changelog

Sourced from postcss-preset-env's changelog.

11.2.0

February 21, 2026

Commits

Updates @types/node from 25.2.3 to 25.3.3

Commits

Updates autoprefixer from 10.4.24 to 10.4.27

Release notes

Sourced from autoprefixer's releases.

10.4.27

  • Removed development key from package.json.

10.4.26

  • Reduced package size.

10.4.25

  • Fixed broken gradients on CSS Custom Properties (by @​serger777).
Changelog

Sourced from autoprefixer's changelog.

10.4.27

  • Removed development key from package.json.

10.4.26

  • Reduced package size.

10.4.25

  • Fixed broken gradients on CSS Custom Properties (by @​serger777).
Commits

Updates postcss from 8.5.6 to 8.5.8

Release notes

Sourced from postcss's releases.

8.5.8

  • Fixed Processor#version.

8.5.7

  • Improved source map annotation cleaning performance (by CodeAnt AI).
Changelog

Sourced from postcss's changelog.

8.5.8

  • Fixed Processor#version.

8.5.7

  • Improved source map annotation cleaning performance (by CodeAnt AI).
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 5, 2026
@chuangcaleb
Copy link
Owner

chuangcaleb commented Mar 5, 2026

@dependabot recreate

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/staging/nonmajor-edfea1abd4 branch from 4dccb2d to a7b71b2 Compare March 5, 2026 12:13
@github-actions
Copy link
Contributor

github-actions bot commented Mar 5, 2026

❌ Build Failed - Manual Review Required

This dependency update failed CI, so it was not auto-merged to .

Action needed:

  • Review CI logs to identify the failure
  • Confirm whether the failure is related to this dependency update
  • Fix issues (or recreate the PR) and re-run checks
  • Manually merge when all checks pass

@chuangcaleb
Copy link
Owner

chuangcaleb commented Mar 5, 2026

@dependabot recreate

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/staging/nonmajor-edfea1abd4 branch from a7b71b2 to 3ba1f8e Compare March 5, 2026 13:55
@github-actions
Copy link
Contributor

github-actions bot commented Mar 5, 2026

❌ Build Failed - Manual Review Required

This dependency update failed CI, so it was not auto-merged to .

Action needed:

  • Review CI logs to identify the failure
  • Confirm whether the failure is related to this dependency update
  • Fix issues (or recreate the PR) and re-run checks
  • Manually merge when all checks pass

@chuangcaleb
Copy link
Owner

chuangcaleb commented Mar 5, 2026

@dependabot recreate

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/staging/nonmajor-edfea1abd4 branch from d218e9d to 83214b7 Compare March 5, 2026 15:14
@github-actions
Copy link
Contributor

github-actions bot commented Mar 5, 2026

❌ Build Failed - Manual Review Required

This dependency update failed CI, so it was not auto-merged to .

Action needed:

  • Review CI logs to identify the failure
  • Confirm whether the failure is related to this dependency update
  • Fix issues (or recreate the PR) and re-run checks
  • Manually merge when all checks pass

@chuangcaleb
Copy link
Owner

chuangcaleb commented Mar 5, 2026

@depenabot recreate

@github-actions
Copy link
Contributor

github-actions bot commented Mar 5, 2026

❌ Build Failed - Manual Review Required

This dependency update failed CI, so it was not auto-merged to .

Action needed:

  • Review CI logs to identify the failure
  • Confirm whether the failure is related to this dependency update
  • Fix issues (or recreate the PR) and re-run checks
  • Manually merge when all checks pass

@chuangcaleb
Copy link
Owner

chuangcaleb commented Mar 8, 2026

@dependabot recreate

@dependabot
chore(deps): bump the nonmajor group across 1 directory with 11 updates
204dc1b 
Bumps the nonmajor group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@iconify-json/lucide](https://github.com/iconify/icon-sets) | `1.2.90` | `1.2.95` |
| [@iconify-json/simple-icons](https://github.com/iconify/icon-sets) | `1.2.70` | `1.2.72` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `5.17.2` | `5.18.0` |
| [astro-compressor](https://github.com/sondr3/astro-compressor) | `1.2.0` | `1.3.0` |
| [fs-extra](https://github.com/jprichardson/node-fs-extra) | `11.3.3` | `11.3.4` |
| [google-auth-library](https://github.com/googleapis/google-cloud-node-core/tree/HEAD/packages/google-auth-library-nodejs) | `10.5.0` | `10.6.1` |
| [postcss-custom-media](https://github.com/csstools/postcss-plugins/tree/HEAD/plugins/postcss-custom-media) | `12.0.0` | `12.0.1` |
| [postcss-preset-env](https://github.com/csstools/postcss-plugins/tree/HEAD/plugin-packs/postcss-preset-env) | `11.1.3` | `11.2.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.2.3` | `25.3.3` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.4.24` | `10.4.27` |
| [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.8` |



Updates `@iconify-json/lucide` from 1.2.90 to 1.2.95
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@iconify-json/simple-icons` from 1.2.70 to 1.2.72
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `astro` from 5.17.2 to 5.18.0
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/astro@5.18.0/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@5.18.0/packages/astro)

Updates `astro-compressor` from 1.2.0 to 1.3.0
- [Release notes](https://github.com/sondr3/astro-compressor/releases)
- [Changelog](https://github.com/sondr3/astro-compressor/blob/main/CHANGELOG.md)
- [Commits](sondr3/astro-compressor@v1.2.0...v1.3.0)

Updates `fs-extra` from 11.3.3 to 11.3.4
- [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md)
- [Commits](jprichardson/node-fs-extra@11.3.3...11.3.4)

Updates `google-auth-library` from 10.5.0 to 10.6.1
- [Release notes](https://github.com/googleapis/google-cloud-node-core/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node-core/blob/main/packages/google-auth-library-nodejs/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node-core/commits/google-auth-library-v10.6.1/packages/google-auth-library-nodejs)

Updates `postcss-custom-media` from 12.0.0 to 12.0.1
- [Changelog](https://github.com/csstools/postcss-plugins/blob/main/plugins/postcss-custom-media/CHANGELOG.md)
- [Commits](https://github.com/csstools/postcss-plugins/commits/HEAD/plugins/postcss-custom-media)

Updates `postcss-preset-env` from 11.1.3 to 11.2.0
- [Changelog](https://github.com/csstools/postcss-plugins/blob/main/plugin-packs/postcss-preset-env/CHANGELOG.md)
- [Commits](https://github.com/csstools/postcss-plugins/commits/HEAD/plugin-packs/postcss-preset-env)

Updates `@types/node` from 25.2.3 to 25.3.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `autoprefixer` from 10.4.24 to 10.4.27
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.4.24...10.4.27)

Updates `postcss` from 8.5.6 to 8.5.8
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.8)

---
updated-dependencies:
- dependency-name: "@iconify-json/lucide"
  dependency-version: 1.2.95
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nonmajor
- dependency-name: "@iconify-json/simple-icons"
  dependency-version: 1.2.72
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nonmajor
- dependency-name: astro
  dependency-version: 5.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nonmajor
- dependency-name: astro-compressor
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nonmajor
- dependency-name: fs-extra
  dependency-version: 11.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nonmajor
- dependency-name: google-auth-library
  dependency-version: 10.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nonmajor
- dependency-name: postcss-custom-media
  dependency-version: 12.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nonmajor
- dependency-name: postcss-preset-env
  dependency-version: 11.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nonmajor
- dependency-name: "@types/node"
  dependency-version: 25.3.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: nonmajor
- dependency-name: autoprefixer
  dependency-version: 10.4.27
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: nonmajor
- dependency-name: postcss
  dependency-version: 8.5.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: nonmajor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/staging/nonmajor-edfea1abd4 branch from e71e5fb to 204dc1b Compare March 8, 2026 14:07
@github-actions
Copy link
Contributor

github-actions bot commented Mar 8, 2026

❌ Build Failed - Manual Review Required

This dependency update failed CI, so it was not auto-merged to .

Action needed:

  • Review CI logs to identify the failure
  • Confirm whether the failure is related to this dependency update
  • Fix issues (or recreate the PR) and re-run checks
  • Manually merge when all checks pass

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chuangcaleb