chore(deps): bump the npm-minor-patch group in /docs with 3 updates

[dependabot]

Bumps the npm-minor-patch group in /docs with 3 updates: @astrojs/mdx, astro and start-server-and-test.

Updates @astrojs/mdx from 6.0.2 to 6.0.3

Release notes

Sourced from @​astrojs/mdx's releases.

@​astrojs/mdx@​6.0.3

Patch Changes

• #16969 4a31f90 Thanks @​Princesseuh! - Adds support for Prism syntax highlighting to the Sätteri Markdown and MDX processors. Setting markdown.syntaxHighlight to 'prism' now highlights your code blocks with Prism.

  // astro.config.mjs
  import { satteri } from '@astrojs/markdown-satteri';
  export default defineConfig({
  markdown: {
  processor: satteri(),
  syntaxHighlight: 'prism',
  },
  });

Changelog

Sourced from @​astrojs/mdx's changelog.

6.0.3

Patch Changes

• #16969 4a31f90 Thanks @​Princesseuh! - Adds support for Prism syntax highlighting to the Sätteri Markdown and MDX processors. Setting markdown.syntaxHighlight to 'prism' now highlights your code blocks with Prism.

  // astro.config.mjs
  import { satteri } from '@astrojs/markdown-satteri';
  export default defineConfig({
  markdown: {
  processor: satteri(),
  syntaxHighlight: 'prism',
  },
  });

Commits

• 0b879fb [ci] release (#16972)
• 7e8d371 chore: avoid an unwanted mdx major bump (#16977)
• 4a31f90 feat(satteri): Add support for Prism highlighting (#16969)
• See full diff in compare view

Updates astro from 6.4.4 to 6.4.6

Release notes

Sourced from astro's releases.

astro@6.4.6

Patch Changes

• #16765 b10e86e Thanks @​fkatsuhiro! - Fixes an issue where renaming an image file while the dev server is running triggers a build error. Now Astro correctly hot-reloads the image without crashing.

• #17026 add3df1 Thanks @​matthewp! - Hardens addAttribute to drop attribute names containing characters that are invalid per the HTML spec (", ', >, /, =, whitespace)

• #17033 ffda27b Thanks @​matthewp! - Validates the request origin against allowedDomains before fetching prerendered error pages. When allowedDomains is configured and the Host header matches, the original origin is used. Otherwise, the fetch falls back to localhost.

astro@6.4.5

Patch Changes

• #16985 4ecff32 Thanks @​maximslo! - Fixes the experimental.logger destination not being used for the "Server listening on..." startup message. The logger is now resolved before the server starts listening, and adapterLogger re-creates itself when the underlying logger changes so the startup message uses the correct destination.

• #16947 e0703a6 Thanks @​ematipico! - Fixes Astro.request.url not reflecting validated X-Forwarded-Proto/X-Forwarded-Host headers when security.allowedDomains is configured. Previously, only Astro.url was updated with the forwarded origin while Astro.request.url retained the socket-derived URL, causing the two to diverge behind TLS-terminating proxies.

• #16997 dc45246 Thanks @​matthewp! - Reverts a change to isNode runtime detection that caused a significant build time regression for Cloudflare adapter users with large prerendered sites

Changelog

Sourced from astro's changelog.

6.4.6

Patch Changes

• #16765 b10e86e Thanks @​fkatsuhiro! - Fixes an issue where renaming an image file while the dev server is running triggers a build error. Now Astro correctly hot-reloads the image without crashing.

• #17026 add3df1 Thanks @​matthewp! - Hardens addAttribute to drop attribute names containing characters that are invalid per the HTML spec (", ', >, /, =, whitespace)

• #17033 ffda27b Thanks @​matthewp! - Validates the request origin against allowedDomains before fetching prerendered error pages. When allowedDomains is configured and the Host header matches, the original origin is used. Otherwise, the fetch falls back to localhost.

6.4.5

Patch Changes

• #16985 4ecff32 Thanks @​maximslo! - Fixes the experimental.logger destination not being used for the "Server listening on..." startup message. The logger is now resolved before the server starts listening, and adapterLogger re-creates itself when the underlying logger changes so the startup message uses the correct destination.

• #16947 e0703a6 Thanks @​ematipico! - Fixes Astro.request.url not reflecting validated X-Forwarded-Proto/X-Forwarded-Host headers when security.allowedDomains is configured. Previously, only Astro.url was updated with the forwarded origin while Astro.request.url retained the socket-derived URL, causing the two to diverge behind TLS-terminating proxies.

• #16997 dc45246 Thanks @​matthewp! - Reverts a change to isNode runtime detection that caused a significant build time regression for Cloudflare adapter users with large prerendered sites

Commits

• 19ad1b4 [ci] release (#17023)
• f1baeea [ci] format
• ffda27b Validate origin in prerendered error page fetch against allowedDomains (#17033)
• 0408628 [ci] format
• add3df1 Harden addAttribute to reject invalid attribute names (#17026)
• cfeb958 [ci] format
• b10e86e fix : content collections image hmr (#16765)
• 0b879fb [ci] release (#16972)
• dc45246 Revert isNode workerd detection that caused Cloudflare build regression (#16997)
• 132a879 [ci] format
• Additional commits viewable in compare view

Updates start-server-and-test from 3.0.9 to 3.0.11

Release notes

Sourced from start-server-and-test's releases.

v3.0.11

3.0.11 (2026-06-11)

Bug Fixes

• register --expected as an alias of --expect (#484) (57c221d)

v3.0.10

3.0.10 (2026-06-10)

Bug Fixes

• allow both --proxy-password and --proxy-pass options (#482) (797973d)
• conform to npm branding (lowercase) (#483) (f165b18)

Commits

• 57c221d fix: register --expected as an alias of --expect (#484)
• f165b18 fix: conform to npm branding (lowercase) (#483)
• 797973d fix: allow both --proxy-password and --proxy-pass options (#482)
• 9f727ac chore(deps): replace got with fetch in test/client (#480)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: javascript. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[claude]

Dependabot assessment

What changed: Three patch bumps in the /docs npm group:

• @astrojs/mdx 6.0.2 → 6.0.3 (adds optional Prism highlighting support, no breaking changes)
• astro 6.4.4 → 6.4.6 (bug fixes: image HMR, addAttribute hardening, request URL fixes — no breaking changes)
• start-server-and-test 3.0.9 → 3.0.11 (bug fixes for CLI flag aliases — no breaking changes)

Risk: Low. All three are patch bumps scoped to the docs site only. No breaking changes in any changelog. Not security-critical dependencies.

Decision: Meets auto-merge criteria (all patch, no breaking changes, not security-critical) — but CI checks are still pending. Will merge once all checks pass.