chore(deps): bump astro from 7.3.5 to 7.3.8

[dependabot]

Bumps astro from 7.3.5 to 7.3.8.

Release notes

Sourced from astro's releases.

astro@7.3.8

Patch Changes

• #18293 28e7410 Thanks @​astro-factory! - Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

• #18298 0e9e857 Thanks @​matthewp! - Fixes astro add removing existing allowBuilds approvals from pnpm-workspace.yaml with pnpm v11.0–v11.22

• #18263 882dd98 Thanks @​florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

• #18290 31f13c3 Thanks @​astro-factory! - Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob such as !(drafts)/**/*.md

astro@7.3.7

Patch Changes

• #18266 cba76cc Thanks @​astro-factory! - Fixes a build error when a Markdown content collection entry loaded with glob({ deferRender: true }) has a layout frontmatter property. layout is now ignored for content collection entries, as documented.

• #18287 38f6793 Thanks @​astro-factory! - Fixes astro add cloudflare failing to install dependencies with pnpm v11+ by approving the workerd build script, and shows the package manager's error output when astro add fails to install dependencies

• #18222 fcf6ed6 Thanks @​mingjunlu! - Fixes an issue where AVIF images were served as image/heif instead of image/avif in the dev server.

• #18240 de4df06 Thanks @​astro-factory! - Fixes the cache() handler from astro/hono and astro/fetch throwing a TypeError when a cache provider is configured. It now registers the cache provider before rendering, so Astro.cache is available to downstream handlers like pages().

• #18268 547b572 Thanks @​astro-factory! - Fixes security.checkOrigin rejecting cross-origin requests with non-form content types such as application/json. As documented, the check only applies to unsafe requests that have no content-type header or one of application/x-www-form-urlencoded, multipart/form-data, or text/plain.

astro@7.3.6

Patch Changes

• #18166 5134d0f Thanks @​astro-factory! - Fixes an intermittent dev server crash when using astro:actions inside a server island with adapters that use a pre-bundled SSR environment (e.g. @astrojs/cloudflare)

• #18076 8a2df66 Thanks @​astro-factory! - Fixes stale scoped styles during HMR when both markup and <style> are changed in a single save

• #18252 2d29e7e Thanks @​astro-factory! - Fixes CSS from other pages leaking into a page's <head> in dev when the page imports a module such as astro:config/server.

• #18000 6724575 Thanks @​barclayd! - Fixes a bug where server islands containing framework components rendered empty in the dev server when using a custom src/fetch.ts

• #18241 7c5fd6f Thanks @​astro-factory! - Fixes the composable i18n() handler from astro/fetch and astro/hono returning an empty 404 for paths without a locale prefix. It now renders the custom 404 page, matching astro().

• #18164 1a6997f Thanks @​astro-factory! - Fixes CSS Module HMR in dev when a component is rendered both with and without hydration on the same page. Astro now uses path-based class name hashing in dev mode so that editing CSS declarations no longer changes the generated selectors, allowing Vite's CSS HMR to update styles without a full page reload.

• #18243 dd29d62 Thanks @​astro-factory! - Fixes context.props being null in middleware and endpoints when the composable astro/hono or astro/fetch actions() handler runs before middleware(), or when pages() runs without middleware()

• #18193 95d5d16 Thanks @​astro-factory! - Fixes astro build failing on Windows with Node.js 25+ with ERR_INVALID_ARG_VALUE when clearing the output directory hits a transient EPERM error

• #18220 d6c13a4 Thanks @​astro-factory! - Fixes type errors reported in Astro's built-in <Picture /> and <Font /> components when type-checking a project with tsc and @astrojs/ts-content-mapper

• #18133 faac481 Thanks @​astro-factory! - Fixes lost request state when Vite discovers server dependencies during a request in Cloudflare dev mode

• #18146 2af4516 Thanks @​astro-factory! - Fixes CSS imported from an injectScript('page') script being dropped during build

• #18159 e5f8fe0 Thanks @​astro-factory! - Fixes a hang when a server:defer component is inside a slot of another component in an MDX content collection entry

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.8

Patch Changes

• #18293 28e7410 Thanks @​astro-factory! - Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

• #18298 0e9e857 Thanks @​matthewp! - Fixes astro add removing existing allowBuilds approvals from pnpm-workspace.yaml with pnpm v11.0–v11.22

• #18263 882dd98 Thanks @​florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

• #18290 31f13c3 Thanks @​astro-factory! - Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob such as !(drafts)/**/*.md

7.3.7

Patch Changes

• #18266 cba76cc Thanks @​astro-factory! - Fixes a build error when a Markdown content collection entry loaded with glob({ deferRender: true }) has a layout frontmatter property. layout is now ignored for content collection entries, as documented.

• #18287 38f6793 Thanks @​astro-factory! - Fixes astro add cloudflare failing to install dependencies with pnpm v11+ by approving the workerd build script, and shows the package manager's error output when astro add fails to install dependencies

• #18222 fcf6ed6 Thanks @​mingjunlu! - Fixes an issue where AVIF images were served as image/heif instead of image/avif in the dev server.

• #18240 de4df06 Thanks @​astro-factory! - Fixes the cache() handler from astro/hono and astro/fetch throwing a TypeError when a cache provider is configured. It now registers the cache provider before rendering, so Astro.cache is available to downstream handlers like pages().

• #18268 547b572 Thanks @​astro-factory! - Fixes security.checkOrigin rejecting cross-origin requests with non-form content types such as application/json. As documented, the check only applies to unsafe requests that have no content-type header or one of application/x-www-form-urlencoded, multipart/form-data, or text/plain.

7.3.6

Patch Changes

• #18166 5134d0f Thanks @​astro-factory! - Fixes an intermittent dev server crash when using astro:actions inside a server island with adapters that use a pre-bundled SSR environment (e.g. @astrojs/cloudflare)

• #18076 8a2df66 Thanks @​astro-factory! - Fixes stale scoped styles during HMR when both markup and <style> are changed in a single save

• #18252 2d29e7e Thanks @​astro-factory! - Fixes CSS from other pages leaking into a page's <head> in dev when the page imports a module such as astro:config/server.

• #18000 6724575 Thanks @​barclayd! - Fixes a bug where server islands containing framework components rendered empty in the dev server when using a custom src/fetch.ts

• #18241 7c5fd6f Thanks @​astro-factory! - Fixes the composable i18n() handler from astro/fetch and astro/hono returning an empty 404 for paths without a locale prefix. It now renders the custom 404 page, matching astro().

• #18164 1a6997f Thanks @​astro-factory! - Fixes CSS Module HMR in dev when a component is rendered both with and without hydration on the same page. Astro now uses path-based class name hashing in dev mode so that editing CSS declarations no longer changes the generated selectors, allowing Vite's CSS HMR to update styles without a full page reload.

• #18243 dd29d62 Thanks @​astro-factory! - Fixes context.props being null in middleware and endpoints when the composable astro/hono or astro/fetch actions() handler runs before middleware(), or when pages() runs without middleware()

• #18193 95d5d16 Thanks @​astro-factory! - Fixes astro build failing on Windows with Node.js 25+ with ERR_INVALID_ARG_VALUE when clearing the output directory hits a transient EPERM error

• #18220 d6c13a4 Thanks @​astro-factory! - Fixes type errors reported in Astro's built-in <Picture /> and <Font /> components when type-checking a project with tsc and @astrojs/ts-content-mapper

• #18133 faac481 Thanks @​astro-factory! - Fixes lost request state when Vite discovers server dependencies during a request in Cloudflare dev mode

... (truncated)

Commits

• 3571e2d [ci] release (#18292)
• 0e9e857 Keep existing pnpm allowBuilds approvals in astro add (#18298)
• 882dd98 Replace esbuild with Vite and Rolldown APIs (#18263)
• 28e7410 fix(astro): provide Astro.cache when rendering error pages (#18293)
• 31f13c3 Fix glob() loader watcher ignoring patterns starting with an extglob like `!(...
• 25c19fa [ci] release (#18272)
• 38f6793 fix(astro): approve workerd builds in astro add cloudflare for pnpm v11+ an...
• 547b572 Restore content-type gate in security.checkOrigin so JSON requests are not bl...
• fcf6ed6 fix(assets): return requested format from Sharp transform (#18222)
• bec7d18 Ignore layout frontmatter in Markdown content collection entries with `defe...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)