chore(deps): bump astro to 7.3.2 and Starlight to 0.42.0 - #390
Conversation
astro 7.1.6 is affected by GHSA-26w7-cxv4-gfx2 (critical, RCE via AVIF image optimization, patched in 7.2.8) and GHSA-376h-93r7-7g6f (base-path auth bypass, patched in 7.2.4). astro 7.2.10 moved its @astrojs/markdown-remark peer from an exact pin to ^7.3.0, which only @astrojs/mdx 8 satisfies, which in turn only arrives with Starlight 0.42. The three have to move together, which is why dependabot's astro-only bump (#384) cannot resolve. CodeExample drops xmlns from its footer SVGs: astro 7.3 / mdx 8 serialize it as `:xmlns` when the component renders inside a <TabItem> slot.
A macOS `npm install` with node_modules present reuses the local tree and drops the top-level @emnapi packages, which npm ci needs on Linux. Regenerated with --package-lock-only and no node_modules, then the libc fields restored.
There was a problem hiding this comment.
🟡 Changes recommended
The Node.js runtime requirement and dependency engine floor are not consistently documented or enforced.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Updates Astro and Starlight to resolve dependency conflicts, address security advisories, and fix an MDX SVG serialization issue.
Changes:
- Bumps Astro ecosystem dependencies and refreshes the lockfile.
- Removes
xmlnsfromCodeExamplefooter SVGs. - Updates transitive dependencies.
File summaries
| File | Description |
|---|---|
src/components/CodeExample.astro |
Applies the inline SVG serialization workaround. |
package.json |
Updates framework dependency versions. |
package-lock.json |
Records the resolved dependency graph. |
Review details
- Files reviewed: 2/3 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Copilot feedback reviewed, no change needed. Replied in thread: the Node floor is unchanged ( |
Summary
Closes #384, which cannot resolve: astro 7.2.10 changed its
@astrojs/markdown-remarkpeer from an exact pin to^7.3.0, and only@astrojs/mdx8 satisfies that, which only arrives with Starlight 0.42. Dependabot bumps one package, sonpm cifails with ERESOLVE. Same shape as #337 → #339.Clears three advisories:
basenpm auditreports 0 vulnerabilities after the bump.Starlight 0.42 breaking changes
popover+.sl-menu-button, droppingstarlight-menu-button,aria-expandedanddata-mobile-menu-expanded. Nothing insrc/orcustom.csstargets those.taglineconfig option removed. OurHero.astrouses thehero.taglinefrontmatter field, which is unaffected..d.tsinstead of TS source. We only import@astrojs/starlight/loaders,/schemaand/components.Verification
Built against a
mainbaseline, both on node 22:llms.txt,llms-full.txt,sitemap.xmland all 210.mdendpoints byte-identical;feed.xmldiffers only bylastBuildDateand item order (pre-existing nondeterminism)generatormeta tags, and page-local tab ids (a 0.41.8 change)package-lock.jsonkeeps itslibcmetadata; a macOSnpm installstrips it, so it was restored by hand and re-validated withnpm ciOne upstream bug worked around
Under astro 7.3 / mdx 8, an
.astrocomponent with scoped styles rendered inside another component's slot in MDX getsxmlnsserialized as:xmlns. It reproduces with a minimal component inside<TabItem>and is specific toxmlns(xmlns:xlink,viewBoxand ordinary attributes are fine). Here it hit the two footer icons ofCodeExample, so those SVGs now omitxmlns— inline SVG does not need it. To be reported upstream; nothing is filed yet.