Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
astro (source)	dependencies	patch	7.1.5 → 7.1.6
release-drafter/release-drafter	action	minor	v7.6.0 → v7.7.0

---

Release Notes

withastro/astro (astro)

v7.1.6

Compare Source

Patch Changes

• #​17536 ff97b86 Thanks @​dmgawel! - Fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes

• #​17383 296e1b0 Thanks @​thelazylamaGit! - Fixes stale dev CSS after editing component style blocks and CSS files in dev

• #​17543 bbc1ec9 Thanks @​ematipico! - Adds a feature to experimental.collectionStorage that allows to change the size of chunks.

  For example, you can reduce the size of chunks to 1MB:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  
  export default defineConfig({
    experimental: {
      collectionStorage: {
        type: 'chunked',
        chunkSize: 1024 * 1024,
      },
    },
  });

• #​17545 5214663 Thanks @​ematipico! - Bumps the Astro compiler to the latest version. Changelog.

release-drafter/release-drafter (release-drafter/release-drafter)

v7.7.0

Compare Source

What's Changed

New

• feat: no new contributor template (#​1687) @​cchanche
• feat: categorize PRs based on conventional title (#​1556) @​cchanche
• feat: log all config sources (#​1674) @​jetersen

Dependency Updates

9 changes

• build(deps-dev): bump postcss from 8.5.17 to 8.5.23 (#​1683) @​dependabot[bot]
• chore(deps): update npm tool constraint to 12.0.1 (#​1668) @​renovate[bot], @​cchanche
• chore(deps): update npm tool constraint to 11.18.0 (#​1665) @​renovate[bot], @​cchanche
• chore(deps): update node.js to v24.18.0 (#​1664) @​renovate[bot]
• build(deps): support GraphQL 17 (#​1678) @​jetersen
• build(deps-dev): Update js-yaml to 4.3.0 (#​1677) @​jetersen
• build(deps-dev): bump shell-quote from 1.8.4 to 1.10.0 (#​1676) @​dependabot[bot]
• build(deps): bump immutable from 5.1.5 to 5.1.9 (#​1675) @​dependabot[bot]
• build(deps-dev): bump brace-expansion from 5.0.6 to 5.0.7 (#​1672) @​dependabot[bot]

Bug Fixes

• fix: preserve proxy-aware fetch in octokit client (#​1682) @​jetersen

Maintenance

• chore: update references to branch master to main (#​1686) @​cchanche
• ci: rely on conventional pr titles (#​1685) @​cchanche

New Contributors

• No new contributors

Full Changelog: release-drafter/release-drafter@v7.6.0...v7.7.0

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • Between 06:00 PM and 11:59 PM (* 18-23 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	astro@​7.1.5 ⏵ 7.1.6	-21			+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm astro is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/astro@7.1.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/astro@7.1.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report