build(deps): bump js-yaml, @astrojs/cloudflare and astro

[dependabot]

Bumps js-yaml to 4.3.0 and updates ancestor dependencies js-yaml, @astrojs/cloudflare and astro. These dependencies need to be updated together.

Updates js-yaml from 3.14.1 to 4.3.0

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

• Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
• Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

• maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

• Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

• Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

• [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

• Added named exports for schemas, tags, parser events and AST utilities.
• Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
• Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
• Added dump() transform option for changing the generated AST before rendering.
• Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.
• Added formal data layers (events and AST) for modular data pipelines.
  • Added low-level parser (to events), presenter and visitor APIs.
• Added the YAML Test Suite to the test set.

Changed

• See the migration guide for upgrade notes.
• Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits

• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• 6842ef6 doc polish
• 590dbab 4.2.0 released
• f944dc5 Add package.json funding field
• f692719 Changelog update
• Additional commits viewable in compare view

Updates @astrojs/cloudflare from 11.1.0 to 14.1.0

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.1.0

Minor Changes

• #17099 fdab7ce Thanks @​adamchal! - Adds configured image service support with the compile and custom options.

  The Cloudflare adapter supports various options that affect how images are processed for both pre-rendered and on-demand routes:

  • Setting imageService: 'compile' now ensures it is used for pre-rendered routes. When no custom image service is defined, the behavior remains unchanged.
  • With imageService: 'custom', assets are now processed at build time for pre-rendered routes. If you have configured an image service, it will be bundled to handle images at runtime; otherwise, the behavior remains unchanged.
  • The other imageService options remain unchanged.

  Learn more about the image service options available in the Cloudflare adapter guide.

Patch Changes

• #17236 c411200 Thanks @​matthewp! - Prevents warnings in the Cloudflare adapter about optimizing the @astrojs/cloudflare/entrypoints/server module in dev.

• #17249 02b73b0 Thanks @​ematipico! - Fixes an issue where the peerDependencies field used incorrect dependencies.

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.3

@​astrojs/cloudflare@​14.0.2

Patch Changes

• #17049 ffceaa2 Thanks @​astrobot-houston! - Fixes prerender errors being silently swallowed when pages throw during rendering in workerd, causing astro build to exit 0 and emit truncated HTML. The response body is now fully buffered inside workerd before being sent back to the build process, so streaming errors are caught and surfaced as build failures with clear error messages.

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.3

@​astrojs/cloudflare@​14.0.1

Patch Changes

• #17175 7a7d879 Thanks @​astrobot-houston! - Fixes astro dev OOM crashes for @astrojs/cloudflare users on Vite 8 by migrating the frontmatter scan plugin to Rolldown-compatible options.

• #17187 0db4b57 Thanks @​matthewp! - Fixes React invalid hook warning during cold SSR optimizer reload when using ClientRouter

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.3

@​astrojs/cloudflare@​14.0.0

Major Changes

• #15819 cafec4e Thanks @​delucis! - Upgrade to Vite v8

Minor Changes

• #16335 9a53f77 Thanks @​ascorbic! - Adds an opt-in CDN cache provider for Astro route caching on Cloudflare Workers

  [!WARNING]

... (truncated)

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.1.0

Minor Changes

• #17099 fdab7ce Thanks @​adamchal! - Adds configured image service support with the compile and custom options.

  The Cloudflare adapter supports various options that affect how images are processed for both pre-rendered and on-demand routes:

  • Setting imageService: 'compile' now ensures it is used for pre-rendered routes. When no custom image service is defined, the behavior remains unchanged.
  • With imageService: 'custom', assets are now processed at build time for pre-rendered routes. If you have configured an image service, it will be bundled to handle images at runtime; otherwise, the behavior remains unchanged.
  • The other imageService options remain unchanged.

  Learn more about the image service options available in the Cloudflare adapter guide.

Patch Changes

• #17236 c411200 Thanks @​matthewp! - Prevents warnings in the Cloudflare adapter about optimizing the @astrojs/cloudflare/entrypoints/server module in dev.

• #17249 02b73b0 Thanks @​ematipico! - Fixes an issue where the peerDependencies field used incorrect dependencies.

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.3

14.0.2

Patch Changes

• #17049 ffceaa2 Thanks @​astrobot-houston! - Fixes prerender errors being silently swallowed when pages throw during rendering in workerd, causing astro build to exit 0 and emit truncated HTML. The response body is now fully buffered inside workerd before being sent back to the build process, so streaming errors are caught and surfaced as build failures with clear error messages.

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.3

14.0.1

Patch Changes

• #17175 7a7d879 Thanks @​astrobot-houston! - Fixes astro dev OOM crashes for @astrojs/cloudflare users on Vite 8 by migrating the frontmatter scan plugin to Rolldown-compatible options.

• #17187 0db4b57 Thanks @​matthewp! - Fixes React invalid hook warning during cold SSR optimizer reload when using ClientRouter

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.3

14.0.0

Major Changes

• #15819 cafec4e Thanks @​delucis! - Upgrade to Vite v8

Minor Changes

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​astrojs/cloudflare since your current version.

Updates astro from 4.16.5 to 7.0.5

Release notes

Sourced from astro's releases.

astro@7.0.5

Patch Changes

• #17242 9c05ba4 Thanks @​matthewp! - Fixes an error that could occur after the dev server restarts when using an adapter such as @astrojs/cloudflare, where a request would fail with a 500 referencing a missing pre-bundled dependency:

  The file does not exist at "node_modules/.vite/deps_ssr/astro_compiler-runtime.js?v=6419660d" which is in the optimize deps directory. The dependency might be incompatible with the dep optimizer. Try adding it to `optimizeDeps.exclude`.
  

• #17202 c6d254d Thanks @​matthewp! - Refactors path alias resolution to use Vite's native tsconfigPaths option

  This is an internal change with no expected impact on user projects. Astro now defers tsconfig and jsconfig paths alias resolution to Vite, keeping a small fallback for a few CSS cases Vite does not yet handle.

• #17123 72e29bd Thanks @​martrapp! - Fixes an issue where the ClientRouter wipes head elements after page transitions if the <head> contains a server:defer component.

• #17232 257505e Thanks @​matthewp! - Fixes a bug where <style> tags from components such as a content collection's Content could be silently dropped from the output when an await appeared before the component in an .astro file's markup.

• #17193 a7352fd Thanks @​jan-kubica! - Fixes the background dev server failing to start when astro is hoisted outside the project's node_modules (for example bun workspaces). The background process is now spawned from Astro's own resolved location instead of a path assumed under the project root.

• #17255 581d171 Thanks @​astrobot-houston! - Fixes prefetch not working for links inside server:defer components

astro@7.0.4

Patch Changes

• #17212 7ba0bb1 Thanks @​matthewp! - Ensures transition directive values are HTML-escaped when rendered on hydrated islands

• #17224 dc5e52f Thanks @​astrobot-houston! - Fixes trailing slash handling for dynamic file endpoints in dev mode. Dynamic file endpoints (e.g., src/pages/api/[name].json.ts) with trailingSlash: "always" incorrectly required a trailing slash in dev mode, returning 404 for /api/bar.json and 200 for /api/bar.json/.

• #17067 23f9446 Thanks @​fkatsuhiro! - Fixed a bug where the development toolbar did not output a warning even though the implicit ARIA role and the manually specified role were duplicated.

• #17234 d5fbee8 Thanks @​ocavue! - Adds support for sharp v0.35. pnpm users no longer need to approve sharp's build script (see allowBuilds) when on v0.35.

• #17223 5970ef4 Thanks @​astrobot-houston! - Fixes getCollection() returning empty in dev mode for large content collections (500k+ entries)

• #17184 799e5cd Thanks @​Princesseuh! - Upgrades the Rust compiler to the latest, which fixes some bugs. Refer to its changelog for more information.

• #17208 da8b573 Thanks @​matthewp! - Hardens forwarded header handling so the internal request helper validates X-Forwarded-Host against security.allowedDomains before trusting X-Forwarded-For for clientAddress. Previously it only checked that the header was present, which was inconsistent with the public createRequest helper. This aligns both code paths; behavior is unchanged for correctly configured proxies.

astro@7.0.3

Patch Changes

• #17189 24d2c9e Thanks @​astrobot-houston! - Fixes a bug where an error thrown inside one route's getStaticPaths() would prevent other valid routes from being matched in dev mode

• #16932 8f4a3db Thanks @​fkatsuhiro! - Fixes HMR for action files during development. Editing files in src/actions/ now takes effect on the next request without requiring a dev server restart.

• #17087 fb0ab02 Thanks @​jp-knj! - Fixes localized custom error pages in i18n projects so routes like /pt/404 are used for missing localized pages and return the correct status code

astro@7.0.2

Patch Changes

• Updated dependencies [3b5e994]:
  • @​astrojs/markdown-satteri@​0.3.2

... (truncated)

Changelog

Sourced from astro's changelog.

4.16.16

Patch Changes

• #12542 65e50eb Thanks @​kadykov! - Fix JPEG image size determination

• #12525 cf0d8b0 Thanks @​ematipico! - Fixes an issue where with i18n enabled, Astro couldn't render the 404.astro component for nonexistent routes.

4.16.15

Patch Changes

• #12498 b140a3f Thanks @​ematipico! - Fixes a regression where Astro was trying to access Request.headers

4.16.14

Patch Changes

• #12480 c3b7e7c Thanks @​matthewp! - Removes the default throw behavior in astro:env

• #12444 28dd3ce Thanks @​ematipico! - Fixes an issue where a server island hydration script might fail case the island ID misses from the DOM.

• #12476 80a9a52 Thanks @​florian-lefebvre! - Fixes a case where the Content Layer glob() loader would not update when renaming or deleting an entry

• #12418 25baa4e Thanks @​oliverlynch! - Fix cached image redownloading if it is the first asset

• #12477 46f6b38 Thanks @​ematipico! - Fixes an issue where the SSR build was emitting the dist/server/entry.mjs file with an incorrect import at the top of the file/

• #12365 a23985b Thanks @​apatel369! - Fixes an issue where Astro.currentLocale was not correctly returning the locale for 404 and 500 pages.

4.16.13

Patch Changes

• #12436 453ec6b Thanks @​martrapp! - Fixes a potential null access in the clientside router

• #12392 0462219 Thanks @​apatel369! - Fixes an issue where scripts were not correctly injected during the build. The issue was triggered when there were injected routes with the same entrypoint and different pattern

4.16.12

Patch Changes

• #12420 acac0af Thanks @​ematipico! - Fixes an issue where the dev server returns a 404 status code when a user middleware returns a valid Response.

4.16.11

Patch Changes

• #12305 f5f7109 Thanks @​florian-lefebvre! - Fixes a case where the error overlay would not escape the message

... (truncated)

Commits

• 7d8ec1f [ci] release (#17237)
• 4fe943a [ci] format
• 581d171 fix(prefetch): observe dynamically added anchors from server islands (#13297)...
• 9c05ba4 Fix spurious dependency re-optimization on dev server restart (#17242)
• 0a054e7 chore(head): normalize html charset declarations (#17197)
• d6ce7cd Fix inline \<style> blocks ignoring vite.build.target when cssMinify is ...
• 807c8fd [ci] format
• 72e29bd fix(client router): prevent head elements loss during page transitions with s...
• a7352fd fix: background dev server fails to start in hoisted monorepos (#17193)
• c6d254d Use Vite tsconfig path resolution by default (#17202)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for astro since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.