Bump the production-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the production-dependencies group with 4 updates in the / directory: @astrojs/cloudflare, astro, micromark and uuid.

Updates @astrojs/cloudflare from 14.3.2 to 14.4.0

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​14.4.0

Minor Changes

• #18177 7d814e5 Thanks @​Princesseuh! - Reworks image processing on prerendered pages to use Astro's built-in image pipeline. Requires astro@^7.4.0

  Images on prerendered pages now behave the same as on other adapters. Images optimized with the Cloudflare Images binding are now properly cached between builds, and image options such as assetQueryParams and build.assetsPrefix are applied the same way as everywhere else.

Patch Changes

• Updated dependencies [b7a1bd9]:
  • @​astrojs/internal-helpers@​0.13.0
  • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.3.4

Patch Changes

• #18213 1e5523d Thanks @​astro-factory! - Fixes the globalThis.process shim being prepended to client-side scripts. The shim is now only added to the server output.

• #18253 78dca00 Thanks @​astro-factory! - Fixes the @astrojs/cloudflare/hono usage example so i18n() is mounted before pages(). In the old order, i18n() never ran, so locale redirects and fallbacks were skipped.

• #18145 02246c9 Thanks @​astro-factory! - Fixes dev dependency scan failing when a frontmatter line starts with import.meta or import(

• #17677 4f85749 Thanks @​andreialba! - Fixes remote images without a file extension failing with 400 Unsupported format: null when using the cloudflare-binding image service

  Astro only adds the f (format) parameter to /_image URLs when it can infer a format from the source, and otherwise leaves it off so the image service resolves the format from the source itself. Extensionless remote images, such as GitHub avatars like https://avatars.githubusercontent.com/u/1234, take that path. The image transform endpoint now falls back to the source's media type when f is absent, passing SVG sources through unchanged and encoding everything else as WebP. This also fixes SVG images, which are requested as f=svg and previously failed the same way.

• #18057 8db3024 Thanks @​asqar! - Fixes astro build failing with fetch failed / connect ECONNREFUSED 127.0.0.1:<port> during prerendering on hosts where localhost resolves to IPv6

  The prerenderer started its Vite preview server with host: 'localhost' and then built the fetch URL by re-stating that same hostname. localhost was therefore resolved twice, independently — once by listen() to pick a bind address and once by fetch() to pick a connect address — with nothing making the two agree. On hosts where those resolutions land on different families, the preview server listens on ::1 while fetch dials 127.0.0.1, and every prerender request is refused. The URL is now derived from the address actually bound, so bind and connect agree by construction.

• Updated dependencies [6987261, 62b13ba]:

  • @​astrojs/internal-helpers@​0.12.0
  • @​astrojs/underscore-redirects@​1.0.4

@​astrojs/cloudflare@​14.3.3

Patch Changes

• #18059 30cb32e Thanks @​Princesseuh! - Fixes image transforms without a specified quality outputting an higher quality than expected on certain formats

• #18091 28d59a9 Thanks @​astro-factory! - Fixes optimizeDeps.include glob astro/runtime/** matching .d.ts files, which caused 83 unnecessary optimizer entries and empty output chunks per environment during dev

• #18032 f7dbc6a Thanks @​adamchal! - Fixes image requests when using imageService: 'compile' with passthroughImageService().

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

Changelog

Sourced from @​astrojs/cloudflare's changelog.

14.4.0

Minor Changes

• #18177 7d814e5 Thanks @​Princesseuh! - Reworks image processing on prerendered pages to use Astro's built-in image pipeline. Requires astro@^7.4.0

  Images on prerendered pages now behave the same as on other adapters. Images optimized with the Cloudflare Images binding are now properly cached between builds, and image options such as assetQueryParams and build.assetsPrefix are applied the same way as everywhere else.

Patch Changes

• Updated dependencies [b7a1bd9]:
  • @​astrojs/internal-helpers@​0.13.0
  • @​astrojs/underscore-redirects@​1.0.4

14.3.4

Patch Changes

• #18213 1e5523d Thanks @​astro-factory! - Fixes the globalThis.process shim being prepended to client-side scripts. The shim is now only added to the server output.

• #18253 78dca00 Thanks @​astro-factory! - Fixes the @astrojs/cloudflare/hono usage example so i18n() is mounted before pages(). In the old order, i18n() never ran, so locale redirects and fallbacks were skipped.

• #18145 02246c9 Thanks @​astro-factory! - Fixes dev dependency scan failing when a frontmatter line starts with import.meta or import(

• #17677 4f85749 Thanks @​andreialba! - Fixes remote images without a file extension failing with 400 Unsupported format: null when using the cloudflare-binding image service

  Astro only adds the f (format) parameter to /_image URLs when it can infer a format from the source, and otherwise leaves it off so the image service resolves the format from the source itself. Extensionless remote images, such as GitHub avatars like https://avatars.githubusercontent.com/u/1234, take that path. The image transform endpoint now falls back to the source's media type when f is absent, passing SVG sources through unchanged and encoding everything else as WebP. This also fixes SVG images, which are requested as f=svg and previously failed the same way.

• #18057 8db3024 Thanks @​asqar! - Fixes astro build failing with fetch failed / connect ECONNREFUSED 127.0.0.1:<port> during prerendering on hosts where localhost resolves to IPv6

  The prerenderer started its Vite preview server with host: 'localhost' and then built the fetch URL by re-stating that same hostname. localhost was therefore resolved twice, independently — once by listen() to pick a bind address and once by fetch() to pick a connect address — with nothing making the two agree. On hosts where those resolutions land on different families, the preview server listens on ::1 while fetch dials 127.0.0.1, and every prerender request is refused. The URL is now derived from the address actually bound, so bind and connect agree by construction.

• Updated dependencies [6987261, 62b13ba]:

  • @​astrojs/internal-helpers@​0.12.0
  • @​astrojs/underscore-redirects@​1.0.4

14.3.3

Patch Changes

• #18059 30cb32e Thanks @​Princesseuh! - Fixes image transforms without a specified quality outputting an higher quality than expected on certain formats

• #18091 28d59a9 Thanks @​astro-factory! - Fixes optimizeDeps.include glob astro/runtime/** matching .d.ts files, which caused 83 unnecessary optimizer entries and empty output chunks per environment during dev

• #18032 f7dbc6a Thanks @​adamchal! - Fixes image requests when using imageService: 'compile' with passthroughImageService().

• Updated dependencies []:

  • @​astrojs/underscore-redirects@​1.0.4

Commits

• c2c43a9 [ci] release (#18354)
• d09b2c2 Update @​astrojs/cloudflare (#18395)
• 83f5f4d Update dependency vite to ^8.3.4 (#18393)
• 5c48d3b Update dependency devalue to v6 (#18385)
• 910ee69 Add notFound() handler to astro/hono and astro/fetch so prerendered 404...
• 7d814e5 refactor(assets): remove globalThis.astroAsset image tracking (#18177)
• 59b9cc0 Fail the build when a prerender error is swallowed by a custom fetch handler ...
• 882a28a Update @​astrojs/cloudflare (#18340)
• 3cbd72c Update dependency @​cloudflare/workers-types to ^5.20261006.1 (#18322)
• 5646f43 Update dependency vite to ^8.3.3 (#18321)
• Additional commits viewable in compare view

Updates astro from 7.3.3 to 7.4.0

Release notes

Sourced from astro's releases.

astro@7.4.0

Minor Changes

• #17894 b7a1bd9 Thanks @​Princesseuh! - Adds a new --timings flag to astro build to help you find what slows down your builds

  When a build takes longer than expected, it can be hard to tell whether the cause is an integration, a Markdown processor plugin, image processing, or even syntax highlighting. Add the --timings flag to your build command to print a summary once the build finishes:

  astro build --timings

  This is helpful to decide what to optimize first, or to compare build times before and after a change to your project.

• #17830 a937b0d Thanks @​florian-lefebvre! - Adds a new optional getFontProperties() callback to font providers

  Font providers can now expose the weights, styles, subsets and formats a font family actually has. Astro uses it when resolving your font configuration to warn about values a provider cannot serve, for example a weight a font family does not offer.

  All built-in providers implement it. If you maintain a custom font provider, implementing this callback is optional for now but it will be required in Astro 8:

  import type { FontProvider } from 'astro';
  const provider: FontProvider = {
  name: 'my-provider',
  resolveFont: ({ familyName }) => {
  // ...
  },
  getFontProperties: ({ familyName }) => ({
  weights: ['400', '700'],
  styles: ['normal', 'italic'],
  subsets: ['latin'],
  formats: ['woff2'],
  }),
  };

• #17830 a937b0d Thanks @​florian-lefebvre! - Adds a fetch() function to the font provider init() context

  This function requests a provider API, retrying transient failures and more. It lets providers that wrap a 3rd-party unifont provider pass the context to it directly:

  import type { FontProvider } from 'astro';
  import type { InitializedProvider } from 'unifont';
  import { acmeProvider } from '@acme/unifont-provider';
  export function acmeFontProvider(): FontProvider {
  const provider = acmeProvider();
  let initializedProvider: InitializedProvider | undefined;
  return {
  name: provider._name,

... (truncated)

Changelog

Sourced from astro's changelog.

7.4.0

Minor Changes

• #17894 b7a1bd9 Thanks @​Princesseuh! - Adds a new --timings flag to astro build to help you find what slows down your builds

  When a build takes longer than expected, it can be hard to tell whether the cause is an integration, a Markdown processor plugin, image processing, or even syntax highlighting. Add the --timings flag to your build command to print a summary once the build finishes:

  astro build --timings

  This is helpful to decide what to optimize first, or to compare build times before and after a change to your project.

• #17830 a937b0d Thanks @​florian-lefebvre! - Adds a new optional getFontProperties() callback to font providers

  Font providers can now expose the weights, styles, subsets and formats a font family actually has. Astro uses it when resolving your font configuration to warn about values a provider cannot serve, for example a weight a font family does not offer.

  All built-in providers implement it. If you maintain a custom font provider, implementing this callback is optional for now but it will be required in Astro 8:

  import type { FontProvider } from 'astro';
  const provider: FontProvider = {
  name: 'my-provider',
  resolveFont: ({ familyName }) => {
  // ...
  },
  getFontProperties: ({ familyName }) => ({
  weights: ['400', '700'],
  styles: ['normal', 'italic'],
  subsets: ['latin'],
  formats: ['woff2'],
  }),
  };

• #17830 a937b0d Thanks @​florian-lefebvre! - Adds a fetch() function to the font provider init() context

  This function requests a provider API, retrying transient failures and more. It lets providers that wrap a 3rd-party unifont provider pass the context to it directly:

  import type { FontProvider } from 'astro';
  import type { InitializedProvider } from 'unifont';
  import { acmeProvider } from '@acme/unifont-provider';
  export function acmeFontProvider(): FontProvider {
  const provider = acmeProvider();
  let initializedProvider: InitializedProvider | undefined;
  return {

... (truncated)

Commits

• c2c43a9 [ci] release (#18354)
• f698e18 fix(astro): ignore image.service overrides with only undefined values (#18383)
• 83f5f4d Update dependency vite to ^8.3.4 (#18393)
• 858938a Update astro (#18390)
• 1f04637 feat: use tinyps for process finding (#18368)
• c96d07e Update dependency preact to v11 (#18389)
• f8cf143 Update dependency rolldown to ^1.2.13 (#18388)
• 5c48d3b Update dependency devalue to v6 (#18385)
• 71e2b24 feat: treat Vite's resolved outDir values as the source of truth for build ou...
• a937b0d feat(fonts): warn on invalid properties (#17830)
• Additional commits viewable in compare view

Updates micromark from 4.0.2 to 4.0.3

Commits

• 4aec520 4.0.3
• c890f37 micromark-core-commonmark: 2.0.4
• d9679ad micromark-factory-space: 2.1.0
• 21cd4c3 micromark-util-edit-map: 1.0.0
• b5f6a6f micromark-util-types: 2.0.3
• 3f0d484 micromark-core-commonmark: fix attention flanking next to others
• 8421970 micromark: use edit map in text initializer
• 34234f9 micromark-factory-space: add factorySpaceMinMax
• b31f51c micromark-core-commonmark: refactor non-lazy cont check
• c0f7daf micromark-core-commonmark: add list of start tokens
• Additional commits viewable in compare view

Updates uuid from 14.0.2 to 14.0.3

Release notes

Sourced from uuid's releases.

v14.0.3

14.0.3 (2026-10-09)

Bug Fixes

• fix CITGM #1154 (#981) (b44f159)

Changelog

Sourced from uuid's changelog.

14.0.3 (2026-10-09)

Bug Fixes

• fix CITGM #1154 (#981) (b44f159)

Commits

• 993ff7b chore(main): release 14.0.3 (#982)
• f7d19b9 chore: update workflow actions (#983)
• b44f159 fix: fix CITGM #1154 (#981)
• dd8c173 chore: update deps (#975)
• See full diff in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions