chore(deps): bump astro from 7.2.0 to 7.3.8 in the minor-and-patch group across 1 directory

[dependabot]

Bumps the minor-and-patch group with 1 update in the / directory: astro.

Updates astro from 7.2.0 to 7.3.8

Release notes

Sourced from astro's releases.

astro@7.3.8

Patch Changes

• #18293 28e7410 Thanks @​astro-factory! - Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

• #18298 0e9e857 Thanks @​matthewp! - Fixes astro add removing existing allowBuilds approvals from pnpm-workspace.yaml with pnpm v11.0–v11.22

• #18263 882dd98 Thanks @​florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

• #18290 31f13c3 Thanks @​astro-factory! - Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob such as !(drafts)/**/*.md

astro@7.3.7

Patch Changes

• #18266 cba76cc Thanks @​astro-factory! - Fixes a build error when a Markdown content collection entry loaded with glob({ deferRender: true }) has a layout frontmatter property. layout is now ignored for content collection entries, as documented.

• #18287 38f6793 Thanks @​astro-factory! - Fixes astro add cloudflare failing to install dependencies with pnpm v11+ by approving the workerd build script, and shows the package manager's error output when astro add fails to install dependencies

• #18222 fcf6ed6 Thanks @​mingjunlu! - Fixes an issue where AVIF images were served as image/heif instead of image/avif in the dev server.

• #18240 de4df06 Thanks @​astro-factory! - Fixes the cache() handler from astro/hono and astro/fetch throwing a TypeError when a cache provider is configured. It now registers the cache provider before rendering, so Astro.cache is available to downstream handlers like pages().

• #18268 547b572 Thanks @​astro-factory! - Fixes security.checkOrigin rejecting cross-origin requests with non-form content types such as application/json. As documented, the check only applies to unsafe requests that have no content-type header or one of application/x-www-form-urlencoded, multipart/form-data, or text/plain.

astro@7.3.6

Patch Changes

• #18166 5134d0f Thanks @​astro-factory! - Fixes an intermittent dev server crash when using astro:actions inside a server island with adapters that use a pre-bundled SSR environment (e.g. @astrojs/cloudflare)

• #18076 8a2df66 Thanks @​astro-factory! - Fixes stale scoped styles during HMR when both markup and <style> are changed in a single save

• #18252 2d29e7e Thanks @​astro-factory! - Fixes CSS from other pages leaking into a page's <head> in dev when the page imports a module such as astro:config/server.

• #18000 6724575 Thanks @​barclayd! - Fixes a bug where server islands containing framework components rendered empty in the dev server when using a custom src/fetch.ts

• #18241 7c5fd6f Thanks @​astro-factory! - Fixes the composable i18n() handler from astro/fetch and astro/hono returning an empty 404 for paths without a locale prefix. It now renders the custom 404 page, matching astro().

• #18164 1a6997f Thanks @​astro-factory! - Fixes CSS Module HMR in dev when a component is rendered both with and without hydration on the same page. Astro now uses path-based class name hashing in dev mode so that editing CSS declarations no longer changes the generated selectors, allowing Vite's CSS HMR to update styles without a full page reload.

• #18243 dd29d62 Thanks @​astro-factory! - Fixes context.props being null in middleware and endpoints when the composable astro/hono or astro/fetch actions() handler runs before middleware(), or when pages() runs without middleware()

• #18193 95d5d16 Thanks @​astro-factory! - Fixes astro build failing on Windows with Node.js 25+ with ERR_INVALID_ARG_VALUE when clearing the output directory hits a transient EPERM error

• #18220 d6c13a4 Thanks @​astro-factory! - Fixes type errors reported in Astro's built-in <Picture /> and <Font /> components when type-checking a project with tsc and @astrojs/ts-content-mapper

• #18133 faac481 Thanks @​astro-factory! - Fixes lost request state when Vite discovers server dependencies during a request in Cloudflare dev mode

• #18146 2af4516 Thanks @​astro-factory! - Fixes CSS imported from an injectScript('page') script being dropped during build

• #18159 e5f8fe0 Thanks @​astro-factory! - Fixes a hang when a server:defer component is inside a slot of another component in an MDX content collection entry

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.8

Patch Changes

• #18293 28e7410 Thanks @​astro-factory! - Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

• #18298 0e9e857 Thanks @​matthewp! - Fixes astro add removing existing allowBuilds approvals from pnpm-workspace.yaml with pnpm v11.0–v11.22

• #18263 882dd98 Thanks @​florian-lefebvre! - Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

• #18290 31f13c3 Thanks @​astro-factory! - Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob such as !(drafts)/**/*.md

7.3.7

Patch Changes

• #18266 cba76cc Thanks @​astro-factory! - Fixes a build error when a Markdown content collection entry loaded with glob({ deferRender: true }) has a layout frontmatter property. layout is now ignored for content collection entries, as documented.

• #18287 38f6793 Thanks @​astro-factory! - Fixes astro add cloudflare failing to install dependencies with pnpm v11+ by approving the workerd build script, and shows the package manager's error output when astro add fails to install dependencies

• #18222 fcf6ed6 Thanks @​mingjunlu! - Fixes an issue where AVIF images were served as image/heif instead of image/avif in the dev server.

• #18240 de4df06 Thanks @​astro-factory! - Fixes the cache() handler from astro/hono and astro/fetch throwing a TypeError when a cache provider is configured. It now registers the cache provider before rendering, so Astro.cache is available to downstream handlers like pages().

• #18268 547b572 Thanks @​astro-factory! - Fixes security.checkOrigin rejecting cross-origin requests with non-form content types such as application/json. As documented, the check only applies to unsafe requests that have no content-type header or one of application/x-www-form-urlencoded, multipart/form-data, or text/plain.

7.3.6

Patch Changes

• #18166 5134d0f Thanks @​astro-factory! - Fixes an intermittent dev server crash when using astro:actions inside a server island with adapters that use a pre-bundled SSR environment (e.g. @astrojs/cloudflare)

• #18076 8a2df66 Thanks @​astro-factory! - Fixes stale scoped styles during HMR when both markup and <style> are changed in a single save

• #18252 2d29e7e Thanks @​astro-factory! - Fixes CSS from other pages leaking into a page's <head> in dev when the page imports a module such as astro:config/server.

• #18000 6724575 Thanks @​barclayd! - Fixes a bug where server islands containing framework components rendered empty in the dev server when using a custom src/fetch.ts

• #18241 7c5fd6f Thanks @​astro-factory! - Fixes the composable i18n() handler from astro/fetch and astro/hono returning an empty 404 for paths without a locale prefix. It now renders the custom 404 page, matching astro().

• #18164 1a6997f Thanks @​astro-factory! - Fixes CSS Module HMR in dev when a component is rendered both with and without hydration on the same page. Astro now uses path-based class name hashing in dev mode so that editing CSS declarations no longer changes the generated selectors, allowing Vite's CSS HMR to update styles without a full page reload.

• #18243 dd29d62 Thanks @​astro-factory! - Fixes context.props being null in middleware and endpoints when the composable astro/hono or astro/fetch actions() handler runs before middleware(), or when pages() runs without middleware()

• #18193 95d5d16 Thanks @​astro-factory! - Fixes astro build failing on Windows with Node.js 25+ with ERR_INVALID_ARG_VALUE when clearing the output directory hits a transient EPERM error

• #18220 d6c13a4 Thanks @​astro-factory! - Fixes type errors reported in Astro's built-in <Picture /> and <Font /> components when type-checking a project with tsc and @astrojs/ts-content-mapper

• #18133 faac481 Thanks @​astro-factory! - Fixes lost request state when Vite discovers server dependencies during a request in Cloudflare dev mode

... (truncated)

Commits

• 3571e2d [ci] release (#18292)
• 0e9e857 Keep existing pnpm allowBuilds approvals in astro add (#18298)
• 882dd98 Replace esbuild with Vite and Rolldown APIs (#18263)
• 28e7410 fix(astro): provide Astro.cache when rendering error pages (#18293)
• 31f13c3 Fix glob() loader watcher ignoring patterns starting with an extglob like `!(...
• 25c19fa [ci] release (#18272)
• 38f6793 fix(astro): approve workerd builds in astro add cloudflare for pnpm v11+ an...
• 547b572 Restore content-type gate in security.checkOrigin so JSON requests are not bl...
• fcf6ed6 fix(assets): return requested format from Sharp transform (#18222)
• bec7d18 Ignore layout frontmatter in Markdown content collection entries with `defe...
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
uplbtools-me	Ready	Preview	Oct 12, 2026 10:24pm UTC

[smmariquit]

sweep: leaving open — the deploy check is failing on this PR (In a non-interactive environment, it's necessary to set a CLOUDFLARE_API_TOKEN environment variable for wrangler to work). This looks pre-existing/environmental (Dependabot PRs don't get access to repo secrets like CLOUDFLARE_API_TOKEN) rather than caused by the astro 7.2.0→7.3.2 bump itself, which is otherwise a clean minor-and-patch, lockfile-only change. Will keep watching; may need a maintainer to confirm secret access for Dependabot runs or re-trigger after merge.

---

Generated by Claude Code

[smmariquit]

sweep: weekly re-check, same conclusion — leaving open. The deploy check is still failing (CLOUDFLARE_API_TOKEN not available in the Dependabot run context) — same pre-existing/infra issue as the other action-pin PRs in this repo, unrelated to the astro 7.2.0→7.3.2 bump itself. The version bump is a clean minor-and-patch, lockfile-only change; safe to merge once the deploy check environment issue is resolved (e.g. a maintainer reruns the check with secrets available, or the workflow is adjusted to skip that step for Dependabot PRs).

---

Generated by Claude Code

[smmariquit]

sweep: weekly re-check, same conclusion — leaving open. Bump itself (astro 7.2.0→7.3.2) is a clean minor-and-patch, lockfile/manifest-only change (package.json + package-lock.json). The deploy check is still failing with CLOUDFLARE_API_TOKEN not set — confirmed in the job log, same pre-existing/environmental issue (Dependabot runs don't get repo secrets), unrelated to this bump. Safe to merge once that secret-access gap is addressed for Dependabot runs.

---

Generated by Claude Code

[smmariquit]

sweep: weekly re-check, same conclusion — leaving open. Bump itself (astro 7.2.0→7.3.5) is a clean minor-and-patch, lockfile/manifest-only change (package.json + package-lock.json). The deploy check is still failing with CLOUDFLARE_API_TOKEN not set — confirmed in the job log, same pre-existing/environmental issue (Dependabot runs don't get repo secrets), unrelated to this bump. Safe to merge once that secret-access gap is addressed for Dependabot runs.

---

Generated by Claude Code