Bump the site group in /site with 4 updates

[dependabot]

Bumps the site group in /site with 4 updates: @astrojs/starlight, astro, html-validate and puppeteer.

Updates @astrojs/starlight from 0.42.0 to 0.42.1

Release notes

Sourced from @​astrojs/starlight's releases.

@​astrojs/starlight@​0.42.1

Patch Changes

• #4198 96a44d4 Thanks @​mayank99! - Removes the popover attribute from the sidebar pane on desktop viewports. This ensures the desktop sidebar doesn't stay in a "hidden" popover visibility state.

Changelog

Sourced from @​astrojs/starlight's changelog.

0.42.1

Patch Changes

• #4198 96a44d4 Thanks @​mayank99! - Removes the popover attribute from the sidebar pane on desktop viewports. This ensures the desktop sidebar doesn't stay in a "hidden" popover visibility state.

Commits

• a852070 [ci] release (#4199)
• 96a44d4 remove popover attribute from sidebar-pane on wide viewports (#4198)
• See full diff in compare view

Updates astro from 7.3.2 to 7.3.3

Release notes

Sourced from astro's releases.

astro@7.3.3

Patch Changes

• #17651 504333c Thanks @​sxzz! - Refactors internal version handling to use a smaller, ESM-native dependency

• #17942 0bc5715 Thanks @​matthewp! - Returns appropriate 400 and 404 responses from the image endpoint for invalid and missing local image paths

• #17700 b2222fc Thanks @​winklemad! - Fixes Astro.preferredLocaleList returning an empty list when a locale is configured with the object form ({ path, codes }) and the browser sends the code with different casing or an underscore, such as en-US matching a configured en-us

• #17941 394ff79 Thanks @​matthewp! - Fixes astro preview --ignore-lock (and astro dev --ignore-lock) being refused when run from an AI agent environment. The flag now starts the server in the foreground instead of erroring, since agent detection only inferred background mode and was never explicitly requested. An explicit --background combined with --ignore-lock still errors.

• #17928 3277927 Thanks @​ArmandPhilippot! - Fixes TypeScript autocompletion for getImage() to suggest all available predefined options.

• #17928 3277927 Thanks @​ArmandPhilippot! - Fixes a type error in getImage() options that allowed passing both widths and densities at the same time.

• #17857 2637ed1 Thanks @​Princesseuh! - Improves rendering performance

• #17943 2fc7ce9 Thanks @​matthewp! - Fixes a WebAssembly error when importing astro:actions in tests that run under @cloudflare/vitest-pool-workers

• #18018 1b5a234 Thanks @​astro-factory! - Fixes trailing-slash redirect response body pointing to the incoming URL instead of the redirect target. The location header was correct, but the HTML body (<meta http-equiv="refresh">, <title>, and <a> tag) contained the original request path without the trailing-slash correction or query string.

• #17905 eaf70fa Thanks @​SudoDevStudio! - Fixes custom dev toolbar apps losing their UI after client-side navigation with <ClientRouter />.

• #18011 558b301 Thanks @​astro-factory! - Fixes prerendered Cloudflare pages rendering as [object Object] when nodejs_compat is enabled in wrangler.toml

• #17944 ba08e35 Thanks @​matthewp! - Fixes a regression in astro dev where writes outside the module graph (for example, @astrojs/cloudflare's .wrangler/state files) invalidated the middleware on every request, causing repeated SSR reloads. Such writes no longer invalidate the middleware.

• #17531 ae837db Thanks @​danilloestrela! - Updates svgo to 4.0.2 to resolve a security advisory

• #17953 dbbf10e Thanks @​astro-factory! - Fixes a one-time page reload shortly after the first load on cold dev-server starts when a project has framework components imported from MDX content entries. MDX files are now included in the dev dependency pre-bundling scan, so their framework dependencies are bundled up front instead of being discovered (and reloaded for) at runtime.

• #17955 4e8ad9a Thanks @​matthewp! - Improves dev server startup time. The content config and dev server app module graphs now begin compiling during server creation without blocking the server from listening. Request handling waits for the shared setup result when needed, cutting astro dev ready time by roughly a third on projects with a content config.

• #17960 9838049 Thanks @​Chy-Zaber-Bin-Zahid! - Improves the diagnostics of some Astro errors.

• #17998 0e5478d Thanks @​astro-factory! - Fixes SVG <style> elements nested inside <defs> or other container elements not being hashed for CSP

• #17994 80f9f1d Thanks @​astro-factory! - Fixes experimental.incrementalBuild restoring pages with stale CSS after a preprocessor partial changes or missing original images referenced by restored pages

• #17889 8ae6b46 Thanks @​ajfAfg! - Fixes a bug where the dev server stripped the configured base from URLs that only share a prefix with it. With base: '/s', requests to /src/... were rewritten to /rc/... and failed, breaking those pages during development.

• #17980 cfccafa Thanks @​gameroman! - Improves JSDoc for fonts api

• #17953 dbbf10e Thanks @​astro-factory! - Fixes CSS HMR for framework components rendered through content entries after ClientRouter navigation

• #17970 0b4dc3a Thanks @​matthewp! - Improves serialization of transition animation values in generated CSS

• #17999 30ef3cb Thanks @​astro-factory! - Fixes content collection HMR not updating prerendered pages when an adapter enables a separate prerender environment (e.g. @astrojs/cloudflare with prerenderEnvironment: 'node')

• #18002 312ab49 Thanks @​shoutoutuoadi325! - Fixes redirect targets being corrupted when a dynamic route parameter value contains $ replacement patterns like $&

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.3

Patch Changes

• #17651 504333c Thanks @​sxzz! - Refactors internal version handling to use a smaller, ESM-native dependency

• #17942 0bc5715 Thanks @​matthewp! - Returns appropriate 400 and 404 responses from the image endpoint for invalid and missing local image paths

• #17700 b2222fc Thanks @​winklemad! - Fixes Astro.preferredLocaleList returning an empty list when a locale is configured with the object form ({ path, codes }) and the browser sends the code with different casing or an underscore, such as en-US matching a configured en-us

• #17941 394ff79 Thanks @​matthewp! - Fixes astro preview --ignore-lock (and astro dev --ignore-lock) being refused when run from an AI agent environment. The flag now starts the server in the foreground instead of erroring, since agent detection only inferred background mode and was never explicitly requested. An explicit --background combined with --ignore-lock still errors.

• #17928 3277927 Thanks @​ArmandPhilippot! - Fixes TypeScript autocompletion for getImage() to suggest all available predefined options.

• #17928 3277927 Thanks @​ArmandPhilippot! - Fixes a type error in getImage() options that allowed passing both widths and densities at the same time.

• #17857 2637ed1 Thanks @​Princesseuh! - Improves rendering performance

• #17943 2fc7ce9 Thanks @​matthewp! - Fixes a WebAssembly error when importing astro:actions in tests that run under @cloudflare/vitest-pool-workers

• #18018 1b5a234 Thanks @​astro-factory! - Fixes trailing-slash redirect response body pointing to the incoming URL instead of the redirect target. The location header was correct, but the HTML body (<meta http-equiv="refresh">, <title>, and <a> tag) contained the original request path without the trailing-slash correction or query string.

• #17905 eaf70fa Thanks @​SudoDevStudio! - Fixes custom dev toolbar apps losing their UI after client-side navigation with <ClientRouter />.

• #18011 558b301 Thanks @​astro-factory! - Fixes prerendered Cloudflare pages rendering as [object Object] when nodejs_compat is enabled in wrangler.toml

• #17944 ba08e35 Thanks @​matthewp! - Fixes a regression in astro dev where writes outside the module graph (for example, @astrojs/cloudflare's .wrangler/state files) invalidated the middleware on every request, causing repeated SSR reloads. Such writes no longer invalidate the middleware.

• #17531 ae837db Thanks @​danilloestrela! - Updates svgo to 4.0.2 to resolve a security advisory

• #17953 dbbf10e Thanks @​astro-factory! - Fixes a one-time page reload shortly after the first load on cold dev-server starts when a project has framework components imported from MDX content entries. MDX files are now included in the dev dependency pre-bundling scan, so their framework dependencies are bundled up front instead of being discovered (and reloaded for) at runtime.

• #17955 4e8ad9a Thanks @​matthewp! - Improves dev server startup time. The content config and dev server app module graphs now begin compiling during server creation without blocking the server from listening. Request handling waits for the shared setup result when needed, cutting astro dev ready time by roughly a third on projects with a content config.

• #17960 9838049 Thanks @​Chy-Zaber-Bin-Zahid! - Improves the diagnostics of some Astro errors.

• #17998 0e5478d Thanks @​astro-factory! - Fixes SVG <style> elements nested inside <defs> or other container elements not being hashed for CSP

• #17994 80f9f1d Thanks @​astro-factory! - Fixes experimental.incrementalBuild restoring pages with stale CSS after a preprocessor partial changes or missing original images referenced by restored pages

• #17889 8ae6b46 Thanks @​ajfAfg! - Fixes a bug where the dev server stripped the configured base from URLs that only share a prefix with it. With base: '/s', requests to /src/... were rewritten to /rc/... and failed, breaking those pages during development.

• #17980 cfccafa Thanks @​gameroman! - Improves JSDoc for fonts api

• #17953 dbbf10e Thanks @​astro-factory! - Fixes CSS HMR for framework components rendered through content entries after ClientRouter navigation

• #17970 0b4dc3a Thanks @​matthewp! - Improves serialization of transition animation values in generated CSS

• #17999 30ef3cb Thanks @​astro-factory! - Fixes content collection HMR not updating prerendered pages when an adapter enables a separate prerender environment (e.g. @astrojs/cloudflare with prerenderEnvironment: 'node')

... (truncated)

Commits

• 8a3106e [ci] release (#17939)
• 5efea1b Add a version field to the astro-client-only fixture
• 80f9f1d Hash compiled CSS output in incremental build to detect Sass partial changes ...
• bc6572f Revert "Forward user class to Picture's outer element" (#18004) (#18030)
• 0e5478d Normalize CRLF line endings before computing CSP hashes (#17998)
• 30ef3cb fix: invalidate prerender environment in invalidateDataStore (#17991) (#17999)
• 312ab49 Fix redirect targets when a param value contains a $ replacement pattern (#...
• 1b5a234 Fix trailing-slash redirect body to match the Location header target (#18018)
• 558b301 Fix prerendered Cloudflare pages rendering as [object Object] with nodejs_com...
• 4464b3a fix(assets): forward class to picture element in Picture component (#18003) (...
• Additional commits viewable in compare view

Updates html-validate from 11.15.0 to 11.16.0

Release notes

Sourced from html-validate's releases.

v11.16.0

11.16.0 (2026-09-15)

Features

• api: unified HtmlValidate.autofix() and deprecate all other variants (40c67f0)
• rules: add minSectioningRootInitialRank option to heading-level (7b9629f)

Bug Fixes

• deps: update dependency ignore to v7.0.9 (0337345)

Changelog

Sourced from html-validate's changelog.

11.16.0 (2026-09-15)

Features

• api: unified HtmlValidate.autofix() and deprecate all other variants (40c67f0)
• rules: add minSectioningRootInitialRank option to heading-level (7b9629f)

Bug Fixes

• deps: update dependency ignore to v7.0.9 (0337345)

Commits

• 7ddac8f chore(release): 11.16.0
• 0aec394 Merge branch 'feature/bind-autofix' into 'master'
• 40c67f0 feat(api): unified HtmlValidate.autofix() and deprecate all other variants
• ca9c7b1 Merge branch 'issue/309' into 'master'
• 7b9629f feat(rules): add minSectioningRootInitialRank option to heading-level
• fd13b06 chore(deps): update dependency rollup to v4.63.3
• 8978900 Merge branch 'renovate/lock-file-maintenance' into 'master'
• 0d9b96f chore(deps): lock file maintenance
• 4718868 chore(deps): update dependency memfs to v4.78.0
• 1c7497d chore(deps): update dependency memfs to v4.77.0
• Additional commits viewable in compare view

Updates puppeteer from 25.10.0 to 25.11.0

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v25.11.0

25.11.0 (2026-09-13)

🎉 Features

• roll to Chrome 153.0.8010.36 (#15443) (947d527)

🛠️ Fixes

• roll to Chrome 152.0.7977.82 (#15434) (f0dc34c)
• roll to Firefox 155.0.1 (#15421) (25832f9)

📄 Documentation

• clarify JavaScript coverage across navigations (#15445) (499c713)

puppeteer: v25.11.0

25.11.0 (2026-09-13)

🎉 Features

• roll to Chrome 153.0.8010.36 (#15443) (947d527)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • puppeteer-core bumped from 25.10.0 to 25.11.0

Commits

• 043cd46 chore: release main (#15433)
• 079789a chore(deps): bump the all group in /website with 2 updates (#15448)
• 499c713 docs: clarify JavaScript coverage across navigations (#15445)
• e1a15e7 chore(deps): bump js-yaml from 4.3.1 to 4.3.2 in /website (#15444)
• 947d527 feat: roll to Chrome 153.0.8010.36 (#15443)
• 23fd45f build: use portable npm output in browser revision update (#15442)
• 966916b chore: avoid Unix-only tail in protocol check (#15438)
• 84a8f0e build: run docs versioning on Windows (#15439)
• a2086c7 test: cover Browser.connected state after disconnect (#15355)
• f0dc34c fix: roll to Chrome 152.0.7977.82 (#15434)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.91%. Comparing base (bf81b35) to head (989b4c3).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #831   +/-   ##
=======================================
  Coverage   96.91%   96.91%           
=======================================
  Files         360      360           
  Lines       56930    56930           
=======================================
  Hits        55172    55172           
  Misses       1758     1758           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Numerical conformance

1261/1261 checks pass across 87 domains and 461 standards (179 normative designations, 114 further published sources).

_{Used in the tables below is how much of that clause's published tolerance the deviation consumes: 100 % sits exactly on the limit, 5 % uses a twentieth of the allowance, and a dash means the clause states no two-sided tolerance for the quantity, so there is no budget to spend. It is reported and never used to decide a verdict, which is settled at full precision before any rounding.}

Nothing moved: same 1261 checks, same verdicts, same numbers.

Closest to their published limit (top 5)

The rows with the least room left, so the ones a change is most likely to push over.

Standard	Quantity	Deviation	Used
ISO/TR 17534-3:2015 Table 3	Ground-projected path length dp, m	0.005 m	100 %
DIN 4150-2:1999-06 Annex C, Example 5	KB_FTr with hammer b) in the rest hours, Formula (5)	-0.005	100 %
DIN 4150-2:1999-06 Annex C, Example 8	KB_FTm over the record with the passage maxima alone	-0.0005	100 %
E DIN 4150-2:2023-08 Annex B, Table B.1	KB_FTm,Zug of the metro north by Formula (5)	-0.0005	100 %
Long 2e Table 14.9 (worked duct-borne sheet, supply path)	Fan to room, 8 octave bands -> 52/42/30/18/9/-2/-2/-1 dB at the receiver	1 dB	100 %

---

Tests & coverage: 97734 tests, 0 failures (all green)

Python Version	Tests	Failures	Coverage	Status
macos-latest-3.13	16289	0	96.9%	Passed
macos-latest-3.14	16289	0	96.9%	Passed
ubuntu-latest-3.13	16289	0	96.9%	Passed
ubuntu-latest-3.14	16289	0	96.9%	Passed
windows-latest-3.13	16289	0	96.9%	Passed
windows-latest-3.14	16289	0	96.9%	Passed

_{Full report at this commit: docs/CONFORMANCE.md · docs/conformance.json · full CI artifacts}