chore(deps): Bump the astro group across 1 directory with 4 updates

[dependabot]

Bumps the astro group with 4 updates in the / directory: astro, @astrojs/check, @astrojs/sitemap and @astrojs/vercel.

Updates astro from 6.1.9 to 6.3.2

Release notes

Sourced from astro's releases.

astro@6.3.2

Patch Changes

• #16675 11d4592 Thanks @​ascorbic! - Fixes a regression where Astro.cache was undefined when experimental.cache was not configured.

  The previous documented behavior is for Astro.cache to always be defined as a no-op shim: cache.set() warns once, cache.invalidate() throws and cache.enabled can be used to gate. This allows library and user code can call cache methods without conditional checks. The cache provider registration was being gated at the call site on experimental.cache being configured, which meant the disabled shim branch inside the provider was unreachable and the Astro.cache getter was never attached to the context.

• #16691 0f0a4ce Thanks @​matthewp! - Fixes HTMLElement is not defined error during HMR when using components with client-side scripts (e.g. Starlight <Tabs>) and the Cloudflare adapter

• #16562 07529ec Thanks @​matthewp! - Fixes non-prerendered routes failing when a dynamic prerendered route exists in the same project with prerenderEnvironment: 'node'

• #16638 272185b Thanks @​ematipico! - Fixes a bug where the Astro compiler wasn't freed at the end of the build. After the fix, the memory used by the compiler is now correctly freed at the end of the build.

• #16544 d365c97 Thanks @​matthewp! - Tightens isRemotePath() to reject control characters after a leading slash and fixes the dev image endpoint origin check

• #16685 889e748 Thanks @​farrosfr! - Improve validation messages for security.csp.directives when script-src or style-src are incorrectly placed in the directives array.

• #16605 772f13a Thanks @​rururux! - Fixes assetsPrefix not being available on build from astro:config/server.

• #16556 f38dec7 Thanks @​matthewp! - Rejects double-encoded URL paths with a 400 response instead of silently falling back to partial decoding

• #16659 38bcb25 Thanks @​jsparkdev! - Fixes & characters appearing as raw entity strings (e.g. &[#38](https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/38);) in <meta> tags when viewed in link previews or raw HTML.

• Updated dependencies [d365c97, 9256345]:

  • @​astrojs/internal-helpers@​0.9.1
  • @​astrojs/markdown-remark@​7.1.2

astro@6.3.1

Patch Changes

• #16646 15fbc41 Thanks @​matthewp! - Fixes local images returning 404 on non-prerendered pages when using the generic image endpoint

astro@6.3.0

Minor Changes

• #16366 d69f858 Thanks @​matthewp! - Adds a new experimental.advancedRouting option that lets you take full control of Astro's request handling pipeline by creating a src/app.ts file in your project.

  Today, Astro handles every incoming request through a fixed internal pipeline: trailing slash normalization, redirects, actions, middleware, page rendering, i18n, and so on. That pipeline works great for most sites, but as projects grow you often want to run your own logic between those steps — an auth check before rendering, a rate limiter before actions, custom logging around the whole stack. Advanced routing gives you that control.

  When enabled, Astro looks for a src/app.ts file in your project. If it finds one, that file becomes the entrypoint for all server-rendered requests. You compose the pipeline yourself using the handlers Astro provides, and you can slot your own logic anywhere in the chain.

  Enabling advanced routing

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  experimental: {
  advancedRouting: true,

... (truncated)

Changelog

Sourced from astro's changelog.

6.3.2

Patch Changes

• #16675 11d4592 Thanks @​ascorbic! - Fixes a regression where Astro.cache was undefined when experimental.cache was not configured.

  The previous documented behavior is for Astro.cache to always be defined as a no-op shim: cache.set() warns once, cache.invalidate() throws and cache.enabled can be used to gate. This allows library and user code can call cache methods without conditional checks. The cache provider registration was being gated at the call site on experimental.cache being configured, which meant the disabled shim branch inside the provider was unreachable and the Astro.cache getter was never attached to the context.

• #16691 0f0a4ce Thanks @​matthewp! - Fixes HTMLElement is not defined error during HMR when using components with client-side scripts (e.g. Starlight <Tabs>) and the Cloudflare adapter

• #16562 07529ec Thanks @​matthewp! - Fixes non-prerendered routes failing when a dynamic prerendered route exists in the same project with prerenderEnvironment: 'node'

• #16638 272185b Thanks @​ematipico! - Fixes a bug where the Astro compiler wasn't freed at the end of the build. After the fix, the memory used by the compiler is now correctly freed at the end of the build.

• #16544 d365c97 Thanks @​matthewp! - Tightens isRemotePath() to reject control characters after a leading slash and fixes the dev image endpoint origin check

• #16685 889e748 Thanks @​farrosfr! - Improve validation messages for security.csp.directives when script-src or style-src are incorrectly placed in the directives array.

• #16605 772f13a Thanks @​rururux! - Fixes assetsPrefix not being available on build from astro:config/server.

• #16556 f38dec7 Thanks @​matthewp! - Rejects double-encoded URL paths with a 400 response instead of silently falling back to partial decoding

• #16659 38bcb25 Thanks @​jsparkdev! - Fixes & characters appearing as raw entity strings (e.g. &[#38](https://github.com/withastro/astro/tree/HEAD/packages/astro/issues/38);) in <meta> tags when viewed in link previews or raw HTML.

• Updated dependencies [d365c97, 9256345]:

  • @​astrojs/internal-helpers@​0.9.1
  • @​astrojs/markdown-remark@​7.1.2

6.3.1

Patch Changes

• #16646 15fbc41 Thanks @​matthewp! - Fixes local images returning 404 on non-prerendered pages when using the generic image endpoint

6.3.0

Minor Changes

• #16366 d69f858 Thanks @​matthewp! - Adds a new experimental.advancedRouting option that lets you take full control of Astro's request handling pipeline by creating a src/app.ts file in your project.

  Today, Astro handles every incoming request through a fixed internal pipeline: trailing slash normalization, redirects, actions, middleware, page rendering, i18n, and so on. That pipeline works great for most sites, but as projects grow you often want to run your own logic between those steps — an auth check before rendering, a rate limiter before actions, custom logging around the whole stack. Advanced routing gives you that control.

  When enabled, Astro looks for a src/app.ts file in your project. If it finds one, that file becomes the entrypoint for all server-rendered requests. You compose the pipeline yourself using the handlers Astro provides, and you can slot your own logic anywhere in the chain.

  Enabling advanced routing

  // astro.config.mjs
  import { defineConfig } from 'astro/config';

... (truncated)

Commits

• e345bcd [ci] release (#16653)
• 04fdbb2 Update pnpm to v11 (#16716)
• 772f13a fix(astro): correctly export build.assetsPrefix from astro:config/server ...
• d1c258a test: isolate fixture cache dirs for shared fixtures (#16689)
• 7e8226e refactor: address floating promises in tests (#16687)
• 9446049 [ci] format
• 889e748 docs(csp): improve validation messages for directives (#16685)
• cdeae00 refactor: remove redudant assertions (#16694)
• 38bcb25 fix: use named HTML entities for attribute escaping (#16659)
• 0f0a4ce fix(astro): treat 'astro' vite environment as a server environment (#16691)
• Additional commits viewable in compare view

Updates @astrojs/check from 0.9.8 to 0.9.9

Release notes

Sourced from @​astrojs/check's releases.

@​astrojs/check@​0.9.9

Patch Changes

• #16471 f56bb3f Thanks @​delucis! - Adds support for TypeScript v6 to peer dependencies range

• Updated dependencies [8c62159]:

  • @​astrojs/language-server@​2.16.7

Changelog

Sourced from @​astrojs/check's changelog.

0.9.9

Patch Changes

• #16471 f56bb3f Thanks @​delucis! - Adds support for TypeScript v6 to peer dependencies range

• Updated dependencies [8c62159]:

  • @​astrojs/language-server@​2.16.7

Commits

• c1f2e4f [ci] release (#16467)
• f56bb3f Widen typescript peer dependency range to allow v6 (#16471)
• 184700c fix(deps): update language tools (#16230)
• 88fcc98 fix integrations links across docs (#16098)
• b9e96da fix(deps): update dependency vitest to v4 (#15372)
• See full diff in compare view

Updates @astrojs/sitemap from 3.7.0 to 3.7.2

Release notes

Sourced from @​astrojs/sitemap's releases.

@​astrojs/sitemap@​3.7.2

Patch Changes

• #15455 babf57f Thanks @​AhmadYasser1! - Fixes i18n fallback pages missing from the generated sitemap when using fallbackType: 'rewrite'.

Changelog

Sourced from @​astrojs/sitemap's changelog.

3.7.2

Patch Changes

• #15455 babf57f Thanks @​AhmadYasser1! - Fixes i18n fallback pages missing from the generated sitemap when using fallbackType: 'rewrite'.

3.7.1

Patch Changes

• #15187 bbb5811 Thanks @​matthewp! - Update to Astro 6 beta

• #14956 0ff51df Thanks @​matthewp! - Updates usage of zod to own dependency rather than relying on astro/zod

• #15036 f125a73 Thanks @​florian-lefebvre! - Updates how routes are retrieved to avoid relying on a deprecated API

• #15373 14252b2 Thanks @​renovate! - Updates zod to v4

3.6.1-beta.3

Patch Changes

• #15373 14252b2 Thanks @​renovate! - Updates zod to v4

3.6.1-beta.2

Patch Changes

• #15187 bbb5811 Thanks @​matthewp! - Update to Astro 6 beta

3.6.1-alpha.1

Patch Changes

• #15036 f125a73 Thanks @​florian-lefebvre! - Updates how routes are retrieved to avoid relying on a deprecated API

3.6.1-alpha.0

Patch Changes

• #14956 0ff51df Thanks @​matthewp! - Updates usage of zod to own dependency rather than relying on astro/zod

Commits

• 4a6ff2a [ci] release (#16020)
• 28079e9 [ci] format
• babf57f feat(astro): Add fallbackRoutes to astro:routes:resolved's return type and ...
• 48e5c4d [ci] release (#15808)
• 6453380 fix: manually updates packages who had main releases later than betas (#15816)
• 6414732 Spelling (#15601)
• 1118ac4 feat: update tsconfig template to prepare for TS 6 (#15668)
• 3758436 [ci] release (beta) (#15354)
• 14252b2 fix(deps): update dependency zod to v4 (#15373)
• 14b1d31 chore: do renovate blocked updates (#15307)
• Additional commits viewable in compare view

Updates @astrojs/vercel from 10.0.4 to 10.0.7

Release notes

Sourced from @​astrojs/vercel's releases.

@​astrojs/vercel@​10.0.7

Patch Changes

• Updated dependencies [d365c97]:
  • @​astrojs/internal-helpers@​0.9.1

@​astrojs/vercel@​10.0.6

Patch Changes

• #16486 0bae1a5 Thanks @​cyphercodes! - Fix forwarded serverless requests with streamed bodies by preserving the required duplex: 'half' option when rewriting middleware paths.

@​astrojs/vercel@​10.0.5

Patch Changes

• Updated dependencies [99464ed, f3485c3]:
  • @​astrojs/internal-helpers@​0.9.0

Changelog

Sourced from @​astrojs/vercel's changelog.

10.0.7

Patch Changes

• Updated dependencies [d365c97]:
  • @​astrojs/internal-helpers@​0.9.1

10.0.6

Patch Changes

• #16486 0bae1a5 Thanks @​cyphercodes! - Fix forwarded serverless requests with streamed bodies by preserving the required duplex: 'half' option when rewriting middleware paths.

10.0.5

Patch Changes

• Updated dependencies [99464ed, f3485c3]:
  • @​astrojs/internal-helpers@​0.9.0

Commits

• e345bcd [ci] release (#16653)
• 5a8cd09 refactor: update tsconfig to use TypeScript project references (#16505)
• c1f2e4f [ci] release (#16467)
• 0bae1a5 fix(vercel): preserve duplex for forwarded request bodies (#16486)
• 5c543c5 refactor(astro): add internal entry points for test (#16473)
• f1fb559 refactor(astro): migrate test helpers to TypeScript (#16474)
• 21ca872 [ci] release (#16399)
• 99464ed Bump vite, picomatch, and unstorage to latest patch versions (#16448)
• c085cb2 refactor(vercel): remove duplicated test files (#16416)
• 9ed6b75 refactor: remove PRERENDER env variable in tests (#16391)
• Additional commits viewable in compare view

[skip-impl-check]

[dependabot]

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
website	Ready	Preview, Comment	May 14, 2026 5:43am

[github-actions]

E2E Test Results

E2E Test Results - May 14, 2026

Summary

• Status: ✅ PASSED
• Total Duration: 0.00s
• Generated: 2026-05-14T05:58:27.617Z

Test Results

Phase	Status	Duration
CLI E2E	⏭️ Skipped	-
MCP E2E	⏭️ Skipped	-

---

Generated by skillsmith E2E test suite