#2546bf42300 Thanks @HiDeoo! - Fixes an issue where i18n content collection related errors, e.g. malformed JSON or YAML, would not be reported.
#254807673c8 Thanks @HiDeoo! - Fixes a URL localization edge case. In projects without a root locale configured, slugs without a locale prefix did not fall back to the default locale as expected.
#254791e1dd7 Thanks @HiDeoo! - Fixes a Firefox Markdown content rendering issue for text sentences separated by a line break.
#2565236467b Thanks @HiDeoo! - Fixes an issue with custom UI strings defined in YAML files not being loaded in some contexts.
0.28.5
Patch Changes
#2546bf42300 Thanks @HiDeoo! - Fixes an issue where i18n content collection related errors, e.g. malformed JSON or YAML, would not be reported.
#254807673c8 Thanks @HiDeoo! - Fixes a URL localization edge case. In projects without a root locale configured, slugs without a locale prefix did not fall back to the default locale as expected.
#254791e1dd7 Thanks @HiDeoo! - Fixes a Firefox Markdown content rendering issue for text sentences separated by a line break.
440bb83: Fixes invalid CSS file links when using the Code component together with plugin-collapsible-sections and pnpm. Thank you @simonporter007 and @ayZagen for the report!
440bb83: Fixes invalid CSS file links when using the Code component together with plugin-collapsible-sections and pnpm. Thank you @simonporter007 and @ayZagen for the report!
fix: warn on invalid cookie name characters (#12806)
fix: when using @vitejs/plugin-basic-ssl, set a no-op proxy config to downgrade from HTTP/2 to TLS since undici does not yet enable HTTP/2 by default (#12907)
fix: warn on invalid cookie name characters (#12806)
fix: when using @vitejs/plugin-basic-ssl, set a no-op proxy config to downgrade from HTTP/2 to TLS since undici does not yet enable HTTP/2 by default (#12907)
2.7.4
Patch Changes
fix: ensure element is focused after subsequent clicks of the same hash link (#12866)
fix: avoid preload if event default was prevented for touchstart and mousedown events (#12887)
fix: avoid reloading behaviour for hash links with data-sveltekit-reload if the hash is on the same page (#12866)
#123587680349 Thanks @spacedawwwg! - Honors inlineAstroConfig parameter in getViteConfig when creating a logger
#1235335795a1 Thanks @hippotastic! - Fixes an issue in dev server watch file handling that could cause multiple restarts for a single file change.
#123515751488 Thanks @florian-lefebvre! - Reverts a change made in 4.16.6 that prevented usage of astro:env secrets inside middleware in SSR
#1234620e5a84 Thanks @bluwy! - Fixes sourcemap generation when prefetch is enabled
#123491fc83d3 Thanks @norskeld! - Fixes the getImage options type so it properly extends ImageTransform
astro@4.16.8
Patch Changes
#123389ca89b3 Thanks @situ2001! - Resets NODE_ENV to ensure install command run in dev mode
#122869d6bcdb Thanks @florian-lefebvre! - Fixes a case where a warning for experimental astro:env support would be shown when using an adapter but not actually using astro:env
#123587680349 Thanks @spacedawwwg! - Honors inlineAstroConfig parameter in getViteConfig when creating a logger
#1235335795a1 Thanks @hippotastic! - Fixes an issue in dev server watch file handling that could cause multiple restarts for a single file change.
#123515751488 Thanks @florian-lefebvre! - Reverts a change made in 4.16.6 that prevented usage of astro:env secrets inside middleware in SSR
#1234620e5a84 Thanks @bluwy! - Fixes sourcemap generation when prefetch is enabled
#123491fc83d3 Thanks @norskeld! - Fixes the getImage options type so it properly extends ImageTransform
4.16.8
Patch Changes
#123389ca89b3 Thanks @situ2001! - Resets NODE_ENV to ensure install command run in dev mode
#122869d6bcdb Thanks @florian-lefebvre! - Fixes a case where a warning for experimental astro:env support would be shown when using an adapter but not actually using astro:env
Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.
Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.
Take a deeper look at the dependency
Take a moment to review the security alert above. Review the linked
package source code to understand the potential risk. Ensure the package
is not malicious before proceeding. If you're unsure how to proceed, reach
out to your security team or ask the Socket team for help at support [AT]
socket [DOT] dev.
Remove the package
If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.
Mark a package as acceptable risk
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all
Bumps the arcjet-apps-minor group with 16 updates:
0.28.40.28.60.37.10.38.20.37.10.38.29.1.09.2.01.13.31.13.50.3.110.3.1210.4.610.4.710.4.610.4.72.7.32.7.73.4.273.4.334.16.74.16.94.6.84.6.94.68.44.71.01.80.51.80.60.12.30.13.01.1.121.1.13Updates
@astrojs/starlightfrom 0.28.4 to 0.28.6Release notes
Sourced from
@astrojs/starlight's releases.Changelog
Sourced from
@astrojs/starlight's changelog.Commits
70d02c3[ci] release (#2570)236467bAdd YAML support to the FS translation system (#2565)8186f38[ci] release (#2528)07673c8Fix invalid locale issue (#2548)bf42300Stop silencing i18n content collection related errors (#2546)91e1dd7Fix Firefox Markdown content rendering issue (#2547)1b46783fix: update wrong links (#2524)Updates
@expressive-code/plugin-collapsible-sectionsfrom 0.37.1 to 0.38.2Release notes
Sourced from
@expressive-code/plugin-collapsible-sections's releases.Changelog
Sourced from
@expressive-code/plugin-collapsible-sections's changelog.Commits
910c923[CI] Release (#268)a7bdaae[CI] Release (#266)440bb83FixcssVarReplacementsdesync by moving it intoPluginStyleSettings(#265)e16df97[CI] Release (#261)Updates
@expressive-code/plugin-line-numbersfrom 0.37.1 to 0.38.2Release notes
Sourced from
@expressive-code/plugin-line-numbers's releases.Changelog
Sourced from
@expressive-code/plugin-line-numbers's changelog.Commits
910c923[CI] Release (#268)a7bdaae[CI] Release (#266)e16df97[CI] Release (#261)Updates
@faker-js/fakerfrom 9.1.0 to 9.2.0Release notes
Sourced from
@faker-js/faker's releases.Changelog
Sourced from
@faker-js/faker's changelog.Commits
d31579bchore(release): 9.2.0 (#3243)2d34798infra(unicorn): permanently disable no-object-as-default-parameter (#3203)18f14c8docs(string): improve documentation for length parameters (#3216)c0a7e23docs: expose documentation for randomizers (#3221)cb97682docs: add required twitter meta tags (#3232)290e7c9chore(deps): update eslint (#3238)99d81berefactor(locale): improve Spanish color names (#3230)1da9290test: patch and filter seeded run stacktraces (#3229)d8887b8chore(deps): update dependency vitepress to v1.4.3 (#3237)a36a3cdchore(deps): update vitest to v2.1.4 (#3239)Updates
@hono/node-serverfrom 1.13.3 to 1.13.5Release notes
Sourced from
@hono/node-server's releases.Commits
350f9b7v1.13.59327d9cfix(utils): accept HeadersInit, null, undefined in buildOutgoingHttpHeaders (...e63a808v1.13.4909e21efix: TypeError: headers is not iterable (#210)Updates
@langchain/communityfrom 0.3.11 to 0.3.12Release notes
Sourced from
@langchain/community's releases.... (truncated)
Commits
Updates
@nestjs/commonfrom 10.4.6 to 10.4.7Commits
a544552chore(@nestjs) publish v10.4.7 releaseUpdates
@nestjs/corefrom 10.4.6 to 10.4.7Commits
a544552chore(@nestjs) publish v10.4.7 releaseUpdates
@sveltejs/kitfrom 2.7.3 to 2.7.7Release notes
Sourced from
@sveltejs/kit's releases.Changelog
Sourced from
@sveltejs/kit's changelog.Commits
fc27361Version Packages (#12964)5670357fix: update links in JSDoc (#12963)92e129eVersion Packages (#12962)70246e6fix: update broken links in JSDoc (#12960)9d0230echore: run CI tests on Node 22 (#12954)425a005Version Packages (#12952)c80b1d8fix: set no-op proxy config to get Vite HTTPS working (#12907)951224dfix: warn on invalid cookie name characters (#12806)d55b822Version Packages (#12897)967bad7breaking: require svelte 5 for enhanced-img (#12822)Updates
aifrom 3.4.27 to 3.4.33Release notes
Sourced from ai's releases.
Commits
855f9d2Version Packages (#3469)ac380e3fix (provider/anthropic): continuation mode with 3+ steps (#3466)cfbe5d8fix (docs): Correct missing close-backtick breaking Anthropic text. (#3464)88be2a6Version Packages (#3461)6bb9e51fix (ai/core): expose response.messages in streamText (#3460)003fa11Version Packages (#3455)4d2e53bfeat (provider/anthropic): pdf support (#3458)2cbed46fix (provider/cohere): fix tool roundtrips (#3456)c8afcb5feat (provider/anthropic): allow using computer use and cache control at the ...a7cbdf6feat (provider/cohere): Use Cohere v2 API. (#3420)Updates
astrofrom 4.16.7 to 4.16.9Release notes
Sourced from astro's releases.
Changelog
Sourced from astro's changelog.
Commits
ec3113d[ci] release (#12345)7680349fix: honor getViteConfig inlineAstroConfig.logLevel setting (#12358)35795a1Fix watchfile multiple dev server restart (#12353)5751488fix: revert #12227 (#12351)c480b8f[ci] format1fc83d3fix(assets): fixgetImageoptions type (#12349)20e5a84Fix prefetch sourcemap generation (#12346)836cd91fix: Destroy the node http server response stream if there was a caught error...5f7bf49[ci] release (#12290)ffc836bFix cli command typo (#12342)Updates
honofrom 4.6.8 to 4.6.9Release notes
Sourced from hono's releases.
New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
+235+54+5400+90+7+20+74+5+62+3320+23+27+28🚮 Removed packages: npm/@astrojs/starlight@0.28.4, npm/@expressive-code/plugin-collapsible-sections@0.37.1, npm/@expressive-code/plugin-line-numbers@0.37.1, npm/@faker-js/faker@9.1.0, npm/@hono/node-server@1.13.3, npm/@langchain/community@0.3.11, npm/@nestjs/common@10.4.6, npm/@nestjs/core@10.4.6, npm/@sveltejs/kit@2.7.3, npm/@types/bun@1.1.12, npm/ai@3.4.27, npm/astro@4.16.7, npm/hono@4.6.8, npm/openai@4.68.4, npm/sass@1.80.5, npm/starlight-links-validator@0.12.3
View full report↗︎
🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎
To accept the risk, merge this PR and you will not be notified again.
opencollective || exit 0package-lock.jsonpackage.jsonView full report↗︎
Next steps
What is an install script?
Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.
Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.
Take a deeper look at the dependency
Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.
Remove the package
If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.
Mark a package as acceptable risk
To ignore an alert, reply with a comment starting with
@SocketSecurity ignorefollowed by a space separated list ofecosystem/package-name@versionspecifiers. e.g.@SocketSecurity ignore npm/foo@1.0.0or ignore all packages with@SocketSecurity ignore-all@SocketSecurity ignore npm/@nestjs/core@10.4.7Looks like these dependencies are no longer updatable, so this is no longer needed.