You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Ensure @source globs with symlinks are preserved (#20203)
Ensure later @source rules can re-include files excluded by earlier @source not rules (#20203)
Upgrade: don't migrate empty class rules to invalid @utility rules (#20205)
Ensure transitions between inset-shadow-none and other inset shadows work correctly (#20208)
Ensure explicitly referenced @source directories are scanned even when ignored by git (#20214)
Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#20217)
Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#20221)
Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#20228)
Changed
Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#20196)
Ensure @source globs with symlinks are preserved (#20203)
Ensure later @source rules can re-include files excluded by earlier @source not rules (#20203)
Upgrade: don't migrate empty class rules to invalid @utility rules (#20205)
Ensure transitions between inset-shadow-none and other inset shadows work correctly (#20208)
Ensure explicitly referenced @source directories are scanned even when ignored by git (#20214)
Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#20217)
Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#20221)
Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#20228)
#1718924d2c9e Thanks @astrobot-houston! - Fixes a bug where an error thrown inside one route's getStaticPaths() would prevent other valid routes from being matched in dev mode
#169328f4a3db Thanks @fkatsuhiro! - Fixes HMR for action files during development. Editing files in src/actions/ now takes effect on the next request without requiring a dev server restart.
#17087fb0ab02 Thanks @jp-knj! - Fixes localized custom error pages in i18n projects so routes like /pt/404 are used for missing localized pages and return the correct status code
#17151ccceda3 Thanks @matthewp! - Fixes astro dev incorrectly starting in background mode for Warp terminal users. Hybrid environments like Warp are no longer treated as AI agents for auto-background detection.
#17158164df87 Thanks @ematipico! - Fixes astro dev --background --host not listing the network addresses. The background server start output and astro dev status now show every exposed network URL, matching the foreground dev server.
#17141d785b9d Thanks @astrobot-houston! - Fixes responsive image CSS overriding user styles defined inside CSS @layer blocks. The generated image styles are now wrapped in @layer astro.images, ensuring they have lower cascade priority than user-defined layers.
#171501a61386 Thanks @matthewp! - Fixes astro dev --background failing on Windows with "Failed to spawn background dev server process"
Astro now strips whitespace from your HTML using JSX rules by default, the same way frameworks like React do. Whitespace and line breaks around elements are removed, but meaningful whitespace within a single line — like a space between two inline elements — is preserved. To keep a space that would otherwise be removed, write it explicitly in your source, for example with {" "}.
This can change rendered output where whitespace between inline elements was previously meaningful. To keep Astro's earlier behavior, set compressHTML: true for HTML-aware compression, or compressHTML: false to preserve all whitespace.
#16610c63e7e4 Thanks @matthewp! - Adds background dev server management for AI coding agents.
When an AI coding agent is detected, astro dev now automatically starts the dev server as a detached background process. This prevents the dev server from blocking the agent's terminal and allows it to continue working while the server runs.
A lock file (.astro/dev.json) is written when the dev server starts, recording the server's URL, port, and PID. This prevents duplicate servers from being started for the same project.
New flag and subcommands
astro dev --background — Start the dev server as a background process (this is what runs automatically when an agent is detected).
astro dev stop — Stop a running background dev server.
astro dev status — Check if a dev server is running and display its URL, PID, and uptime.
astro dev logs — View logs from a background dev server. Use --follow (-f) to stream new output as it's written.
#1718924d2c9e Thanks @astrobot-houston! - Fixes a bug where an error thrown inside one route's getStaticPaths() would prevent other valid routes from being matched in dev mode
#169328f4a3db Thanks @fkatsuhiro! - Fixes HMR for action files during development. Editing files in src/actions/ now takes effect on the next request without requiring a dev server restart.
#17087fb0ab02 Thanks @jp-knj! - Fixes localized custom error pages in i18n projects so routes like /pt/404 are used for missing localized pages and return the correct status code
#17151ccceda3 Thanks @matthewp! - Fixes astro dev incorrectly starting in background mode for Warp terminal users. Hybrid environments like Warp are no longer treated as AI agents for auto-background detection.
#17158164df87 Thanks @ematipico! - Fixes astro dev --background --host not listing the network addresses. The background server start output and astro dev status now show every exposed network URL, matching the foreground dev server.
#17141d785b9d Thanks @astrobot-houston! - Fixes responsive image CSS overriding user styles defined inside CSS @layer blocks. The generated image styles are now wrapped in @layer astro.images, ensuring they have lower cascade priority than user-defined layers.
#171501a61386 Thanks @matthewp! - Fixes astro dev --background failing on Windows with "Failed to spawn background dev server process"
Astro now strips whitespace from your HTML using JSX rules by default, the same way frameworks like React do. Whitespace and line breaks around elements are removed, but meaningful whitespace within a single line — like a space between two inline elements — is preserved. To keep a space that would otherwise be removed, write it explicitly in your source, for example with {" "}.
This can change rendered output where whitespace between inline elements was previously meaningful. To keep Astro's earlier behavior, set compressHTML: true for HTML-aware compression, or compressHTML: false to preserve all whitespace.
#16610c63e7e4 Thanks @matthewp! - Adds background dev server management for AI coding agents.
When an AI coding agent is detected, astro dev now automatically starts the dev server as a detached background process. This prevents the dev server from blocking the agent's terminal and allows it to continue working while the server runs.
A lock file (.astro/dev.json) is written when the dev server starts, recording the server's URL, port, and PID. This prevents duplicate servers from being started for the same project.
New flag and subcommands
astro dev --background — Start the dev server as a background process (this is what runs automatically when an agent is detected).
astro dev stop — Stop a running background dev server.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
Warn
Obfuscated code: npm astro is 90.0% likely obfuscated
Next steps: Take a moment to review the security alert above. Review
the linked package source code to understand the potential risk. Ensure the
package is not malicious before proceeding. If you're unsure how to proceed,
reach out to your security team or ask the Socket team for help at
support@socket.dev.
Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.
Mark the package as acceptable risk. To ignore this alert only
in this pull request, reply with the comment
@SocketSecurity ignore npm/astro@7.0.3. You can
also ignore all packages with @SocketSecurity ignore-all.
To ignore an alert for all future pull requests, use Socket's Dashboard to
change the triage state of this alert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code
0 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
Bumps vite to 8.1.1 and updates ancestor dependencies vite, @tailwindcss/vite and astro. These dependencies need to be updated together.
Updates
vitefrom 6.4.2 to 8.1.1Release notes
Sourced from vite's releases.
... (truncated)
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
4ae9e14release: v8.1.18f925e2fix(bundledDev): skip plugin transform hooks for rolldown-lazy stub modules (...c088511test: enable "manual chunk path" test and remove "worker.format error" test (...62bd7affeat: update dynamic import warning to link to Vite docs (#22823)2dafd3brefactor(css): remove lightningcss null byte bug workaround (#22822)833fc30fix: escape ids with multiple null bytes (#22687)9fa7ab4fix(css): preserve dollar signs in external@importurls with lightningcss ...1113acfrefactor: use pre-defined environments variable to avoid duplicate `Object.va...709eb8efix(bundled-dev): avoid stack overflow onimport.meta.hot.invalidate()(#22...043a810fix: ignore bundled config temp dir (#22800)Updates
@tailwindcss/vitefrom 4.1.15 to 4.3.2Release notes
Sourced from @tailwindcss/vite's releases.
... (truncated)
Changelog
Sourced from @tailwindcss/vite's changelog.
... (truncated)
Commits
056a1554.3.2 (#20281)bb6a109use.tsinstead of.css8a14a714.3.1 (#20226)73983e1Fix 'Sourcemap is likely to be incorrect' warnings when using `@tailwindcss/v...588bd734.3.0 (#20023)d194d4cdocs: fix various typos in comments and documentation (#19878)db27049fix(@tailwindcss/vite): include@variantin feature detection (#19966)5a79990Always resolve relative files, relative to the current .css file (#19965)f3fdda2fix(vite): avoid resolving JS plugins to browser CSS entries (#19949)69ad7cc4.2.4 (#19948)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@tailwindcss/vitesince your current version.Updates
astrofrom 5.18.1 to 7.0.3Release notes
Sourced from astro's releases.
... (truncated)
Changelog
Sourced from astro's changelog.
... (truncated)
Commits
f7283e0[ci] release (#17180)24d2c9eFix getStaticPaths error in one route blocking other matching routes in dev (...efdd4d1[ci] formatfb0ab02fix: localized error route status handling (#17087)8f4a3dbFix HMR for action files during development (#16932)fa6428afix(dev): wire AbortController to socket close so request.signal reflects cli...ccd1e37chore(head): remove meta title tag in favor of standard title tag (#17178)dc260daRemove legacy "X-UA-Compatible" meta tags (#17162)74f5f24chore: update Vite to 8.1 (#17160)a39b7a8[ci] release (#17167)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.