fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@astrojs/starlight (source)	0.34.3 -> 0.34.4
@lerna-lite/cli (source)	^4.3.0 -> ^4.4.1
@lerna-lite/publish (source)	^4.3.0 -> ^4.4.1
@lerna-lite/run (source)	^4.3.0 -> ^4.4.1
@types/node (source)	^22.15.30 -> ^22.15.31
@types/react (source)	^19.1.6 -> ^19.1.8
@types/react (source)	19.1.6 -> 19.1.8
astro (source)	5.9.1 -> 5.9.3
eslint (source)	^9.28.0 -> ^9.29.0
lint-staged	^16.1.0 -> ^16.1.1

---

Release Notes

withastro/starlight (@​astrojs/starlight)

v0.34.4

Compare Source

Patch Changes

• #​3205 95d124a Thanks @​sgalcheung! - Fixes an issue preventing to use the <StarlightPage> component when the docs content collection that Starlight uses does not exist.

• #​3206 e6ea584 Thanks @​HiDeoo! - Fixes a text selection issue for heading with a clickable anchor link when using double click to select text in Chrome and Safari.

• #​3233 3064c40 Thanks @​torn4dom4n! - Updates Vietnamese UI translations.

• #​3248 16c1239 Thanks @​HiDeoo! - Prevents icons in the <Card> component from being shrunk in some narrow viewports.

• #​3225 21b93b8 Thanks @​randomguy-2650! - Updates German UI translations

lerna-lite/lerna-lite (@​lerna-lite/cli)

v4.4.1

Compare Source

Note: Version bump only for package @​lerna-lite/cli

v4.4.0

Compare Source

Features

• support Bun Catalogs, fixes #​1063 (#​1065) (4f1e1aa) - by @​ghiscoding

lerna-lite/lerna-lite (@​lerna-lite/publish)

v4.4.1

Compare Source

Bug Fixes

• add missing npmClient needed for Catalog while newing QueryGraph (#​1070) (eda2aac) - by @​ghiscoding

v4.4.0

Compare Source

Features

• support Bun Catalogs, fixes #​1063 (#​1065) (4f1e1aa) - by @​ghiscoding

Bug Fixes

• deps: update all non-major dependencies (#​1067) (a50cf0c) - by @​renovate[bot]

lerna-lite/lerna-lite (@​lerna-lite/run)

v4.4.1

Compare Source

Bug Fixes

• add missing npmClient needed for Catalog while newing QueryGraph (#​1070) (eda2aac) - by @​ghiscoding

v4.4.0

Compare Source

Note: Version bump only for package @​lerna-lite/run

withastro/astro (astro)

v5.9.3

Compare Source

Patch Changes

• #​13923 a9ac5ed Thanks @​ematipico! - BREAKING CHANGE to the experimental Content Security Policy (CSP) only

  Changes the behavior of experimental Content Security Policy (CSP) to now serve hashes differently depending on whether or not a page is prerendered:

  • Via the <meta> element for static pages.
  • Via the Response header content-security-policy for on-demand rendered pages.

  This new strategy allows you to add CSP content that is not supported in a <meta> element (e.g. report-uri, frame-ancestors, and sandbox directives) to on-demand rendered pages.

  No change to your project code is required as this is an implementation detail. However, this will result in a different HTML output for pages that are rendered on demand. Please check your production site to verify that CSP is working as intended.

  To keep up to date with this developing feature, or to leave feedback, visit the CSP Roadmap proposal.

• #​13926 953a249 Thanks @​ematipico! - Adds a new Astro Adapter Feature called experimentalStaticHeaders to allow your adapter to receive the Headers for rendered static pages.

  Adapters that enable support for this feature can access header values directly, affecting their handling of some Astro features such as Content Security Policy (CSP). For example, Astro will no longer serve the CSP <meta http-equiv="content-security-policy"> element in static pages to adapters with this support.

  Astro will serve the value of the header inside a map that can be retrieved from the hook astro:build:generated. Adapters can read this mapping and use their hosting headers capabilities to create a configuration file.

  A new field called experimentalRouteToHeaders will contain a map of Map<IntegrationResolvedRoute, Headers> where the Headers type contains the headers emitted by the rendered static route.

  To enable support for this experimental Astro Adapter Feature, add it to your adapterFeatures in your adapter config:

  // my-adapter.mjs
  export default function createIntegration() {
    return {
      name: '@​example/my-adapter',
      hooks: {
        'astro:config:done': ({ setAdapter }) => {
          setAdapter({
            name: '@​example/my-adapter',
            serverEntrypoint: '@​example/my-adapter/server.js',
            adapterFeatures: {
              experimentalStaticHeaders: true,
            },
          });
        },
      },
    };
  }

  See the Adapter API docs for more information about providing adapter features.

• #​13697 af83b85 Thanks @​benosmac! - Fixes issues with fallback route pattern matching when i18n.routing.fallbackType is rewrite.

  • Adds conditions for route matching in generatePath when building fallback routes and checking for existing translated pages

  Now for a route to be matched it needs to be inside a named [locale] folder. This fixes an issue where route.pattern.test() incorrectly matched dynamic routes, causing the page to be skipped.

  • Adds conditions for route matching in findRouteToRewrite

  Now the requested pathname must exist in route.distURL for a dynamic route to match. This fixes an issue where route.pattern.test() incorrectly matched dynamic routes, causing the build to fail.

• #​13924 1cd8c3b Thanks @​qw-in! - Fixes an edge case where isPrerendered was incorrectly set to false for static redirects.

• #​13926 953a249 Thanks @​ematipico! - Fixes an issue where the experimental CSP meta element wasn't placed in the <head> element as early as possible, causing these policies to not apply to styles and scripts that came before the meta element.

v5.9.2

Compare Source

Patch Changes

• #​13919 423fe60 Thanks @​ematipico! - Fixes a bug where Astro added quotes to the CSP resources.

  Only certain resources require quotes (e.g. 'self' but not https://cdn.example.com), so Astro no longer adds quotes to any resources. You must now provide the quotes yourself for resources such as 'self' when necessary:

  export default defineConfig({
    experimental: {
      csp: {
        styleDirective: {
          resources: [
  -          "self",
  +          "'self'",
            "https://cdn.example.com"
          ]
        }
      }
    }
  })

• #​13914 76c5480 Thanks @​ematipico! - BREAKING CHANGE to the experimental Content Security Policy feature only

  Removes support for experimental Content Security Policy (CSP) when using the <ClientRouter /> component for view transitions.

  It is no longer possible to enable experimental CSP while using Astro's view transitions. Support was already unstable with the <ClientRouter /> because CSP required making its underlying implementation asynchronous. This caused breaking changes for several users and therefore, this PR removes support completely.

  If you are currently using the component for view transitions, please remove the experimental CSP flag as they cannot be used together.

  import { defineConfig } from 'astro/config';
  
  export default defineConfig({
    experimental: {
  -   csp: true
     }
  });

  Alternatively, to continue using experimental CSP in your project, you can consider migrating to the browser native View Transition API and remove the <ClientRouter /> from your project. You may be able to achieve similar results if you are not using Astro's enhancements to the native View Transitions and Navigation APIs.

  Support might be reintroduced in future releases. You can follow this experimental feature's development in the CSP RFC.

eslint/eslint (eslint)

v9.29.0

Compare Source

lint-staged/lint-staged (lint-staged)

v16.1.1

Compare Source

Patch Changes

• #​1565 3686977 Thanks @​iiroj! - Lint-staged now explicitly warns about potential data loss when using --no-stash.

• #​1571 02299a9 Thanks @​iiroj! - Function tasks (introduced in v16.0.0) only received the staged files matching the conpmnfigured glob, instead of all staged files.

• #​1563 bc61c74 Thanks @​iiroj! - This version fixes incorrect behavior where unstaged changes were committed when using the --no-stash option. This happened because --no-stash implied --no-hide-partially-staged, meaning unstaged changes to files which also had other staged changes were added to the commit by lint-staged; this is no longer the case.

  The previous (incorrect) behavior can still be achieved by using both options --no-stash --no-hide-partially-staged at the same time.

---

Configuration

📅 Schedule: Branch creation - "before 12pm on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.