fix(npm): update astro monorepo (patch)

[truecharts-admin]

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/sitemap (source)	3.6.0 -> 3.6.1
astro (source)	5.16.1 -> 5.16.7

Add the preset :preserveSemverRanges to your config if you don't want to pin your dependencies.

---

Release Notes

withastro/astro (@​astrojs/sitemap)

v3.6.1

Compare Source

Patch Changes

• #​15033 dd06779 Thanks @​florian-lefebvre! - Updates how routes are retrieved to avoid relying on a deprecated API

withastro/astro (astro)

v5.16.7

Compare Source

Patch Changes

• #​15122 b137946 Thanks @​florian-lefebvre! - Improves JSDoc annotations for AstroGlobal, AstroSharedContext and APIContext types

• #​15123 3f58fa2 Thanks @​43081j! - Improves rendering performance by grouping render chunks when emitting from async iterables to avoid encoding costs

• #​14954 7bec4bd Thanks @​volpeon! - Fixes remote images Etag header handling by disabling internal cache

• #​15052 b2bcd5a Thanks @​Princesseuh! - Fixes images not working in development when using setups with port forwarding

• #​15028 87b19b8 Thanks @​Princesseuh! - Fixes certain aliases not working when using images in JSON files with the content layer

• #​15118 cfa382b Thanks @​florian-lefebvre! - BREAKING CHANGE to the experimental Fonts API only

  Removes the defineAstroFontProvider() type helper.

  If you are building a custom font provider, remove any occurrence of defineAstroFontProvider() and use the FontProvider type instead:

  -import { defineAstroFontProvider } from 'astro/config';
  
  -export function myProvider() {
  -    return defineAstroFontProvider({
  -        entrypoint: new URL('./implementation.js', import.meta.url)
  -    });
  -};
  
  +import type { FontProvider } from 'astro';
  
  +export function myProvider(): FontProvider {
  +    return {
  +        entrypoint: new URL('./implementation.js', import.meta.url)
  +    },
  +}

• #​15055 4e28db8 Thanks @​delucis! - Reduces Astro’s install size by around 8 MB

• #​15088 a19140f Thanks @​martrapp! - Enables the ClientRouter to preserve the original hash part of the target URL during server side redirects.

• #​15117 b1e8e32 Thanks @​florian-lefebvre! - BREAKING CHANGE to the experimental Fonts API only

  Changes the font format downloaded by default when using the experimental Fonts API. Additionally, adds a new formats configuration option to specify which font formats to download.

  Previously, Astro was opinionated about which font sources would be kept for usage, mainly keeping woff2 and woff files.

  You can now specify what font formats should be downloaded (if available). Only woff2 files are downloaded by default.

What should I do?

If you were previously relying on Astro downloading the woff format, you will now need to specify this explicitly with the new formats configuration option. Additionally, you may also specify any additional file formats to download if available:

// astro.config.mjs
import { defineConfig, fontProviders } from 'astro/config'

export default defineConfig({
    experimental: {
        fonts: [{
            name: 'Roboto',
            cssVariable: '--font-roboto',
            provider: fontProviders.google(),
+            formats: ['woff2', 'woff', 'otf']
        }]
    }
})

• #​15034 8115752 Thanks @​florian-lefebvre! - Fixes a vite warning log during builds when using npm

v5.16.6

Compare Source

Patch Changes

• #​14982 6849e38 Thanks @​Princesseuh! - Fixes images outside the project directory not working when using astro:assets in development mode

• #​14987 9dd9fca Thanks @​Princesseuh! - Fixes SVGs not working in dev mode when using the passthrough image service

• #​15014 a178422 Thanks @​delucis! - Adds support for extending the type of the props accepted by Astro’s <Image> component, <Picture> component, and getImage() API.

v5.16.5

Compare Source

Patch Changes

• #​14985 c016f10 Thanks @​florian-lefebvre! - Fixes a case where JSDoc annotations wouldn't show for fonts related APIs in the Astro config

• #​14973 ed7cc2f Thanks @​amankumarpandeyin! - Fixes performance regression and OOM errors when building medium-sized blogs with many content entries. Replaced O(n²) object spread pattern with direct mutation in generateLookupMap.

• #​14958 70eb542 Thanks @​ascorbic! - Gives a helpful error message if a user sets output: "hybrid" in their Astro config.

  The option was removed in Astro 5, but lots of content online still references it, and LLMs often suggest it. It's not always clear that the replacement is output: "static", rather than output: "server". This change adds a helpful error message to guide humans and robots.

• #​14901 ef53716 Thanks @​Darknab! - Updates the glob() loader to log a warning when duplicated IDs are detected

• Updated dependencies [d8305f8]:

  • @​astrojs/markdown-remark@​6.3.10

v5.16.4

Compare Source

Patch Changes

• #​14940 2cf79c2 Thanks @​ematipico! - Fixes a bug where Astro didn't properly combine CSP resources from the csp configuration with those added using the runtime API (Astro.csp.insertDirective()) to form grammatically correct CSP headers

  Now Astro correctly deduplicate CSP resources. For example, if you have a global resource in the configuration file, and then you add a
  a new one using the runtime APIs.

v5.16.3

Compare Source

Patch Changes

• #​14889 4bceeb0 Thanks @​florian-lefebvre! - Fixes actions types when using specific TypeScript configurations

• #​14929 e0f277d Thanks @​matthewp! - Fixes authentication bypass via double URL encoding in middleware

  Prevents attackers from bypassing path-based authentication checks using multi-level URL encoding (e.g., /%2561dmin instead of /%61dmin). Pathnames are now validated after decoding to ensure no additional encoding remains.

v5.16.2

Compare Source

Patch Changes

• #​14876 b43dc7f Thanks @​florian-lefebvre! - Fixes a vite warning log during builds when using npm

• #​14884 10273e0 Thanks @​florian-lefebvre! - Fixes a case where setting the status of a page to 404 in ssr would show an empty page (or 404.astro page if provided) instead of using the current page

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

🚧 Deploy Preview building...

Name	Link
🔨 Latest commit	0ea93a1
🔍 Latest deploy log	https:/github.com/trueforge-org/website/actions/runs/20850367156

---