Repository navigation
chore(deps): bump astro from 7.4.1 to 7.4.2 in /src/Dhadgar.Panel in the panel-minor-patch group - #203
Closed
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the panel-minor-patch group in /src/Dhadgar.Panel with 1 update: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). Updates `astro` from 7.4.1 to 7.4.2 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@7.4.2/packages/astro) --- updated-dependencies: - dependency-name: astro dependency-version: 7.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: panel-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the
|
Cadacious
added a commit
that referenced
this pull request
Oct 26, 2026
…Auth exchange (#212) * ci(deps): stop Dependabot proposing static-web-apps-deploy The action is only published as a moving v1 tag, which Dependabot resolves to the 2021 tag commit and offers as an update (#207). Ignore it and update the pin by hand. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * chore(deps): dotenv 18 in BetterAuth Supersedes Dependabot #202 (17.4.2 -> 18.0.9). dotenv 18 adds a CLI and an opt-in fast parser, drops .env.vault support and preloading, and moves the "injected env" line to stderr. config() still logs unless quiet is set, so env.js keeps config({ quiet: true }); only its comment changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * fix(betterauth): rate-limit the exchange endpoint Addresses CodeQL js/missing-rate-limiting on POST /api/v1/betterauth/exchange, which does a session lookup, a DB query and signs a token per request. express-rate-limit 8 now limits it per client IP (default 30 per minute, EXCHANGE_RATE_LIMIT_MAX and EXCHANGE_RATE_LIMIT_WINDOW_MS override) and answers 429 { "error": "rate_limited" } with draft-8 RateLimit headers. The client IP comes from a new TRUST_PROXY setting (unset = trust nothing, integer = hop count, otherwise an address/subnet list). "true" is refused at startup because it lets clients spoof X-Forwarded-For. Behind the Gateway the deployment should set TRUST_PROXY=1. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * deploy(compose): trust the Gateway hop in BetterAuth BetterAuth sits behind the Gateway, so without TRUST_PROXY every request looks like it comes from the Gateway and the /exchange rate limit becomes one bucket for all users. Trust one hop. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * chore(deps): bump astro to 7.4.2 and @astrojs/react to 7.1.1 in Panel and ShoppingCart Resolves Dependabot #203, #204, #205 and #206. @astrojs/react 7 moves to @vitejs/plugin-react 6 (Oxc) and drops the `babel` option; neither site passes options to react(), so no config change is needed. Adds engines.node >=22.23.4 to match Scope and the new astro/@astrojs/react engine floor. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * chore(deps): bump @astrojs/react to 7.1.1 in Scope Keeps Scope on the same @astrojs/react major as Panel and ShoppingCart. Scope passes no options to react(), so the removed `babel` option does not affect it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * chore(deps): move Scope linting to ESLint 10 Resolves Dependabot #162 (eslint 9 -> 10; takes 10.13.0, the newest 10.x). - eslint 10.13.0, plus @eslint/js 10.0.1 as an explicit devDependency (eslint 10 no longer pulls it in). - eslint-plugin-react 7.37.5 -> @eslint-react/eslint-plugin 5.28.8. eslint-plugin-react crashes on ESLint 10 (removed context.getFilename) and its maintainer says it is not yet supported (jsx-eslint/eslint-plugin-react#3977). Uses recommended-typescript, with the old recommended rules it only warns on or omits raised to error (no-missing-component-display-name, jsx-no-comment-textnodes, jsx-no-children-prop, dom-no-unsafe-target-blank, dom-no-unknown-property). Its duplicate hook rules are turned off so eslint-plugin-react-hooks stays the only source of hooks checks. - eslint-plugin-jsx-a11y 6.10.2 -> eslint-plugin-jsx-a11y-x 0.2.0, the maintained drop-in fork that declares ESLint 10 support; the same 31 recommended rules, now under the jsx-a11y-x/ prefix. - eslint-plugin-security 3.0.1 -> 4.2.0: 3.x calls context.getSourceCode() and crashes on ESLint 10. 4.x adds detect-invisible-characters (warn). No --force, --legacy-peer-deps, overrides or compat shims. Lint: 0 errors, 22 warnings (12 new warnings from @eslint-react recommended rules). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * chore(deps): NuGet minor/patch group and coverlet 10.1 Applies the target versions from Dependabot #196 (nuget-minor-patch group) and #197 (coverlet.collector) on top of current main, and regenerates the lock files. Notable bumps: - Aspire.Hosting.* and Aspire.Hosting.Testing 13.5.3 -> 13.6.4, with the AppHost SDK moved to 13.6.4 to match (MessagePack stays 3.1.12) - OpenTelemetry core, exporter and AspNetCore/Http/Runtime instrumentation 1.18.0 -> 1.20.1 - coverlet.collector 10.0.1 -> 10.1.0 - AngleSharp 1.8.6, MailKit 4.18.2, OpenIddict 7.7.2, Microsoft.Extensions.* (Resilience/Telemetry/Redaction/TimeProvider) 10.11.0, IdentityModel 8.23.0, Azure KeyVault patches, Azure.ResourceManager.KeyVault 1.5.0, FluentValidation 12.2.0, FluentAssertions 8.11.0, Microsoft.OpenApi 2.13.0, Scalar 2.18.3, Spectre.Console.Cli 0.57.2, Discord.Net 3.20.2, SQLitePCLRaw 2.1.14 Held back: - MassTransit stays 8.3.6 (deliberate hold, #195) - System.CommandLine stays 2.0.0-beta4 (the group's 2.0.14 is the stable line with a different API) The group's extra csproj edits (VersionOverride on StackExchange.Redis, direct FluentValidation/Jwt references in Identity) were not needed and are left out; no code changes were required. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * chore(deps): bump MassTransit to 8.5.12 and System.CommandLine to 2.0.14 MassTransit, MassTransit.EntityFrameworkCore and MassTransit.RabbitMQ go from 8.3.6 to 8.5.12. The 8.5.12 nuspecs declare Apache-2.0, so this stays on the open-source v8 line; the hold on v9 (commercial) remains. MassTransit 8.5 registers a usage tracker that only implements IAsyncDisposable, so the messaging credential tests now dispose their ServiceProvider with await using, as the generic host does. System.CommandLine moves from 2.0.0-beta4.22272.1 to the 2.0.14 stable release. The CLI is migrated to the GA API: - SetHandler/InvocationContext -> SetAction with ParseResult.GetValue; commands that set an exit code now return it from the action - AddCommand/AddOption/AddArgument -> Subcommands/Options/Arguments.Add - descriptions move to the Description property, IsRequired -> Required, getDefaultValue -> DefaultValueFactory - option validators use Validators.Add and AddError - root.InvokeAsync(args) -> root.Parse(args).InvokeAsync() - the ping command forwards the action's cancellation token (CA2016) - the commands listing handles Option.Name now carrying the "--" prefix and ArgumentHelpName becoming HelpName Help, validation and error output is unchanged except that root help lists --help before --version and some blank lines move. Lock files regenerated with --force-evaluate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE * fix(betterauth): close the direct-port bypass and log rate-limit hits - Bind BetterAuth's compose host port to 127.0.0.1. With TRUST_PROXY=1, a caller reaching port 5130 directly could set X-Forwarded-For per request and get a fresh bucket each time. - Log when the exchange limit rejects a request. - Parse TRUST_PROXY and the limit settings before loading secrets and running migrations, so a bad value fails fast. - README: per-client limits need Cloudflare in front of the Gateway, and the count is per process. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
Author
|
Looks like astro is no longer updatable, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/src/Dhadgar.Panel/panel-minor-patch-9cae7cad90
branch
October 26, 2026 23:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the panel-minor-patch group in /src/Dhadgar.Panel with 1 update: astro.
Updates
astrofrom 7.4.1 to 7.4.2Release notes
Sourced from astro's releases.
Changelog
Sourced from astro's changelog.
Commits
34c9535[ci] release (#18459)cf27e70fix: minimal support node version (#18475)1efb9d6Update dependency@playwright/testto v1.64.1 (#18441)5e0eaa4fix(astro): stop excluding node-fetch from server dep optimization in workerd...a4e201dfix(dev): treat missing ps row as stale in lockfile process check (#18376)7a0ba6fUse a separate Vite cache for the temporary sync server (#18451)d1fb7d3fix(i18n): use locale path instead of codes in defineConfig i18n types (#18467)dda9ec3fix(content): compute UTF-8 width arithmetically in getChunkEnd (#18430)7af66fcFix astro-check binary silently dropping the first two CLI arguments (#18455)829fc00Skip server island manifest in CSS ensureModulesLoaded to fix late-discovery ...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions