This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | Pending | |---|---|---|---|---|---|---| | [@astrojs/starlight](https://starlight.astro.build) ([source](https://github.com/withastro/starlight/tree/HEAD/packages/starlight)) | [`0.42.7` → `0.42.8`](https://renovatebot.com/diffs/npm/@astrojs%2fstarlight/0.42.7/0.42.8) |  |  | dependencies | patch | `0.42.10` (+1) | | [@pagefind/default-ui](https://github.com/Pagefind/pagefind) | [`1.5.2` → `1.6.0`](https://renovatebot.com/diffs/npm/@pagefind%2fdefault-ui/1.5.2/1.6.0) |  |  | dependencies | minor | | | [astro](https://astro.build) ([source](https://github.com/withastro/astro/tree/HEAD/packages/astro)) | [`7.4.2` → `7.4.5`](https://renovatebot.com/diffs/npm/astro/7.4.2/7.4.5) |  |  | dependencies | patch | `7.4.7` (+1) | | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm/npm/pnpm)) | [`12.16.1` → `12.17.0`](https://renovatebot.com/diffs/npm/pnpm/12.16.1/12.17.0) |  |  | packageManager | minor | `12.18.0` | | [pnpm/action-setup](https://github.com/pnpm/action-setup) ([changelog](https://github.com/pnpm/action-setup/compare/0977fd99725f1db4007ccb2928dbb4e90d06cc86..73e46992e05b19abd31f2f3c20e0e7370d762115)) | `0977fd9` → `73e4699` | | | action | digest | | --- ### Release Notes <details> <summary>withastro/starlight (@​astrojs/starlight)</summary> ### [`v0.42.8`](https://github.com/withastro/starlight/blob/HEAD/packages/starlight/CHANGELOG.md#0428) [Compare Source](https://github.com/withastro/starlight/compare/@astrojs/[email protected]...@astrojs/[email protected]) ##### Patch Changes - [#​4309](https://github.com/withastro/starlight/pull/4309) [`3490c80`](https://github.com/withastro/starlight/commit/3490c803a5fd02019fd3c9357982e9e3753e335d) Thanks [@​athulsreekumar](https://github.com/athulsreekumar)! - Fixes autogenerated sidebar groups omitting directories whose names match `Object.prototype` properties, such as `constructor` or `toString` - [#​4290](https://github.com/withastro/starlight/pull/4290) [`bf93823`](https://github.com/withastro/starlight/commit/bf938239f5f9775318baeaea1adc1ef93768628c) Thanks [@​RaphaelFakhri](https://github.com/RaphaelFakhri)! - Fixes missing last-updated dates in production builds for pages whose file path contains special characters - [#​4295](https://github.com/withastro/starlight/pull/4295) [`af9557e`](https://github.com/withastro/starlight/commit/af9557ea8c957173ea9174e19a87d80fce22a983) Thanks [@​delucis](https://github.com/delucis)! - Fixes a formatting issue in some error messages impacting projects with Zod ≥4.5 installed - [#​4299](https://github.com/withastro/starlight/pull/4299) [`a103f38`](https://github.com/withastro/starlight/commit/a103f383bcd99a7bd0b9c62a678c41ec5202497b) Thanks [@​clean99](https://github.com/clean99)! - Fixes empty sidebars when autogenerating entries from the docs root directory using `directory: ''` </details> <details> <summary>Pagefind/pagefind (@​pagefind/default-ui)</summary> ### [`v1.6.0`](https://github.com/Pagefind/pagefind/blob/HEAD/CHANGELOG.md#v160-November-1-2026) [Compare Source](https://github.com/Pagefind/pagefind/compare/v1.5.2...v1.6.0) 👋 A little overdue, but this release knocks out a healthy selection of bug reports, and includes a lot of work from the community. Thanks to everyone who contributed ❤️ - [@​bglw](https://github.com/bglw) ##### Multilingual Segmentation Pagefind's extended build now segments Chinese, Japanese, and Thai pages with ICU4X, replacing the previous dependency (PR [#​1383](https://github.com/Pagefind/pagefind/issues/1383)). Alongside producing a smaller binary, ICU4X segments a lot closer to the `Intl.Segmenter` used in the browser on the search query (which is ICU4C). This closes out a mixture of latent and reported issues where the different segmentation between indexing and searching makes for iffy results. It's not perfect yet, but it's a darn sight closer. Bonuses: - Segmentation is smarter in languages such as Thai, and doesn't break inside a grapheme cluster - Japanese katakana has special handling, but should still be improved over 1.5.2 - Japanese voiced and semi-voiced sound marks are no longer normalized into each other ##### Fewer Fragment Files Pagefind now has an option to limit the total number of fragment files produced, for hosting providers that cap the number of uploaded files. Contributed in PR [#​1020](https://github.com/Pagefind/pagefind/issues/1020) — thanks [@​yakovsh](https://github.com/yakovsh) ! This limit is set with `--max-fragments` / `max_fragments`, and applies per language. When applied, multiple fragments are bundled together and loaded as a set when required. See [📘 Max fragments](https://pagefind.app/docs/config-options/#max-fragments). ##### Explicit Sub-Result Titles Added support for explicit sub-result titles. Any element with both an `id` and a `data-pagefind-title` attribute can be used as a sub-result (PR [#​1282](https://github.com/Pagefind/pagefind/issues/1282) — thanks [@​samuel-williams-shopify](https://github.com/samuel-williams-shopify) !) See [📘 Defining a sub result explicitly](https://pagefind.app/docs/sub-results/#defining-a-sub-result-explicitly). ##### Component UI - Added a `sort` attribute to `<pagefind-config>`, to order results by a [sort key](https://pagefind.app/docs/js-api-sorting/) (PR [#​1326](https://github.com/Pagefind/pagefind/issues/1326)) - Added a `max-sub-results` attribute to `<pagefind-searchbox>` (PR [#​1324](https://github.com/Pagefind/pagefind/issues/1324)) - Added a `placeholder` setter to `<pagefind-searchbox>` and `<pagefind-modal-trigger>` (PR [#​1321](https://github.com/Pagefind/pagefind/issues/1321)) - `configureInstance` now applies to an instance that already exists but has not loaded yet (PR [#​1323](https://github.com/Pagefind/pagefind/issues/1323)) - Fixed the UI language being resolved after the first render, which could flash the wrong translations (PR [#​1332](https://github.com/Pagefind/pagefind/issues/1332)) - Fixed component cleanup after being disconnected (PR [#​1322](https://github.com/Pagefind/pagefind/issues/1322)) - Fixed IME composition keystrokes support (PR [#​1284](https://github.com/Pagefind/pagefind/issues/1284) — thanks [@​oharu121](https://github.com/oharu121) !) - Fixed the modal staying open when clicking a result for the current page (PR [#​1327](https://github.com/Pagefind/pagefind/issues/1327)) - Fixed the filter panel checkbox shrinking when its label wraps (PR [#​1166](https://github.com/Pagefind/pagefind/issues/1166) — thanks [@​mbrambilla](https://github.com/mbrambilla) !) - Hid the keyboard shortcut badge on touch-only devices (PR [#​1325](https://github.com/Pagefind/pagefind/issues/1325)) ##### Search Results & Options - Added an `excerptEllipsis` option to mark the truncated ends of excerpts (PR [#​1320](https://github.com/Pagefind/pagefind/issues/1320)) - See [📘 Excerpt ellipsis](https://pagefind.app/docs/search-config/#excerpt-ellipsis) - Fixed phrase search across diacritic variants, so searching `"cafe latte"` can match a page containing `café latte` (PR [#​1386](https://github.com/Pagefind/pagefind/issues/1386) — thanks [@​sean0407](https://github.com/sean0407) !) - Fixed filters not matching values containing escaped characters such as quotes or backslashes (PR [#​1392](https://github.com/Pagefind/pagefind/issues/1392)) - Fixed compound words being counted twice in metadata coverage, which could overvalue a metadata match (PR [#​1319](https://github.com/Pagefind/pagefind/issues/1319)) - Fixed a bug which could build excerpts from the wrong words (PR [#​1318](https://github.com/Pagefind/pagefind/issues/1318)) - Fixed decoding for HTML entities in the automatic `image` and `image_alt` metadata (PR [#​1393](https://github.com/Pagefind/pagefind/issues/1393) — thanks [@​digilist](https://github.com/digilist) !) ##### Indexing & Performance - More work making the index deterministic between builds (PR [#​1124](https://github.com/Pagefind/pagefind/issues/1124) — thanks [@​gissimo](https://github.com/gissimo) !) - Improved search performance on a bunch of broad queries (PR [#​1334](https://github.com/Pagefind/pagefind/issues/1334)) - Fixed a bug where a word with many variants could produce an oversized index chunk (PR [#​1316](https://github.com/Pagefind/pagefind/issues/1316)) - Searches no longer request index chunks for empty terms (PR [#​1317](https://github.com/Pagefind/pagefind/issues/1317)) - More minor search performance work (PR [#​1238](https://github.com/Pagefind/pagefind/issues/1238) — thanks [@​sanjaiyan-dev](https://github.com/sanjaiyan-dev) !) ##### Fixes & Tweaks - Search terms that normalize to nothing are now dropped, rather than searching for an empty term (PR [#​1382](https://github.com/Pagefind/pagefind/issues/1382)) - Improved some compound indexing, so `sysconfig.is_python_build` can be found by searching `is_python_build` - Fixed a way that output files could be truncated in service-mode (PR [#​1272](https://github.com/Pagefind/pagefind/issues/1272) — thanks [@​zelinskyy](https://github.com/zelinskyy) !) - Fixed `--exclude-selectors` hard-erroring when a single selector could not be parsed (PR [#​1312](https://github.com/Pagefind/pagefind/issues/1312) — thanks [@​dualfroz](https://github.com/dualfroz) !) - Improved handling of percent-encoded page URLs (PR [#​1315](https://github.com/Pagefind/pagefind/issues/1315), PR [#​1335](https://github.com/Pagefind/pagefind/issues/1335) — thanks [@​dualfroz](https://github.com/dualfroz) !) - Failed index fetches are now evicted from the cache correctly and are retried (PR [#​1329](https://github.com/Pagefind/pagefind/issues/1329)) - Per-page warnings are now only logged with `--verbose` (PR [#​1314](https://github.com/Pagefind/pagefind/issues/1314)) ##### UI Translations - Added Macedonian (mk) translations (PR [#​1353](https://github.com/Pagefind/pagefind/issues/1353) — thanks [@​I90rche](https://github.com/I90rche) !) - Added Bulgarian (bg) translations (PR [#​1341](https://github.com/Pagefind/pagefind/issues/1341) — thanks [@​salif](https://github.com/salif) !) - Improved French (fr) translations (PR [#​1145](https://github.com/Pagefind/pagefind/issues/1145) — thanks [@​maxonss](https://github.com/maxonss) !) - Improved German (de) translations (PR [#​1096](https://github.com/Pagefind/pagefind/issues/1096) — thanks [@​randomguy-2650](https://github.com/randomguy-2650) !) - Improved Persian (fa) translations (PR [#​1204](https://github.com/Pagefind/pagefind/issues/1204) — thanks [@​Goudarz](https://github.com/Goudarz) !) - Improved Swahili (sw) translations (PR [#​1185](https://github.com/Pagefind/pagefind/issues/1185) — thanks [@​gully223](https://github.com/gully223) !) </details> <details> <summary>withastro/astro (astro)</summary> ### [`v7.4.5`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#745) [Compare Source](https://github.com/withastro/astro/compare/[email protected]@7.4.5) ##### Patch Changes - [#​18558](https://github.com/withastro/astro/pull/18558) [`fac3c50`](https://github.com/withastro/astro/commit/fac3c50463ce9c290bdccb1d6dba30dc7ca4d779) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes `astro dev status` and other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process - [#​18559](https://github.com/withastro/astro/pull/18559) [`10dae2f`](https://github.com/withastro/astro/commit/10dae2f31486cc0a6a04d1f3d7f5ab7fa8889b30) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes `import.meta.env` values containing `$` sequences (such as `$$` or `$&`) being corrupted in `astro build` when server code reads the `import.meta.env` object directly, for example with `const { MY_SECRET } = import.meta.env` - [#​18544](https://github.com/withastro/astro/pull/18544) [`e3bec3d`](https://github.com/withastro/astro/commit/e3bec3d2c770cb53771dad723db57a2ebf931b42) Thanks [@​skezo](https://github.com/skezo)! - Fixes request paths with invalid percent-encoding (e.g. `/%C0%AF` or a bare `%`) being logged as an `Invalid URL encoding` error and routed with the undecoded path. These requests now return a `400`, the same as a path that is encoded too many times. - [#​18520](https://github.com/withastro/astro/pull/18520) [`e023aba`](https://github.com/withastro/astro/commit/e023abac912d7cb6af2b9fb5107ef5dabc667096) Thanks [@​matthewp](https://github.com/matthewp)! - Makes rendering of string tag names stricter and consistent across `.astro` dynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as `/` or `=` can no longer change the generated markup. A string that does not start with a valid element name (for example `'!--'` or `''`) now throws an error instead of producing invalid HTML. ### [`v7.4.4`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#744) [Compare Source](https://github.com/withastro/astro/compare/[email protected]@7.4.4) ##### Patch Changes - [#​18344](https://github.com/withastro/astro/pull/18344) [`df838da`](https://github.com/withastro/astro/commit/df838da6c6d965504fae0d89e12d3e67bdd0f4c6) Thanks [@​edmundhung](https://github.com/edmundhung)! - Allows `astro add` to configure tagged versions of official adapters ### [`v7.4.3`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#743) [Compare Source](https://github.com/withastro/astro/compare/[email protected]@7.4.3) ##### Patch Changes - [#​18488](https://github.com/withastro/astro/pull/18488) [`e4e25fa`](https://github.com/withastro/astro/commit/e4e25fa7d47e702985cbb1ee633d4ffb92f8dad6) Thanks [@​umeraamir69](https://github.com/umeraamir69)! - CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string into `script-src` and `style-src`. - [#​18500](https://github.com/withastro/astro/pull/18500) [`e5a3a1b`](https://github.com/withastro/astro/commit/e5a3a1bdec268933f01a0da3fbeb4e38bdf455c9) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes `<Image>` and `<Picture>` emitting duplicate `srcset` candidates when `densities` contains equivalent values such as `1` and `'1x'` - [#​18517](https://github.com/withastro/astro/pull/18517) [`c3185b7`](https://github.com/withastro/astro/commit/c3185b764e14f50664b0e63ec665804fdecf685e) Thanks [@​okxint](https://github.com/okxint)! - Fix unhandled `AbortError` rejection when `ClientRouter` skips a pending view transition - [#​18497](https://github.com/withastro/astro/pull/18497) [`c712113`](https://github.com/withastro/astro/commit/c7121132acc25ee3a7f3dc6dd36240f031537878) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes an uncaught `TypeError` in the browser when a `server:defer` island request fails due to a network error. The fallback content is kept, as it is for non-200 responses. - [#​18525](https://github.com/withastro/astro/pull/18525) [`d0240b9`](https://github.com/withastro/astro/commit/d0240b9d5738a97f0b8ad100b76bce8b7527e4cd) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes a `DEP0190` deprecation warning printed by `astro info` on Node.js 24 and later - [#​18522](https://github.com/withastro/astro/pull/18522) [`776b9a6`](https://github.com/withastro/astro/commit/776b9a6124a8d5aef8e280a8af4f8ba68c80e65b) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes `memoryCache()` serving an empty body for cached pages that return an empty `404` or `500` response. These responses now render the `404` or `500` error page on every request. - [#​18511](https://github.com/withastro/astro/pull/18511) [`d060ff9`](https://github.com/withastro/astro/commit/d060ff9b68f737af2788e521635afb6f6a84b029) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes `transition:name` styles missing in dev when the element is inside a component that is only rendered through another component with no styles or scripts - [#​18494](https://github.com/withastro/astro/pull/18494) [`5fe699c`](https://github.com/withastro/astro/commit/5fe699c888d0423db75cac3f0939409d7eb28e37) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes the `astro` CLI refusing to run on StackBlitz by allowing Node.js `>=22.22.0` inside WebContainers, whose Node.js version users cannot change - [#​18506](https://github.com/withastro/astro/pull/18506) [`bf43a60`](https://github.com/withastro/astro/commit/bf43a6042f8a9e87c2cef1b4c36700d4e941c35f) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes `<ClientRouter />` animating scroll restoration on back/forward navigation when `scroll-behavior: smooth` is set. Saved scroll positions are now restored instantly, matching the browser's native behavior. - [#​18476](https://github.com/withastro/astro/pull/18476) [`8ea79a2`](https://github.com/withastro/astro/commit/8ea79a282e53b83c65f69c9013f5eeb5d97aadb1) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes a `DataCloneError` crash when building pages that render SVG imports with `<Image />` or `getImage()` while `experimental.parallelPrerender` is enabled. - [#​18504](https://github.com/withastro/astro/pull/18504) [`6dbd737`](https://github.com/withastro/astro/commit/6dbd73764f8a0f16d696f276b634e32631982aab) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes `<Picture>` emitting a duplicate `1x` candidate in `<source>` `srcset` when `densities` includes `1` - [#​18524](https://github.com/withastro/astro/pull/18524) [`7524889`](https://github.com/withastro/astro/commit/75248890363ce7de03e5d9b56605958323752dc4) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes type errors reported in Astro's built-in `<Image />`, `<Picture />`, `<Code />`, `<Debug />` and `<ClientRouter />` components when type-checking a project that extends `astro/tsconfigs/strictest` with `tsc` and `@astrojs/ts-content-mapper` - [#​18493](https://github.com/withastro/astro/pull/18493) [`3773941`](https://github.com/withastro/astro/commit/377394179293d1f898c49d38a5b28cf9b21641a9) Thanks [@​astro-factory](https://github.com/apps/astro-factory)! - Fixes scoped styles of unused Astro components being included in the build when those components are re-exported from a barrel file - [#​18512](https://github.com/withastro/astro/pull/18512) [`1151b9e`](https://github.com/withastro/astro/commit/1151b9e0d05e850fa3638a927ac9f66179010e00) Thanks [@​jp-knj](https://github.com/jp-knj)! - Fixes CSP hashes added with `Astro.csp` from components rendered inside `<body>` being left out of the CSP `<meta>` element in static builds, including MDX pages - Updated dependencies \[[`6cf3423`](https://github.com/withastro/astro/commit/6cf3423e4c62af5e54a2676c8304a209ab1e064d), [`edfbf4a`](https://github.com/withastro/astro/commit/edfbf4ab34ff007ae8f7188af76a023a15c9443d)]: - [@​astrojs/telemetry](https://github.com/astrojs/telemetry)@3.4.2 - [@​astrojs/markdown-satteri](https://github.com/astrojs/markdown-satteri)@0.4.6 </details> <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v12.17.0`](https://github.com/pnpm/pnpm/releases/tag/v12.17.0): pnpm 12.17 [Compare Source](https://github.com/pnpm/pnpm/compare/v12.16.1...v12.17.0) pnpm 12.17.0 adds `pnpm peers check --global`, dependency-group selectors and wildcards in `overrides`, and runtime, package manager, Cargo, and Python updates in `pnpm outdated` and `pnpm update`. It also fixes files that other users could not read in Docker images, and repeat installs that missed changes to local dependencies. ##### Minor Changes - `pnpm peers check` now accepts `--global` (`-g`) to check globally installed packages. After a global install or update, the peer dependency warning now suggests `pnpm peers check -g` [#​17504](https://github.com/pnpm/pnpm/issues/17504). - `pnpm outdated` and `pnpm update` now inspect and update package manager and runtime versions in `devEngines.packageManager`, `packageManager`, `devEngines.runtime`, `engines.runtime`, and `runtime:` dependencies. With `cargo.enabled` or `python.enabled`, `pnpm outdated` and `pnpm update` also inspect and update Cargo dependencies in `Cargo.toml` and `Cargo.lock` and Python dependencies in `pyproject.toml` and `pylock.toml`. - `overrides` selectors now support `:prod`, `:optional`, and `:peer` pseudo-selectors that target a single dependency group. They also support `*` wildcard patterns on parent and target package names. An override with a non-range value, such as `npm:` or `file:`, no longer adds a peer dependency to `dependencies`. Removing an optional dependency with `"-"` now also removes the duplicate entry from `dependencies` [#​5391](https://github.com/pnpm/pnpm/issues/5391). ##### Patch Changes ##### Installing packages - Files that pnpm creates in a project now get the permissions the umask gives any new file, such as `0644`. Before, several of them were readable only by the user who ran pnpm, which broke Docker images that run as a different user [#​17435](https://github.com/orgs/pnpm/discussions/17435). The fix applies to: - `node_modules/.pnpm-workspace-state-v1.json`. A different user running `pnpm run` reinstalled the dependencies because it could not read this file. - `pnpm-workspace.yaml` - the files written by `pnpm deploy` - patch files from `pnpm patch-commit` - the lockfile restored by `pnpm dedupe --check` - the Cargo and Python files that pnpm writes When pnpm edits an existing file, the file keeps its permissions. - `pnpm install` no longer writes broken dependency links when the project's `node_modules` is a symlink to another directory, such as another project's `node_modules`. The install reported success, but the links it wrote did not resolve [#​17448](https://github.com/pnpm/pnpm/issues/17448). - Commands installed with `pnpm add --global` now find the dependencies that pnpm hoists for their package. A package that loads a dependency it does not declare, such as a native addon's platform-specific package, failed with "Cannot find module". Reinstall such a package with `pnpm add --global` to update its existing command [#​17503](https://github.com/pnpm/pnpm/issues/17503). - When pnpm switches to the version a project pins, it now installs that version's native binary for the current host, even if the project's `supportedArchitectures` excludes the host. Before, pnpm could not use the pinned version and kept running the installed one. pnpm also repairs a pinned version that an earlier install left without the host's binary. - With the global virtual store, a change to a dependency of one package in a dependency cycle now gives every package in that cycle a new directory. Before, the other packages kept their directories and still linked the old copy of the changed package, so the project could load two copies of it [#​17466](https://github.com/pnpm/pnpm/issues/17466). Packages in a dependency cycle, and packages that depend on one, move to new global virtual store directories once after this update. Those that run a build miss the side-effects cache once. - With `nodeLinker: hoisted`, when two workspace projects need the same package version and it cannot be hoisted to the root, each project now keeps the copy installed in its own `node_modules`. Build scripts run in each of these copies. Before, the second project's copy was replaced with a symlink to the first project's, so every repeat install imported it again [#​17498](https://github.com/pnpm/pnpm/issues/17498). - The Node.js `latest` selector now chooses the newest stable release [#​17490](https://github.com/pnpm/pnpm/issues/17490). - Hardlinking from the store now stats each store file once per install. Since pnpm 12.8.0, a store file was stat'ed again for every package that links it. On an offline install of a large workspace, that added up to 15% system CPU [#​17500](https://github.com/pnpm/pnpm/issues/17500). ##### Repeat installs and local dependencies - `pnpm install --frozen-lockfile` no longer reports an outdated lockfile right after the install that wrote it. This happened when a pnpmfile `readPackage` hook or `packageExtensions` changed the dependencies or peer dependencies of a local directory dependency outside the workspace projects. It affected a `file:` dependency, an injected `workspace:../dir` dependency outside the workspace patterns, and an injected workspace package left out by `--filter` [#​17447](https://github.com/pnpm/pnpm/issues/17447) [#​17473](https://github.com/pnpm/pnpm/issues/17473). A repeat `pnpm install` now takes the fast path when `ignoredOptionalDependencies` removes an optional dependency of a `file:` directory dependency. It used to resolve again on every run. - `pnpm install` now resolves again after an edit to an injected `workspace:../dir` dependency outside the workspace patterns under a shared lockfile. It used to keep the lockfile unchanged. The next `pnpm install --frozen-lockfile` then failed [#​17476](https://github.com/pnpm/pnpm/issues/17476). - `pnpm install` now resolves a local directory again after its `package.json` changes when an override or a package extension adds it to the dependencies of a registry package. `pnpm install --frozen-lockfile` fails on a lockfile that still records the old dependencies of such a directory [#​17486](https://github.com/pnpm/pnpm/issues/17486). - With `injectWorkspacePackages` and per-project lockfiles, `pnpm install` now updates a project's lockfile when a local tarball that an injected workspace project depends on is replaced. The project's lockfile kept the old version and integrity before. - `pnpm install` now detects a change to a local tarball or directory that only a pnpmfile `readPackage` hook depends on. A repeat install reported "Already up to date" and kept the old contents before [pnpm/tasks#227](https://github.com/pnpm/tasks/issues/227). - `pnpm install` now relinks a `workspace:` or `link:` dependency whose link was deleted from `node_modules`. It used to report "Already up to date" and leave the link missing [#​17485](https://github.com/pnpm/pnpm/issues/17485). - A repeat `pnpm install` reports "Already up to date" again when a pnpmfile `readPackage` hook changes the dependencies of a workspace project. Since 12.15.0, every such install ran in full [#​17468](https://github.com/pnpm/pnpm/issues/17468). After an edit to a project's `package.json`, `pnpm install` and `verifyDepsBeforeRun` now run the pnpmfile's `readPackage` hook on the edited manifest before comparing it with the lockfile. They could report the project up to date when the hook rewrote the edited dependency to a specifier the lockfile did not record. ##### Adding and updating dependencies - `pnpm update --latest` with package selectors now updates the dependencies of the selected packages within their declared ranges. Excluded packages and their dependencies keep their locked versions [#​17444](https://github.com/pnpm/pnpm/issues/17444). - `pnpm add <pkg>@<tag>` now uses a catalog entry set to that same dist-tag. The dependency is saved as `catalog:` and the entry stays as written [pnpm/tasks#225](https://github.com/pnpm/tasks/issues/225). When `pnpm add` adds a new dist-tag such as `vue@legacy` to a catalog, the catalog entry records the exact version the tag points to. The same applies to a dependency added without a version when the `tag` setting names a dist-tag other than `latest`. - `pnpm add` now saves the resolved version range of an npm alias. For example, `pnpm add v2@npm:vue` and `pnpm add v2@npm:vue@^3.0.0` both save `npm:vue@^3.5.13`. ##### Running scripts and commands - Programs that a script or `pnpm exec` command leaves running, such as a browser opened by the `open` package, now outlive pnpm exactly when they would outlive the command run without pnpm. Before, on Windows, a failed command, `Ctrl+C`, or a closed terminal ended all of them. pnpm still ends them when it is killed or crashes. When a recursive or parallel run bails, the scripts still running now receive `SIGTERM` on Unix and are killed only if they are still running two seconds later. On Windows, everything those scripts started is ended, including detached processes whose parent has already exited. Before, a bail killed them at once [#​17465](https://github.com/pnpm/pnpm/issues/17465). - On Windows, the shell shim of a `.cmd` or `.bat` bin now runs it under Git Bash when MSYS argument conversion is off, such as with `MSYS_NO_PATHCONV=1` or `MSYS2_ARG_CONV_EXCL='*'`. The shim used to start an interactive cmd.exe prompt [#​17480](https://github.com/pnpm/pnpm/issues/17480). - `pnx` and `pnpm create` now run the command in the directory selected by `--dir` or `--workspace-root`. Without either flag, the command still runs in the directory pnpm was started in. - `pnpm --env-file` now reads files the way `node --env-file` does. Values are taken as written, so `$VAR` is no longer expanded and Windows paths such as `C:\Users\me` load unchanged. A file is no longer rejected for its contents. ##### Settings and messages - `pnpm version` no longer creates a git commit and tag when `gitTagVersion` is set to `false` [#​17460](https://github.com/pnpm/pnpm/issues/17460). - `pnpm publish` now reads the `publishBranch` setting from `pnpm-workspace.yaml` and from `PNPM_CONFIG_PUBLISH_BRANCH`. The `--publish-branch` flag overrides it. - `pnpm` now accepts `--strict-ssl` and `--local-address <ip>` on the command line. - `pnpm doctor` uses a 15-second timeout when checking registry connectivity. - `pnpm-workspace.yaml` parse errors now report `ERR_PNPM_INVALID_SETTING`. - The error for a dependency with an invalid name in a project's manifest now names the project's directory. It used to say only "The current package", which did not tell which workspace project to fix [#​17475](https://github.com/pnpm/pnpm/issues/17475). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://notion.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/notion.svg" width="80" alt="Notion"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://www.cloudflare.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/cloudflare.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/cloudflare_light.svg" /> <img src="https://pnpm.io/img/users/cloudflare.svg" width="160" alt="Cloudflare" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://latitude.so/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/latitude.svg" width="160" alt="Latitude"></a> </td> <td align="center" valign="middle"> <a href="https://syntax.fm/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/syntaxfm.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/syntaxfm_light.svg" /> <img src="https://pnpm.io/img/users/syntaxfm.svg" width="90" alt="Syntax" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xOTkuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjIyMi41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> <!-- cloudflare-preview --> Preview: https://pr-640.docs-gitea-com.pages.dev --------- Co-authored-by: Lunny Xiao <[email protected]> Reviewed-on: https://gitea.com/gitea/docs/pulls/640 Reviewed-by: Lunny Xiao <[email protected]> Co-authored-by: Renovate Bot <[email protected]>
Astro + Starlight site
Renders the gitea documentation with Starlight: the docs (6 versions x 3 languages), the runner docs (4 series), the cli docs and the api reference (7 swagger documents). The enterprise docs stay in their own deployment and are linked from the header.
The content directories are the ones the site has always used — docs/,
versioned_docs/, i18n/, runner-docs/, runner-docs_versioned_docs/ and
static/swagger-*.json (plus static/openapi3-*.json since gitea 1.27) — so
the release scripts and the translation workflow stay unchanged. The cli docs
in cli-docs/ follow the layout of the runner docs.
Running it
Everything is driven from the repository root, see the README.md there:
make serve-fast # english, the version served at the root, starts in seconds
make serve # whole matrix, api included
make serve-built # build and serve it, the only way to try the search locally
make build
make check
GITEA_DOCS_PRODUCTS, GITEA_DOCS_VERSIONS and GITEA_DOCS_LOCALES (comma
separated) restrict the matrix, which is what make serve-fast uses.
How it is put together
packages/content-loader holds the product matrix and the astro content loader.
src/products.ts is the single source of truth for product x version x language
and drives everything else: content loading, sidebars, the version and language
pickers, the version banner, the search facets and the api schemas.
| Source | Route |
|---|---|
versioned_docs/version-1.27/ |
/ |
docs/ |
/next/ |
versioned_docs/version-1.26/ |
/1.26/ |
i18n/zh-cn/docs/version-1.27/ |
/zh-cn/ |
runner-docs_versioned_docs/version-3/ |
/runner/ |
runner-docs/ |
/runner/develop/ |
cli-docs/ |
/cli/, until a cli series is released |
static/openapi3-27.json |
/api/ |
static/openapi3-latest.json |
/api/next/ |
static/swagger-26.json |
/api/1.26/ |
The loader reads the markdown in two passes. The first one works out the route of every file, the second normalizes and renders it:
- substitutes the version variables (
@version@,@dockerVersion@, ...) - lifts the leading
# headinginto the starlighttitle - maps
sidebar_positiontosidebar.orderand honours theslug, including the translations that moved a page - rewrites the relative
*.mdlinks to urls, resolving them against the file and against the version root, and reports the ones that do not resolve - turns the admonitions into starlight asides (
:::warningto:::caution,:::infoto:::note,:::note Titleto:::note[Title]) - recreates the index pages of
_category_.json(/category/installation/,/usage/actions/)
Sidebars are built per (product, version, language) from _category_.json and
from the sidebar files (sidebars.js, versioned_sidebars/,
runner-sidebars.js, runner-docs_versioned_sidebars/, cli-sidebars.js),
and selected in src/routeData.ts, since starlight only supports a single
static sidebar.
Set GITEA_DOCS_STRICT_LINKS=true to fail the build on a broken internal link
instead of warning.
Products and languages
The docs are the site itself, so their language comes first: /zh-cn/1.26/.
The runner, the cli and the api are separate products and keep their language
inside the product, /runner/zh-cn/3/, which is reserved: all are published in
english only today. Starlight builds a fallback page in every configured
language for every english page, so /zh-cn/runner/ would exist; the post build
integration removes those directories and cloudflare/_redirects sends them to
the english page.
The version served at the root of a product has no number in its url: docs 1.27
is /, runner 3 is /runner/ and api 1.27 is /api/. /1.27/, /runner/3/
and /api/1.27/ are redirected onto them in cloudflare/_redirects.
Api reference
starlight-openapi generates a page per operation from the documents
update_api_docs.sh maintains: the openapi 3.0 document for the versions that
have one (gitea >= 1.27), the swagger 2.0 one for the older versions. Both
describe the same api and use the same operation ids, so the urls of the
operation pages do not depend on which one is rendered. Three adjustments
happen at build time:
- the swagger 2.0 documents set
basePathto the fullhttps://gitea.com/api/v1url, which redoc accepted but is not valid swagger 2.0. A normalized copy is written to.cache/openapi/instead of touching the sources. The openapi 3.0 documents keep that url inservers, where it is valid, and only get the operation ids and the tag descriptions adjusted. - both documents of a version are linked for download from its overview page,
see
specDownloads()insrc/config/api.tsandsrc/components/ApiOverviewTags.astro. - the plugin slugifies the base path, so
/api/1.26/is generated as/api/126/.src/integrations/postbuild.tsrenames the directories and rewrites the links once the build is done.
Search
Algolia docsearch, enabled when PUBLIC_DOCSEARCH_APP_ID and
PUBLIC_DOCSEARCH_API_KEY are set, pagefind otherwise, so a fork without
credentials still gets search. Every page carries docsearch:product,
docsearch:version and docsearch:language meta tags; the crawler turns them
into facets and src/config/docsearch.ts filters the search on the product,
version and language being read. cloudflare/docsearch-crawler.json holds the
crawler configuration and only indexes the versions people read.
Pagefind builds one index for the whole site, so the same scope has to be applied on its side as well, otherwise a search started in the 1.23 docs answers with the pages of the latest release:
src/components/MarkdownContent.astrowraps the content in thedata-pagefind-filterelements that putproductandversioninto the index. One filter per element, pagefind reads the whole attribute as a singlename:valuepair.- the same scope is written to the
gitea:search-filtersmeta tag bysrc/lib/search.ts. - starlight builds the search ui with a build time configuration and has no
option for per page filters, so its
@pagefind/default-uiimport is redirected to the subclass insrc/lib/pagefind-ui.tsby thegitea-pagefind-filtersplugin inastro.config.mjs. It selects the filters of the page the modal was opened on and adds the "Search all versions" checkbox, which drops them again and labels the results with their version. A starlight upgrade that moves the import fails the build, thegitea-pagefind-filters-checkintegration verifies that the redirect ran.
Deployment
cloudflare/_headers and cloudflare/_redirects are copied next to the build
output by the publish workflow. /enterprise/* is routed to the enterprise
pages project by a Cloudflare worker maintained outside this repository.
Differences between pnpm dev and the deployed site
/api/1.26/is served at/api/126/, the renaming happens after the build./zh-cn/runner/still answers, the fallback pages are removed after the build./1.27/,/runner/3/and/api/1.27/are cloudflare redirects, so they only work on the deployed site.- search is built by pagefind at build time and only answers on the built site,
unless the algolia docsearch credentials are set;
make serve-builtbuilds and serves it locally. - a scoped run only builds part of the matrix, so the products and versions left
out answer with the 404 page;
pnpm devserves everything.