chore(deps): bump the npm-minor-patch group across 1 directory with 10 updates

[dependabot]

Bumps the npm-minor-patch group with 10 updates in the /docs/site directory:

Package	From	To
@astrojs/starlight	0.41.2	0.41.5
@fontsource/ibm-plex-mono	5.2.7	5.3.0
@fontsource/public-sans	5.2.7	5.3.0
astro	7.1.3	7.1.5
@astrojs/check	0.9.9	0.9.10
@astrojs/markdown-remark	7.2.1	7.2.2
@redocly/cli	2.36.0	2.41.1
@vvago/vale	3.15.1	3.15.2
markdownlint-cli2	0.23.0	0.23.2
turndown	7.2.1	7.2.4

Updates @astrojs/starlight from 0.41.2 to 0.41.5

Release notes

Sourced from @​astrojs/starlight's releases.

@​astrojs/starlight@​0.41.5

Patch Changes

• #4095 bb06434 Thanks @​HiDeoo! - Fixes a regression when using a union to extend Starlight’s docsSchema().

@​astrojs/starlight@​0.41.4

Patch Changes

• #3936 712eedd Thanks @​miichom! - Fixes support for modifying Zod enums when passing an extend option to Starlight’s docsSchema()

• #4092 0896b91 Thanks @​delucis! - Fixes support for links containing a protocol like mailto: in the sidebar

• #4088 4486ba4 Thanks @​delucis! - Simplifies Starlight’s client-side sidebar state persistence script slightly

@​astrojs/starlight@​0.41.3

Patch Changes

• #3911 1686ecc Thanks @​timothyjordan! - Keeps keyboard focus inside the mobile menu while it is open, preventing focus moving to hidden interactive elements in page content.

Changelog

Sourced from @​astrojs/starlight's changelog.

0.41.5

Patch Changes

• #4095 bb06434 Thanks @​HiDeoo! - Fixes a regression when using a union to extend Starlight’s docsSchema().

0.41.4

Patch Changes

• #3936 712eedd Thanks @​miichom! - Fixes support for modifying Zod enums when passing an extend option to Starlight’s docsSchema()

• #4092 0896b91 Thanks @​delucis! - Fixes support for links containing a protocol like mailto: in the sidebar

• #4088 4486ba4 Thanks @​delucis! - Simplifies Starlight’s client-side sidebar state persistence script slightly

0.41.3

Patch Changes

• #3911 1686ecc Thanks @​timothyjordan! - Keeps keyboard focus inside the mobile menu while it is open, preventing focus moving to hidden interactive elements in page content.

Commits

• 5b06909 [ci] release (#4097)
• bb06434 Fix union schema extend regression (#4095)
• ab2792b [ci] release (#4090)
• 712eedd fix: invalid option error when modifying enums in docsSchema's extend (#3936)
• 0896b91 Support links with any protocol in sidebars (#4092)
• 4486ba4 Remove pagehide event from sidebar persistence script (#4088)
• 96cee6e [ci] release (#4032)
• 1686ecc fix(MobileMenuToggle): trap keyboard focus inside the mobile menu (#3911)
• See full diff in compare view

Updates @fontsource/ibm-plex-mono from 5.2.7 to 5.3.0

Commits

• See full diff in compare view

Updates @fontsource/public-sans from 5.2.7 to 5.3.0

Commits

• See full diff in compare view

Updates astro from 7.1.3 to 7.1.5

Release notes

Sourced from astro's releases.

astro@7.1.5

Patch Changes

• #17524 7613030 Thanks @​matthewp! - Fixes a bug where an error while finalizing a request could prevent a response from being sent

• #17480 f61ba9c Thanks @​florian-lefebvre! - Fixes a case where a custom logger.entrypoint failed to load at runtime in a built server bundle.

• #17525 e614b7b Thanks @​matthewp! - Fixes action path resolution so that properties of a resolved action function are not treated as routable path segments

• #17284 c775c1f Thanks @​matthewp! - Fixes a bug where the custom 404 (or 500) page was not rendered when a middleware rewrite targeted a route that returned an empty 404/500 response, and a blank page was returned instead

• #17474 c895b12 Thanks @​nicksnyder! - Updates dependency js-yaml to v4.3.0

• Updated dependencies [c895b12]:

  • @​astrojs/internal-helpers@​0.10.2
  • @​astrojs/markdown-remark@​7.2.2
  • @​astrojs/markdown-satteri@​0.3.5

astro@7.1.4

Patch Changes

• #17488 d4f266d Thanks @​emerson-d-lopes! - Fixes duplicate CSS files being emitted in server output when a prerendered page and a server-rendered page share the same styles (e.g. a shared layout importing Tailwind). The prerender and SSR environments each emitted their own copy of the same stylesheet (index.X.css and _..Y.css); the SSR build now reuses the CSS asset filename from the prerender build when the stylesheet is backed by the same CSS source modules, so only a single file is emitted.

• #17472 4dc590c Thanks @​astrobot-houston! - Adds the missing background prop to the <Image /> and <Picture /> component types. The prop already worked at runtime, but was absent from the types, causing astro check to report that background does not exist on the component props

• #17292 0fc519d Thanks @​astrobot-houston! - Fixes missing scoped styles for child components inside client:only islands in production builds

• #17421 f1448de Thanks @​iamkaleemsajjad-hue! - Fixes session runtime errors being silently swallowed by console.error instead of routing through Astro's logger

• #17421 f1448de Thanks @​iamkaleemsajjad-hue! - Fixes a session being left in a partial state after a storage failure during session.regenerate(), preventing unnecessary storage reads on subsequent operations

• #17517 82bf7e2 Thanks @​Hashim1999164! - Prevents a visible terminal window from popping up on Windows when the dev server runs in background mode. The detached child process is now spawned with windowsHide: true, so console-subsystem grandchildren (such as workerd.exe) no longer get a new focus-stealing window allocated by Windows Terminal.

• #17510 eaa1fb0 Thanks @​astrobot-houston! - Fixes the glob() loader watcher so negation patterns like !docs/drafts/** correctly exclude files during development, matching the behavior of the initial scan. Previously, negations were treated as independent matchers, causing unrelated files (including .astro/data-store.json) to be ingested as collection entries

• #17511 704e570 Thanks @​astrobot-houston! - Fixes TypeScript path aliases from tsconfig.json not resolving in astro.config.ts

Changelog

Sourced from astro's changelog.

7.1.5

Patch Changes

• #17524 7613030 Thanks @​matthewp! - Fixes a bug where an error while finalizing a request could prevent a response from being sent

• #17480 f61ba9c Thanks @​florian-lefebvre! - Fixes a case where a custom logger.entrypoint failed to load at runtime in a built server bundle.

• #17525 e614b7b Thanks @​matthewp! - Fixes action path resolution so that properties of a resolved action function are not treated as routable path segments

• #17284 c775c1f Thanks @​matthewp! - Fixes a bug where the custom 404 (or 500) page was not rendered when a middleware rewrite targeted a route that returned an empty 404/500 response, and a blank page was returned instead

• #17474 c895b12 Thanks @​nicksnyder! - Updates dependency js-yaml to v4.3.0

• Updated dependencies [c895b12]:

  • @​astrojs/internal-helpers@​0.10.2
  • @​astrojs/markdown-remark@​7.2.2
  • @​astrojs/markdown-satteri@​0.3.5

7.1.4

Patch Changes

• #17488 d4f266d Thanks @​emerson-d-lopes! - Fixes duplicate CSS files being emitted in server output when a prerendered page and a server-rendered page share the same styles (e.g. a shared layout importing Tailwind). The prerender and SSR environments each emitted their own copy of the same stylesheet (index.X.css and _..Y.css); the SSR build now reuses the CSS asset filename from the prerender build when the stylesheet is backed by the same CSS source modules, so only a single file is emitted.

• #17472 4dc590c Thanks @​astrobot-houston! - Adds the missing background prop to the <Image /> and <Picture /> component types. The prop already worked at runtime, but was absent from the types, causing astro check to report that background does not exist on the component props

• #17292 0fc519d Thanks @​astrobot-houston! - Fixes missing scoped styles for child components inside client:only islands in production builds

• #17421 f1448de Thanks @​iamkaleemsajjad-hue! - Fixes session runtime errors being silently swallowed by console.error instead of routing through Astro's logger

• #17421 f1448de Thanks @​iamkaleemsajjad-hue! - Fixes a session being left in a partial state after a storage failure during session.regenerate(), preventing unnecessary storage reads on subsequent operations

• #17517 82bf7e2 Thanks @​Hashim1999164! - Prevents a visible terminal window from popping up on Windows when the dev server runs in background mode. The detached child process is now spawned with windowsHide: true, so console-subsystem grandchildren (such as workerd.exe) no longer get a new focus-stealing window allocated by Windows Terminal.

• #17510 eaa1fb0 Thanks @​astrobot-houston! - Fixes the glob() loader watcher so negation patterns like !docs/drafts/** correctly exclude files during development, matching the behavior of the initial scan. Previously, negations were treated as independent matchers, causing unrelated files (including .astro/data-store.json) to be ingested as collection entries

• #17511 704e570 Thanks @​astrobot-houston! - Fixes TypeScript path aliases from tsconfig.json not resolving in astro.config.ts

Commits

• b0535ca [ci] release (#17528)
• c895b12 Update js-yaml to 4.3.0 (#17474)
• f61ba9c fix(logger): loading at runtime when entrypoint is a URL (#17480)
• e614b7b fix(astro): do not resolve action function properties as path segments (#17525)
• 7613030 Return a response when request finalization fails (#17524)
• c775c1f Render the custom 404 page when a middleware rewrite dead-ends in an empty 40...
• 112d3ea [ci] release (#17469)
• 82bf7e2 fix(astro): hide console window for background dev server on Windows (#17517)
• 0fc519d fix(css): preserve styles for child components of client:only islands during ...
• d4f266d fix(build): deduplicate CSS assets between prerender and SSR environments (#1...
• Additional commits viewable in compare view

Updates @astrojs/check from 0.9.9 to 0.9.10

Release notes

Sourced from @​astrojs/check's releases.

@​astrojs/check@​0.9.10

Patch Changes

• #17447 b01a692 Thanks @​ocavue! - Update dependency yargs to version 18. See the yargs changelog for details.

Changelog

Sourced from @​astrojs/check's changelog.

0.9.10

Patch Changes

• #17447 b01a692 Thanks @​ocavue! - Update dependency yargs to version 18. See the yargs changelog for details.

Commits

• 112d3ea [ci] release (#17469)
• b01a692 chore(deps): update yargs to v18 (#17447)
• 3652d1c chore: merge main into next
• 8062391 chore(deps): dedupe vite installations (#16788)
• ce88423 Dedupe vite (#16787)
• b8061a6 refactor: use TypeScript project service in ESLint (#16623)
• 5a8cd09 refactor: update tsconfig to use TypeScript project references (#16505)
• See full diff in compare view

Updates @astrojs/markdown-remark from 7.2.1 to 7.2.2

Release notes

Sourced from @​astrojs/markdown-remark's releases.

@​astrojs/markdown-remark@​7.2.2

Patch Changes

• Updated dependencies [c895b12]:
  • @​astrojs/internal-helpers@​0.10.2

Changelog

Sourced from @​astrojs/markdown-remark's changelog.

7.2.2

Patch Changes

• Updated dependencies [c895b12]:
  • @​astrojs/internal-helpers@​0.10.2

Commits

• b0535ca [ci] release (#17528)
• See full diff in compare view

Updates @redocly/cli from 2.36.0 to 2.41.1

Release notes

Sourced from @​redocly/cli's releases.

@​redocly/cli@​2.41.1

Patch Changes

• Fixed an issue where the drift command's schema-consistency rule reported false-positive findings for oneOf schemas with a discriminator. Payloads are validated only against the branch selected by the discriminator value instead of every oneOf branch. Schemas whose discriminator does not meet Ajv's structural requirements keep the previous behavior.
• Extended the drift command's built-in undocumented-header ignore list with x-amz-, x-amzn- and x-github- prefixes, and the x-hub-signature / x-hub-signature-256 webhook signature headers.

@​redocly/cli@​2.41.0

Minor Changes

• Added a new built-in rule security-scopes-defined that requires every scope used in a security requirement to be defined in the corresponding OAuth2 security scheme. The rule supports OpenAPI 2.0/3.x and AsyncAPI 2.6/3.0, suggests the closest defined scope for typos, and has an opt-in requireScopes option that requires OAuth2 security requirements to list at least one scope.

Patch Changes

• Fixed an issue in respect where the execution of parent workflow's steps didn't halt after a step that referenced another workflow had failed.
• Fixed an issue where the cursor AI provider of the generate-spec command sent only the instructions to the model and the operation to refine never reached it.
• Updated @​redocly/openapi-core to v2.41.0.
• Updated @​redocly/respect-core to v2.41.0.

@​redocly/cli@​2.40.0

Minor Changes

• Added an --ignore-headers option to the experimental drift and proxy commands. It takes a comma-separated list of header names to skip in undocumented-header checks, and a trailing * matches by prefix (for example x-consumer-*). Use it to silence headers a gateway or proxy adds that are not part of the API contract.
• Added an experimental generate-spec command that infers an OpenAPI description from recorded HTTP traffic.

Patch Changes

• Fixed the drift command's schema-consistency rule reporting false-positive "Undocumented query parameter" findings for deepObject-style query parameters. Traffic keys like namespace[id]=...&namespace[name]=... are now matched to the documented namespace parameter, and the reconstructed object is validated against the parameter schema.

• Fixed an issue where the drift command's schema-consistency rule reported false-positive request findings for exchanges the server rejected with a 4xx client error. For example: missing required parameter, missing required body, request-body schema mismatch. A 4xx response means the server never accepted the request. Validating it against the operation's success-path contract flagged the server's own correct rejection as drift. Response-side validation still runs, so a documented error response whose shape differs from reality is still reported.

• Fixed an issue where the join command silently dropped path-level x-* extensions with non-string values.

• Updated js-yaml from 4.2.0 to 5.2.1. Fixed an issue where strings that look like numbers with underscores (for example '12_34') had quotation marks removed by the bundle command. These strings stay quoted in the output.

  Note: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error. Parse errors are reported at the offending token instead of the end of the document.

• Fixed an issue where the drift command's security-baseline rule reported false-positive "credential exposure over insecure HTTP transport" warnings for traffic captured against loopback hosts, for example: localhost, *.localhost, 127.0.0.0/8, [::1].

... (truncated)

Commits

• b15dae2 chore: 🔖 release new versions (#2975)
• 6da4e28 fix: validate discriminated oneOf schemas against only the branch selected by...
• fba67bd chore: fix snapshot release (#2974)
• e5ecde4 docs: add Redocly CLI usage skill for AI agents (#2972)
• 75fd772 docs: revise the cookbook catalog (#2971)
• d1ad2a8 chore: detect graphql specification in collectSpecData (#2970)
• 96c2619 chore: 🔖 release new versions (#2954)
• fba5d04 fix(respect): referenced workflow execution flow inconsistency (#2966)
• dc26151 fix: pipe the whole generate-spec prompt through stdin in the cursor provider...
• 4fe4ecb chore(deps): apply npm audit fix (#2962)
• Additional commits viewable in compare view

Updates @vvago/vale from 3.15.1 to 3.15.2

Commits

• See full diff in compare view

Updates markdownlint-cli2 from 0.23.0 to 0.23.2

Changelog

Sourced from markdownlint-cli2's changelog.

0.23.2

• Update dependencies

0.23.1

• Show attempted fix counts after fixing
• Update dependencies (including markdownlint)

Commits

• b82a6c8 Update to version 0.23.2.
• e4e659d Add a stub for process.nextTick (using queueMicrotask) now that globby (indir...
• 99760af Bump globby from 16.2.1 to 16.2.2
• 3070236 Address new ESLint warnings from previous commit.
• 6e3cc93 Bump eslint-plugin-unicorn from 71.1.0 to 72.0.0
• 4ba8177 Add eslint-package-json/all to lint script, address new issues.
• 9cb99b2 Refactor eslint.config.mjs to use defineConfig, change eslint-plugin-n from "...
• 37fb0ec Address new ESLint warnings from previous commit.
• f7fea61 Bump eslint-node-test from 0.2.0 to 0.3.0
• 85bb5e7 Bump js-yaml from 5.2.1 to 5.2.2
• Additional commits viewable in compare view

Updates turndown from 7.2.1 to 7.2.4

Release notes

Sourced from turndown's releases.

v7.2.4

• Revert "Merge pull request #515 from Corion/master" f11801c

---

mixmark-io/turndown@v7.2.3...v7.2.4

v7.2.3

• Merge pull request #521 from mixmark-io/dependabot/npm_and_yarn/flatted-3.4.2 3cb11bd
• Bump flatted from 3.4.1 to 3.4.2 20bd64e
• Merge pull request #520 from pavelhoral/remove-browserify 0a6d298
• Replace Browserify with RollupJS build 54123af
• Merge pull request #519 from pavelhoral/upgrade-deps 8c2055e
• Merge pull request #477 from za3k/demo-link a1bb94a
• Add Babel transpilation step so that the output stays the same fc21b5f
• Upgrade standard linter and fix connected issues c1e9141
• Merge pull request #518 from pavelhoral/upgrade-deps 88ebe7c
• Upgrade dependencies 5337d5b
• Merge pull request #515 from Corion/master 01b35ad
• Normalize linebreaks within PRE elements ae008ec
• Merge pull request #511 from vicb/vicb/up-rollup 162ef46
• Bump rollup f82dcaa
• Merge pull request #517 from pavelhoral/fix-link-destination 1986fd3
• Fix escaping link destination with spaces ce16479
• Merge pull request #474 from orchitech/fix-image-links a22e6dc
• Properly escape inline link and image attributes. Fix #473. ea45ddd
• Add demo link b6874f7

---

mixmark-io/turndown@v7.2.2...v7.2.3

v7.2.2

• Merge pull request #504 from pavelhoral/fix-regexp-trim 8ed0499
• Replace regexp trim (#501) e26cc81

---

mixmark-io/turndown@v7.2.1...v7.2.2

Commits

• fb7a865 7.2.4
• f11801c Revert "Merge pull request #515 from Corion/master"
• 0c9954b 7.2.3
• 3cb11bd Merge pull request #521 from mixmark-io/dependabot/npm_and_yarn/flatted-3.4.2
• 20bd64e Bump flatted from 3.4.1 to 3.4.2
• 0a6d298 Merge pull request #520 from pavelhoral/remove-browserify
• 54123af Replace Browserify with RollupJS build
• 8c2055e Merge pull request #519 from pavelhoral/upgrade-deps
• a1bb94a Merge pull request #477 from za3k/demo-link
• fc21b5f Add Babel transpilation step so that the output stays the same
• Additional commits viewable in compare view

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 72379176c4

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Add the missing DCO sign-off

For this commit, git show --format=full 5aa226b938a43ea09fde16ba99db7ee576c98d9c has no Signed-off-by: trailer, while .github/workflows/dco.yml checks every PR commit and exits nonzero when that trailer is absent. Please re-create/amend this dependency-bump commit with git commit -s so the PR is mergeable.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 95f7c3a06c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Add the missing DCO sign-off

For fc46a3b05d3da8fa0da0b854b0b95f0123375c56, git show --format=full --no-patch fc46a3b05d3da8fa0da0b854b0b95f0123375c56 contains no Signed-off-by: trailer. The DCO workflow checks every PR commit and fails when that trailer is absent, so this dependency bump will keep the PR unmergeable until it is re-created/amended with git commit -s. This is fresh evidence for the currently reviewed commit, whereas the previous Codex comment named a different commit.

AGENTS.md reference: AGENTS.md:L70-L70

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Add the missing DCO sign-off

For fc46a3b05d3da8fa0da0b854b0b95f0123375c56, git show --format=full --no-patch fc46a3b05d3da8fa0da0b854b0b95f0123375c56 contains no Signed-off-by: trailer. The DCO workflow checks every PR commit and fails when that trailer is absent, so this dependency bump will keep the PR unmergeable until it is re-created/amended with git commit -s. This is fresh evidence for the currently reviewed commit, whereas the previous Codex comment named a different commit.

Useful? React with 👍 / 👎.