Skip to content

chore(deps): roll up 12 Dependabot bumps (Astro 7.4, satori 0.63, prettier-plugin-astro 1.1) - #107

Merged
ephbaum merged 5 commits into
mainfrom
claude/dependabot-rollup-oct
Oct 23, 2026
Merged

ephbaum merged 5 commits into
mainfrom
claude/dependabot-rollup-oct

Conversation

@ephbaum

@ephbaum ephbaum commented Oct 23, 2026 •

Copy link
Copy Markdown
Owner

📝 What's This PR About?

Type of Change:

  • 🔧 Maintenance - Bug fixes, dependency updates, refactoring

📋 Description

Rolls up every live Dependabot PR into one branch, gated by a single build. Two of them broke on their own: #105 ran out of memory and #106 broke the OG image layout. Both are fixed here.

For Technical Changes:

  • What changed: 12 Dependabot PRs (14 packages) in 5 commits, plus a fix to content.config.ts, CSS changes to the OG templates, and a CLAUDE.md trim.
  • Why: Clear the Dependabot backlog. chore(deps): bump astro from 7.3.3 to 7.4.1 #105 was failing Vercel with exit 137.
  • Impact: Lockfile and package.json, src/content.config.ts, both OG endpoints, and CLAUDE.md.

12517d9 + 27caaf4: astro 7.3.3 → 7.4.1 (was #105)

astro 7.4.1 requires zod ^4.6.6, so a second zod copy (4.6.7) landed next to the root's 4.6.5. content.config.ts built its schema with the root copy, while astro:content types it against astro's copy. tsc then compared the two zod type trees structurally and ran out of V8 heap in astro check: about 2.5 GB locally, and exit 137 on Vercel. The fix imports z from astro/zod and drops the direct zod dependency, which nothing else used. Supersedes #93 (zod bump) as well.

da4536b: 10 low-risk bumps

Package From To Was
@astrojs/check 0.9.10 0.9.12 #104
@typescript-eslint/parser 8.70.0 8.72.0 #103
@iconify-json/logos 1.2.14 1.2.17 #102
unocss + @unocss/astro + @unocss/reset 66.10.5 66.11.0 #100
prettier 3.9.6 3.9.10 #96
vite 8.3.0 8.3.4 #95
globals 17.12.0 17.13.0 #90
sharp 0.35.4 0.35.5 #86

1d6ac34: prettier-plugin-astro 1.0.1 → 1.1.1 (was #101)

The tree needs no reformat. 1.1.1 fixes both 1.0.x bugs that CLAUDE.md told us to write around:

  • the non-idempotent wrapped self-closing <script />
  • upstream #487, where multi-line <style> comments drift in indentation

I reproduced both with probes on 1.0.1 (the comment indentation went 9 → 11 → 15 → 13 → 19 across runs) and checked that 1.1.1 is stable. The workaround paragraph is removed from CLAUDE.md.

a68740a: satori 0.33.4 → 0.63.2 (was #106)

satori 0.63 uses content-box sizing and resolves <p>'s default 1em margin against each element's own font size. With the existing template, the card overflowed the canvas, the avatar fell off the edge, and the text spread out. The fix sets box-sizing: border-box on the padded boxes and margin: 1rem 0 on each <p>.

🖼️ Visual Changes

  • Visual changes described in comments

OG images: I pixel-diffed all 56 OG PNGs before and after the satori bump.

  • 55 post images: text rows sit within 1px of their previous positions. About 1.5% of pixels differ, nearly all of it anti-aliasing on the drop-shadow edge.
  • default.png picks a random background colour on every build, so its diff is mostly colour. I checked its layout by eye.

Pages: I diffed all 215 HTML pages plus the XML feeds, main against this branch. After normalizing the things that change on every build anyway (random brutal-ui colours, font-fallback ids, asset hashes, the generator meta), one line differs across the whole site:

  • On /blog/on-falling-in-love-with-your-town/, the alt text Mt. Ranier from 6th &amp;amp; Veneta is now &amp;. Astro 7.3.3 escaped the & twice; 7.4.1 escapes it once, which is correct.

Two inline scripts, used site-wide, are minified differently by the newer bundler: an early return becomes a ternary in one and an else if in the other. I read both; they behave the same.

🧪 Testing

  • Tested locally with pnpm run dev
  • Built successfully with pnpm run build
  • Preview deployment looks good
  • No console errors
  • Mobile responsive (if UI changes)

I ran pnpm run build and pnpm run check on the tip from a clean pnpm install --frozen-lockfile: 215 pages, astro check reporting 0 errors, lint and format clean. CI's log shows the same Result (36 files): 0 errors, so the gate really ran there too. Peak build RSS is about 1.45 GB, against about 1.0 GB on main; @astrojs/check 0.9.12 brings in a heavier language server.

Watch out: if @astrojs/check fails to import, astro check offers to install it. With no TTY (CI, Vercel) it skips the offer and exits 0 without type-checking. Incremental pnpm add runs left @emnapi/core missing locally and caused exactly that. A clean install is fine, and CI and Vercel always install clean, but the build gate can be bypassed this way. A green build only means it type-checked if the log shows a Result (N files) line.

📚 Documentation

  • New features documented

CLAUDE.md drops the prettier-plugin-astro 1.0.x workaround note now that 1.1.1 fixes both bugs.

🔗 Related

✅ Checklist

  • Code follows project conventions
  • No linting errors
  • Preview deployment works correctly
  • Ready for review

The Vercel preview built and deployed successfully. Nobody has clicked through it, so "looks good" stays unchecked.

🤖 Generated with Claude Code

https://claude.ai/code/session_011rvCtaiKiC4ZSvX9yewguJ

dependabot Bot and others added 5 commits October 23, 2026 00:06
Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 7.3.3 to 7.4.1.
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/[email protected]/packages/astro)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 7.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
astro 7.4.1 requires zod ^4.6.6, so the lockfile resolved a second copy
(4.6.7) beside the root's 4.6.5. content.config.ts built its schema with
the root copy while astro:content types it against astro's, and tsc's
structural comparison of the two zod type trees exhausted the heap:
astro check OOM'd locally at ~2.5 GB and Vercel killed the build (137).

Take z from astro/zod so the schema always uses astro's own zod, and drop
the now-unused direct zod dependency. Peak RSS back to ~1 GB, matching
main.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_011rvCtaiKiC4ZSvX9yewguJ
@astrojs/check 0.9.12, @typescript-eslint/parser 8.72.0,
@iconify-json/logos 1.2.17, unocss + @unocss/astro + @unocss/reset
66.11.0, prettier 3.9.10, vite 8.3.4, globals 17.13.0, sharp 0.35.5.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_011rvCtaiKiC4ZSvX9yewguJ
… note

1.1.1 fixes both 1.0.x bugs CLAUDE.md told us to write around: a wrapped
self-closing <script /> now formats idempotently, and multi-line comments
in <style> no longer gain indentation every run (upstream #487). Verified
with probes that drift on 1.0.1 and are stable on 1.1.1. No reformat of
the tree needed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_011rvCtaiKiC4ZSvX9yewguJ
satori 0.63 sizes boxes as content-box and resolves <p>'s default 1em
margins against each element's font size. Under the old template that
pushed the card past the canvas edge (taking the avatar with it) and
spread the text out. Set box-sizing: border-box on the padded boxes and
margin: 1rem 0 on each <p>, which restores the 0.33 layout: all 55 post
images are within 1px of their previous text positions; the rest of the
pixel delta is drop-shadow anti-aliasing.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_011rvCtaiKiC4ZSvX9yewguJ
@vercel

vercel Bot commented Oct 23, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
ephbaumdotdev Ready Ready Preview Oct 23, 2026 12:20am UTC

@ephbaum
ephbaum merged commit 746b619 into main Oct 23, 2026
3 checks passed
@ephbaum
ephbaum deleted the claude/dependabot-rollup-oct branch October 23, 2026 03:12

This branch was successfully deployed

1 active deployment
Preview — a68740a6 Deployed Oct 23, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants