Bump astro and @astrojs/mdx

[dependabot]

Bumps astro and @astrojs/mdx. These dependencies needed to be updated together.
Updates astro from 5.18.1 to 7.3.2

Release notes

Sourced from astro's releases.

astro@7.3.2

Patch Changes

• #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

• #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

• #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

• #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

• Updated dependencies [a548223]:

  • @​astrojs/markdown-satteri@​0.4.1

astro@7.3.1

Patch Changes

• #17899 0389640 Thanks @​ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

astro@7.3.0

Minor Changes

• #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

  Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { LocalImageService } from 'astro';
  const service: LocalImageService = {
  // ...
  async transform(inputBuffer, transform, imageConfig, logger) {
  logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
  return { data: inputBuffer, format: 'png' };
  },
  };

  Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

  Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { CacheProvider } from 'astro';
  const provider: CacheProvider = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.2

Patch Changes

• #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

• #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

• #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

• #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

• Updated dependencies [a548223]:

  • @​astrojs/markdown-satteri@​0.4.1

7.3.1

Patch Changes

• #17899 0389640 Thanks @​ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

7.3.0

Minor Changes

• #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

  Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { LocalImageService } from 'astro';
  const service: LocalImageService = {
  // ...
  async transform(inputBuffer, transform, imageConfig, logger) {
  logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
  return { data: inputBuffer, format: 'png' };
  },
  };

  Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

  Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

... (truncated)

Commits

• aa4949e [ci] release (#17915)
• 42e9188 fix(i18n): replace locale segment by index in fallback routing (#17907) (#17908)
• 4b92ddc Guard setFetchHandler call in non-runnable dev entrypoint to fix sessions + m...
• c1a6a89 fix: include .astro files in client optimizeDeps entries to prevent 504 on la...
• a548223 Only treat literal script/style content as raw in MDX rendering (#17896)
• 92f23cc [ci] release (#17900)
• 0389640 fix: dont use internal paths (#17899)
• f800de1 [ci] release (#17881)
• 1e0b7e6 [ci] format
• 4671a5c chore(deps): update react to v19 in 0-css fixture (#17888)
• Additional commits viewable in compare view

Updates @astrojs/mdx from 4.3.14 to 8.0.1

Release notes

Sourced from @​astrojs/mdx's releases.

@​astrojs/mdx@​8.0.1

Patch Changes

• Updated dependencies [a548223]:
  • @​astrojs/markdown-satteri@​0.4.1

@​astrojs/mdx@​8.0.0

Major Changes

• #17262 f8e9458 Thanks @​Princesseuh! - Moves MDX file processing to the Markdown processors.

  '@​astrojs/mdx' is still required to add MDX support to your project. However, it now delegates the MDX files processing to Markdown processors.

  What should I do?

  If you haven't explicitly installed a Markdown processor, you don't need to do anything.

  Otherwise, ensure that your configured Markdown processor uses the following version:

  • @astrojs/markdown-satteri 0.4.0 or later if you use satteri()
  • @astrojs/markdown-remark 7.3.0 or later if you use unified()

Patch Changes

• #17262 f8e9458 Thanks @​Princesseuh! - Fixes .mdx files still using markdown.processor when extendMarkdownConfig is false. They now use a clean default processor instead; pass mdx({ processor }) to choose one explicitly.

• #17262 f8e9458 Thanks @​Princesseuh! - Adds a warning when the deprecated remarkPlugins, rehypePlugins, recmaPlugins and remarkRehype options are ignored because your Markdown processor does not run them. They still apply when your processor is unified(), and were previously dropped silently otherwise.

• Updated dependencies [f8e9458, f8e9458]:

  • @​astrojs/internal-helpers@​0.11.0
  • @​astrojs/markdown-satteri@​0.4.0

@​astrojs/mdx@​7.0.8

Patch Changes

• #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

• #17766 0762a83 Thanks @​HiDeoo! - Fixes Sätteri processor option types to accept all plugin entries supported by Sätteri v0.10.3.

@​astrojs/mdx@​7.0.7

Patch Changes

• #17731 bc171af Thanks @​Princesseuh! - Updates Sätteri processor to v0.10.3. See its changelog for details on bugs fixed and features added.

• Updated dependencies [05763a0]:

  • @​astrojs/internal-helpers@​0.10.4
  • @​astrojs/markdown-remark@​7.2.4

@​astrojs/mdx@​7.0.6

Patch Changes

... (truncated)

Changelog

Sourced from @​astrojs/mdx's changelog.

8.0.1

Patch Changes

• Updated dependencies [a548223]:
  • @​astrojs/markdown-satteri@​0.4.1

8.0.0

Major Changes

• #17262 f8e9458 Thanks @​Princesseuh! - Moves MDX file processing to the Markdown processors.

  '@​astrojs/mdx' is still required to add MDX support to your project. However, it now delegates the MDX files processing to Markdown processors.

  What should I do?

  If you haven't explicitly installed a Markdown processor, you don't need to do anything.

  Otherwise, ensure that your configured Markdown processor uses the following version:

  • @astrojs/markdown-satteri 0.4.0 or later if you use satteri()
  • @astrojs/markdown-remark 7.3.0 or later if you use unified()

Patch Changes

• #17262 f8e9458 Thanks @​Princesseuh! - Fixes .mdx files still using markdown.processor when extendMarkdownConfig is false. They now use a clean default processor instead; pass mdx({ processor }) to choose one explicitly.

• #17262 f8e9458 Thanks @​Princesseuh! - Adds a warning when the deprecated remarkPlugins, rehypePlugins, recmaPlugins and remarkRehype options are ignored because your Markdown processor does not run them. They still apply when your processor is unified(), and were previously dropped silently otherwise.

• Updated dependencies [f8e9458, f8e9458]:

  • @​astrojs/internal-helpers@​0.11.0
  • @​astrojs/markdown-satteri@​0.4.0

7.0.8

Patch Changes

• #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

• #17766 0762a83 Thanks @​HiDeoo! - Fixes Sätteri processor option types to accept all plugin entries supported by Sätteri v0.10.3.

7.0.7

Patch Changes

• #17731 bc171af Thanks @​Princesseuh! - Updates Sätteri processor to v0.10.3. See its changelog for details on bugs fixed and features added.

• Updated dependencies [05763a0]:

  • @​astrojs/internal-helpers@​0.10.4
  • @​astrojs/markdown-remark@​7.2.4

... (truncated)

Commits

• aa4949e [ci] release (#17915)
• a548223 Only treat literal script/style content as raw in MDX rendering (#17896)
• 2fdf731 [ci] release (#17849)
• bd7af0b chore(deps): update react to v19 in fixtures (#16905)
• f8e9458 feat: move MDX into the processors themselves (#17262)
• eb87a23 Escape set:text values in Astro JSX (#17847)
• d38ed60 [ci] release (#17753)
• 660991c Fix build error location reporting for MDX and aggregate plugin errors (#17757)
• 0762a83 fix: accept all sätteri plugin entry types (#17766)
• 8a31cba [ci] release (#17739)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Superseded by #2174.