chore(deps): bump the github-actions group with 4 updates by dependabot[bot] · Pull Request #1628 · Open-reSource/openresource.dev

dependabot · 2026-05-28T07:36:44Z

Bumps the github-actions group with 4 updates: astro, tsx, vercel and vitest.

Updates astro from 6.3.3 to 6.3.6

Release notes

astro@6.3.6

Patch Changes

#16774 8f77583 Thanks @astrobot-houston! - Fixes markdown images with empty alt text (![](https://github.com/withastro/astro/tree/HEAD/packages/astro/blob/HEAD/image.jpg)) in content collections dropping the alt attribute entirely. The alt="" attribute is now correctly preserved in the rendered HTML output, which is important for accessibility (indicating decorative images).

#16776 3d10b5e Thanks @matthewp! - Fixes HMR serving stale content when components are passed as props via getStaticPaths()

#16784 7453860 Thanks @ematipico! - Improved the printing of the build time if it goes over the 60 seconds.

#16665 3dbbcee Thanks @Princesseuh! - Fixes remote SVG sources erroring with dangerouslyProcessSVG after the v6.3 SVG-processing gate. The default Sharp service now resolves the output format from the source up-front when it can (URL extension, data: MIME, ESM metadata), and from the actual buffer at request time when it can't, so SVG sources pass through untouched without needing to set image.dangerouslyProcessSVG: true or an explicit format="svg".

The error message has also been updated to point at format="svg" as the simpler workaround when an SVG source is encountered without dangerouslyProcessSVG enabled.

#16777 1754b91 Thanks @matthewp! - Fixes HMR serving stale content for dynamically imported components through barrel files

#16730 068d924 Thanks @harshagarwalnyu! - Fixes an issue where the file() content loader did not generate a valid JSON Schema for collections whose JSON or YAML data is a top-level array instead of an object.

astro@6.3.5

Patch Changes

#16771 07c8805 Thanks @ematipico! - Fixes position prop on <Image> and <Picture> components breaking Content Security Policy (CSP).

#16593 50924ce Thanks @yanthomasdev! - Improves error messages with more consistent and correct writing.

#16757 5d661cd Thanks @astrobot-houston! - Fixes dev server serving stale content when SSR-only modules change (e.g. .astro files outside the project root in a monorepo, or dynamically imported components).

Previously, the astro:hmr-reload plugin returned an empty array after detecting SSR-only module changes, which prevented Vite's updateModules from propagating the invalidation to the SSR module runner. The runner's evaluated module cache stayed stale, so subsequent requests continued returning old content.

Now the plugin returns the SSR-only modules so Vite can process them through updateModules, which properly invalidates the module runner's cache and ensures fresh content on the next request.

astro@6.3.4

Patch Changes
#16723 0f10bfe Thanks @matthewp! - Adds fetchFile option to experimental.advancedRouting to customize or disable the entrypoint file
export default defineConfig({
  experimental: {
    advancedRouting: {
      fetchFile: 'fetch.ts',
    },
  },
});
#16723 0f10bfe Thanks @matthewp! - Fixes Hono cache() middleware to follow the standard wrapper pattern
#16723 0f10bfe Thanks @matthewp! - Adds App.Providers interface for typing custom context providers on Astro and ctx

... (truncated)

Changelog

Sourced from astro's changelog.

6.3.6

Patch Changes

#16774 8f77583 Thanks @astrobot-houston! - Fixes markdown images with empty alt text (![](https://github.com/withastro/astro/blob/main/packages/astro/image.jpg)) in content collections dropping the alt attribute entirely. The alt="" attribute is now correctly preserved in the rendered HTML output, which is important for accessibility (indicating decorative images).

#16776 3d10b5e Thanks @matthewp! - Fixes HMR serving stale content when components are passed as props via getStaticPaths()

#16784 7453860 Thanks @ematipico! - Improved the printing of the build time if it goes over the 60 seconds.

#16665 3dbbcee Thanks @Princesseuh! - Fixes remote SVG sources erroring with dangerouslyProcessSVG after the v6.3 SVG-processing gate. The default Sharp service now resolves the output format from the source up-front when it can (URL extension, data: MIME, ESM metadata), and from the actual buffer at request time when it can't, so SVG sources pass through untouched without needing to set image.dangerouslyProcessSVG: true or an explicit format="svg".

The error message has also been updated to point at format="svg" as the simpler workaround when an SVG source is encountered without dangerouslyProcessSVG enabled.

#16777 1754b91 Thanks @matthewp! - Fixes HMR serving stale content for dynamically imported components through barrel files

#16730 068d924 Thanks @harshagarwalnyu! - Fixes an issue where the file() content loader did not generate a valid JSON Schema for collections whose JSON or YAML data is a top-level array instead of an object.

6.3.5

Patch Changes

#16771 07c8805 Thanks @ematipico! - Fixes position prop on <Image> and <Picture> components breaking Content Security Policy (CSP).

#16593 50924ce Thanks @yanthomasdev! - Improves error messages with more consistent and correct writing.

#16757 5d661cd Thanks @astrobot-houston! - Fixes dev server serving stale content when SSR-only modules change (e.g. .astro files outside the project root in a monorepo, or dynamically imported components).

Previously, the astro:hmr-reload plugin returned an empty array after detecting SSR-only module changes, which prevented Vite's updateModules from propagating the invalidation to the SSR module runner. The runner's evaluated module cache stayed stale, so subsequent requests continued returning old content.

Now the plugin returns the SSR-only modules so Vite can process them through updateModules, which properly invalidates the module runner's cache and ensures fresh content on the next request.

6.3.4

Patch Changes
#16723 0f10bfe Thanks @matthewp! - Adds fetchFile option to experimental.advancedRouting to customize or disable the entrypoint file
export default defineConfig({
  experimental: {
    advancedRouting: {
      fetchFile: 'fetch.ts',
    },
  },
});
#16723 0f10bfe Thanks @matthewp! - Fixes Hono cache() middleware to follow the standard wrapper pattern

... (truncated)

Commits

223a843 [ci] release (#16775)
e4bce73 [ci] format
1754b91 Invalidate importer modules in runner cache during HMR (#16777)
3d10b5e Invalidate route cache when module identity changes after HMR (#16776)
7453860 fix: build times timestamp (#16784)
3dbbcee fix(sharp): handle default formats differently (#16665)
068d924 fix(content): generate anyOf schema for file() loader to support top-level ar...
8f77583 fix(content): preserve empty alt attributes on markdown images in content col...
5b4122e [ci] release (#16772)
5d661cd Fix dev server serving stale content for files outside project root (#16757)
Additional commits viewable in compare view

Updates tsx from 4.22.1 to 4.22.3

Release notes

Sourced from tsx's releases.

v4.22.3

4.22.3 (2026-05-19)

Bug Fixes

decode typed loader source (dce02fc)

preserve entrypoint with TypeScript preload hooks (68f72f3)

This release is also available on:

npm package (@latest dist-tag)

v4.22.2

4.22.2 (2026-05-18)

Bug Fixes

preserve CJS JSON require in ESM hooks (35b700b)

preserve named exports from CommonJS TypeScript (11de737)

support module.exports require(esm) interop (cf8f199)

This release is also available on:

npm package (@latest dist-tag)

Commits

dce02fc fix: decode typed loader source
68f72f3 fix: preserve entrypoint with TypeScript preload hooks
69455cf test: cover package exports for ambiguous ESM reexports
35b700b fix: preserve CJS JSON require in ESM hooks
ef807db chore: update testing dependencies
3917090 test: document compatibility test taxonomy
de8113f refactor: centralize Node capability facts
c1f62db test: consolidate tsconfig path edge coverage
4e08174 test: consolidate loader hook coverage
674bb30 test: consolidate tsImport commonjs mts coverage
Additional commits viewable in compare view

Updates vercel from 54.1.0 to 54.2.0

Release notes

Sourced from vercel's releases.

vercel@54.2.0

Minor Changes

39850ef: Add vercel connect update <id> subcommand to change connector branding. Accepts --icon (PNG or JPEG path, uploaded to Vercel and sent as SHA-1), --background-color, and --accent-color (both #RRGGBB). Gated behind the existing FF_CONNEX_ENABLED flag.

63a66d4: Add --icon, --background-color, and --accent-color flags to vercel connect create. The icon is uploaded to Vercel before the connector is created. When the API requires a browser registration step, branding is appended to the dashboard URL so the create form can prefill itself; the CLI also applies a follow-up PATCH after the browser flow as a safety net for the dashboard rollout. Gated behind the existing FF_CONNEX_ENABLED flag.

137e5d1: Allow builder V2 to expose startDevServer.

b1aa926: [vc dev] handle process errors in dev server

Patch Changes

a3a1a5a: Added CLI eval support for comparable agent/model experiment runs and restored transcript artifact uploads via chunked result ingestion.

18e9fd6: fix(cli): point vc connect open and registration error URLs at the renamed /connect dashboard route

4118600: Fix standalone CLI binary latest-version worker startup.

80e8e06: Track Vercel plugin active-session markers in CLI telemetry.

bb61428: Include framework slug in output/config.json

f45e466: Add opt-in automatic CLI updates via vercel upgrade --enable-auto and prompt users to enable them after a successful manual upgrade.

a3a1a5a: Add offline-friendly local modes for CLI eval discovery and dashboard fixture generation, and expand Vercel CLI eval coverage for project, list, inspect, logs, and pull commands.

a3a1a5a: Relaxed the CLI env/add eval grader to accept equivalent JSON format syntax and shell-variable env names when outputs prove the variable was added.

a3a1a5a: Simplified the implicit curl eval grader to only require that the agent ran vercel curl or vc curl.

8fb4dc8: Add vercel flags split to configure weighted Vercel Flags splits from the CLI.

Configure a split interactively by letting the CLI prompt for the environment, bucketing attribute, weights, fallback variant, and revision message. vercel flags split welcome-message

Configure a boolean flag split in production with 95/5 traffic. vercel flags split redesigned-checkout --environment production --by user.userId --weight off=95 --weight on=5

Configure a string flag split with an explicit fallback variant. vercel flags split welcome-message -e production --by user.userId --default-variant control --weight control=90 --weight treatment=10

Exclude a variant from receiving traffic by setting its weight to 0. vercel flags split checkout-copy -e preview --by user.userId --default-variant control --weight control=50 --weight treatment=50 --weight legacy=0

Updated dependencies [bb61428]

Updated dependencies [137e5d1]

Updated dependencies [f45e466]

Updated dependencies [744e96c]

... (truncated)

Changelog

Sourced from vercel's changelog.

54.2.0

Minor Changes

39850ef: Add vercel connect update <id> subcommand to change connector branding. Accepts --icon (PNG or JPEG path, uploaded to Vercel and sent as SHA-1), --background-color, and --accent-color (both #RRGGBB). Gated behind the existing FF_CONNEX_ENABLED flag.

63a66d4: Add --icon, --background-color, and --accent-color flags to vercel connect create. The icon is uploaded to Vercel before the connector is created. When the API requires a browser registration step, branding is appended to the dashboard URL so the create form can prefill itself; the CLI also applies a follow-up PATCH after the browser flow as a safety net for the dashboard rollout. Gated behind the existing FF_CONNEX_ENABLED flag.

137e5d1: Allow builder V2 to expose startDevServer.

b1aa926: [vc dev] handle process errors in dev server

Patch Changes

a3a1a5a: Added CLI eval support for comparable agent/model experiment runs and restored transcript artifact uploads via chunked result ingestion.

18e9fd6: fix(cli): point vc connect open and registration error URLs at the renamed /connect dashboard route

4118600: Fix standalone CLI binary latest-version worker startup.

80e8e06: Track Vercel plugin active-session markers in CLI telemetry.

bb61428: Include framework slug in output/config.json

f45e466: Add opt-in automatic CLI updates via vercel upgrade --enable-auto and prompt users to enable them after a successful manual upgrade.

a3a1a5a: Add offline-friendly local modes for CLI eval discovery and dashboard fixture generation, and expand Vercel CLI eval coverage for project, list, inspect, logs, and pull commands.

a3a1a5a: Relaxed the CLI env/add eval grader to accept equivalent JSON format syntax and shell-variable env names when outputs prove the variable was added.

a3a1a5a: Simplified the implicit curl eval grader to only require that the agent ran vercel curl or vc curl.

8fb4dc8: Add vercel flags split to configure weighted Vercel Flags splits from the CLI.

Configure a split interactively by letting the CLI prompt for the environment, bucketing attribute, weights, fallback variant, and revision message. vercel flags split welcome-message

Configure a boolean flag split in production with 95/5 traffic. vercel flags split redesigned-checkout --environment production --by user.userId --weight off=95 --weight on=5

Configure a string flag split with an explicit fallback variant. vercel flags split welcome-message -e production --by user.userId --default-variant control --weight control=90 --weight treatment=10

Exclude a variant from receiving traffic by setting its weight to 0. vercel flags split checkout-copy -e preview --by user.userId --default-variant control --weight control=50 --weight treatment=50 --weight legacy=0

Updated dependencies [bb61428]

Updated dependencies [137e5d1]

Updated dependencies [f45e466]

Updated dependencies [744e96c]

Updated dependencies [7923d34]

@vercel/build-utils@13.26.0

@vercel/next@4.17.2

@vercel/cli-config@0.1.2

@vercel/remix-builder@5.8.2

@vercel/static-build@2.9.28

@vercel/backends@0.7.1

@vercel/elysia@0.1.79

@vercel/express@0.1.89

@vercel/fastify@0.1.82

@vercel/go@3.7.0

@vercel/h3@0.1.88

... (truncated)

Commits

75ad9c6 Version Packages (#16342)
63a66d4 [cli] Add icon + colors to vercel connect create (#16345)
bb61428 Include framework slug in output/config.json (#16357)
137e5d1 [services] Allow builder V2 to expose startDevServer. (#16336)
f45e466 [CLI] adding auto updating feature (#16347)
80e8e06 [CLI] Adding telemetry matching with active plugin sessions (#16346)
18e9fd6 [vercel-cli] Rename dashboard URL in vc connex open: /connex → /connect (#16291)
8fb4dc8 Add Vercel Flags split command (#16317)
4118600 [FIX] Fixing a single deployment error (#16351)
39850ef [cli] Add vercel connect update subcommand (#16337)
Additional commits viewable in compare view

Updates vitest from 4.1.6 to 4.1.7

Release notes

Sourced from vitest's releases.

v4.1.7

🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

View changes on GitHub

Commits

a09d472 chore: release v4.1.7
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 4 updates: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro), [tsx](https://github.com/privatenumber/tsx), [vercel](https://github.com/vercel/vercel/tree/HEAD/packages/cli) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Updates `astro` from 6.3.3 to 6.3.6 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@6.3.6/packages/astro) Updates `tsx` from 4.22.1 to 4.22.3 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.22.1...v4.22.3) Updates `vercel` from 54.1.0 to 54.2.0 - [Release notes](https://github.com/vercel/vercel/releases) - [Changelog](https://github.com/vercel/vercel/blob/main/packages/cli/CHANGELOG.md) - [Commits](https://github.com/vercel/vercel/commits/vercel@54.2.0/packages/cli) Updates `vitest` from 4.1.6 to 4.1.7 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.7/packages/vitest) --- updated-dependencies: - dependency-name: astro dependency-version: 6.3.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: tsx dependency-version: 4.22.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: vercel dependency-version: 54.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: vitest dependency-version: 4.1.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-05-28T07:36:47Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openresource-dev	Ready	Preview, Comment	May 28, 2026 7:37am

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 28, 2026

vercel Bot deployed to Preview May 28, 2026 07:37 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the github-actions group with 4 updates#1628

chore(deps): bump the github-actions group with 4 updates#1628
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/github-actions-7ec4c3a108

dependabot Bot commented on behalf of github May 28, 2026

Uh oh!

vercel Bot commented May 28, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 28, 2026

astro@6.3.6

Patch Changes

astro@6.3.5

Patch Changes

astro@6.3.4

Patch Changes

6.3.6

Patch Changes

6.3.5

Patch Changes

6.3.4

Patch Changes

v4.22.3

4.22.3 (2026-05-19)

Bug Fixes

v4.22.2

4.22.2 (2026-05-18)

Bug Fixes

vercel@54.2.0

Minor Changes

Patch Changes

54.2.0

Minor Changes

Patch Changes

v4.1.7

🐞 Bug Fixes

View changes on GitHub

Uh oh!

vercel Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

vercel Bot commented May 28, 2026 •

edited

Loading