chore(deps): bump the docs group across 1 directory with 5 updates

[dependabot]

Bumps the docs group with 5 updates in the /docs/web directory:

Package	From	To
@astrojs/markdown-satteri	0.3.8	0.4.1
@astrojs/starlight	0.41.9	0.42.0
astro	7.2.8	7.3.2
cytoscape	3.34.2	3.34.3
@playwright/test	1.62.1	1.63.0

Updates @astrojs/markdown-satteri from 0.3.8 to 0.4.1

Release notes

Sourced from @​astrojs/markdown-satteri's releases.

@​astrojs/markdown-satteri@​0.4.1

Patch Changes

• #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

@​astrojs/markdown-satteri@​0.4.0

Minor Changes

• #17262 f8e9458 Thanks @​Princesseuh! - Adds MDX rendering to the unified() and satteri() processors.

  Both processors now compile .mdx files themselves. You still need to install @astrojs/mdx to add MDX support to your project.

Patch Changes

• Updated dependencies [f8e9458]:
  • @​astrojs/internal-helpers@​0.11.0

Changelog

Sourced from @​astrojs/markdown-satteri's changelog.

0.4.1

Patch Changes

• #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

0.4.0

Minor Changes

• #17262 f8e9458 Thanks @​Princesseuh! - Adds MDX rendering to the unified() and satteri() processors.

  Both processors now compile .mdx files themselves. You still need to install @astrojs/mdx to add MDX support to your project.

Patch Changes

• Updated dependencies [f8e9458]:
  • @​astrojs/internal-helpers@​0.11.0

Commits

• aa4949e [ci] release (#17915)
• a548223 Only treat literal script/style content as raw in MDX rendering (#17896)
• 2fdf731 [ci] release (#17849)
• f8e9458 feat: move MDX into the processors themselves (#17262)
• See full diff in compare view

Updates @astrojs/starlight from 0.41.9 to 0.42.0

Release notes

Sourced from @​astrojs/starlight's releases.

@​astrojs/starlight@​0.42.0

Minor Changes

• #3572 292fb17 Thanks @​HiDeoo! - Distributes package as JavaScript files with dedicated type declaration files instead of TypeScript source files.

• #4121 2623ae6 Thanks @​delucis! - Simplifies markup for Starlight’s mobile menu toggle

  ⚠️ Potentially breaking change: If you use a theme plugin, custom styles, or component overrides targeting the MobileMenuToggle button or PageFrame components, you may need to adjust these for the new markup. The button is no longer wrapped in a <starlight-menu-button> custom element and no longer uses the aria-expanded attribute. Instead, you can use the .sl-menu-button class name to target the button and the :popover-open pseudo-class to style the menu open state specifically.

  In the following example, custom styles for the menu button are updated for the new approach:

  - starlight-menu-button button {
  + .sl-menu-button {
    color: var(--sl-color-text);
  }
  
  starlight-menu-button[aria-expanded='true'] button {
  
  
  .sl-menu-button:has(~ :popover-open) {
  color: var(--sl-color-text-accent-high);
  }

See MobileMenuToggle.astro and PageFrame.astro on GitHub for the full source code of the updated components.

#3572 292fb17 Thanks @​HiDeoo! - Removes the tagline configuration option, which was never used.

If your configuration included a tagline option, you can safely remove it without any replacement.

#4134 6135f01 Thanks @​HiDeoo! - Updates internal @astrojs/mdx, @astrojs/markdown-satteri, and satteri dependencies.

⚠️ BREAKING CHANGE: The following minimum versions are now required:

• astro v7.2.10 or later
• @astrojs/markdown-satteri 0.4.0 or later (if you use it)
• @astrojs/markdown-remark 7.3.0 or later (if you use it)

Please update Starlight and Astro together:

npx @astrojs/upgrade

#4121 2623ae6 Thanks @​delucis! - Refactors Starlight’s mobile menu toggle to work when JavaScript fails or is disabled

⚠️ BREAKING CHANGE: This release drops official support for Chromium-based browsers prior to version 116 (released August 2023), Safari-based browsers prior to version 17.0 (released September 2023), and Firefox prior to version 125 (released April 2024). You can find a list of currently supported browsers and their versions using this browserslist query.

This change also removes the data-mobile-menu-expanded attribute, which was previously added to <body> while the mobile menu is open. If you have custom code that was depending on this attribute, you will need to update it to use a new selector to check if the mobile menu is open.

In the following example, a custom background colour for the site header while the menu is open is updated for the new approach:

... (truncated)

Changelog

Sourced from @​astrojs/starlight's changelog.

0.42.0

Minor Changes

• #3572 292fb17 Thanks @​HiDeoo! - Distributes package as JavaScript files with dedicated type declaration files instead of TypeScript source files.

• #4121 2623ae6 Thanks @​delucis! - Simplifies markup for Starlight’s mobile menu toggle

  ⚠️ Potentially breaking change: If you use a theme plugin, custom styles, or component overrides targeting the MobileMenuToggle button or PageFrame components, you may need to adjust these for the new markup. The button is no longer wrapped in a <starlight-menu-button> custom element and no longer uses the aria-expanded attribute. Instead, you can use the .sl-menu-button class name to target the button and the :popover-open pseudo-class to style the menu open state specifically.

  In the following example, custom styles for the menu button are updated for the new approach:

  - starlight-menu-button button {
  + .sl-menu-button {
    color: var(--sl-color-text);
  }
  
  starlight-menu-button[aria-expanded='true'] button {
  
  
  .sl-menu-button:has(~ :popover-open) {
  color: var(--sl-color-text-accent-high);
  }

See MobileMenuToggle.astro and PageFrame.astro on GitHub for the full source code of the updated components.

#3572 292fb17 Thanks @​HiDeoo! - Removes the tagline configuration option, which was never used.

If your configuration included a tagline option, you can safely remove it without any replacement.

#4134 6135f01 Thanks @​HiDeoo! - Updates internal @astrojs/mdx, @astrojs/markdown-satteri, and satteri dependencies.

⚠️ BREAKING CHANGE: The following minimum versions are now required:

• astro v7.2.10 or later
• @astrojs/markdown-satteri 0.4.0 or later (if you use it)
• @astrojs/markdown-remark 7.3.0 or later (if you use it)

Please update Starlight and Astro together:

npx @astrojs/upgrade

#4121 2623ae6 Thanks @​delucis! - Refactors Starlight’s mobile menu toggle to work when JavaScript fails or is disabled

⚠️ BREAKING CHANGE: This release drops official support for Chromium-based browsers prior to version 116 (released August 2023), Safari-based browsers prior to version 17.0 (released September 2023), and Firefox prior to version 125 (released April 2024). You can find a list of currently supported browsers and their versions using this browserslist query.

This change also removes the data-mobile-menu-expanded attribute, which was previously added to <body> while the mobile menu is open. If you have custom code that was depending on this attribute, you will need to update it to use a new selector to check if the mobile menu is open.

... (truncated)

Commits

• 88ad3c2 [ci] release (#4172)
• 74cb3f1 Update dependencies (#4173)
• 6135f01 Use Sätteri 0.10 APIs (#4134)
• 2623ae6 Refactor mobile menu to use Popover API (#4121)
• 09af1c6 chore(deps): update magic-string to v1 (#4082)
• 292fb17 [i18nIgnore] Transpile Starlight packages (#3572)
• 0138f22 [ci] release (#4169)
• 32a5e29 Fix hidden heading anchor links (#4167)
• cdfafd8 perf: optimize route and sidebar lookups (#4148)
• dd7fb97 chore: add benchmarks (#4157)
• Additional commits viewable in compare view

Updates astro from 7.2.8 to 7.3.2

Release notes

Sourced from astro's releases.

astro@7.3.2

Patch Changes

• #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

• #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

• #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

• #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

• Updated dependencies [a548223]:

  • @​astrojs/markdown-satteri@​0.4.1

astro@7.3.1

Patch Changes

• #17899 0389640 Thanks @​ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

astro@7.3.0

Minor Changes

• #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

  Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { LocalImageService } from 'astro';
  const service: LocalImageService = {
  // ...
  async transform(inputBuffer, transform, imageConfig, logger) {
  logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
  return { data: inputBuffer, format: 'png' };
  },
  };

  Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

  Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { CacheProvider } from 'astro';
  const provider: CacheProvider = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.2

Patch Changes

• #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

• #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

• #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

• #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

• Updated dependencies [a548223]:

  • @​astrojs/markdown-satteri@​0.4.1

7.3.1

Patch Changes

• #17899 0389640 Thanks @​ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

7.3.0

Minor Changes

• #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

  Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { LocalImageService } from 'astro';
  const service: LocalImageService = {
  // ...
  async transform(inputBuffer, transform, imageConfig, logger) {
  logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
  return { data: inputBuffer, format: 'png' };
  },
  };

  Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

  Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

... (truncated)

Commits

• aa4949e [ci] release (#17915)
• 42e9188 fix(i18n): replace locale segment by index in fallback routing (#17907) (#17908)
• 4b92ddc Guard setFetchHandler call in non-runnable dev entrypoint to fix sessions + m...
• c1a6a89 fix: include .astro files in client optimizeDeps entries to prevent 504 on la...
• a548223 Only treat literal script/style content as raw in MDX rendering (#17896)
• 92f23cc [ci] release (#17900)
• 0389640 fix: dont use internal paths (#17899)
• f800de1 [ci] release (#17881)
• 1e0b7e6 [ci] format
• 4671a5c chore(deps): update react to v19 in 0-css fixture (#17888)
• Additional commits viewable in compare view

Updates cytoscape from 3.34.2 to 3.34.3

Release notes

Sourced from cytoscape's releases.

v3.34.3

Release version v3.34.3

Commits

• 716a1cb 3.34.3
• 367caa6 Build 3.34.3
• 22d297e Docs: Add 3.34.3 to versions.json
• bd81234 Cherry pick to master: Merge pull request #3515 from sera-wi/feat/multiclickd...
• See full diff in compare view

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions