Skip to content

Bump astro from 6.4.8 to 7.1.1 - #44

Open
dependabot[bot] wants to merge 4 commits into
masterfrom
dependabot/npm_and_yarn/astro-7.1.1
Open

Bump astro from 6.4.8 to 7.1.1#44
dependabot[bot] wants to merge 4 commits into
masterfrom
dependabot/npm_and_yarn/astro-7.1.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown
Contributor

Bumps astro from 6.4.8 to 7.1.1.

Release notes

Sourced from astro's releases.

astro@7.1.1

Patch Changes

astro@7.1.0

Minor Changes

  • #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

    // src/content.config.ts
    import { defineCollection } from 'astro:content';
    import { glob } from 'astro/loaders';
    const docs = defineCollection({
    loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
    });

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

  • #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

    Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

    // astro.config.mjs
    import { defineConfig } from 'astro/config';
    export default defineConfig({
    experimental: {
    collectionStorage: 'chunked',
    },
    });

    Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

  • #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

    Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

    Scoping sources and hashes in your config

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.1

Patch Changes

7.1.0

Minor Changes

  • #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

    // src/content.config.ts
    import { defineCollection } from 'astro:content';
    import { glob } from 'astro/loaders';
    const docs = defineCollection({
    loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
    });

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

  • #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

    Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

    // astro.config.mjs
    import { defineConfig } from 'astro/config';
    export default defineConfig({
    experimental: {
    collectionStorage: 'chunked',
    },
    });

    Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

  • #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

    Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

cbroker1 and others added 4 commits August 23, 2026 18:34
…nel (#43)

* Add browser-local RAG assistant ("Ask about Carl")

A recruiter-facing assistant on every page that answers from this site's own
content, with retrieval and inference running entirely in the visitor's browser.
No backend, no APIs, no analytics.

Pipeline: question -> BM25F retrieval over a build-time corpus -> grounding gate
-> local model writes prose -> source links rendered from retrieval metadata.
The model only turns passages into sentences; it never decides whether an answer
exists and never produces a link.

Grounding:
- Approved sources are declared in one place, the header of
  src/pages/assistant/corpus.json.ts. Nothing is crawled.
- A question whose subject is absent from the corpus is declined by name before
  any model runs.
- URLs, citations and addresses not present in the evidence are stripped in code.

Model: Qwen3-0.6B q4f16 on WebGPU (~580 MB, cached). Chosen by measurement --
SmolLM2-360M contradicted its own evidence, and Qwen2.5-0.5B invented a project
name, a definition and a framework. Falls back to quoting the closest passage
when WebGPU, fp16 shaders or an unmetered connection are unavailable.

Cost to a visitor who never opens it: ~5.4 KB gzipped and zero requests. The
corpus, retriever and runtime are dynamically imported on first intent.

Checks: npm run assistant:eval (25 retrieval cases), assistant:test (controller,
grounding gate, and a provenance check asserting every word in the corpus comes
from an approved source file).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Fix assistant model loading, launcher icon, and input collapse

The local model never loaded for anyone. Loading transformers.js from
jsDelivr's raw dist path threw before a single model byte was fetched:

  TypeError: Failed to resolve module specifier "onnxruntime-web/webgpu"

The published dist/transformers.web.min.js keeps a bare import specifier that a
browser cannot resolve without an import map. Switched to jsDelivr's `+esm`
build, which rewrites those specifiers to absolute URLs. Verified end to end in
headless Chrome: import, ONNX session creation, and generation all succeed.

Also:
- Launcher icon now fills the button, leaving a hairline of white, and reads as
  a swept three-blade propeller rather than petals.
- The input could collapse to nothing. The autosizer ran while the panel was
  still display:none, where scrollHeight is 0, and wrote that back as a height —
  pushing the placeholder out of view. Added a CSS one-line floor, a guard for
  the unmeasurable case, and a re-measure when the panel opens.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Add a reset control to the assistant panel

Clears the conversation and returns the panel to exactly how it looks on first
open — intro text and suggestion chips included, by re-inserting a clone of the
empty state captured at mount. Any in-flight generation is aborted, and the
status line confirms the clear before handing back to the real model status.

The button sits beside the close control and only appears once there is
something to clear, so it is never a dead affordance.

Two bugs surfaced while verifying this, both of which affected desktop:

- Autofocus on open was gated on `pointer: fine`, which is false on any device
  with no pointing device at all, not just touch. Now gated on `pointer: coarse`
  so only a touch keyboard is spared.
- The layout flush that `resizeInput` performs has to happen before focusing:
  focusing an element the browser still considers unrendered silently no-ops.

Adds scripts/drive-assistant.mjs, which drives the real panel in headless Chrome
over the DevTools Protocol and asserts open, ask, sources, reset and close.
Dependency-free — Node's built-in fetch and WebSocket. Screenshots did not catch
either bug above; this does.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Upgrade assistant model from Qwen3-0.6B to Qwen3-1.7B

- 1.7B model has real reasoning capacity for multi-turn context
- Download size: ~1.4 GB (up from ~580 MB)
- Relocate assistant modules from src/lib/assistant/ to src/assistant/
- Update banner text to 'the wait is worth it'
- Update model labels throughout UI

* Revert model back to Qwen3-0.6B — 1.7B download too slow for testing

* feat: swap assistant from local ONNX to server-side llama.cpp via funnel

- Add server-engine.ts: OpenAI-compatible SSE streaming client for the
  llama.cpp funnel API
- Wire server engine into controller.ts with local ONNX fallback
- Pass funnel URL/model via data attributes from Astro component
- Add VITE_ASSISTANT_FUNNEL_URL and VITE_ASSISTANT_MODEL env vars
- Update banner text to show Qwen3.6-35B-A3B-MTP · llama.cpp
- Server engine is preferred; local ONNX drops to fallback on failure

* chore: pass assistant funnel URL/model as secrets in deploy workflow

* feat: add API key authentication for llama.cpp funnel

- Add --api-key to llama.cpp startup script
- Add LLAMA_API_KEY env file for systemd service
- Server engine sends Authorization: Bearer header
- Add VITE_ASSISTANT_API_KEY env var to Astro config
- Pass API key through data attributes (component → ui → controller)
- Add ASSISTANT_API_KEY secret to deploy workflow
- GitHub secret already configured

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Bumps [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) from 6.4.8 to 7.1.1.
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.1/packages/astro)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 7.1.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 23, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor Author

A newer version of astro exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant