chore(deps): bump astro from 7.0.6 to 7.1.0 in the npm_and_yarn group across 1 directory

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: astro.

Updates astro from 7.0.6 to 7.1.0

Release notes

Sourced from astro's releases.

astro@7.1.0

Minor Changes

• #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

  When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

  This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

  // src/content.config.ts
  import { defineCollection } from 'astro:content';
  import { glob } from 'astro/loaders';
  const docs = defineCollection({
  loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
  });

  By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

• #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

  By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

  Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  experimental: {
  collectionStorage: 'chunked',
  },
  });

  Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

• #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

  Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

  Scoping sources and hashes in your config

  Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.

  // astro.config.mjs

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.0

Minor Changes

• #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

  When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

  This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

  // src/content.config.ts
  import { defineCollection } from 'astro:content';
  import { glob } from 'astro/loaders';
  const docs = defineCollection({
  loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
  });

  By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

• #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

  By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

  Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  experimental: {
  collectionStorage: 'chunked',
  },
  });

  Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

• #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

  Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

  Scoping sources and hashes in your config

  Each entry in resources and hashes can be an object with a kind property. Depending on whether you use scriptDirective or styleDirective, "element" targets script-src-elem or style-src-elem, "attribute" targets script-src-attr or style-src-attr, and "default" (the same as a bare string or hash) targets script-src or style-src.

... (truncated)

Commits

• fdd673c [ci] release (#17387)
• d9f99e1 Preserve CSP resource defaults for element directives (#17394)
• 092da56 Add more escaping for rendered content (#17393)
• 186a1e7 fix(logger): allows setting in updateConfig() (#17391)
• 4407483 fix(logger): use console API in JSON logger for cross-runtime compatibility...
• 16de021 feat(logger): allow passing entrypoint as URL (#17389)
• ed71eaf fix(logger): make AstroLoggerDestination not generic (#17390)
• 30698a2 feat: chunk data store (#17296)
• 44c4989 feat(csp): support for -elem and -attr directives (#17214)
• 7db6420 Add --ignore-lock flag to run multiple dev servers (#17331)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
steipete-me	Ready	Preview, Comment	Jul 27, 2026 10:53am

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 22, 2026, 4:38 AM ET / 08:38 UTC.

Summary
The branch raises the direct astro dependency from ^7.0.6 to ^7.1.0 and refreshes the corresponding pnpm dependency resolutions.

Reproducibility: not applicable. this is a dependency-maintenance PR rather than a report of broken existing behavior; the relevant validation is an after-update build and preview smoke check.

Review metrics: 2 noteworthy metrics.

• Changed surface: 2 files affected; 1 direct production dependency changed. The code change is intentionally narrow, while the lockfile carries the transitive resolution update.
• Lockfile resolution: 645 added, 273 removed lines. The Astro update also resolves newer transitive Vite and Terser packages, so compatibility should be confirmed beyond manifest inspection.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P1] Add a redacted pnpm run build transcript or preview smoke result from the updated dependency graph.
• After adding proof, update the PR body for a fresh ClawSweeper review; if it does not trigger, ask a maintainer to comment @clawsweeper re-review.

Proof guidance:

• [P1] Needs real behavior proof before merge: The PR body and discussion contain no contributor-provided after-update runtime evidence; CI and the Vercel deployment are supplemental only. Add a redacted fresh build transcript or deployed-preview smoke result, then update the PR body for re-review.

Risk before merge

• [P1] Astro 7.1.0 changes the resolved dependency graph substantially (916 lockfile lines), so green automation does not fully establish fresh-install and production-preview compatibility for this site’s MDX, PWA, and Vite integrations.

Maintainer options:

1. Add an after-update smoke result (recommended)
   Provide a redacted fresh build transcript or preview smoke result covering the rendered site after installing the updated lockfile, then proceed with ordinary maintainer merge review.
2. Accept CI-only evidence
   A maintainer may merge based on the successful build, lint, security, and Vercel preview checks while accepting that no contributor-run runtime evidence was supplied.

Next step before merge

• [P2] This clean, current Dependabot update needs contributor runtime evidence and ordinary maintainer acceptance, not an automated code repair.

Security
Cleared: The diff updates an existing registry dependency and lockfile only; it adds no scripts, workflows, permissions, dependency sources, or package lifecycle hooks.

Review details

Best possible solution:

Retain the narrow Dependabot update after a fresh pnpm run build or deployed-preview smoke result confirms the configured site renders and its PWA integration remains healthy.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-maintenance PR rather than a report of broken existing behavior; the relevant validation is an after-update build and preview smoke check.

Is this the best way to solve the issue?

Yes, conditionally: a direct manifest bump plus regenerated lockfile is the narrow maintainable path, provided runtime behavior is confirmed in this site’s actual Astro configuration.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning high; reviewed against c8bb7c663917.

Label changes

Label changes:

• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🧂 unranked krab, so this older rating label is no longer current.

Label justifications:

• P3: This is a routine dependency-maintenance update with successful automated checks and no reported production regression.
• merge-risk: 🚨 compatibility: Updating the site’s direct framework dependency and 916-line lockfile resolution can affect existing build, rendering, and integration behavior on upgrade.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body and discussion contain no contributor-provided after-update runtime evidence; CI and the Vercel deployment are supplemental only. Add a redacted fresh build transcript or deployed-preview smoke result, then update the PR body for re-review.

Evidence reviewed

What I checked:

• Focused dependency diff: The proposed branch changes only the direct Astro version and its generated pnpm resolution graph; it does not alter application source, scripts, workflows, or deployment configuration. (package.json:35, aa69d72ac6d1)
• Current Astro integration surface: Current main configures Astro with MDX, sitemap, React, PWA, Tailwind/Vite, and Markdown integrations, so a fresh site build and preview smoke check are the relevant behavioral validation. (astro.config.mjs:613, c8bb7c663917)
• Automated validation: GitHub reports successful build, lint, GitGuardian, and Vercel preview checks for the proposed head; these are useful supplemental validation but do not demonstrate an after-update runtime smoke result supplied by the contributor. (pnpm-lock.yaml:23, aa69d72ac6d1)
• Repository policy: The full repository AGENTS.md only defines the workflow for scaffolding new blog posts and does not impose a dependency-update review requirement. (AGENTS.md:1, c8bb7c663917)

Likely related people:

• steipete: This is the repository owner’s personal Astro site; current main owns the direct Astro dependency and its central configuration, though the available review evidence did not establish more specific file-history authorship. (role: likely project dependency owner; confidence: low; commits: c8bb7c663917; files: package.json, astro.config.mjs, pnpm-lock.yaml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

• reviewed 2026-07-22T06:37:16.370Z sha aa69d72 :: needs maintainer review before merge. :: none

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(deps): bump astro from 7.0.6 to 7.1.0 in the npm_and_yarn group across 1 directory This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

[steipete]

Exact-head proof for 48b26fe:

• Fresh pnpm 10.33.2 install completed with security overrides loaded from pnpm-workspace.yaml.
• Format and Oxlint checks passed.
• Astro diagnostics completed with 0 errors and 29 pre-existing hints.
• Production build completed 415 pages and Pagefind indexed 112 searchable pages.
• Local Astro 7.1.3 preview returned HTTP 200 for the homepage, a representative 2026 post, search, and the Pagefind client asset.
• Production audit reports no known vulnerabilities; all direct dependencies are current except TypeScript 7, intentionally held at 6.0.3 because astro check explicitly rejects TS7's native compiler API.
• Codex autoreview returned clean with no accepted or actionable findings.

The branch also adds the missing React type packages and moves pnpm overrides out of the now-ignored package.json#pnpm location, so the security pins are actually enforced.

[steipete]

Landed as 2087ac9.

Post-merge verification:

• Exact-head build, lint, GitGuardian, and Vercel preview checks passed.
• Local Astro diagnostics, 415-page build, Pagefind indexing, audit, and preview HTTP smoke passed.
• Main-branch Lint and Format and Astro Build workflows passed on the merge commit.
• The production Vercel deployment completed successfully.
• https://steipete.me/ returns HTTP 200 and identifies Astro v7.1.3 in the rendered production HTML.

No manual release artifact was published; this repository deploys the website from main.