build(deps): bump the npm_and_yarn group across 1 directory with 6 updates by dependabot[bot] · Pull Request #54 · SSWConsulting/SSW.Website.Global

dependabot · 2026-06-13T00:37:25Z

Bumps the npm_and_yarn group with 4 updates in the / directory: @astrojs/cloudflare, astro, @tinacms/cli and tinacms.

Updates @astrojs/cloudflare from 12.6.13 to 13.1.10

Changelog

Sourced from @astrojs/cloudflare's changelog.

13.1.10

Patch Changes

#16320 a43eb4b Thanks @matthewp! - Uses redirect: 'manual' for remote image fetches in the Cloudflare binding image transform, consistent with all other image fetch paths

#16307 a81dd3e Thanks @matthewp! - Surfaces console.log and console.warn output from workerd during prerendering

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

13.1.9

Patch Changes

#16210 e030bd0 Thanks @matthewp! - Fixes .svelte files in node_modules failing with Unknown file extension ".svelte" when using the Cloudflare adapter with prerenderEnvironment: 'node'

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

13.1.8

Patch Changes

#16225 756e7be Thanks @travisbreaks! - Fixes ERR_MULTIPLE_CONSUMERS error when using Cloudflare Queues with prerendered pages. The prerender worker config callback now excludes queues.consumers from the entry worker config, since the prerender worker only renders static HTML and should not register as a queue consumer. Queue producers (bindings) are preserved.

#16192 79d86b8 Thanks @alexanderniebuhr! - Removes an unused function re-export from the /info package path

Updated dependencies []:

@astrojs/underscore-redirects@1.0.3

13.1.7

Patch Changes

Updated dependencies [814406d]:

@astrojs/underscore-redirects@1.0.3

13.1.6

Patch Changes

#16151 4978165 Thanks @matthewp! - Fixes a dev-mode crash loop in the Cloudflare adapter when using Starlight by excluding @astrojs/starlight from SSR dependency optimization

13.1.5

Patch Changes

#16109 c887b4a Thanks @matthewp! - Fix HMR crash when editing content collection files caused by Vite's SSR transform colliding with zod v4's meta export

... (truncated)

Commits

eca29c1 [ci] release (#16314)
a43eb4b Use redirect: manual in Cloudflare image binding transform (#16320)
a81dd3e Surface console output from workerd during Cloudflare prerendering (#16307)
1945a93 [ci] release (#16281)
e030bd0 Fix .svelte files in node_modules with Cloudflare prerenderEnvironment: node ...
92fc030 refactor(core): rename logger internal types (#16271)
673a871 [ci] release (#16244)
79d86b8 chore: adapt code to upstream deprecation (#16192)
756e7be fix(cloudflare): exclude queue consumers from prerender worker (#16225)
b5b8093 [ci] release (#16159)
Additional commits viewable in compare view

Updates astro from 5.18.1 to 6.1.10

Release notes

Sourced from astro's releases.

astro@5.18.2

Patch Changes

#16813 8f7d8c4 Thanks @matthewp! - Populates styles in the SSR manifest for prerendered routes. Previously, prerendered routes had styles: [] in the manifest, making it impossible for workers or middleware to discover which CSS files a prerendered page uses.

Changelog

Sourced from astro's changelog.

6.1.10

Patch Changes

#16479 1058428 Thanks @matthewp! - Fixes a spurious [WARN] [content] Content config not loaded warning during astro dev for projects that don't use content collections

#16457 3d82220 Thanks @matthewp! - Hardens server island encryption to prevent encrypted data from one island component being replayed against a different one

#16481 152700e Thanks @matthewp! - Fixes a spurious 404 request for a dev toolbar sourcemap during astro dev caused by the browser mis-resolving a relative sourceMappingURL from the /@id/ URL prefix

#16480 1bcb43b Thanks @matthewp! - Fixes an unnecessary full page reload on first navigation during dev

6.1.9

Patch Changes

#16448 99464ed Thanks @matthewp! - Updates vite, picomatch, and unstorage to latest patch versions

#16422 a3951d7 Thanks @matthewp! - Hardens astro-island export resolution and hydration error handling for malformed component metadata

#16420 e21de1d Thanks @matthewp! - Hardens Astro's error overlay and server logging paths to avoid unsafe HTML insertion and format-string interpolation

#16419 f3485c3 Thanks @matthewp! - Hardens nested object and package metadata lookups to ignore prototype keys in content handling and project scaffolding

#16022 a002540 Thanks @mathieumaf! - Fixes an issue where i18n domains would return 404 when trailingSlash is set to never.

Updated dependencies [99464ed, f3485c3]:

@astrojs/internal-helpers@0.9.0

@astrojs/markdown-remark@7.1.1

6.1.8

Patch Changes

#16367 a6866a7 Thanks @ematipico! - Fixes an issue where build output files could contain special characters (!, ~, {, }) in their names, causing deploy failures on platforms like Netlify.

#16381 217c5b3 Thanks @ematipico! - Slightly improved the performance of the dev server by caching the internal crawling of the dependencies of a project.

#16348 7d26cd7 Thanks @ocavue! - Fixes a bug where emitted assets during a client build would contain always fresh, new hashes in their name. Now the build should be more stable.

#16317 d012bfe Thanks @das-peter! - Fixes a bug where allowedDomains weren't correctly propagated when using the development server.

#16379 5a84551 Thanks @martrapp! - Improves Vue scoped style handling in DEV mode during client router navigation.

#16317 d012bfe Thanks @das-peter! - Adds tests to verify settings are properly propagated when using the development server.

#16282 5b0fdaa Thanks @jmurty! - Fixes build errors on platforms with skew protection enabled (e.g. Vercel, Netlify) for inter-chunk Javascript using dynamic imports

Updated dependencies [e0b240e]:

@astrojs/telemetry@3.3.1

... (truncated)

Commits

c1f2e4f [ci] release (#16467)
345fb9e chore: fix flaky dev toolbar render time test (#16500)
5120ecd [ci] format
3d82220 Add AEAD context binding to server island encryption (#16457)
1bcb43b Prebundle dev toolbar entrypoint in client environment (#16480)
93101cc [ci] format
152700e fix: strip sourceMappingURL from dev toolbar entrypoint during dep optimizati...
bc83041 refactor(astro): migrate test utils to typescript (#16492)
5c543c5 refactor(astro): add internal entry points for test (#16473)
1058428 Suppress content config warning for projects without content collections (#16...
Additional commits viewable in compare view

Updates @tinacms/cli from 0.0.0-c724883-20260514062230 to 2.1.8

Changelog

Sourced from @tinacms/cli's changelog.

2.1.8

Patch Changes

#6450 56d533e Thanks @18-th! - * Restricted CORS on dev server to localhost by default for GHSA-8pw3-9m7f-q734.

Added server.allowedOrigins config option for non-localhost environments.

Enabled Vite server.fs.strict with computed allow list for GHSA-m48g-4wr2-j2h6

Bind LevelDB TCP server to 127.0.0.1

Updated dependencies [f23c2a6, d782ca2, 56d533e, 60510bb]:

tinacms@3.6.0

@tinacms/schema-tools@2.7.0

@tinacms/app@2.3.27

@tinacms/graphql@2.1.4

@tinacms/search@1.2.5

2.1.7

Patch Changes

#6440 c2517c2 Thanks @18-th! - * Add path traversal protection and tests for GHSA-5hxf-c7j4-279c path traversal vulnerability

Add path traversal protection and tests for GHSA-2f24-mg4x-534q path traversal vulnerability

Updated dependencies [c2517c2, 2738749, dfb4ce8]:

@tinacms/graphql@2.1.3

tinacms@3.5.1

@tinacms/search@1.2.4

@tinacms/app@2.3.26

2.1.6

Patch Changes

#6416 62d0e5b Thanks @18-th! - Adding tests to confirm that a Security Advisory was fixed

#6439 bde4e4f Thanks @kulesy! - Improve error message when content directory is missing a tina/ folder. When using localContentPath, the error now explains that the content directory needs a tina/ folder for generated files and provides the exact mkdir command to fix it, instead of the misleading suggestion to use --rootPath.

#6419 bd9dabd Thanks @18-th! - Added tests to confirm that a Security Advisory was fixed

Updated dependencies [39fa13a, da837f7, f90d47b, 6988450, c806e41, 89aee8a]:

@tinacms/graphql@2.1.2

tinacms@3.5.0

@tinacms/schema-tools@2.6.0

@tinacms/search@1.2.3

@tinacms/app@2.3.25

@tinacms/metrics@2.0.1

2.1.5

Patch Changes

#6398 5345122 Thanks @kulesy! - Preserve key order in tinaSchema config while handling search settings

... (truncated)

Commits

See full diff in compare view

Updates tinacms from 0.0.0-c724883-20260514062230 to 3.1.1

Changelog

Sourced from tinacms's changelog.

3.1.1

Patch Changes

#6262 3a12a39 Thanks @0xharkirat! - 🔒 Security: Update Next.js to 14.2.35 to address security vulnerabilities

Address CVE-2025-55184 (high): DoS via malicious HTTP request causing server to hang

Address CVE-2025-67779 (high): Complete fix for CVE-2025-55184 DoS vulnerability

Updated Next.js devDependency from 14.2.10/14.2.24 to 14.2.35

See: https://nextjs.org/blog/security-update-2025-12-11

Updated dependencies []:

@tinacms/search@1.1.7

3.1.0

Minor Changes

#6233 a125472 Thanks @joshbermanssw! - ✨ File History Provider

Patch Changes

#6240 998975c Thanks @JackDevAU! - Fixing node cache path resolutions

#6236 3097535 Thanks @joshbermanssw! - 🐛 Bug - Fix Toast Blocking Content Underneath

#6198 9fb397d Thanks @Pat-Stuart! - Branch Selector - Add truncation and tooltip to branch name, adjust max width, add sticky header

Updated dependencies [a125472]:

@tinacms/schema-tools@2.1.0

@tinacms/mdx@2.0.1

@tinacms/search@1.1.6

3.0.2

Patch Changes

#6216 5c1e891 Thanks @JackDevAU! - - @tinacms/graphql: remove scmp dependency, replaced with modern code (now inbuilt)

@tinacms/metrics: remove isomorphic-fetch dependency, now relies on global fetch

@tinacms/cli: remove log4js dependency, replaced with custom logger implementation; update chalk to v5 (ESM-only)

@tinacms/scripts, create-tina-app: update chalk to v5 (ESM-only)

next-tinacms-azure: Buffer to Uint8Array conversion

tinacms: TypeScript style prop typing

#6208 f717193 Thanks @18-th! - react-color to react-colorful migration

#6213 ac59522 Thanks @joshbermanssw! - plate : hyperlink UI fixes for valid urls

Updated dependencies []:

... (truncated)

Commits

See full diff in compare view

Updates @tinacms/graphql from 0.0.0-c724883-20260514062230 to 2.0.3

Changelog

Sourced from @tinacms/graphql's changelog.

2.0.3

Patch Changes

#6268 fa7c27a Thanks @wicksipedia! - fix: Security patch to prevent arbitrary code execution in markdown frontmatter

This fixes a security vulnerability where the gray-matter package executes JavaScript code by default when processing markdown files with ---js, ---javascript, or ---coffee frontmatter delimiters. Attackers who could control markdown file content could exploit this to execute arbitrary code on the server.

The fix disables JavaScript and CoffeeScript engines in frontmatter parsing. Valid frontmatter formats (YAML, TOML, JSON) continue to work normally, including storing JSX/HTML as string data.

Breaking Change: If your content files use ---js, ---javascript, or ---coffee frontmatter delimiters, they will now throw an error. You should migrate these files to use YAML, TOML, or JSON frontmatter instead

2.0.2

Patch Changes

Updated dependencies [a125472]:

@tinacms/schema-tools@2.1.0

@tinacms/mdx@2.0.1

2.0.1

Patch Changes

#6216 5c1e891 Thanks @JackDevAU! - - @tinacms/graphql: remove scmp dependency, replaced with modern code (now inbuilt)

@tinacms/metrics: remove isomorphic-fetch dependency, now relies on global fetch

@tinacms/cli: remove log4js dependency, replaced with custom logger implementation; update chalk to v5 (ESM-only)

@tinacms/scripts, create-tina-app: update chalk to v5 (ESM-only)

next-tinacms-azure: Buffer to Uint8Array conversion

tinacms: TypeScript style prop typing

Updated dependencies []:

@tinacms/mdx@2.0.0

@tinacms/schema-tools@2.0.0

2.0.0

Major Changes

#5982 2e1535d Thanks @brookjeynes-ssw! - feat: migrate from commonjs to esm

Patch Changes

Updated dependencies [2e1535d, ed6025e]:

@tinacms/mdx@2.0.0

@tinacms/schema-tools@2.0.0

1.6.3

Patch Changes

... (truncated)

Commits

See full diff in compare view

Updates js-cookie from 2.2.1 to 3.0.8

Release notes

Sourced from js-cookie's releases.

v3.0.8

Restore ES5 compatibility, inadvertently broken in 3.0.7 - #959

Lift Node version restriction, inadvertently restricted to >= 20 in 3.0.7 - #956

v3.0.7

Prevent cookie attribute injection: CVE-2026-46625 (eb3c40e)

Add Partitioned attribute to readme (b994768)

Publish to npm registry via trusted publisher exclusively (4dc71be)

Ensure consistent behaviour for get('name') + get() (1953d30)

v3.0.5

Remove npm version restriction in package.json - #818

v3.0.4

Publish to npmjs.com with package provenance

v3.0.1

Make package.json accessible in export - #727

v3.0.0

Removed defaults in favor of a builder: now to supply an api instance with particular predefined (cookie) attributes there's Cookies.withAttributes(), e.g.:
const api = Cookies.withAttributes({
  path: '/',
  secure: true
})
api.set('key', 'value') // writes cookie with path: '/' and secure: true...
The attributes that an api instance is configured with are exposed as attributes property; it's an immutable object and unlike defaults cannot be changed to configure the api.

The mechanism to fall back to the standard, internal converter by returning a falsy value in a custom read converter has been removed. Instead the default converters are now exposed as Cookies.converter, which allows for implementing self-contained custom converters providing the same behavior:
const customReadConverter = (value, name) => {
  if (name === 'special') {
    return unescape(value)
  }
  return Cookies.converter.read(value)
}
withConverter() no longer accepts a function as argument to be turned into a read converter. It is now required to always pass an object with the explicit type(s) of converter(s):
const api = Cookies.withConverter({
  read: (value, name) => unescape(value)
})
The converter(s) that an api instance is configured with are exposed as converter property; it's an immutable object and cannot be changed to configure the api.

Started providing library as ES module, in addition to UMD module. The module field in package.json points to an ES module variant of the library.

Started using browser field instead of main in package.json (for the UMD variant of the library).

Dropped support for IE < 10.

Removed built-in JSON support, i.e. getJSON() and automatic stringifying in set(): use Cookies.set('foo', JSON.stringify({ ... })) and JSON.parse(Cookies.get('foo')) instead.

Removed support for Bower.

... (truncated)

Commits

d7a1096 Craft v3.0.8 release
248e685 Use existing Chrome with puppeteer
fc04269 Remove QUnit related workaround in Grunt config
265a685 Tidy up package lock file
478e591 Disable Node deprecation DEP0044 for release workflow
331d524 Fix node version config for E2E test job
11d773d Ensure ECMAScript compatibility
d788646 Remove engines property from package
e7d9a4d Fix typo in test assertion message
b5fca24 Make credentials use explicit in release workflow
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for js-cookie since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 4 updates in the / directory: [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare), [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro), [@tinacms/cli](https://github.com/tinacms/tinacms/tree/HEAD/packages/@tinacms/cli) and [tinacms](https://github.com/tinacms/tinacms/tree/HEAD/packages/tinacms). Updates `@astrojs/cloudflare` from 12.6.13 to 13.1.10 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@13.1.10/packages/integrations/cloudflare) Updates `astro` from 5.18.1 to 6.1.10 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/astro@6.1.10/packages/astro) Updates `@tinacms/cli` from 0.0.0-c724883-20260514062230 to 2.1.8 - [Release notes](https://github.com/tinacms/tinacms/releases) - [Changelog](https://github.com/tinacms/tinacms/blob/main/packages/@tinacms/cli/CHANGELOG.md) - [Commits](https://github.com/tinacms/tinacms/commits/@tinacms/cli@2.1.8/packages/@tinacms/cli) Updates `tinacms` from 0.0.0-c724883-20260514062230 to 3.1.1 - [Release notes](https://github.com/tinacms/tinacms/releases) - [Changelog](https://github.com/tinacms/tinacms/blob/main/packages/tinacms/CHANGELOG.md) - [Commits](https://github.com/tinacms/tinacms/commits/tinacms@3.1.1/packages/tinacms) Updates `@tinacms/graphql` from 0.0.0-c724883-20260514062230 to 2.0.3 - [Release notes](https://github.com/tinacms/tinacms/releases) - [Changelog](https://github.com/tinacms/tinacms/blob/main/packages/@tinacms/graphql/CHANGELOG.md) - [Commits](https://github.com/tinacms/tinacms/commits/@tinacms/graphql@2.0.3/packages/@tinacms/graphql) Updates `js-cookie` from 2.2.1 to 3.0.8 - [Release notes](https://github.com/js-cookie/js-cookie/releases) - [Commits](js-cookie/js-cookie@v2.2.1...v3.0.8) --- updated-dependencies: - dependency-name: "@astrojs/cloudflare" dependency-version: 13.1.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: astro dependency-version: 6.1.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@tinacms/cli" dependency-version: 2.1.8 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: tinacms dependency-version: 3.1.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@tinacms/graphql" dependency-version: 2.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-cookie dependency-version: 3.0.8 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-06-13T00:37:33Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	ssw-website-global	`eb1ba59`	Jun 13 2026, 12:38 AM

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 13, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the npm_and_yarn group across 1 directory with 6 updates#54

build(deps): bump the npm_and_yarn group across 1 directory with 6 updates#54
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-1164930105

dependabot Bot commented on behalf of github Jun 13, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 13, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 13, 2026

13.1.10

Patch Changes

13.1.9

Patch Changes

13.1.8

Patch Changes

13.1.7

Patch Changes

13.1.6

Patch Changes

13.1.5

Patch Changes

astro@5.18.2

Patch Changes

6.1.10

Patch Changes

6.1.9

Patch Changes

6.1.8

Patch Changes

2.1.8

Patch Changes

2.1.7

Patch Changes

2.1.6

Patch Changes

2.1.5

Patch Changes

3.1.1

Patch Changes

3.1.0

Minor Changes

Patch Changes

3.0.2

Patch Changes

2.0.3

Patch Changes

2.0.2

Patch Changes

2.0.1

Patch Changes

2.0.0

Major Changes

Patch Changes

1.6.3

Patch Changes

v3.0.8

v3.0.7

v3.0.5

v3.0.4

v3.0.1

v3.0.0

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

cloudflare-workers-and-pages Bot commented Jun 13, 2026 •

edited

Loading