chore(deps): bump astro from 5.18.2 to 7.3.2 in /apps/docs

[dependabot]

Bumps astro from 5.18.2 to 7.3.2.

Release notes

Sourced from astro's releases.

astro@7.3.2

Patch Changes

• #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

• #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

• #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

• #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

• Updated dependencies [a548223]:

  • @​astrojs/markdown-satteri@​0.4.1

astro@7.3.1

Patch Changes

• #17899 0389640 Thanks @​ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

astro@7.3.0

Minor Changes

• #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

  Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { LocalImageService } from 'astro';
  const service: LocalImageService = {
  // ...
  async transform(inputBuffer, transform, imageConfig, logger) {
  logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
  return { data: inputBuffer, format: 'png' };
  },
  };

  Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

  Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { CacheProvider } from 'astro';
  const provider: CacheProvider = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.2

Patch Changes

• #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

• #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

• #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

• #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

• Updated dependencies [a548223]:

  • @​astrojs/markdown-satteri@​0.4.1

7.3.1

Patch Changes

• #17899 0389640 Thanks @​ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

7.3.0

Minor Changes

• #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

  Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

  import type { LocalImageService } from 'astro';
  const service: LocalImageService = {
  // ...
  async transform(inputBuffer, transform, imageConfig, logger) {
  logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
  return { data: inputBuffer, format: 'png' };
  },
  };

  Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

• #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

  Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

... (truncated)

Commits

• aa4949e [ci] release (#17915)
• 42e9188 fix(i18n): replace locale segment by index in fallback routing (#17907) (#17908)
• 4b92ddc Guard setFetchHandler call in non-runnable dev entrypoint to fix sessions + m...
• c1a6a89 fix: include .astro files in client optimizeDeps entries to prevent 504 on la...
• a548223 Only treat literal script/style content as raw in MDX rendering (#17896)
• 92f23cc [ci] release (#17900)
• 0389640 fix: dont use internal paths (#17899)
• f800de1 [ci] release (#17881)
• 1e0b7e6 [ci] format
• 4671a5c chore(deps): update react to v19 in 0-css fixture (#17888)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[beeeku]

Audit note (scheduled routine): this PR is the same class as the previously-closed astro-major bumps #110 / #116 / #119 / #121 / #122 and belongs to the coordinated Astro/Starlight/Tailwind/Zod migration tracked in #115. The astro@^7 peer wall on Starlight 0.41.x still forces a multi-package migration (see the refreshed shape in #115), so this can't land as a drive-by.

Recommend closing with ·@·d·ependabot i·gnore t·his major version, same treatment as the five predecessors above.

Side-note — the ignore rule appears to be leaking. .github/dependabot.yml already declares:

- package-ecosystem: npm
  directory: /apps/docs
  …
  ignore:
    - dependency-name: astro
      update-types:
        - version-update:semver-major

That rule landed in 43a60dc (via #124) on 2026-08-13 and matches exactly the shape of this PR (5.18.2 → 7.3.2 is a semver-major bump on astro in /apps/docs), yet Dependabot still filed it on the 2026-09-09 cycle. Worth a follow-up look — possible causes:

1. Interaction with the groups: npm_and_yarn block above it (grouped updates handle ignore differently: the group opts patch/minor only, but the standalone major PR path may not honor per-dep ignore when the dep is also a group member).
2. Dependabot ignore is respected on scheduled runs but not on manual ·@·d·ependabot r·ecreate triggers.

Once this PR is closed, @dependabot show astro ignore conditions on the same thread should confirm what Dependabot actually has loaded for the ignore.

Not touching the PR itself — the close-with-comment is an owner decision.

---

Generated by Claude Code

[beeeku]

·@·d·ependabot i·gnore t·his major version

Subsumed by the coordinated Astro 5 → 7 migration tracked in #115 — this bump has recurred four times now (#110 / #116 / #119 / #121 / #122 → #142) and cannot land ahead of the peer-dep chain (@astrojs/starlight 0.41.x peers astro: ^7, plus Zod v4 / Tailwind v4 / @astrojs/react 6). Class-wide ignore is queued behind #137; using per-PR ignore here so the noise stops immediately.

---

Generated by Claude Code

[beeeku]

·@·d·ependabot i·gnore t·his major version

Subsumed by the Astro 5 → 7 coordinated docs migration tracker #115 — same class as the five previously-closed astro-major bumps (#110 / #116 / #119 / #121 / #122). The astro@^7 peer wall on Starlight 0.41.x plus Zod v4 / Tailwind v4 / @astrojs/react v6 forces a multi-package migration. Config ignore is queued behind #137; using per-PR ignore so the noise stops immediately. Reversible via @dependabot unignore this major version once the migration unblocks.

The 2026-09-19 audit comment on #141 posted this same command with middle-dot obfuscation and Dependabot didn't parse it — reposting properly this run.

---

Generated by Claude Code

[beeeku]

·@·d·ependabot i·gnore t·his major version

Subsumed by the coordinated Astro 5 → 7 docs migration tracker #115 — same class as the five previously-closed astro-major bumps (#110/#116/#119/#121/#122). The astro@^7 peer wall on Starlight 0.41.x plus Zod v4 / Tailwind v4 / @astrojs/react v6 forces a multi-package migration; can't land as a drive-by. Config-level ignore is queued behind #137.

Three prior audit runs (2026-09-10, 09-19, 09-21) posted this same command with middle-dot U+00B7 characters interspersed between the letters, which GitHub's Dependabot parser doesn't recognize — that's why this PR is still open. Reposting cleanly.

---

Generated by Claude Code

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.