chore(deps): bump the prod-minor-patch group with 5 updates

[dependabot]

Bumps the prod-minor-patch group with 5 updates:

Package	From	To
@astrojs/react	5.0.6	5.0.7
astro	6.4.2	6.4.4
@tanstack/react-query	5.100.14	5.101.0
viem	2.52.0	2.52.2
@anthropic-ai/sdk	0.100.1	0.102.0

Updates @astrojs/react from 5.0.6 to 5.0.7

Release notes

Sourced from @​astrojs/react's releases.

@​astrojs/react@​5.0.7

Patch Changes

• #16900 17a0fbd Thanks @​ocavue! - Bumps devalue dependency to v5.8.1

Changelog

Sourced from @​astrojs/react's changelog.

5.0.7

Patch Changes

• #16900 17a0fbd Thanks @​ocavue! - Bumps devalue dependency to v5.8.1

Commits

• 75ae5df [ci] release (#16912)
• 17a0fbd chore(deps): update devalue (#16900)
• See full diff in compare view

Updates astro from 6.4.2 to 6.4.4

Release notes

Sourced from astro's releases.

astro@6.4.4

Patch Changes

• #16926 1b39ae8 Thanks @​narendraio! - Prevents App.match() from throwing on request paths that contain an invalid percent-sequence.

• #16924 2c0bc94 Thanks @​astrobot-houston! - Fixes an issue where editing a client-side component (e.g. with client:idle, client:load, etc.) caused an unnecessary full program reload of the backend during development.

• #16958 2c1d50f Thanks @​fkatsuhiro! - Fixes a bug where static file endpoints using getStaticPaths with .html in dynamic param values (e.g. { path: 'file.html' }) would fail with a NoMatchingStaticPathFound error during build. The .html suffix is no longer incorrectly stripped from endpoint route pathnames.

• #16855 c610cda Thanks @​astrobot-houston! - Fixes dynamic routes returning 500 "TypeError: Missing parameter" when using domain-based i18n routing in SSR.

• #16946 606c37b Thanks @​ematipico! - Fixes Astro.routePattern to preserve original casing of dynamic parameter names from filenames. Previously, a file at src/pages/blog/[postId].astro would return /blog/[postid] for Astro.routePattern due to an internal .toLowerCase() call. It now correctly returns /blog/[postId].

• #16720 16d49b6 Thanks @​thomas-callahan-collibra! - Fix an issue where dynamic routes would return the string [object Object] instead of the expected content, in certain runtimes.

• #16703 17390a6 Thanks @​henrybrewer00-dotcom! - Fixes styles being stripped when the project root is started with a path whose case differs from the actual filesystem case (e.g. running astro dev from d:\dev\app while the folder on disk is D:\dev\app).

• #16855 c610cda Thanks @​astrobot-houston! - Fixes Astro.currentLocale returning the default locale instead of the domain's locale on dynamic routes served from a mapped domain.

astro@6.4.3

Patch Changes

• #16900 17a0fbd Thanks @​ocavue! - Bumps devalue dependency to v5.8.1

• #16016 0d85e1b Thanks @​felmonon! - Fix a false positive in the dev toolbar accessibility audit for anchors with text inside closed <details> elements.

• #16911 79c6c46 Thanks @​astrobot-houston! - Fixes a bug where experimental.advancedRouting with astro/hono handlers threw TypeError: Cannot read properties of undefined (reading 'route') for unmatched routes instead of rendering the custom 404 page.

• #16899 239c469 Thanks @​matthewp! - Fixes a false "does not call the middleware() handler" warning when using astro() in a custom src/app.ts and the first request is a redirect route.

• #16887 493acdb Thanks @​astrobot-houston! - Fixes redirectToDefaultLocale not working after the Advanced Routing refactoring.

• #16908 ef53ab9 Thanks @​florian-lefebvre! - Improves optimized fallbacks generation when using the Fonts API by using better metrics for bold variants

Changelog

Sourced from astro's changelog.

6.4.4

Patch Changes

• #16926 1b39ae8 Thanks @​narendraio! - Prevents App.match() from throwing on request paths that contain an invalid percent-sequence.

• #16924 2c0bc94 Thanks @​astrobot-houston! - Fixes an issue where editing a client-side component (e.g. with client:idle, client:load, etc.) caused an unnecessary full program reload of the backend during development.

• #16958 2c1d50f Thanks @​fkatsuhiro! - Fixes a bug where static file endpoints using getStaticPaths with .html in dynamic param values (e.g. { path: 'file.html' }) would fail with a NoMatchingStaticPathFound error during build. The .html suffix is no longer incorrectly stripped from endpoint route pathnames.

• #16855 c610cda Thanks @​astrobot-houston! - Fixes dynamic routes returning 500 "TypeError: Missing parameter" when using domain-based i18n routing in SSR.

• #16946 606c37b Thanks @​ematipico! - Fixes Astro.routePattern to preserve original casing of dynamic parameter names from filenames. Previously, a file at src/pages/blog/[postId].astro would return /blog/[postid] for Astro.routePattern due to an internal .toLowerCase() call. It now correctly returns /blog/[postId].

• #16720 16d49b6 Thanks @​thomas-callahan-collibra! - Fix an issue where dynamic routes would return the string [object Object] instead of the expected content, in certain runtimes.

• #16703 17390a6 Thanks @​henrybrewer00-dotcom! - Fixes styles being stripped when the project root is started with a path whose case differs from the actual filesystem case (e.g. running astro dev from d:\dev\app while the folder on disk is D:\dev\app).

• #16855 c610cda Thanks @​astrobot-houston! - Fixes Astro.currentLocale returning the default locale instead of the domain's locale on dynamic routes served from a mapped domain.

6.4.3

Patch Changes

• #16900 17a0fbd Thanks @​ocavue! - Bumps devalue dependency to v5.8.1

• #16016 0d85e1b Thanks @​felmonon! - Fix a false positive in the dev toolbar accessibility audit for anchors with text inside closed <details> elements.

• #16911 79c6c46 Thanks @​astrobot-houston! - Fixes a bug where experimental.advancedRouting with astro/hono handlers threw TypeError: Cannot read properties of undefined (reading 'route') for unmatched routes instead of rendering the custom 404 page.

• #16899 239c469 Thanks @​matthewp! - Fixes a false "does not call the middleware() handler" warning when using astro() in a custom src/app.ts and the first request is a redirect route.

• #16887 493acdb Thanks @​astrobot-houston! - Fixes redirectToDefaultLocale not working after the Advanced Routing refactoring.

• #16908 ef53ab9 Thanks @​florian-lefebvre! - Improves optimized fallbacks generation when using the Fonts API by using better metrics for bold variants

Commits

• fd7784e [ci] release (#16950)
• c610cda Fix dynamic route parameters in domain-based i18n routing (#16855)
• 29b01ee [ci] format
• 1b39ae8 fix(astro): guard App.match() against malformed request URIs (#16926)
• 16d49b6 Fix issue with dynamic routes in complex projects using workerd (#16720)
• 1adb876 [ci] format
• 2c1d50f fix(routing): preserve .html in pathname for endpoint routes with dynamic par...
• 556b013 docs(astro): fix allows to grammar in two source comments (#16959)
• 17390a6 fix(astro): match case-mismatched project paths in normalizeFilename (#16703)
• 2c0bc94 Fix unnecessary backend reloads when editing client-side components (#16924)
• Additional commits viewable in compare view

Updates @tanstack/react-query from 5.100.14 to 5.101.0

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.101.0

Patch Changes

• Updated dependencies [3042860, e631dc3]:
  • @​tanstack/query-devtools@​5.101.0
  • @​tanstack/react-query@​5.101.0

@​tanstack/react-query-next-experimental@​5.101.0

Patch Changes

• #10857 7cf5923 - fix(react-query-next-experimental): replace deprecated 'isServer' with 'environmentManager.isServer()'

• Updated dependencies []:

  • @​tanstack/react-query@​5.101.0

@​tanstack/react-query-persist-client@​5.101.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.101.0
  • @​tanstack/react-query@​5.101.0

@​tanstack/react-query@​5.101.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.101.0

Changelog

Sourced from @​tanstack/react-query's changelog.

5.101.0

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.101.0

Commits

• f3d8d2a ci: Version Packages (#10774)
• 532bb29 fix(tests): disable local coverage instrumentation (#10776)
• See full diff in compare view

Updates viem from 2.52.0 to 2.52.2

Release notes

Sourced from viem's releases.

viem@2.52.2

Patch Changes

• #4718 1969c01715736de8a16b841cfed81640f0d708c2 Thanks @​jxom! - Tempo: Set the t5 hardfork on the Tempo Testnet (Moderato) chain.

Commits

• 1b6a888 chore: version package (#4719)
• 78a9a60 chore: version package (#4707)
• 5fe74ca docs(tempo): use calls in multisig transaction examples (#4716)
• 1969c01 feat(chains): set t5 hardfork on Tempo Testnet (Moderato) (#4718)
• 394f1c5 chore: bump chains size-limit budgets (#4717)
• 51c51ba Update multisig account support in viem/tempo
• a74b05d chore: bump vitest to fix audit vulnerability (#4715)
• f5ae20d feat(tempo): infer multisig config from account in prepareTransactionRequest ...
• 25c2d6a feat(tempo): add native multisig account support (#4710)
• cee9b68 chore: bump vocs to 2.0.11 (#4708)
• Additional commits viewable in compare view

Updates @anthropic-ai/sdk from 0.100.1 to 0.102.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.102.0

0.102.0 (2026-06-06)

Full Changelog: sdk-v0.101.0...sdk-v0.102.0

Features

• api: small updates to Managed Agents types (8ba4f92)

Bug Fixes

• client: run middleware before request signing (#45) (95f1a4a)

sdk: v0.101.0

0.101.0 (2026-06-05)

Full Changelog: sdk-v0.100.1...sdk-v0.101.0

Features

• client: add support for middleware (9b01120)

Bug Fixes

• apply request timeout to inner fetch only, not middleware chain (#40) (25c13f6)
• streaming: carry stop_details through beta message_delta accumulation (ed3fec7)
• streaming: correctly parse json numbers with scientific notation (#9) (7d5e642)

Chores

• internal: fix artifact url (925ec27)
• internal: fix branch names (fa3cf2c)
• internal: update private repo name (a8ac213)

Documentation

• point security reports to Anthropic's HackerOne program (#16) (5c7912c)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.102.0 (2026-06-06)

Full Changelog: sdk-v0.101.0...sdk-v0.102.0

Features

• api: small updates to Managed Agents types (8ba4f92)

Bug Fixes

• client: run middleware before request signing (#45) (95f1a4a)

0.101.0 (2026-06-05)

Full Changelog: sdk-v0.100.1...sdk-v0.101.0

Features

• client: add support for middleware (9b01120)

Bug Fixes

• apply request timeout to inner fetch only, not middleware chain (#40) (25c13f6)
• streaming: carry stop_details through beta message_delta accumulation (ed3fec7)
• streaming: correctly parse json numbers with scientific notation (#9) (7d5e642)

Chores

• internal: fix artifact url (925ec27)
• internal: fix branch names (fa3cf2c)
• internal: update private repo name (a8ac213)

Documentation

• point security reports to Anthropic's HackerOne program (#16) (5c7912c)

Commits

• f7dfb97 chore: release main
• a3f3c97 feat(api): small updates to Managed Agents types
• a5c98d1 fix(client): run middleware before request signing (#45)
• 185ec06 chore: release main
• fab8910 codegen metadata
• 7ff4036 fix: apply request timeout to inner fetch only, not middleware chain (#40)
• 257bc1f feat(client): add support for middleware
• 5b3ace5 chore(internal): fix artifact url
• 70966be fix(streaming): correctly parse json numbers with scientific notation (#9)
• 7e22f20 docs: point security reports to Anthropic's HackerOne program (#16)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
txkit-docs	Ready	Preview, Comment	Jun 8, 2026 6:24am
txkit-land	Ready	Preview, Comment	Jun 8, 2026 6:24am
txkit-story	Ready	Preview, Comment	Jun 8, 2026 6:24am

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​anthropic-ai/​sdk@​0.102.0
	@​astrojs/​react@​5.0.7
	@​tanstack/​react-query@​5.101.0
	astro@​6.4.4

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm astro is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: app/landing/package.json → npm/astro@6.4.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/astro@6.4.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report