Skip to content

chore(deps): bump blume from 1.6.3 to 1.6.6 - #66

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/blume-1.6.6
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/blume-1.6.6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 18, 2026 •

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.


Bumps blume from 1.6.3 to 1.6.6.

Release notes

Sourced from blume's releases.

blume@1.6.6

Patch Changes

  • 2c373ef: Stop repeating API in generated descriptions when the name already says it. API reference overview and operation meta descriptions no longer turn a spec titled Example API (or Payments APIs, Example API v2) into Example API API, and the generated /openapi.json title no longer doubles the word for a site titled the same way.
  • 520a660: Write the deploy artifacts from the integration's astro:build:done hook instead of after astro build returns: the search index and hosted-provider sync, llms.txt, sitemap.xml, robots.txt, agent-readability.json, the .well-known discovery files, Agent Skills, and the platform _redirects/_headers files now land in the directory Astro reports as its client output during the build. blume build output is unchanged. An ejected app keeps producing all of them from plain astro build — its config tells the hook to scan the project — so blume eject no longer warns that they are lost.
  • a63c10e: Serve the prerendered per-page JSON documents on Cloudflare server builds whose requests run through the Worker: the wrapper answers them from the asset binding (conditional revalidations included) instead of letting Astro hand them to the /api/ catch-all, and .json files stay on the static path under a deployment base or the coarse worker-first fallback.
  • 1197e8b: Opt Cloudflare server builds out of Astro sessions with session: false instead of configuring an in-memory session driver. Blume never reads Astro.session; the driver only existed to keep @astrojs/cloudflare from declaring a SESSION KV binding, which Astro's opt-out now does directly.
  • 1328384: Declare Blume's page front-matter schema on the generated content collections, so entry.data in the runtime is typed and normalized the same way the scan's page metadata is. Custom front-matter keys pass through, and a page the scan already dropped as invalid resolves to defaults instead of failing Astro's content sync.
  • 4f5660b: Honor Accept: text/markdown and send the homepage agent-discovery Link header in blume dev when deployment.base is set. Astro's dev server rewrites the base off the URL before Blume's handler runs, so stripping it a second time left every request unmatched.
  • bbdaa55: Keep the dev server up across page adds, removes, and folder renames. blume dev used to stop and recreate the Astro server on every route-set change; it now asks Astro's content layer to re-sync (refreshContent) and republishes the Markdown-negotiation routes in memory, so the generated config no longer changes with content and Astro never restarts in place for it. A moved page answers under its new route within a second, and editing an <include> partial re-syncs the store the same way instead of touching page mtimes.
  • 6b9f367: Drop the image-size dependency. Its ICNS, HEIF/AVIF, and JXL parsers can be driven into an infinite loop by a crafted file with a zero-sized box or entry, which would hang blume audit or a build, and no patched release exists. The audit's Open Graph image checks now read dimensions through sharp, the image optimizer the build already ships, which covers the same formats and rejects malformed input instead of looping on it. SVG logos for the header and the OG card are measured by a small root-tag parser with the same rules as before: explicit width/height, a viewBox fallback, and CSS units at 96dpi.
  • 7ee1100: Show Blume's config and content errors in the browser error overlay during blume dev on published installs. The dev-server handle was a module-level variable, and the CLI bundle and the copy of the integration Vite loads are separate module instances, so the overlay only ever worked inside the Blume repository itself. The handle now lives on globalThis, like the runtime data registry.
  • 6b26322: Improve Ask AI grounding for conversational follow-ups and long structured pages. A bare follow-up ("Why?", "And then?") retrieves from the earlier user turn, a short follow-up keeps that turn's best match in view behind its own, and a question that names its subject always leads. Excerpts now keep whole Markdown sections — heading, list, and code fence intact — chosen by how well they cover the question rather than by length, and pages are parsed once per endpoint instead of per request. A closing code fence must now be bare, as CommonMark requires, so a same-length fence line with an info string inside an open block no longer ends it.
  • 8d32eb3: Keep <include>-bearing Markdown pages fresh through Astro's documented loader context instead of patching the content store's writes. The collection loader now records a digest of each including page's partials in the collection's meta store and evicts the page's entry when that digest changes, so Astro's glob loader re-renders it on the next sync exactly as it would a new file. Same behavior on a partial edit in dev and on a warm-cache production build; no more replaying the store's private import bookkeeping.
  • e9cd88f: Declare the blume:* virtual modules through Astro's injectTypes hook instead of a generated src/env.d.ts. The declarations now live under .astro/integrations/blume/ and are referenced from Astro's own types.d.ts, so every project that mounts the integration — the hidden runtime and an ejected app alike — gets them without a hand-written file. A project tsconfig.json no longer needs .blume/src/env.d.ts in its include.
  • 3e58b91: Load only the selected CLI command, reducing startup time for every command.
  • f04afce: Read the Vercel function bundle audit's imports with es-module-lexer instead of a text scan, so code samples inside the MCP data chunk (a page quoting import { config } from 'dotenv' or await import('bcryptjs')) no longer fail blume build as missing packages.
  • 3422d29: Read provider secrets through Astro's getSecret() from astro:env/server instead of process.env: the Ask AI endpoint's provider key (and the AI Gateway key, now passed to the gateway provider explicitly), the Mixedbread search endpoint's key, and <GithubInfo>'s GITHUB_TOKEN. Each adapter supplies secrets its own way, so a Cloudflare deployment's Worker bindings now reach these endpoints the same as environment variables do on Node and Vercel.
  • 9dde9cb: Default <html lang> and dir in every document shell to the locale Astro resolves from the URL (Astro.currentLocale), then the site's default locale. A custom pages/ page or a Scalar reference page under /fr/ rendered as lang="en" unless it passed locale itself; the content catch-all still passes the manifest's locale, which also covers fallback pages.
  • 8bbf9a1: Set Astro's trailingSlash: "never" in the generated config instead of hand-splicing a trailing-slash redirect into the Vercel routing config. Blume already treats the slashless URL as the one address for a page (canonicals, sitemap, hreflang), so Astro now enforces it too: blume dev answers /guide/ with a 404 that names the setting, an on-demand server route redirects to /guide, and the Vercel adapter emits the same 308 route from the config that Blume used to splice by hand. Prerendered pages on static hosts are served exactly as before.

blume@1.6.5

Patch Changes

  • 9753355: Render a spec description as the Markdown it is. An OpenAPI description is Markdown by specification, but schema properties, parameters, request bodies, responses, authorization schemes, AsyncAPI messages and every GraphQL description — field, enum value and operation return type — printed it as plain text — so a spec generated from code docstrings showed its own **asterisks** and backticks, a numbered list rendered as one long line, and because HTML collapses newlines every paragraph ran together into a single wall of text. The operation description on the same page never had this problem, because it is emitted into the MDX body and goes through the full pipeline; the two rendered side by side is what made it obvious. Descriptions now render through marked — synchronous, already a dependency, and already how the Ask AI island renders model Markdown — since the full pipeline is async and built for whole documents while these are thousands of short strings per build.

    Only a link the author clearly meant becomes an anchor: written as a link, to an absolute URL, a root-relative path, a fragment or a mailto:. Everything else keeps its raw source text, because a description is often prose that was never Markdown. GFM autolinks bare URLs, www. hosts and email addresses, and spec descriptions are full of example hosts (https://myorg.my.salesforce.com, www.yourstore.myshopify.com) that turned into links to hosts nobody should visit; worse, regex and format notation reads as link syntax — Debezium's column-list wording schemaName[.]tableName[.](https://github.com/haydenbleasel/blume/tree/HEAD/packages/blume/blob/HEAD/columnName1|columnName2) is literally [text](https://github.com/haydenbleasel/blume/tree/HEAD/packages/blume/blob/HEAD/href), which both produced a broken link and deleted the notation, since the link text is only .. An image is held to the same policy. Raw HTML is escaped rather than passed through, for the same reason the Ask AI island runs its Markdown through DOMPurify: this is data lifted out of a file and interpolated into the page.

    A GFM table in a description is wrapped in the same scroll frame the body pipeline gives every other table, because set:html bypasses the plugin that would have done it and a description sits in a narrower column than the body.

    Styling lives in one style block on a single class rather than in per-element utilities. Written as utilities it repeated the same ~620 characters on every description, which on a large reference page is 1.5 MB of identical class attributes and enough to push pages past Googlebot's 2 MB crawl limit; blume audit flags that as an indexability error.

  • dd32b7b: Add analytics.cloudflare for Cloudflare Web Analytics. Pass the site token from the dashboard's JS snippet — analytics: { cloudflare: { token } } — and Blume renders the beacon tag, the same way posthog takes a key. Until now the beacon meant hand-writing a scripts entry with the beacon URL and a JSON data-cf-beacon attribute.

    This is for sites Cloudflare doesn't proxy. A proxied zone with automatic Web Analytics on already injects the beacon at the edge and should leave the option unset, or every pageview is counted twice; the analytics docs now spell out that distinction.

  • 597d824: Give a reference row room for what it holds. The row was scaled for a one-line description — 4px between the property name and its description, 8px before the disclosure, 12px of row padding — but a description is a block, so at 4px it sat closer to the label above it than its own paragraphs sat to each other. That inversion is what made a dense reference page read as a wall rather than as rows, and the disclosure below it touched the next row's divider. Every component that draws a reference row now shares one scale: 8px between a row's own lines, 12px before a disclosure, 16px of row padding. Measured on one operation page, the gap between two properties goes from 25px to 33px.

    Table cells gain the same treatment for the same reason. At 0.5rem of block padding against a line-height near 1.7, a cell whose content wrapped put more space between its own two lines than between itself and the next row. The inline padding is unchanged on purpose: widening it comes out of column width in a capped article, and on one corpus it pushed cells that fit on two lines onto three, spending the space it had just bought.

  • b03b43f: Update dependencies: Mermaid 12, React 19.3, Zod 4.6, ai 7.0.99, @pierre/diffs 1.4.2, and the latest patch releases of the remaining runtime dependencies. Mermaid 12 makes the ELK layout and the "neo" look its defaults; Blume pins the previous dagre layout and classic look so existing diagrams render as before and the ELK engine only downloads for diagrams that opt in through their own front matter.

blume@1.6.4

Patch Changes

  • 623fe85: Remove the extra vertical space at the bottom of code blocks. The scrolling code element carries a small bottom inset so a horizontal scrollbar thumb stays off the last line's descenders, but that inset was added on top of the block's padding, so every block, including a one-line install command, sat 0.375rem taller than the space above the text. The block now gives up the same amount below the code element, so the text sits an even 1rem from the top and bottom edges and the scrollbar gap is unchanged.

  • 6edd17b: Fix a ReferenceError: rafThrottle is not defined thrown on pages that render <Component>: the script block used rafThrottle without importing it. Preview panes now cap at the viewport with CSS (max-height: 100lvh) instead of a resize listener, so a pane capped by a small window grows back when the window does, mobile toolbar collapse no longer resizes it, and the docs page asks already-loaded frames to re-report their height so a report sent before the listener registered isn't lost.

  • ec879ad: Keep content links inside the reader's language on multi-locale sites. Markdown links and Card, Tile, Tooltip, and Update hrefs written as /guides/setup rendered verbatim on translated pages, so a reader on /fr/… was sent back to the default locale on the first click. Root-relative page links now resolve to the same-locale route when one is served — a translation or a fallback page — and keep their authored target otherwise, so custom pages and explicit cross-locale links are untouched. blume check resolves links the same way, so an anchor is validated against the translated page a reader actually lands on.

    Because anchors now travel with the link, blume translate pins every translated heading to its source heading's anchor id with a trailing [#id] marker (unless the translation already pins one), so #fragment links resolve identically in every language.

  • 5efd05e: Fix the language switcher's fallback target under a basePath. A switcher entry for a locale with no real translation derives its href by stripping the page's own locale from its route and re-adding the target locale, but route arrives with the base path already applied (/docs/ja/reference) while locale prefixes are base-less (/ja) — so the strip matched nothing and the re-add produced a second prefix, linking /docs/ja/reference at /ja/docs/ja/reference, /ko/docs/ja/reference and so on. None of those routes are built, so every affected entry was a dead link, and an audit that follows them reported the page as linking to broken routes. The route is now moved into base-less space before the locale is swapped and the base is re-applied to the result, using the same helpers the manifest composes real routes with. This affects any locale without a real translation of the page: a partially translated hand-written page for its missing locales, and, most visibly, a generated OpenAPI or GraphQL reference under a base path for every locale but its own.

  • 4de1d37: Downlevel <Operation>, <ApiTagOperations> and <ApiOverview> on the agent-facing surfaces. A generated reference page is its description as Markdown plus one of those components, so with no serializer for them an operation page reached /<route>.md, llms-full.txt, MCP get_page and the Ask AI corpus as its description followed by a bare tag — no method, no path, nowhere to go. On a site whose reference is most of the corpus, that is most of the corpus: measured on one 449-page site, 266 pages and 266 raw <Operation> in llms-full.txt, so "which endpoint do I call?" had no answer anywhere an agent could read. An operation now downlevels to its endpoint in the spec kind's own notation — GET /pets/{id}, SEND user/signup, query pets or type Pet — plus a deprecation marker; a tag section to its operations as links with their summaries; and the overview to the version and base URLs the rendered page shows. Site search indexes the same text, so a query for an endpoint's path now matches its page. Parameters and schemas stay with the component, which owns that rendering. The components and the serializers also share one own-property lookup, so a source or id that names an inherited property like toString renders the not-found state instead of throwing.

  • 830bd4e: Update the oxfmt directive-preservation patch documented in the FAQ for oxfmt 0.67.0. The patch body is unchanged; it now targets the renamed Markdown formatter chunk so ::: container directives keep their fences on their own lines under the latest oxfmt, oxlint 1.82, and Ultracite 7.11.

... (truncated)

Changelog

Sourced from blume's changelog.

1.6.6

Patch Changes

  • 2c373ef: Stop repeating API in generated descriptions when the name already says it. API reference overview and operation meta descriptions no longer turn a spec titled Example API (or Payments APIs, Example API v2) into Example API API, and the generated /openapi.json title no longer doubles the word for a site titled the same way.
  • 520a660: Write the deploy artifacts from the integration's astro:build:done hook instead of after astro build returns: the search index and hosted-provider sync, llms.txt, sitemap.xml, robots.txt, agent-readability.json, the .well-known discovery files, Agent Skills, and the platform _redirects/_headers files now land in the directory Astro reports as its client output during the build. blume build output is unchanged. An ejected app keeps producing all of them from plain astro build — its config tells the hook to scan the project — so blume eject no longer warns that they are lost.
  • a63c10e: Serve the prerendered per-page JSON documents on Cloudflare server builds whose requests run through the Worker: the wrapper answers them from the asset binding (conditional revalidations included) instead of letting Astro hand them to the /api/ catch-all, and .json files stay on the static path under a deployment base or the coarse worker-first fallback.
  • 1197e8b: Opt Cloudflare server builds out of Astro sessions with session: false instead of configuring an in-memory session driver. Blume never reads Astro.session; the driver only existed to keep @astrojs/cloudflare from declaring a SESSION KV binding, which Astro's opt-out now does directly.
  • 1328384: Declare Blume's page front-matter schema on the generated content collections, so entry.data in the runtime is typed and normalized the same way the scan's page metadata is. Custom front-matter keys pass through, and a page the scan already dropped as invalid resolves to defaults instead of failing Astro's content sync.
  • 4f5660b: Honor Accept: text/markdown and send the homepage agent-discovery Link header in blume dev when deployment.base is set. Astro's dev server rewrites the base off the URL before Blume's handler runs, so stripping it a second time left every request unmatched.
  • bbdaa55: Keep the dev server up across page adds, removes, and folder renames. blume dev used to stop and recreate the Astro server on every route-set change; it now asks Astro's content layer to re-sync (refreshContent) and republishes the Markdown-negotiation routes in memory, so the generated config no longer changes with content and Astro never restarts in place for it. A moved page answers under its new route within a second, and editing an <include> partial re-syncs the store the same way instead of touching page mtimes.
  • 6b9f367: Drop the image-size dependency. Its ICNS, HEIF/AVIF, and JXL parsers can be driven into an infinite loop by a crafted file with a zero-sized box or entry, which would hang blume audit or a build, and no patched release exists. The audit's Open Graph image checks now read dimensions through sharp, the image optimizer the build already ships, which covers the same formats and rejects malformed input instead of looping on it. SVG logos for the header and the OG card are measured by a small root-tag parser with the same rules as before: explicit width/height, a viewBox fallback, and CSS units at 96dpi.
  • 7ee1100: Show Blume's config and content errors in the browser error overlay during blume dev on published installs. The dev-server handle was a module-level variable, and the CLI bundle and the copy of the integration Vite loads are separate module instances, so the overlay only ever worked inside the Blume repository itself. The handle now lives on globalThis, like the runtime data registry.
  • 6b26322: Improve Ask AI grounding for conversational follow-ups and long structured pages. A bare follow-up ("Why?", "And then?") retrieves from the earlier user turn, a short follow-up keeps that turn's best match in view behind its own, and a question that names its subject always leads. Excerpts now keep whole Markdown sections — heading, list, and code fence intact — chosen by how well they cover the question rather than by length, and pages are parsed once per endpoint instead of per request. A closing code fence must now be bare, as CommonMark requires, so a same-length fence line with an info string inside an open block no longer ends it.
  • 8d32eb3: Keep <include>-bearing Markdown pages fresh through Astro's documented loader context instead of patching the content store's writes. The collection loader now records a digest of each including page's partials in the collection's meta store and evicts the page's entry when that digest changes, so Astro's glob loader re-renders it on the next sync exactly as it would a new file. Same behavior on a partial edit in dev and on a warm-cache production build; no more replaying the store's private import bookkeeping.
  • e9cd88f: Declare the blume:* virtual modules through Astro's injectTypes hook instead of a generated src/env.d.ts. The declarations now live under .astro/integrations/blume/ and are referenced from Astro's own types.d.ts, so every project that mounts the integration — the hidden runtime and an ejected app alike — gets them without a hand-written file. A project tsconfig.json no longer needs .blume/src/env.d.ts in its include.
  • 3e58b91: Load only the selected CLI command, reducing startup time for every command.
  • f04afce: Read the Vercel function bundle audit's imports with es-module-lexer instead of a text scan, so code samples inside the MCP data chunk (a page quoting import { config } from 'dotenv' or await import('bcryptjs')) no longer fail blume build as missing packages.
  • 3422d29: Read provider secrets through Astro's getSecret() from astro:env/server instead of process.env: the Ask AI endpoint's provider key (and the AI Gateway key, now passed to the gateway provider explicitly), the Mixedbread search endpoint's key, and <GithubInfo>'s GITHUB_TOKEN. Each adapter supplies secrets its own way, so a Cloudflare deployment's Worker bindings now reach these endpoints the same as environment variables do on Node and Vercel.
  • 9dde9cb: Default <html lang> and dir in every document shell to the locale Astro resolves from the URL (Astro.currentLocale), then the site's default locale. A custom pages/ page or a Scalar reference page under /fr/ rendered as lang="en" unless it passed locale itself; the content catch-all still passes the manifest's locale, which also covers fallback pages.
  • 8bbf9a1: Set Astro's trailingSlash: "never" in the generated config instead of hand-splicing a trailing-slash redirect into the Vercel routing config. Blume already treats the slashless URL as the one address for a page (canonicals, sitemap, hreflang), so Astro now enforces it too: blume dev answers /guide/ with a 404 that names the setting, an on-demand server route redirects to /guide, and the Vercel adapter emits the same 308 route from the config that Blume used to splice by hand. Prerendered pages on static hosts are served exactly as before.

1.6.5

Patch Changes

  • 9753355: Render a spec description as the Markdown it is. An OpenAPI description is Markdown by specification, but schema properties, parameters, request bodies, responses, authorization schemes, AsyncAPI messages and every GraphQL description — field, enum value and operation return type — printed it as plain text — so a spec generated from code docstrings showed its own **asterisks** and backticks, a numbered list rendered as one long line, and because HTML collapses newlines every paragraph ran together into a single wall of text. The operation description on the same page never had this problem, because it is emitted into the MDX body and goes through the full pipeline; the two rendered side by side is what made it obvious. Descriptions now render through marked — synchronous, already a dependency, and already how the Ask AI island renders model Markdown — since the full pipeline is async and built for whole documents while these are thousands of short strings per build.

    Only a link the author clearly meant becomes an anchor: written as a link, to an absolute URL, a root-relative path, a fragment or a mailto:. Everything else keeps its raw source text, because a description is often prose that was never Markdown. GFM autolinks bare URLs, www. hosts and email addresses, and spec descriptions are full of example hosts (https://myorg.my.salesforce.com, www.yourstore.myshopify.com) that turned into links to hosts nobody should visit; worse, regex and format notation reads as link syntax — Debezium's column-list wording schemaName[.]tableName[.](https://github.com/haydenbleasel/blume/blob/main/packages/blume/columnName1|columnName2) is literally [text](https://github.com/haydenbleasel/blume/blob/main/packages/blume/href), which both produced a broken link and deleted the notation, since the link text is only .. An image is held to the same policy. Raw HTML is escaped rather than passed through, for the same reason the Ask AI island runs its Markdown through DOMPurify: this is data lifted out of a file and interpolated into the page.

    A GFM table in a description is wrapped in the same scroll frame the body pipeline gives every other table, because set:html bypasses the plugin that would have done it and a description sits in a narrower column than the body.

    Styling lives in one style block on a single class rather than in per-element utilities. Written as utilities it repeated the same ~620 characters on every description, which on a large reference page is 1.5 MB of identical class attributes and enough to push pages past Googlebot's 2 MB crawl limit; blume audit flags that as an indexability error.

  • dd32b7b: Add analytics.cloudflare for Cloudflare Web Analytics. Pass the site token from the dashboard's JS snippet — analytics: { cloudflare: { token } } — and Blume renders the beacon tag, the same way posthog takes a key. Until now the beacon meant hand-writing a scripts entry with the beacon URL and a JSON data-cf-beacon attribute.

    This is for sites Cloudflare doesn't proxy. A proxied zone with automatic Web Analytics on already injects the beacon at the edge and should leave the option unset, or every pageview is counted twice; the analytics docs now spell out that distinction.

  • 597d824: Give a reference row room for what it holds. The row was scaled for a one-line description — 4px between the property name and its description, 8px before the disclosure, 12px of row padding — but a description is a block, so at 4px it sat closer to the label above it than its own paragraphs sat to each other. That inversion is what made a dense reference page read as a wall rather than as rows, and the disclosure below it touched the next row's divider. Every component that draws a reference row now shares one scale: 8px between a row's own lines, 12px before a disclosure, 16px of row padding. Measured on one operation page, the gap between two properties goes from 25px to 33px.

    Table cells gain the same treatment for the same reason. At 0.5rem of block padding against a line-height near 1.7, a cell whose content wrapped put more space between its own two lines than between itself and the next row. The inline padding is unchanged on purpose: widening it comes out of column width in a capped article, and on one corpus it pushed cells that fit on two lines onto three, spending the space it had just bought.

  • b03b43f: Update dependencies: Mermaid 12, React 19.3, Zod 4.6, ai 7.0.99, @pierre/diffs 1.4.2, and the latest patch releases of the remaining runtime dependencies. Mermaid 12 makes the ELK layout and the "neo" look its defaults; Blume pins the previous dagre layout and classic look so existing diagrams render as before and the ELK engine only downloads for diagrams that opt in through their own front matter.

1.6.4

Patch Changes

  • 623fe85: Remove the extra vertical space at the bottom of code blocks. The scrolling code element carries a small bottom inset so a horizontal scrollbar thumb stays off the last line's descenders, but that inset was added on top of the block's padding, so every block, including a one-line install command, sat 0.375rem taller than the space above the text. The block now gives up the same amount below the code element, so the text sits an even 1rem from the top and bottom edges and the scrollbar gap is unchanged.

  • 6edd17b: Fix a ReferenceError: rafThrottle is not defined thrown on pages that render <Component>: the script block used rafThrottle without importing it. Preview panes now cap at the viewport with CSS (max-height: 100lvh) instead of a resize listener, so a pane capped by a small window grows back when the window does, mobile toolbar collapse no longer resizes it, and the docs page asks already-loaded frames to re-report their height so a report sent before the listener registered isn't lost.

  • ec879ad: Keep content links inside the reader's language on multi-locale sites. Markdown links and Card, Tile, Tooltip, and Update hrefs written as /guides/setup rendered verbatim on translated pages, so a reader on /fr/… was sent back to the default locale on the first click. Root-relative page links now resolve to the same-locale route when one is served — a translation or a fallback page — and keep their authored target otherwise, so custom pages and explicit cross-locale links are untouched. blume check resolves links the same way, so an anchor is validated against the translated page a reader actually lands on.

    Because anchors now travel with the link, blume translate pins every translated heading to its source heading's anchor id with a trailing [#id] marker (unless the translation already pins one), so #fragment links resolve identically in every language.

... (truncated)

Commits
  • 2ed7100 Version Packages (#253)
  • 3e58b91 Lazy-load CLI commands (#259)
  • 2c373ef Avoid duplicate API names in reference descriptions (#257)
  • a63c10e Serve prerendered page JSON on Cloudflare (#258)
  • 6b26322 fix: ground Ask retrieval in relevant conversation and sections (#260)
  • 8d32eb3 refactor: refresh include-bearing pages through the loader meta store
  • 1197e8b refactor: opt Cloudflare builds out of sessions with session: false
  • f04afce fix: read the function bundle audit's imports with es-module-lexer
  • 6b9f367 fix: drop image-size and measure images with sharp
  • 8bbf9a1 refactor: let Astro's trailingSlash own the slashless URL policy
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [blume](https://github.com/haydenbleasel/blume/tree/HEAD/packages/blume) from 1.6.3 to 1.6.6.
- [Release notes](https://github.com/haydenbleasel/blume/releases)
- [Changelog](https://github.com/haydenbleasel/blume/blob/main/packages/blume/CHANGELOG.md)
- [Commits](https://github.com/haydenbleasel/blume/commits/blume@1.6.6/packages/blume)

---
updated-dependencies:
- dependency-name: blume
  dependency-version: 1.6.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency and toolchain version bumps javascript Pull requests that update javascript code labels Sep 18, 2026
@changeset-bot

changeset-bot Bot commented Sep 18, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 735664e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@coderabbitai

coderabbitai Bot commented Sep 18, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 31e736e2-3c9a-49cc-b004-5fd9d90c6ae8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@SutuSebastian

Copy link
Copy Markdown
Contributor

Superseded: Blume is now at 2.1.3 via #68.

@dependabot @github

dependabot Bot commented on behalf of github Oct 6, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/blume-1.6.6 branch October 6, 2026 14:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency and toolchain version bumps javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant