[dependabot]

Bumps the v5-development-dependencies group with 11 updates:

Package	From	To
@astrojs/markdown-remark	7.3.1	7.3.3
@astrojs/prism	4.0.2	4.1.0
bundlewatch	0.4.2	1.1.0
cspell	10.3.6	10.4.0
karma-rollup-preprocessor	7.0.7	7.0.8
lockfile-lint	5.0.1	5.1.0
mime	4.1.0	4.1.1
postcss	8.5.28	8.5.30
prettier	3.9.9	3.9.10
rollup	4.63.5	4.64.7
zod	4.6.5	4.6.7

Updates @astrojs/markdown-remark from 7.3.1 to 7.3.3

Release notes

Sourced from @​astrojs/markdown-remark's releases.

@​astrojs/markdown-remark@​7.3.3

Patch Changes

• #17894 b7a1bd9 Thanks @​Princesseuh! - Adds the measurements that astro build --timings reports for Markdown processing and syntax highlighting.
• Updated dependencies [b7a1bd9, 2715958]:
  • @​astrojs/internal-helpers@​0.13.0
  • @​astrojs/prism@​4.1.0

@​astrojs/markdown-remark@​7.3.2

Patch Changes

• #18099 6987261 Thanks @​renovate! - Adds YAML parsing with timestamp and merge key support, and formats YAML errors consistently across Astro, Markdown, MDX, and Markdoc.

• #18139 d047b5c Thanks @​breken-ai! - Fixes Markdown code blocks with languages ending in a symbol, such as c#, c++, and f#, being highlighted as c or f

• Updated dependencies [6987261, 62b13ba]:

  • @​astrojs/internal-helpers@​0.12.0

Changelog

Sourced from @​astrojs/markdown-remark's changelog.

7.3.3

Patch Changes

• #17894 b7a1bd9 Thanks @​Princesseuh! - Adds the measurements that astro build --timings reports for Markdown processing and syntax highlighting.
• Updated dependencies [b7a1bd9, 2715958]:
  • @​astrojs/internal-helpers@​0.13.0
  • @​astrojs/prism@​4.1.0

7.3.2

Patch Changes

• #18099 6987261 Thanks @​renovate! - Adds YAML parsing with timestamp and merge key support, and formats YAML errors consistently across Astro, Markdown, MDX, and Markdoc.

• #18139 d047b5c Thanks @​breken-ai! - Fixes Markdown code blocks with languages ending in a symbol, such as c#, c++, and f#, being highlighted as c or f

• Updated dependencies [6987261, 62b13ba]:

  • @​astrojs/internal-helpers@​0.12.0

Commits

• c2c43a9 [ci] release (#18354)
• 73b3c26 Update dependency rolldown to ^1.2.13 (#18384)
• b7a1bd9 feat(build): add a --timings flag to astro build (#17894)
• eee0d19 Update markdown (#18302)
• 882dd98 Replace esbuild with Vite and Rolldown APIs (#18263)
• e5eae02 Update markdown (#18280)
• e4f8f46 [ci] release (#18120)
• d047b5c fix(markdown): keep trailing symbols in code block languages (#18139)
• See full diff in compare view

Updates @astrojs/prism from 4.0.2 to 4.1.0

Release notes

Sourced from @​astrojs/prism's releases.

@​astrojs/prism@​4.1.0

Minor Changes

• #18277 2715958 Thanks @​florian-lefebvre! - Increases the minimum Node.js version to 22.22.0

  The minimum supported Node.js version is now 22.22.0, the latest Node.js 22 release supported by StackBlitz. This change is in line with Astro's Node.js support policy.

Changelog

Sourced from @​astrojs/prism's changelog.

4.1.0

Minor Changes

• #18277 2715958 Thanks @​florian-lefebvre! - Increases the minimum Node.js version to 22.22.0

  The minimum supported Node.js version is now 22.22.0, the latest Node.js 22 release supported by StackBlitz. This change is in line with Astro's Node.js support policy.

Commits

• c2c43a9 [ci] release (#18354)
• 2715958 feat: increase minimum Node.js version to 22.22.0 (#18277)
• 956930f [ci] format
• 37fd0cd Update prism homepage url (#17581)
• See full diff in compare view

Updates bundlewatch from 0.4.2 to 1.1.0

Release notes

Sourced from bundlewatch's releases.

v1.1.0

BundleWatch 1.1.0 adds independent reports for applications in a monorepo.

Independent reports with prefix

Set an optional top-level prefix in your configuration or Node API options:

export default {
  prefix: 'storefront',
  files: [{ path: 'dist/assets/*.js', maxSize: '200 kB' }],
};

Use another prefix, such as admin, for a second application. Each application gets its own GitHub statuses (storefront/bundlewatch and admin/bundlewatch) and baseline history, even when both use the same branch and measured file paths. Per-file failure statuses use the same prefix, and results pages display the application name.

Prefixes must contain 1–64 lowercase ASCII letters, digits, hyphens, or underscores, starting with a letter or digit. Changing or removing a prefix selects a different baseline history; it does not move existing data.

Compatibility and adoption

• Without prefix, existing status names, baselines, and result links remain unchanged. No migration is required.
• Use BundleWatch 1.1.0 or later for every application that sets prefix, for example "bundlewatch": "^1.1.0". Older clients silently ignore the option and share the unprefixed status and baseline. Do not downgrade a prefix-enabled application below 1.1.0.
• The hosted service at service.bundlewatch.io supports prefixes. For a self-hosted service, deploy the updated service to every instance before enabling prefixes. POST /capabilities must return { "baselinePrefix": 1 }. Prefixed clients stop if support cannot be confirmed and never fall back to an unprefixed baseline.
• Run each application's tracked base branch once to establish its baseline. Pull requests compare with the matching application's base-branch baseline and cannot save baselines.
• Update branch protection to require each application's prefixed GitHub status. If these replace the old run, remove the obsolete bundlewatch requirement.
• Authentication and repository authorization are unchanged. Node.js 22.17.0 or later is still required.

See the configuration reference for a two-application example and the service rollout details.

Other updates

The accompanying service updates keep results pages steady when file sections are toggled (#526) and lengthen newly generated short-link IDs to 22 characters (#527). Existing result links continue to work.

Full changelog: bundlewatch/bundlewatch@v1.0.0...v1.1.0

v1.0.0

BundleWatch 1.0 is a rewrite of the CLI, the service and the website in TypeScript, with 0.x behaviour treated as a contract. For most projects it's a drop-in upgrade: the bundlewatch command, its flags, environment variables, configuration, the bundlewatch GitHub status and the exit codes are unchanged. It needs Node.js 22.17 or later.

[!IMPORTANT] Read Migrating to 1.0 before upgrading. The short version is under Upgrading below.

Highlights

• Short results links. The service stores the results and links them as https://service.bundlewatch.io/r/<id>. 0.x packed the results into the URL and shortened it with Firebase Dynamic Links, a product Google has shut down; large projects produced links that browsers and servers refused (#404, #456). Existing links keep working.
• GitHub Actions, without a token to manage. The workflow's own GITHUB_TOKEN posts statuses, saves baselines and creates short links. Pushes are compared with the repository's default branch instead of master (#423, bundlewatch/service#280). Pull request statuses land on the pull request's head commit instead of a temporary merge commit, so they show up on the pull request without setting CI_COMMIT_SHA. Branch names containing / are read correctly (#422).
• Config files are discovered. bundlewatch.config.mjs, .js, .cjs, .mts, .ts, .cts or .json is found automatically, searching upward to the nearest package.json. TypeScript configs load natively on Node.js 22.18 and later, and --config accepts absolute paths.
• ES module and CommonJS builds, with TypeScript types. import bundlewatch, { STATUSES } from 'bundlewatch' and require('bundlewatch').default both work, as do the 0.x entry points bundlewatch/lib/app and lib/bin/index.js.
• Brotli without brotli-size. Node's built-in zlib produces identical sizes, so the optional dependency can go.
• Two runtime dependencies, glob and jsonpack, down from ten. HTTP goes through Node's fetch.
• --version prints the version.

... (truncated)

Commits

• 3067957 Bump version from 1.0.0 to 1.1.0
• 0c32344 Add optional prefixes for isolated monorepo reports (#530)
• 18858c0 Restore npm README branding and usage guide (#525)
• 1454c08 Discover config files automatically (#524)
• 3021e0a bundlewatch 1.0: TypeScript monorepo rewrite (#496)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for bundlewatch since your current version.

Updates cspell from 10.3.6 to 10.4.0

Release notes

Sourced from cspell's releases.

v10.4.0

Features

feat: Add --glob-symlinks to follow symbolic links when matching globs (#9342)

Summary

cspell lint can now follow symbolic links in glob searches, with --glob-symlinks. Glob searches skip linked files and linked directories by default, so a tree made of links, such as Bazel runfiles, found nothing to check.

Closes #7700.

Feature

cspell lint --glob-symlinks "**"

• --glob-symlinks follows symbolic links, and searches linked directories, when matching globs. Links are followed wherever they point.
• CSPELL_GLOB_SYMLINKS=true does the same for a whole job. --no-glob-symlinks overrides it.
• API: globSymlinks in the lint options.
• It can't be set in a configuration file.
• Files are reported by the path through the link. A file reached by two paths is checked under both.
• It applies only to glob searches. For --file, --files, and --file-list documents, use --follow-symlinks.

• The design decisions are recorded in docs/ADRs/glob-symlinks/.
• Link loops, such as a link to a parent directory, are stopped by the glob search after one level.

---

feat: Respect COLUMNS for help and table width (#9358)

Summary

Help, and the tables from cspell trace and cspell dictionaries, now follow the COLUMNS environment variable. That lets you choose a narrower width, which helps with large fonts and screen magnifiers. The help in the cspell README now fits on npmjs.com without scrolling sideways.

Feature

Set COLUMNS to pick the output width:

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.4.0 (2026-10-14)

Features

feat: Add --glob-symlinks to follow symbolic links when matching globs (#9342)

Summary

cspell lint can now follow symbolic links in glob searches, with --glob-symlinks. Glob searches skip linked files and linked directories by default, so a tree made of links, such as Bazel runfiles, found nothing to check.

Closes #7700.

Feature

cspell lint --glob-symlinks "**"

• --glob-symlinks follows symbolic links, and searches linked directories, when matching globs. Links are followed wherever they point.
• CSPELL_GLOB_SYMLINKS=true does the same for a whole job. --no-glob-symlinks overrides it.
• API: globSymlinks in the lint options.
• It can't be set in a configuration file.
• Files are reported by the path through the link. A file reached by two paths is checked under both.
• It applies only to glob searches. For --file, --files, and --file-list documents, use --follow-symlinks.

• The design decisions are recorded in docs/ADRs/glob-symlinks/.
• Link loops, such as a link to a parent directory, are stopped by the glob search after one level.

---

feat: Respect COLUMNS for help and table width (#9358)

Summary

Help, and the tables from cspell trace and cspell dictionaries, now follow the COLUMNS environment variable. That lets you choose a narrower width, which helps with large fonts and screen magnifiers. The help in the cspell README now fits on npmjs.com without scrolling sideways.

Feature

... (truncated)

Commits

• 7e2bbb5 v10.4.0
• d2dce3f chore: Prepare Release v10.4.0 (auto-deploy) (#9380)
• a1509fe chore: Fix the README build after the inject-markdown 6 upgrade (#9429)
• ab3ae04 fix: Workflow Bot -- Update Dictionaries (main) (#9405)
• 55c0fbd fix: Show hidden lint options and issue template help in cspell --help (#9387)
• 628768a v10.4.0-alpha.1
• 998957b chore: Prepare Release v10.4.0-alpha.1 (auto-deploy) (#9378)
• 4c287f5 fix: Deprecate cspell-lib/rpc; import from @cspell/rpc (#9376)
• 7be53ce chore: Prepare Release v10.4.0-alpha.0 (auto-deploy) (#9332)
• e3b5887 chore: Update README.md (#9368)
• Additional commits viewable in compare view

Updates karma-rollup-preprocessor from 7.0.7 to 7.0.8

Changelog

Sourced from karma-rollup-preprocessor's changelog.

[7.0.8] - 2022-02-06

Fixed

• Watcher not working using TypeScript @​YonatanKra [topbar spacing #72](jlmakes/karma-rollup-preprocessor#72

Commits

• 7922333 Release 7.0.8
• de386a6 use rollup watch when in watch mode
• See full diff in compare view

Updates lockfile-lint from 5.0.1 to 5.1.0

Changelog

Sourced from lockfile-lint's changelog.

5.1.0

Minor Changes

• #222 578511e580a4c3c398ba7f26fc0465e449f39516 Thanks @​deveshsinghal09! - Add opt-in strict SHA-512 integrity validation that detects missing or malformed hashes while allowing Git, local directory, linked workspace and bundled dependencies.

  Exempt Yarn Classic GitHub codeload archives only when pinned to a full 40-hex commit. Resolve npm bundled dependencies against their nearest non-bundled ancestor before flattening: v2/v3 require a non-empty bundleDependencies declaration and an ancestor with valid SHA-512 integrity or an independent source exemption. npm v1 verifies the ancestor but cannot confirm the bundle declaration. Unverified flags and HTTP(S)/local tarball downloads still require integrity.

  Report Yarn Berry as one marked unsupported-format error. The CLI exits non-zero without calling an unsupported format a security finding; other failing validators still report their security findings.

  Require commit pins for all Git-source exemptions, and recognize percent-encoded local tarball extensions before granting directory exemptions.

Patch Changes

• Updated dependencies [578511e580a4c3c398ba7f26fc0465e449f39516]:
  • lockfile-lint-api@5.10.0

Commits

• d30ce73 chore(release): publish
• e81ffe9 feat(validators): add URL validator (#52)
• b481e80 chore(release): publish
• e183593 feat(cli): add file-based configuration (#75)
• 3e894df chore(release): publish
• 3e0eb59 fix(cli): conflicting arguments will error (#72)
• d894e8a chore(release): publish
• 6baff98 fix(tests): shebangs don't work on Windows (#71)
• 6bf3021 chore(release): publish
• 4fa9090 fix(cli): use path.join when concatenating paths (#70)
• Additional commits viewable in compare view

Updates mime from 4.1.0 to 4.1.1

Release notes

Sourced from mime's releases.

v4.1.1

What's Changed

• fix: normalize content types in getAllExtensions by @​feritcemkahraman in broofa/mime#365

New Contributors

• @​feritcemkahraman made their first contribution in broofa/mime#365

Full Changelog: broofa/mime@v4.1.0...v4.1.1

Changelog

Sourced from mime's changelog.

4.1.1 (2026-10-12)

Bug Fixes

• normalize content types in getAllExtensions (#365) (2a742a4)

Commits

• 1807ff3 chore(main): release 4.1.1 (#368)
• 2a742a4 fix: normalize content types in getAllExtensions (#365)
• e1075e4 chore: ci on pull request (#367)
• 041306a chore: update workflow actions (#366)
• f2d1243 chore: update for npm trusted publishing (#360)
• ac08f60 chore(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#351)
• 551d5e2 chore: upgrade dependencies (#346)
• 4657198 chore: set up npm trusted publishing (#344)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mime since your current version.

Updates postcss from 8.5.28 to 8.5.30

Release notes

Sourced from postcss's releases.

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Changelog

Sourced from postcss's changelog.

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Commits

• f1aca7e Release 8.5.30 version
• 9d83445 Update dependencies
• 6c9bc73 Fix invalid source map mapping on escaping before new line (#2169)
• 1fd8f88 Add missed changes in changelog
• a7a1f34 Release 8.5.29 version
• b55a36d Update dependencies
• 7647a81 Escape </style> in output of non-Root nodes (#2163)
• 7ac9026 Do not split list.comma() and list.space() on separators inside comments (#2162)
• ebffa97 Add postcss-smooth-corners plugin
• 57d6401 Speed up source map cleaning
• Additional commits viewable in compare view

Updates prettier from 3.9.9 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

Commits

• 1172b82 Release 3.9.10
• d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
• 953b908 Bump Prettier dependency to 3.9.9
• ad8a6bf Clean changelog_unreleased
• See full diff in compare view

Updates rollup from 4.63.5 to 4.64.7

Release notes

Sourced from rollup's releases.

v4.64.7

4.64.7

2026-10-15

Bug Fixes

• Fix an issue where watching not-yet-created files from plugins did not work if several shared a directory (#6575)

Pull Requests

• #6575: Report creation of missing watch files sharing a directory on Linux (@​lukastaegert)

v4.64.6

4.64.6

2026-10-13

Bug Fixes

• Do not tree-shake side effects in class instance fields (#6551)
• Extend top-level-await detection to handle asynchronous for...of loops and async disposal (#6563)

Pull Requests

• #6551: Retain instance field initializers with side effects when instantiating a class (@​SulimanAbdulrazzaq, @​lukastaegert)
• #6563: Recognize top-level asynchronous loops and disposal (@​TrickyPi)
• #6570: Lock file maintenance (@​renovate[bot])
• #6571: Align lock file maintenance with other updates (@​lukastaegert)
• #6573: Make addWatchFile watch test robust against watcher start-up timing (@​lukastaegert)

v4.64.5

4.64.5

2026-10-10

Bug Fixes

• Prevent cycles when using indirect top-level await for dynamic imports (#6516)

Pull Requests

• #6516: fix: prevent cycles for indirectly awaited dynamic imports (@​ryanchou1994, @​lukastaegert)

v4.64.4

4.64.4

2026-10-10

Bug Fixes

... (truncated)

Changelog

Sourced from rollup's changelog.

4.64.7

2026-10-15

Bug Fixes

• Fix an issue where watching not-yet-created files from plugins did not work if several shared a directory (#6575)

Pull Requests

• #6575: Report creation of missing watch files sharing a directory on Linux (@​lukastaegert)

4.64.6

2026-10-13

Bug Fixes

• Do not tree-shake side effects in class instance fields (#6551)
• Extend top-level-await detection to handle asynchronous for...of loops and async disposal (#6563)

Pull Requests

• #6551: Retain instance field initializers with side effects when instantiating a class (@​SulimanAbdulrazzaq, @​lukastaegert)
• #6563: Recognize top-level asynchronous loops and disposal (@​TrickyPi)
• #6570: Lock file maintenance (@​renovate[bot])
• #6571: Align lock file maintenance with other updates (@​lukastaegert)
• #6573: Make addWatchFile watch test robust against watcher start-up timing (@​lukastaegert)

4.64.5

2026-10-10

Bug Fixes

• Prevent cycles when using indirect top-level await for dynamic imports (#6516)

Pull Requests

• #6516: fix: prevent cycles for indirectly awaited dynamic imports (@​ryanchou1994, @​lukastaegert)

4.64.4

2026-10-10

Bug Fixes

• Support the Rollup WASM build on big-endian hosts (#6559)

Pull Requests

... (truncated)

Commits

• 5f65860 4.64.7
• 9761109 Report creation of missing watch files sharing a directory on Linux (#6575)
• 3ba5190 4.64.6
• c3fd7be Retain instance field initializers with side effects when instantiating a cla...
• 74517e6 Align lock file maintenance with other updates (#6571)
• c60b554 Make addWatchFile watch test robust against watcher start-up timing (#6573)
• d9095cf Lock file maintenance (#6570)
• 4a6f9c3 Recognize top-level asynchronous loops and disposal (#6563)
• 05a2938 4.64.5
• d45f8e8 fix: prevent cycles for indirectly awaited dynamic imports (#6516)
• Additional commits viewable in compare view

Updates zod from 4.6.5 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

• b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

• 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
• 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
• 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
• 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
• b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
• 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
• bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
• c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
• 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

Commits

• b500a2e 4.6.7
• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
• 529f78d 4.6.6
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
• c42596b release: hold the run on the release-approval environment until the staged ve...
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• b2ef983 docs: add Code for Japan to bronze sponsors
• 74304ce release: stage npm versions instead of publishing them (#6622)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[julien-deramond]

Dev-only bumps for v5, no change to what we ship.

• bundlewatch 0.4.2 → 1.1.0 (major): the same upgrade as on main, where the status and baseline upload already work. Same CLI, config and env vars, needs Node ≥ 22.17 (we're on 24.18).
• rollup 4.64.7 / postcss 8.5.30: all 14 dist/ files are the same gzip size as on v5-dev.
• @astrojs/prism 4.1.0 needs Node ≥ 22.22: fine with .nvmrc, and the docs build passes.
• Everything else is a patch, or a minor with nothing we use changing (cspell, lockfile-lint's opt-in checks).