Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
@astrojs/rss (source)	dependencies	patch	4.0.18 → 4.0.19
@tailwindcss/vite (source)	dependencies	patch	4.3.1 → 4.3.2
astro (source)	dependencies	patch	7.0.3 → 7.0.4
tailwindcss (source)	dependencies	patch	4.3.1 → 4.3.2

---

Release Notes

withastro/astro (@​astrojs/rss)

v4.0.19

Patch Changes

• #​17209 fbcfa03 Thanks @​matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.

tailwindlabs/tailwindcss (@​tailwindcss/vite)

v4.3.2

Compare Source

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#​20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#​20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#​20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#​20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#​20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#​20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#​20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#​20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#​20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#​20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#​20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#​20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#​20289)

withastro/astro (astro)

v7.0.4

Patch Changes

• #​17212 7ba0bb1 Thanks @​matthewp! - Ensures transition directive values are HTML-escaped when rendered on hydrated islands

• #​17224 dc5e52f Thanks @​astrobot-houston! - Fixes trailing slash handling for dynamic file endpoints in dev mode. Dynamic file endpoints (e.g., src/pages/api/[name].json.ts) with trailingSlash: "always" incorrectly required a trailing slash in dev mode, returning 404 for /api/bar.json and 200 for /api/bar.json/.

• #​17067 23f9446 Thanks @​fkatsuhiro! - Fixed a bug where the development toolbar did not output a warning even though the implicit ARIA role and the manually specified role were duplicated.

• #​17234 d5fbee8 Thanks @​ocavue! - Adds support for sharp v0.35. pnpm users no longer need to approve sharp's build script (see allowBuilds) when on v0.35.

• #​17223 5970ef4 Thanks @​astrobot-houston! - Fixes getCollection() returning empty in dev mode for large content collections (500k+ entries)

• #​17184 799e5cd Thanks @​Princesseuh! - Upgrades the Rust compiler to the latest, which fixes some bugs. Refer to its changelog for more information.

• #​17208 da8b573 Thanks @​matthewp! - Hardens forwarded header handling so the internal request helper validates X-Forwarded-Host against security.allowedDomains before trusting X-Forwarded-For for clientAddress. Previously it only checked that the header was present, which was inconsistent with the public createRequest helper. This aligns both code paths; behavior is unchanged for correctly configured proxies.

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • Between 06:00 PM and 11:59 PM (* 18-23 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: package-lock.json

npm --before could not be enforced because existing locked packages were published after the minimumReleaseAge cutoff. This will resolve after the next lock file maintenance run.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tailwindcss@​4.3.1 ⏵ 4.3.2			-3
	astro@​7.0.3 ⏵ 7.0.4			+1
	@​tailwindcss/​vite@​4.3.1 ⏵ 4.3.2
	@​astrojs/​rss@​4.0.18 ⏵ 4.0.19	+1			+6

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm astro is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/astro@7.0.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/astro@7.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report