Conversation
Coordinated major upgrade, kept separate from the safe security batch (#1066) because it can break the custom setup: astro ^6 -> ^7.1.6 @astrojs/starlight ^0.38 -> ^0.41.6 (0.41.0 drops Astro 6) @astrojs/mdx ^5.0.2 -> ^7.0.5 (peers astro ^7) sharp ^0.33 -> ^0.35.3 (astro 7 allows ^0.34 || ^0.35) starlight-image-zoom ^0.14 -> ^0.15 (peers starlight >=0.41) @astrojs/markdown-remark new ^7.2.2 (see below) Bumped in package.json by hand and the lockfile regenerated from scratch, so none of Dependabot's lock diffs are pulled in. The stale lockfile had to go: npm otherwise tries to reconcile the old pinned tree (mdx 5.0.2, starlight 0.38.1, image-zoom 0.14.1) against the new ranges and reports a phantom peer conflict. Resolved cleanly with no --force and no --legacy-peer-deps; every peer lands on astro 7.1.6, all deduped. Astro 7 renders Markdown with Sätteri by default, and Sätteri does not run remark plugins. src/integrations/beacon-transforms.mjs IS a remark plugin and produces the entire Beacon design on every page, so under Sätteri it would go silent with a green build. astro.config.mjs therefore opts back into the remark/rehype pipeline explicitly: markdown: { processor: unified({ remarkPlugins: [beaconTransforms] }) } That is the replacement the Astro 6.4 deprecation warning asks for, so this also removes a warning main currently prints on every build. @astrojs/markdown-satteri is not declared: it is an optional peer of @astrojs/mdx and we stay on the remark pipeline. It still installs transitively, so the Sätteri path remains available later. Closes the sharp high-severity alert (#54, needs 0.35.0 — unreachable on astro 6, which pins sharp ^0.34) plus the three astro 7.x advisories (#41, #45, #46). No documentation content changed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Manual click-through checklistA green build is not proof — everything automated has been run and reported in the PR body; this is the part that needs eyes. Open the Vercel preview for this PR (not For each row: does it behave the same as production? "Different" is the finding, not "broken".
Rows 4 and 8 are where I'd expect trouble first if anything is wrong. On this PR specifically (Astro 7): row 4 matters most — Astro 7 changes CSS delivery (Starlight now inlines some component CSS). I verified statically that our Also worth an extra beat on row 7 — if the Beacon design were going to break, this is the PR that would do it (see the Sätteri note in the description). The marker counts say it's intact; your eyes confirm it looks intact. |
|
Refreshed onto Refresh: merged New finding — a cosmetic peer warning this upgrade introduces. Cause: I did not add an One process note: a plain The click-through checklist above is unchanged and still needs walking before merge. |
|
Walked the 9-row checklist myself in a real browser, so you're re-checking rather than discovering. Caveat on where: the network was down here, so this ran against the local
Row 4 in detail — the fragile spotRound trip snowflake-plain → transformations → snowflake-plain, all by real sidebar clicks. I set
One thing worth knowing so it doesn't scare you: a screenshot taken mid-transition shows the content shifted left and clipped. That is the transition animation in flight — 3 seconds later the layout is pixel-identical to the pre-navigation state. Not a defect. Row 6 — the Ask Kai trigger is supposed to be missing hereI first read the absent // Kai only works when the backend env (AI_SERVICE_URL + KBC_STORAGE_API_TOKEN)
// is configured. A static page can't see server env, so probe GET /api/chat
// once per session and hide the entry points unless the backend confirms it.It probes A local Two consequences worth being explicit about:
What still needs youAll 9 rows pass, so this isn't "unverified" any more — but it's my read, on a local serve. Before merging I'd still want your eyes on row 4 on the actual Vercel preview (the one thing where Vercel's serving could differ) and a subjective look at row 7, since "renders" and "looks right" aren't the same claim. |
|
Closing the gap I left open above: row 4 now verified on the actual Vercel preview, not just a local serve. The network came back, so I redid it there. Preview confirms it's serving this build — Row 4 on the preview — same round trip,
Row 2 on the preview — The Kai gate, now confirmed empirically rather than by reading codeI predicted above that the Ask Kai trigger would also be absent on this preview, and why. That's now measured, and the mechanism is visible end to end:
So the trigger's absence is the gate working correctly at both ends — a 404'd endpoint locally, an explicit That leaves the checklist fully walked, on the artifact you'd actually click. What's genuinely left is a subjective look — "renders" and "looks right" aren't the same claim, and that call is yours. |
# Conflicts: # package-lock.json
Astro 6's compiler auto-closed the element at EOF; Astro 7's rejects it with `Unexpected token` at 141:0 and the entire build fails. Closing the tag at the end of the file reproduces the tree Astro 6 emitted — verified in dist/404.html: sidebar, NotFoundSuggestions and the InkDash canvas all still render.
7.1.6 no longer clears the advisory set it was pinned for: the XSS advisory on astro covers <=7.2.7, so the critical survived the upgrade as written. 7.3.2 is the fixed release. Only `astro` moves in package.json. starlight and mdx follow inside their existing carets (0.41.11, 7.0.8) and markdown-remark resolves to 7.3.1, which is what astro 7.3.2 peers for — so no coordinated majors are needed. The lockfile is regenerated from scratch; a plain install on top of the old one hits ERESOLVE on the markdown-remark peer. npm audit on this branch: 5 advisories (0 critical / 3 high), against 11 (1 critical / 4 high) on main. sharp lands on 0.35.4, closing its high. What remains is the @vercel/node -> undici / path-to-regexp chain, whose only offered fix is the breaking downgrade to 4.0.0. Re-ran the A/B against a build of main from the same content: 623 HTML files both sides, all 12 Beacon and chrome markers identical, so the remark pipeline is still running. Visible text differs on 5 pages, all SmartyPants quote direction — 4 are fixes, the 5th is the known literal quote in the CSV enclosure table, which flips on main too. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Iamfle4ka
changed the title
keboola-pr-reviewer-bot
left a comment
keboola-pr-reviewer-bot
left a comment
There was a problem hiding this comment.
Verdict: needs_human (risk 4/5) · profile connection-docs
PR exceeds size cap (6158 source LOC across 4 source files; 0 test/fixture LOC across 0 files excluded from the cap).
Iamfle4ka
added
the
site-tooling
This branch was successfully deployed
2 participants
PR B of the Dependabot split — the coupled major upgrade, deliberately separate from the safe patch/minor batch (#1066 in August, #1130 now) because this is the half that can break the custom setup. Supersedes the bot's #1123, #1062 and #1041.
astro^6^7.3.2<=7.2.7; 7.3.2 is the fixed release@astrojs/starlight^0.38^0.41.6→ resolves 0.41.11@astrojs/mdx^5.0.2^7.0.5→ resolves 7.0.8astro ^7sharp^0.33^0.35.3→ resolves 0.35.4starlight-image-zoom^0.14^0.15starlight >=0.41@astrojs/markdown-remark^7.2.2→ resolves 7.3.1package.jsonbumped by hand, lockfile regenerated from scratch — none of Dependabot's lock diffs pulled in. No--force, no--legacy-peer-deps.Why 7.3.2 and not 7.1.6 (updated 2026-09-15): the original pin no longer cleared the advisory it was pinned for — the astro XSS advisory covers
<=7.2.7, so the critical survived the upgrade as written. Onlyastromoves inpackage.json; starlight and mdx follow inside their existing carets, so no coordinated major bumps are needed. Note that a plainnpm installon top of the old lockfile hits ERESOLVE on the@astrojs/markdown-remarkpeer — the lockfile has to be regenerated.The one thing that made this risky
Astro 7 renders Markdown with Sätteri by default, and Sätteri does not run remark plugins.
src/integrations/beacon-transforms.mjsis a remark plugin, and it produces the entire Beacon design on every page — check grids, step cards, pseudo-H4s (which feed the right-rail TOC), bold-prefix asides, table scrollers, glossaries. Left alone it would have gone completely silent with a green build.So the config opts back into the remark/rehype pipeline explicitly, which is exactly the replacement the Astro 6.4 deprecation warning asks for:
Side benefit: this removes a deprecation warning
maincurrently prints on every build.@astrojs/markdown-satteriis intentionally not declared — it's an optional peer of@astrojs/mdxand we stay on remark. It still installs transitively, so adopting Sätteri later remains open.Verification — A/B'd against a build of main from the same content
Re-run on 2026-09-15 after merging
main(150 commits) and raising the target. A green build proves nothing here, somainwas built from the same content and the twodist/trees compared mechanically.Structure: 363 pages, 623 HTML files — identical on both sides.
Beacon + chrome markers, counted across all 623 files — all 12 identical:
beacon-steps27,beacon-step75,beacon-pseudo-h455,beacon-check-grid7,beacon-glossary344,beacon-table-scroll249,starlight-aside1480,expressive-code1207,image-zoom7477,anchor-links4,<h4357. The remark pipeline is provably still running.Visible text, all 623 pages (scripts/styles stripped, whitespace collapsed): 5 pages differ, all typographic quote direction from a newer SmartyPants — 4 of the 5 are fixes, where an opening quote was previously rendered as a closing one:
/kai/best-practices/,/kai/use-cases/—”Calculate…"→“Calculate…”✅/components/extractors/generic-extractor/configuration/config/and…/config/jobs/—”c”/”green”→“c”/“green”✅/storage/tables/csv-files/— a literal"in the CSV-enclosure table flips“→”. Pre-existing issue, not caused by this PR: SmartyPants mangles that literal quote in both builds. Worth a separate content fix; out of scope here.Gates:
audit-phase2.mjs130 issues / 29 broken links / 0 missing images / 3 multi-h1 — identical to themainbaseline.check-cli-reference.mjs0 findings.npm run gen:sidebarproduces no diff.Security:
npm audit11 advisories (1 critical / 4 high / 5 moderate / 1 low) on main → 5 (0 critical / 3 high / 2 moderate) here. The critical onastroand the high onsharpare closed, as are the moderates onstarlight,mdxandastro-expressive-code. What remains is the@vercel/node→undici/path-to-regexpchain, whose only offered fix is the breaking downgrade to@vercel/node@4.0.0— the same conclusion #1130 reached.Build warnings: the
markdown.remarkPlugins … deprecatedwarning is gone. One remains (i18ncollection empty), identical onmain.Notes for review
@vercel/node ^5.8.4/js-yaml ^4.2.0— those bumps belong to PRDCT-685: Dependabot bumps — September safe set (no framework majors) #1130, deliberately not duplicated here.Still needs a human
Everything above is static/mechanical. The click-through checklist is in the comment below — please don't merge before it's walked, per the original ask.
🤖 Generated with Claude Code