Upgrade: Bump the patch-updates group across 1 directory with 9 updates

[dependabot]

Bumps the patch-updates group with 9 updates in the / directory:

Package	From	To
@astrojs/check	0.9.8	0.9.9
@astrojs/rss	4.0.18	4.0.19
@astrojs/sitemap	3.7.2	3.7.3
@iconify-json/material-symbols	1.2.66	1.2.83
@tailwindcss/typography	0.5.19	0.5.20
astro	5.18.1	5.18.2
sanitize-html	2.17.3	2.17.5
@astrojs/ts-plugin	1.10.7	1.10.10
@types/hast	3.0.4	3.0.5

Updates @astrojs/check from 0.9.8 to 0.9.9

Changelog

Sourced from @​astrojs/check's changelog.

0.9.9

Patch Changes

• #16471 f56bb3f Thanks @​delucis! - Adds support for TypeScript v6 to peer dependencies range

• Updated dependencies [8c62159]:

  • @​astrojs/language-server@​2.16.7

Commits

• c1f2e4f [ci] release (#16467)
• f56bb3f Widen typescript peer dependency range to allow v6 (#16471)
• 184700c fix(deps): update language tools (#16230)
• 88fcc98 fix integrations links across docs (#16098)
• b9e96da fix(deps): update dependency vitest to v4 (#15372)
• See full diff in compare view

Updates @astrojs/rss from 4.0.18 to 4.0.19

Release notes

Sourced from @​astrojs/rss's releases.

@​astrojs/rss@​4.0.19

Patch Changes

• #17209 fbcfa03 Thanks @​matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.

Changelog

Sourced from @​astrojs/rss's changelog.

4.0.19

Patch Changes

• #17209 fbcfa03 Thanks @​matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.

Commits

• 5978993 [ci] release (#17213)
• 2bfb179 chore: simpler package.json types (#17229)
• fbcfa03 Escape source and enclosure fields in RSS feed generation (#17209)
• 5a8cd09 refactor: update tsconfig to use TypeScript project references (#16505)
• 46633f5 refactor(create-astro): migrate tests to typescript (#16400)
• 747a5b3 refactor: migrate astro-rss tests to typescript (#16357)
• 88fcc98 fix integrations links across docs (#16098)
• See full diff in compare view

Updates @astrojs/sitemap from 3.7.2 to 3.7.3

Changelog

Sourced from @​astrojs/sitemap's changelog.

3.7.3

Patch Changes

• #16837 783c4a6 Thanks @​jdevalk! - Improves <lastmod> accuracy in the sitemap index. Each <sitemap> entry in sitemap-index.xml is now stamped with the most recent lastmod of the URLs in the child sitemap it points to, instead of repeating a single global date on every entry. When a child sitemap has no per-URL lastmod, the entry falls back to the lastmod option as before. This gives search engines a per-file freshness signal, so they can tell which child sitemaps actually changed without refetching all of them.

Commits

• 1e49163 [ci] release (#16832)
• 783c4a6 Stamp sitemap index entries with per-file lastmod (#16837)
• 5a8cd09 refactor: update tsconfig to use TypeScript project references (#16505)
• 5c543c5 refactor(astro): add internal entry points for test (#16473)
• f7566b8 refactor: unify test setup (#16445)
• ba2dbf1 refactor(astro): correct Fixture type signatures in test-utils (#16380)
• 245f300 refactor: migrate sitemap tests to typescript (#16353)
• 88fcc98 fix integrations links across docs (#16098)
• See full diff in compare view

Updates @iconify-json/material-symbols from 1.2.66 to 1.2.83

Commits

• See full diff in compare view

Updates @tailwindcss/typography from 0.5.19 to 0.5.20

Release notes

Sourced from @​tailwindcss/typography's releases.

v0.5.20

Fixed

• Support installing with stable versions of Tailwind CSS v4 (#424)

Changelog

Sourced from @​tailwindcss/typography's changelog.

[0.5.20] - 2026-06-08

Fixed

• Support installing with stable versions of Tailwind CSS v4 (#424)

Commits

• e3714a3 0.5.20
• f34283d Update tailwindcss peer dependency version (#424)
• 543de42 bump Node.js
• 881b048 Setup OIDC (#423)
• 74a3da7 Fix typo in README.md (#413)
• 3963dfe Bump js-yaml from 3.14.1 to 3.14.2 (#410)
• abf85cc className instead of classname (#406)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​tailwindcss/typography since your current version.

Updates astro from 5.18.1 to 5.18.2

Changelog

Sourced from astro's changelog.

5.18.2

Patch Changes

• #16813 8f7d8c4 Thanks @​matthewp! - Populates styles in the SSR manifest for prerendered routes. Previously, prerendered routes had styles: [] in the manifest, making it impossible for workers or middleware to discover which CSS files a prerendered page uses.

Commits

• 1f9b6e0 [ci] release (#16841)
• 8f7d8c4 Populate external stylesheet URLs for prerendered routes in manifest (#16813)
• See full diff in compare view

Updates sanitize-html from 2.17.3 to 2.17.5

Changelog

Sourced from sanitize-html's changelog.

2.17.5 (2026-06-10)

Security

• Added a number of new attributes to be protected against unsafe URLs, e.g. javascript: and similar. None of these are used in the default configuration of sanitize-html or apostrophe or likely to be used there, and some attributes, like an action for a form, are inherently unsafe to allow if XSS protection is your goal. Nevertheless it makes sense to block certain URL types where they are not appropriate. Some attributes are not supported at all by modern browsers but are included for completeness. Thanks to crattack for reporting the vulnerability.
• Address a potential vulnerability when nonTextTags is configured in a nonstandard way. While it is never a good idea to remove known non-text tags from the standard list e.g. script, styles, etc., this change ensures that doing so does not result in nested tags being passed through without sanitization when they are not expressly allowed. (ApostropheCMS would never trigger this situation.) Thanks to Dipanshu singh for pointing out the issue and contributing the fix.

2.17.4

Changes

• sanitize-html and launder now share a single implementation of naughtyHref, based on that which previously existed in sanitize-html.

Security

• Security vulnerability: the xmp tag could be used to pass forbidden markup through sanitize-html, even when xmp itself is not explicitly allowed All users of sanitize-html should update immediately. Thanks to Vincenzo Turturro for reporting the vulnerability.

Commits

• 2427508 release and changelog edits (#5465)
• 5a88e96 Latest security q2 (#5464)
• 958d162 merge main to latest (#5460)
• e9b0ab0 release only (changelogs formatted) (#5408)
• f03fa5b Latest security merge (#5407)
• See full diff in compare view

Updates @astrojs/ts-plugin from 1.10.7 to 1.10.10

Release notes

Sourced from @​astrojs/ts-plugin's releases.

@​astrojs/ts-plugin@​1.10.10

Patch Changes

• #17269 c72d4f2 Thanks @​matthewp! - Fixes "Go To References" from .ts files missing usages inside .astro files that are reached through Astro.locals. The plugin now injects Astro's ambient types so type chains like Astro.locals.utils.toUpper() resolve, matching the language server.

Changelog

Sourced from @​astrojs/ts-plugin's changelog.

1.10.10

Patch Changes

• #17269 c72d4f2 Thanks @​matthewp! - Fixes "Go To References" from .ts files missing usages inside .astro files that are reached through Astro.locals. The plugin now injects Astro's ambient types so type chains like Astro.locals.utils.toUpper() resolve, matching the language server.

1.10.9

Patch Changes

• #16661 03b8f7f Thanks @​ocavue! - Updates typescript to v6. No changes are needed from users.

• Updated dependencies [03b8f7f]:

  • @​astrojs/yaml2ts@​0.2.4

1.10.8

Patch Changes

• #16716 04fdbb2 Thanks @​delucis! - Drops support for versions of VS Code below 1.101.0 [May 2025]

Commits

• See full diff in compare view

Updates @types/hast from 3.0.4 to 3.0.5

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions