astro

Changes Fixes an error that could appear after the dev server restarts when using an adapter that reuses its dev runtime across restarts (e.g. ). A request would fail with a : Root cause: on restart, re-ran and pushed onto the carried-over again, producing a duplicate. The duplicate changed the environment's optimizeDeps config hash, forcing a spurious dependency re-optimization on every restart. That re-optimization could leave the reused runtime importing pre-bundled files that had just been rewritten, producing the error above. Fix: only add the condition when it isn't already present, keeping the config hash stable across restarts so no needless re-optimization is triggered. Testing Adds a unit test asserting adds the condition exactly once when called repeatedly (simulating restart). Docs No docs update needed; this is an internal dev-server bug fix with no API change.

Changes Bump volar-service- deps 0.0.70 → 0.0.71 to resolve yaml CVE-2026-33532 pulls → , which is vulnerable to CVE-2026-33532 (GHSA-48c2-rrv3-qjmp, stack-overflow DoS, fixed in yaml 2.8.3). moves to → . Bumping the full volar-service- set in lockstep to keep them aligned against . This propagates the fix down to via its range, no change needed there. Testing No tests added; patch version bump of volar dependencies. Docs This should have zero user-facing effects beyond removing CVE-2026-33532 from their security scanners.

Fixes #16767 In React 19 dev mode, the renderer probe calls the component inside a wrapper during SSR. When the component uses hooks, React emits an "Invalid hook call" warning because the hooks run in 's render context instead of the component's own. The warning is a false positive — the component works correctly. This wraps the probe render with a targeted suppressor that filters only the "Invalid hook call" message, leaving all other errors intact.