build: bump the docs-dependencies group in /docs with 2 updates

[dependabot]

Bumps the docs-dependencies group in /docs with 2 updates: @astrojs/starlight and astro.

Updates @astrojs/starlight from 0.41.3 to 0.41.4

Release notes

Sourced from @​astrojs/starlight's releases.

@​astrojs/starlight@​0.41.4

Patch Changes

• #3936 712eedd Thanks @​miichom! - Fixes support for modifying Zod enums when passing an extend option to Starlight’s docsSchema()

• #4092 0896b91 Thanks @​delucis! - Fixes support for links containing a protocol like mailto: in the sidebar

• #4088 4486ba4 Thanks @​delucis! - Simplifies Starlight’s client-side sidebar state persistence script slightly

Changelog

Sourced from @​astrojs/starlight's changelog.

0.41.4

Patch Changes

• #3936 712eedd Thanks @​miichom! - Fixes support for modifying Zod enums when passing an extend option to Starlight’s docsSchema()

• #4092 0896b91 Thanks @​delucis! - Fixes support for links containing a protocol like mailto: in the sidebar

• #4088 4486ba4 Thanks @​delucis! - Simplifies Starlight’s client-side sidebar state persistence script slightly

Commits

• ab2792b [ci] release (#4090)
• 712eedd fix: invalid option error when modifying enums in docsSchema's extend (#3936)
• 0896b91 Support links with any protocol in sidebars (#4092)
• 4486ba4 Remove pagehide event from sidebar persistence script (#4088)
• See full diff in compare view

Updates astro from 7.1.2 to 7.1.3

Release notes

Sourced from astro's releases.

astro@7.1.3

Patch Changes

• #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

Changelog

Sourced from astro's changelog.

7.1.3

Patch Changes

• #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

Commits

• cf9ffc7 [ci] release (#17455)
• 630b382 Use os.availableParallelism() for image optimization queue to fix OOM in CP...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cloudflare-workers-and-pages]

Deploying quickadd with    Cloudflare Pages

Latest commit:	a0d6776
Status:	✅  Deploy successful!
Preview URL:	https://9d8aea4f.quickadd.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-docs-nnpu.quickadd.pages.dev

View logs

[chhoumann]

Verdict: APPROVE as-is. No code change needed. One timing caveat below.

@astrojs/starlight 0.41.3 -> 0.41.4, astro 7.1.2 -> 7.1.3.

Note first: no CI job builds the docs site. ci.yml builds only the plugin, and Cloudflare Pages builds docs from master after merge. So the green checks on this PR say nothing about the docs bump. The evidence below is a local before/after build, and it is the only real evidence that exists for this PR.

Method

Built docs/ twice on branches rebased onto current master (the branch is 4 commits behind, and comparing against master head produced phantom diffs from #1606's docs content). 50 pages both times.

Result: the output is equivalent, with exactly one intended upstream change

Byte-identical:

• docs.md, docs-index.json, llms.txt, llms-full.txt
• _redirects, _headers, sitemap-index.xml
• all 7 client JS bundles (page.*.js, ui-core.*.js, starlight-toc.*.js, Search.*.js, TableOfContents.*.js, MobileTableOfContents.*.js, ec.*.js)
• common.css after normalizing Astro's scoped-class hashes (63535 bytes both)
• pagefind search index: same version (1.5.2), same 48 fragments, same 5 index shards, identical 152311 total fragment bytes

All 50 HTML pages are structurally identical after normalizing (a) Astro scoped-class hashes and (b) the generator meta strings. The single residual difference, present on every page, is this inline sidebar-persistence script losing one line:

- addEventListener(`pageHide`, a);
+ (nothing)

That is starlight #4088, "Simplifies Starlight's client-side sidebar state persistence script slightly". Worth noting the removed listener was dead code: DOM event names are case-sensitive and the spec event is pagehide, so addEventListener("pageHide", ...) never fired. State persistence continues via visibilitychange, which is what was actually doing the work. Behaviour is unchanged.

The other two 0.41.4 fixes are unreachable here: the docsSchema() Zod-enum extend fix (this site does not use extend) and the sidebar mailto: protocol fix (no protocol links in the sidebar).

Lockfile churn is larger than "2 updates" suggests, and it is benign

455 changed lines. Beyond the two named packages: @astrojs/markdown-satteri 0.3.3 -> 0.3.4 with its @bruits/satteri-* platform binaries, expressive-code 0.44.0 -> 0.44.1, and re-pinned @types/node. Nothing left the graph; satteri is still present (11 entries). The zod 4.4.3 pin still resolves. docs/ is a separate package with its own lockfile and overrides, so none of this can reach the plugin.

Caveat: this trips your own supply-chain quarantine

~/.npmrc sets min-release-age=7. pnpm install --frozen-lockfile in docs/ is blocked locally:

Safe-chain: blocked 1 direct package download request(s) due to minimum package age:
 - smol-toml@1.7.1

smol-toml@1.7.1 was published 2026-07-26, one day ago. I vetted it before bypassing: published via npm OIDC trusted publishing, approved by cyyynthia (squirrelchat/smol-toml), the same publishing identity as 1.7.0. It is a legitimate release, just fresh. CI is unaffected (safe-chain is a local wrapper).

@astrojs/starlight@0.41.4 (07-22) also sits inside the window until 2026-07-29. astro@7.1.3 (07-20) is already clear.

Suggestion: merge on or after 2026-08-02, when smol-toml@1.7.1 clears your 7-day window, rather than bypassing the gate you configured. Nothing here is urgent. (Also note astro@7.1.4 shipped today, so a follow-up bump is coming regardless.)

What this evidence does NOT cover

Honest limits: a static output diff cannot evaluate live client behaviour, and I did not exercise the deployed site. Given that every JS bundle is byte-identical and the only markup change is the removal of a listener that never fired, I judge the residual risk very low.

Risk: very low. Independent of the other four PRs (separate package, separate lockfile).