[dependabot]

Short Summary (TL;DR)

Brings every dependency up to date, and removes the PostCSS setup and other leftovers nothing needs. No site code changed.

The Issue

Dependabot bumped postcss-nested to v9, but nothing loads it. postcss-import and postcss-nested stayed in package.json after the Tailwind v4 migration (#312) cut postcss.config.cjs down to autoprefixer, sass came in with astro-tabs, which was later replaced by our own Tabs.astro, and octokit already depends on @octokit/auth-app.

Autoprefixer only adds prefixes for browsers older than Tailwind v4's minimum of Safari 16.4, Chrome 111 and Firefox 128, where the site does not work anyway. src/env.d.ts repeats what Astro's base tsconfig already includes.

npm audit reports 7 moderate findings, before and after this change:

postcss-selector-parser  <7.1.6, via @tailwindcss/typography, fix only by downgrading typography to 0.5.4
sprintf-js  *, via gray-matter in astro-rehype-relative-markdown-links, no fix available

How This PR Solves The Issue

Ran npx @astrojs/upgrade and npm update, which moved astro to 7.4.1, @astrojs/mdx to 8.1.0, @astrojs/react to 7.1.0 and the rest within their ranges, so npm outdated is empty. Then uninstalled postcss-nested, postcss-import, autoprefixer, sass and @octokit/auth-app, and deleted postcss.config.cjs and src/env.d.ts. The "DDEV Website for Contributors" post linked to postcss.config.cjs, so that line now links to the Tailwind config and the Typography plugin only.

Astro 7.4 no longer depends on esbuild, and removing sass drops @parcel/watcher, so no installed package has install scripts left on Linux and npm install-scripts prune removed the allowScripts key.

Astro 7.4 runs astro dev in the background when it detects an AI agent. DDEV HEAD after ddev/ddev#8380 passed the agent variables to supervisord, so the daemon kept exiting and respawning, and ddev/ddev#8976 fixes that in DDEV, so the daemon command needs no change. The bump-deps skill no longer names packages that are gone from its allowScripts example, and its daemon check no longer describes the old .astro/dev.json collision.

Manual Testing Instructions

ddev start

# check for problems in:
ddev logs
ddev npm run build
ddev npm audit

astro-dev-daemon should reach RUNNING once and stay there.

Compare https://dependabot-npm-and-yarn-majo-3f12.ddev-com-front-end.pages.dev against https://ddev.com/, in desktop and mobile views: /blog/markdown-features-demo/, /get-started/ with its tabs, /usage-stats/, site search, and the theme toggle.

Release/Deployment Notes

The Cloudflare build no longer installs sass, autoprefixer, postcss-import, postcss-nested or esbuild. The Tailwind bundle loses -moz-, -o- and -webkit-appearance prefixes that only browsers older than Tailwind v4's minimum need, and keeps the -webkit-backdrop-filter and PhotoSwipe prefixes autoprefixer used to strip.

🤖 Developed with assistance from Claude Code

[cloudflare-workers-and-pages]

Deploying ddev-com-front-end with    Cloudflare Pages

Latest commit:	50bf067
Status:	✅  Deploy successful!
Preview URL:	https://2a9be1f5.ddev-com-front-end.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-majo-3f12.ddev-com-front-end.pages.dev

View logs

[stasadev]

ddev/ddev#8976 fixes the cause, so this PR does not need --ignore-lock. ddev start stopped passing AI_AGENT, CLAUDECODE and the other agent variables to supervisord, so astro-dev-daemon stays in the foreground no matter who ran ddev start.

The leak came from ddev/ddev#8380, which no DDEV release includes yet (it is newer than v1.25.4), so once ddev/ddev#8976 is merged no released version has the problem and ddev_version_constraint can stay as it is. Only a HEAD build made between the two merges would still background the server.

2089a54 drops --ignore-lock and its comment sentence from the astro-dev-daemon command in .ddev/config.yaml, and keeps the daemon check in .claude/skills/bump-deps/SKILL.md as a general one without the flag.

Tested with a DDEV build of ddev/ddev#8976 by running ddev restart from Claude Code, with AI_AGENT and CLAUDECODE set. Neither supervisord nor astro dev had the agent variables, the daemon was spawned once and stayed RUNNING with "background": false in .astro/dev.json, and ddev exec still got AI_AGENT.

🤖 Developed with assistance from Claude Code