Update all non-major dependencies (minor)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
astro-icon (source)	^1.1.5 → ^1.2.0
less (source)	^4.6.4 → ^4.9.0

---

Release Notes

natemoo-re/astro-icon (astro-icon)

v1.2.0

Compare Source

Minor Changes

• #​290 956817e Thanks @​stramel! - Bump @iconify/tools to v5 and @iconify/utils to v3, removing the transitive extract-zip dependency that was flagged for a symlink path-traversal vulnerability (GHSA-jmr9-qjv8-65gv).

  Requires Node ≥22.12 — @iconify/utils v3 uses node:util's styleText, which needs Node ≥20.12/21.7, but the toolchain now also builds against Astro 7 (which itself requires Node ≥22.12). Node 20 reached end-of-life in April 2026, so astro-icon's engines field is raised to the currently-supported floor rather than the bare minimum.

• #​285 2e83ca0 Thanks @​stramel! - title/desc props now accept { id, value } in addition to a plain string, so consumers can set id attributes on the generated <title>/<desc> elements for aria-labelledby referencing.

Patch Changes

• #​291 3db45a5 Thanks @​stramel! - Strip the lastModified timestamp from the generated local icon collection so its output is deterministic across builds, allowing Astro's incremental build cache to work as expected.

• #​288 adb18cf Thanks @​stramel! - Log a warning instead of silently swallowing errors when the local icon collection fails to load, so failures during dev/build are visible instead of hidden.

• #​287 fd5d522 Thanks @​stramel! - Fix icon dir watcher so newly added local icons (including files inside subfolders) are picked up without restarting the dev server

• #​282 8904693 Thanks @​stramel! - Update @iconify/tools and @iconify/utils to resolve axios and undici vulnerabilities pulled in transitively.

• #​286 6af6fcf Thanks @​stramel! - Fix viewBox being inconsistently present on <svg> elements across repeated uses of the same icon. The viewBox is now always kept on the <svg> element, so attributes that depend on it (such as preserveAspectRatio) continue to work. Icons whose viewBox has a non-zero min-x/min-y keep a viewBox on their shared <symbol> and anchor their <use> element, so they stay positioned correctly and a per-instance viewBox override no longer leaks onto other instances of the same icon.

• #​281 df57ce6 Thanks @​stramel! - Fix duplicate/incorrect icons rendering in Chromium-based browsers by rewriting internal SVG ids (e.g. gradients, clip paths) to be unique per rendered icon.

• #​284 09177dd Thanks @​stramel! - Fixes Astro.request.headers warning on prerendered pages by keying the internal per-render icon cache off Astro.locals instead of Astro.request

less/less.js (less)

v4.9.0

Compare Source

Changes

• #​4488 feat: support [...] lookups in @{...} interpolation (@​matthew-dean)
• #​4486 fix: prevent reparsing escape() results (@​snowyukitty)
• #​4481 fix: keep the media type first when flattening nested @​media queries (@​Lfan-ke)

v4.8.1

Compare Source

Changes

• #​4483 fix(release): sync release version from PR title (@​matthew-dean)
• #​4479 fix: leave math functions for the browser when an argument is a runtime CSS var() (@​Lfan-ke)
• #​4477 fix: forwarding an unset variadic no longer overrides callee defaults (@​Lfan-ke)
• #​4474 chore: release v4.8.0 — deprecate legacy identifier forms and dynamic @​charset (@​app/github-actions)

v4.8.0

Compare Source

Changes

• #​4473 fix(mixing): resolves issue #​4234 (@​puckowski)
• #​4472 Fix boolean() parsing for comparisons between inline condition expressions (@​app/copilot-swe-agent)

Deprecation Warnings

• #​4475 Deprecate numeric-leading and dash-only variable names, dash-only mixin names, and dynamic @charset interpolation for removal in Less 5.x. Less 4 preserves the existing output while warning; migrate names to valid identifiers and use a static quoted @charset declaration. (@​matthew-dean)

v4.7.0

Compare Source

Changes

• #​4469 Follow-up to #​4462: migrate remaining @​var fixtures, DRY the prelude bare-@​var scan, add warnings coverage (@​matthew-dean)
• #​4462 feat: deprecate bare @​variable in non-value at-rule positions (@​matthew-dean)
• #​4461 Fix #​4460: parse comparison/range syntax in container style() queries (@​dweep-js)
• #​4459 refactor: extract shared ESLint config and add lint scripts (@​JessenReinhart)
• #​4456 Replace image-size with probe-image-size (@​priyamkarn)

v4.6.7

Compare Source

Changes

• #​4457 Fix failing "Request Copilot review" CI job (@​app/copilot-swe-agent)
• #​4451 chore: release v4.6.6 (@​app/github-actions)

v4.6.6

Compare Source

Changes

• #​4450 fix: use printf for PR body to avoid YAML indentation error in run block (@​matthew-dean)
• #​4449 fix: correct push event typo in create-release-pr workflow (pus → push:) (@​matthew-dean)
• #​4446 fix: avoid TypeError on nested @​supports with dumpLineNumbers (@​sarathfrancis90)
• #​4441 Preserve spacing for container feature functions (@​puneetdixit200)
• #​4440 chore: prevent dependency lifecycle scripts (@​puckowski)
• #​4437 docs: fix incorrect contributor attributions in v4.6.0 changelog (@​barry3406)
• #​4434 fix(issue#4316): color calc inside from expression (@​puckowski)

v4.6.5

Compare Source

Bug Fixes

• #​4444 Fix browser export interop by routing bundlers to CJS-typed UMD artifact (@​Copilot)
• #​4427 Fix parenthesis in media query (@​puckowski)
• #​4421 Fix not keyword silently ignored when used without parentheses in conditions (@​Copilot)
• #​4426 Upgrade make-dir to v4 to fix security vulnerability (@​jorenbroekema)

Maintenance

• #​4447 Automate CHANGELOG generation in release workflow (@​matthew-dean)
• #​4448 Add continue-on-error to copilot-review CI job (@​matthew-dean)
• #​4445 Fix Playwright chromium install hang on Node current/lts/* (@​matthew-dean)
• #​4431 PR-based release flow for alpha branches (@​Copilot)
• #​4430 Ensure npm publish is always backed by a GitHub tag, release, and version-bump commit (@​Copilot)
• #​4432 Update packageManager to pnpm@​9.15.9 to match lockfileVersion 9.0 (@​Copilot)
• #​4420 Regression test for @​container mixin parameter variable resolution (@​Copilot)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

❌ Deploy Preview for advanced-astro-kit-i18n failed. Why did it fail? →

Name	Link
🔨 Latest commit	c79a941
🔍 Latest deploy log	https://app.netlify.com/projects/advanced-astro-kit-i18n/deploys/6a8f416e2703d1000836e37c