Dependencies

Notable runtime and build dependencies of the framework, and the policies around them.

Pinned via root pnpm.overrides

'pnpm': { 'overrides': { 'picomatch@<4': '^2.3.2', 'vite@^7': '^7.3.2' } }

Astro pins to Vite 7. The warnIfVite8() check in packages/astro/src/core/dev/dev.ts warns users if they accidentally install Vite 8 — that version brings breaking changes that haven't yet been integrated.

Build-only native deps

pnpm-workspace.yaml onlyBuiltDependencies is the allowlist of native postinstall scripts:

• esbuild — Vite's transformer, runtime importer.
• workerd — Cloudflare runtime used in @astrojs/cloudflare tests.
• @biomejs/biome — code formatter.
• sharp — default image service.
• @parcel/watcher — fast filesystem watcher (used by content layer + Vite).
• keytar — used by astro login/astro link for OS keychain integration.
• @vscode/vsce-sign — used by the VS Code extension build.

Anything outside this list is forbidden from running postinstall.

Patched deps

patches/@changesets__get-github-info@0.7.0.patch — works around a known issue in @changesets/get-github-info. Keep an eye on upstream for a fix.

Framework runtime deps

The most consequential deps for the runtime (declared in packages/astro/package.json):

Dep	Role
@astrojs/compiler	The Go/WASM .astro compiler.
@astrojs/markdown-remark	Sibling workspace package.
@astrojs/internal-helpers	Sibling workspace package.
@astrojs/telemetry	Sibling workspace package.
vite, @vitejs/*	Dev/build engine.
rollup	Used through Vite for production bundling.
esbuild	Used by Vite for dev transforms and dep optimization.
shiki	Markdown syntax highlighting.
magic-string	Used by various Vite plugins for source-map-aware string mutation.
unstorage	Pluggable session/storage backend.
unified, remark-*, rehype-*	Markdown processing.
kleur, piccolore	Terminal colors.
yargs-parser	CLI argument parsing.
tinyexec, tinyclip, tinyglobby	Small replacements for traditional execa/clipboardy/globby to keep the CLI lightweight.
zod	Runtime validation. The bundled version is exposed as astro/zod.

Security-tracked deps

pnpm-workspace.yaml's minimumReleaseAgeExclude allows immediate installation of curated security updates, bypassing the normal 3-day cooldown:

• fast-xml-parser@5.3.8
• svelte@5.53.5
• fastify@5.8.1 || 5.8.3
• rollup@4.59.0
• undici@7.24.0
• smol-toml@1.6.1
• picomatch@4.0.4

Add to this list when Renovate or Dependabot opens a security update PR.

Peer ranges

pnpm-workspace.yaml:

peerDependencyRules:
  allowAny:
    - astro
    - vite

Means the workspace tolerates any peer-dep range for astro and vite to keep installs quiet across the many integration packages.

Dev tooling deps

Dep	Role
@biomejs/biome	Linter + formatter.
prettier, prettier-plugin-astro	Formatter for non-code files.
eslint, typescript-eslint, eslint-plugin-regexp	Lint.
knip	Unused exports detection.
publint	Validates publishable packages.
turbo	Build orchestration.
@changesets/cli, @changesets/changelog-github	Versioning + release notes.
bgproc	Background process manager (used by agents and devs).
@flue/cli, @flue/client	Internal Astro tooling under active development.

Related pages

• how-to-contribute / tooling
• reference / Vite dep optimizer