chore(deps): dependency upgrades

[donfear]

📦 Dependency upgrades

Scanned 29 packages — 11 unique upgrade(s) (12 across workspaces) (3 with a major available, 1 with known vulnerabilities).

✅ Applied in this PR

• @astrojs/markdown-satteri ^0.3.6 → ^0.4.1 (devDependencies)
• @astrojs/sitemap ^3.7.3 → ^3.7.4 (dependencies)
• @biomejs/biome ^2.5.9 → ^2.5.12 (devDependencies)
• @iconify-json/lucide ^1.2.123 → ^1.2.130 (dependencies)
• @types/node ^26.2.0 → ^26.5.0 (devDependencies)
• astro ^7.2.3 → ^7.3.2 (dependencies)
• marked ^18.0.10 → ^18.0.12 (devDependencies)
• undici ^8.10.0 → ^8.10.2 (dependencies)

Updates

Package	Current	→ In-range	Latest	Type	Applied	Major?	Security
@astrojs/markdown-satteri	^0.3.6	^0.4.1	0.4.1	devDependencies	✅	—	—
@astrojs/sitemap	^3.7.3	^3.7.4	3.7.4	dependencies	✅	—	—
@biomejs/biome	^2.5.9	^2.5.12	2.5.12	devDependencies	✅	—	—
@iconify-json/lucide	^1.2.123	^1.2.130	1.2.130	dependencies	✅	—	—
@types/node	^26.2.0	^26.5.0	26.5.0	devDependencies	✅	—	—
@vitest/coverage-v8	^4.1.11	^^4.1.11	5.0.0	devDependencies	—	⚠️ yes	—
astro	^7.2.3	^7.3.2	7.3.2	dependencies	✅	—	🟢 fixed by in-range bump
marked	^18.0.10	^18.0.12	18.0.12	devDependencies	✅	—	—
typescript	^6.0.3	^^6.0.3	7.0.2	devDependencies	—	⚠️ yes	—
undici	^8.10.0	^8.10.2	8.10.2	dependencies	✅	—	—
vitest	^4.1.11	^^4.1.11	5.0.0	devDependencies	—	⚠️ yes	—

🔒 Security

• astro — 2 advisory(ies), highest 🟣 critical — 🟢 fixed by in-range bump
  • Astro: Remote code execution through AVIF image optimization (🟣 critical, affects <7.2.8) — cleared by in-range bump
  • Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base (🟠 moderate, affects <=7.2.3) — cleared by in-range bump

⏭️ Major updates available (not applied)

A new major version exists beyond the in-range bump above. Under the default minor policy the major jump is not applied — review and bump deliberately:

• @vitest/coverage-v8 (current ^4.1.11) → 5.0.0 (devDependencies)
• typescript (current ^6.0.3) → 7.0.2 (devDependencies)
• vitest (current ^4.1.11) → 5.0.0 (devDependencies)

---

🤖 Opened by inup. Re-runs update this same PR.