feat(deps): upgrade Astro and refresh dependencies

[llbbl]

Summary

• Upgrade the application to Astro 7, @astrojs/node 11, and @astrojs/react 6.
• Upgrade the build pipeline to Vite 8 and refresh safe direct dependencies within their supported release lines.
• Declare and document Node.js 22.12.0 as the minimum supported runtime.
• Set compressHTML: true to preserve Astro 6 HTML-aware whitespace behavior after the Astro 7 migration.

Changes

Dependencies

• package.json: Upgrade the Astro integration stack and safe direct dependencies, and declare the Node.js runtime requirement.
• pnpm-lock.yaml: Refresh resolved packages for the upgraded dependency graph.
• pnpm-workspace.yaml: Update scoped transitive overrides to patched releases.

Runtime Compatibility

• astro.config.mjs: Preserve the prior HTML compression behavior under Astro 7.

Tooling and Documentation

• biome.json: Track the current Biome schema version.
• README.md: Document the minimum Node.js and pnpm versions.

Security

• Resolve the audited transitive dependency findings with patched js-yaml 4.3.0, SVGO 4.0.2, and sharp 0.35.3.
• Confirm zero production dependency advisories after the migration.

Validation

• Frozen install
• Format check
• Lint
• tsc --noEmit
• 153 tests
• Local database initialization
• Content indexing for 3 of 3 documents
• Production build
• Runtime smoke test
• Senior Astro review
• Independent JavaScript/TypeScript approval

Release

The feat(deps): commit intentionally triggers the automated minor release for version 1.6.0.

Deferred

TypeScript 7 and @types/node 26 remain deferred for separate compatibility work.

This PR supersedes the dependency changes covered by #67, #68, #69, #77, and #78.

Closes #79

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	happy-dom@​20.11.0 ⏵ 20.11.1			+1	+3
	@​radix-ui/​react-dialog@​1.1.20 ⏵ 1.1.21	+1		+1	+1
	lucide-react@​1.25.0 ⏵ 1.26.0	+1		+1	+1
	marked@​18.0.6 ⏵ 18.0.7				-1
	react@​19.2.7 ⏵ 19.2.8
	react-dom@​19.2.7 ⏵ 19.2.8
	@​biomejs/​biome@​2.5.4 ⏵ 2.5.5	+1			+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/vitest@4.1.10 → npm/@vitest/browser@4.1.10 → npm/@tailwindcss/vite@4.3.3 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm happy-dom is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/happy-dom@20.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/happy-dom@20.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.03%. Comparing base (4a5aa56) to head (aef1b4e).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #80      +/-   ##
==========================================
+ Coverage   82.90%   83.03%   +0.12%     
==========================================
  Files          11       11              
  Lines         275      277       +2     
  Branches       70       70              
==========================================
+ Hits          228      230       +2     
  Misses         28       28              
  Partials       19       19              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.