fix(deps): refresh transitive dependencies in the Astro apps

[unional]

Part 2 of 2 for #326. Stacked on #329 — retarget to main once that merges.

What

pnpm update -r within the existing semver ranges. No majors, no behaviour change intended: this moves patch/minor floors that were already satisfiable, and raises the manifest ranges to match what the lockfile now resolves.

astro            5.18.1 -> 5.18.2
vite             6.4.1  -> 6.4.3
postcss          8.4.47/8.5.6/8.5.8 -> 8.5.28
nanoid           3.3.7/3.3.11 -> 3.3.18
js-yaml          4.1.1  -> 4.3.2
devalue          5.6.4  -> 5.9.2
defu             6.1.4  -> 6.1.7
svgo             4.0.1  -> 4.1.0
browserslist     4.28.0 -> 4.28.9
braces           3.0.2  -> 3.0.3
esbuild          0.27.4 -> 0.27.7

The vulnerable brace-expansion, minimatch, cross-spawn, glob and lodash copies drop out of the tree entirely.

Result

pnpm audit: 48 → 10 advisories. That clears every advisory in apps/starlight that was fixable without a major.

What's left, and why it isn't here

All 10 remaining advisories resolve through astro itself and need the 5 → 7 major:

• GHSA-7pw4-f3q4-r2p2 wants astro >=7.0.4; other astro advisories want >=6.3.3, >=6.4.6, >=7.0.6, >=7.1.0
• sharp <0.35.0 (high) — astro 5 pins its own sharp copy, so bumping our direct sharp range doesn't clear it and only duplicates the install. I tried it and reverted it.
• esbuild >=0.27.3 <0.28.1 (low) — pinned by astro's vite

That upgrade deserves its own PR with a real look at the site afterwards.

Verification

pnpm -r build (astro check && astro build) — both apps build, 0 errors. Starlight emits its 17 pages and the Pagefind index as before.

Note minimumReleaseAge: 1440 + minimumReleaseAgeStrict in pnpm-workspace.yaml: every version here is past the 24h soak.

🤖 Generated with Claude Code

https://claude.ai/code/session_011PW5FYJgspbWswo7osD3ys

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7907b98

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request