Resolve Dependabot alerts via coordinated Astro 6.4 + Starlight 0.41 upgrade

[thinmintdev]

Summary

GitHub reports 15 Dependabot alerts (6 high, 6 moderate, 3 low) across astro, undici, vite, and tar. Investigated on master — none are runtime-exploitable on the deployed static site; all are build-/dev-time only. Fixing them cleanly is not an in-range bump: it requires a coordinated Astro + Starlight upgrade (see below).

Why they're low real-world risk

Site is static output (no SSR adapter; Cloudflare Pages + functions/_middleware.ts). The vulnerable code never ships or runs at request time:

Package	Alerts	Source	Runtime risk
undici	7 (3 high)	astro-icon → @iconify/tools → cheerio — build-time icon tooling	none (not in output)
tar	1 (mod)	astro-icon → @iconify/tools — build-time	none
vite	2 (1 high)	build/dev server; both bugs Windows-only, dev-only	negligible (Linux, not deployed)
astro	4 (2 high)	framework 6.3.3	build-time HTML gen; the Host-header SSRF is an SSR path, neutralized by static output

Why there's no clean patch

• The astro CVEs need astro ≥ 6.4.6. But @astrojs/starlight@0.39.2 pins @astrojs/markdown-remark@7.1.2, while astro@6.4.8 needs 7.2.0. npm hoists 7.1.2 to top level, so astro resolves the wrong copy and the build fails:
  The requested module '@astrojs/markdown-remark' does not provide an export named 'unified' (astro/dist/runtime/prerender/static-paths.js).
• Even plain npm audit fix (no --force) pulls astro→6.4.8 within ^6.3.1 and triggers this break.
• The remaining 3 alerts live in starlight-blog@0.21.0's nested @astrojs/mdx@4 → astro@5.18.2. Clearing them needs starlight-blog@0.27.0, which requires @astrojs/starlight ≥ 0.41.0.
• undici/tar/vite fixes are dragged in by the same astro bump, so they're coupled to this upgrade too.

Required work (coordinated upgrade)

Bump together, off master:

• astro → ^6.4.8
• @astrojs/starlight → ≥ 0.41 (aligns @astrojs/markdown-remark to 7.2.0)
• @astrojs/mdx, @astrojs/sitemap → matching
• starlight-blog → ^0.27.0
• then npm audit fix for any residual undici/tar/vite

Verification checklist

• npm run build succeeds
• npm audit → 0 (or only accepted) vulnerabilities
• Docs pages render (Starlight sidebar, search, code blocks, callouts)
• Blog renders (starlight-blog 0.21→0.27 may change config/frontmatter/layout — check post list + a post)
• Landing page (index.astro) unaffected — incl. the operator-console gallery
• OG images / sharp pipeline still build

Notes

Not urgent (zero runtime exposure) — schedule as a deliberate dependency upgrade, not a hotfix. Attempted a simple in-range patch; reverted because it breaks the build without the Starlight bump.