chore(deps): fix Dependabot alerts

[devin-ai-integration]

Summary

Resolves all 18 open Dependabot alerts across both npm lockfiles via real upgrades (no overrides needed).

Root (package.json / package-lock.json)

• vitest ^4.1.7 → ^4.1.11 (lock 4.1.11) — GHSA-82fw-gwwq-j7x9 (also fixes transitive @vitest/mocker 4.1.11)
• postcss transitive → 8.5.28 — GHSA-fxqj-rqcc-2cmp

Website (website/package.json / website/package-lock.json)

• astro ^7.1.4 → ^7.3.2 (lock 7.3.2; 7.3.3 skipped as <7 days old) — GHSA-26w7-cxv4-gfx2 (critical), GHSA-376h-93r7-7g6f
• mermaid ^11.16.0 → ^11.17.2 — GHSA-c4c3-pg64-4m4v, GHSA-2v8p-3f2j-5mp7, GHSA-6x64-9x62-f2gx, GHSA-3rrr-jr9j-h3q3, GHSA-rhh3-jpg6-66xh (stayed on 11.x; 12.0.0 is a fresh major)
• sharp ^0.35.0 → ^0.35.4 — GHSA-rgj7-g3m4-5g8c
• @astrojs/starlight ^0.41.4 → ^0.41.11 (stayed on 0.41.x)
• Transitives now at: devalue 5.9.2, dompurify 3.4.15, js-yaml 4.3.2, nanoid 3.3.19, svgo 4.1.0

Removed the pnpm.overrides block from website/package.json: the website is installed with npm (package-lock.json, npm ci in pages.yml), so npm silently ignored it and it had no effect. With the bumps above every package it targeted resolves at/above the pinned range naturally, so it was not converted to npm overrides.

Remaining/unfixable alerts: none.

Verified locally with Node 22 / npm 11: root npm ci && npm run typecheck && npm test && npm run build (58 tests pass), website npm ci && npm run build (16 pages). Note: npm 10.9.3 crashes with Cannot read properties of null (reading 'edgesOut') when resolving vitest 4.1.11's peer set — npm 11 works; CI uses actions/setup-node Node 22 whose bundled npm 10 only runs npm ci against the committed lockfile, which doesn't hit that path.

Link to Devin session: https://app.devin.ai/sessions/ee0d39393c0245f684225cb3c26e1401
Open in Devin Desktop: https://app.devin.ai/desktop/session/ee0d39393c0245f684225cb3c26e1401?variant=devin
Requested by: @BYK

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-09-17 22:53 UTC