[mverab]

What

Security dependency update for the docs site (site/package-lock.json). It includes every actionable non-major upgrade in that lockfile (9 entries); majors are left out.

	Before	After
Vulnerable entries (osv-scanner)	12	3
Advisories	30	5

Updated: astro 7.1.6 → 7.3.3 · vite 8.2.0 → 8.2.4 · zod 4.4.3 → 4.6.6 · devalue → 5.9.3 · js-yaml → 4.3.2 · svgo → 4.1.0 · smol-toml → 1.9.0 · nanoid → 3.3.18 · source-map-js → 1.2.2

• astro keeps a caret range (^7.0.2 → ^7.3.3).
• Overrides added for transitive packages, all caret-ranged (^<fixed>) so future compatible updates are not blocked. No override changes any package's major.
• New transitive majors come from the upgraded packages themselves, not from overrides: svgo 4.1.0 requires css-select ^6 / css-what ^7; astro 7.3.3 requires diff ^9.

Still open (majors): sharp 0.34.5 → 0.35 (direct dependency), postcss-selector-parser 6 → 7.

Verification

Built by Kimi K3.1 Pro, independently verified with node 22 / npm 10.9.8:

• npm --prefix site ci: OK
• npm --prefix site run build: 21 pages built
• site/verify.sh: OK (content, metadata, sitemap, desktop/mobile overflow)
• osv-scanner before/after: numbers in the table above

Proposed by escudo-360, the owner's dependency-watch tooling (escudo fix --target egeoagents --source site/package-lock.json).

🤖 Generated with Claude Code