chore(deps): bump docs deps to clear astro/vite/tar/undici/babel CVEs (#357)

[kylehounslow]

What

Clears the high and moderate CVEs on the docs/ manifest (docs/package.json + docs/package-lock.json), staying within astro 6.x. Does not touch docs/starlight-docs (out of scope for this PR).

Changes

docs/package.json:

• astro ^6.1.6 -> ^6.4.6 (resolves 6.4.8)
• overrides: raise undici ^7.24.0 -> ^7.29.0; add tar ^7.5.22, js-yaml ^4.3.0, @babel/core ^7.29.6; add scoped vite ^7.3.6 under astro and @astrojs/react

Resolved versions: astro 6.4.8, vite 7.3.6 (single deduped copy), tar 7.5.22, undici 7.29.0, js-yaml 4.3.0, @babel/core 7.29.7, yauzl 3.4.0 (via the existing override), postcss 8.5.23.

CVEs closed

• astro: CVE-2026-54299, CVE-2026-54298 (fixed in astro 6.4.6, within 6.x)
• vite: GHSA-fx2h-pf6j-xcff (server.fs.deny bypass), GHSA-v6wh-96g9-6wx3 (launch-editor NTLMv2 disclosure)
• astro-icon build chain: undici GHSA-38rv-x7px-6hhq and related (CVE-2026-9675, CVE-2026-12151, CVE-2026-9697, CVE-2026-6734, CVE-2026-9678, CVE-2026-9679); tar
• @astrojs/react -> @babel/core (CVE-2026-9358 class)
• extract-zip: its vulnerable child yauzl was already overridden to ^3.2.1; extract-zip is no longer flagged

Why the vite override

astro 6.4.x requires vite ^7.3.2, which resolves to 7.3.3, below the 7.3.6 fixed floor. A lockfile-only bump would regress on the next dependabot regen, so the fix is pinned in overrides scoped to astro and @astrojs/react. The top-level vite (via @tailwindcss/vite) stays on the 8.x line, above the fixed floor. No global vite override, so the 8.x tree is not downgraded.

Left open (astro 7 only)

Five advisories remain and require the astro 7 major, out of scope for this non-breaking pass: GHSA-4g3v-8h47-v7g6, GHSA-7pw4-f3q4-r2p2, GHSA-f48w-9m4c-m7f5, plus astro's nested esbuild (GHSA-g7r4-m6w7-qqqr) and sharp (GHSA-f88m-g3jw-g9cj). Note: GHSA-f48w-9m4c-m7f5 is a distinct follow-up advisory (range <7.0.6) whose title reads "incomplete fix for CVE-2026-54298"; the original CVE-2026-54298 is cleared by 6.4.6. Tracked separately for the astro 7 major upgrade.

Validation

Mirrors docs-ci.yml:

• npm ci clean (lockfile in sync with manifest)
• npm run build:main succeeds on astro 6.4.8 / vite 7.3.6
• npm run test:coverage: 557 passed
• npm audit --omit=dev: 3 vulnerabilities remain, all the astro-7-only advisories above

CI (ubuntu-latest) runs the native rollup path.

Refs #357

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.62%. Comparing base (782b129) to head (8653c85).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #360   +/-   ##
=======================================
  Coverage   55.62%   55.62%           
=======================================
  Files           4        4           
  Lines         169      169           
  Branches       47       47           
=======================================
  Hits           94       94           
  Misses         74       74           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.