chore: patch dependency vulnerabilities within existing semver ranges

[0xd3lta]

What

npm audit fix only. package.json is untouched — every update resolved inside the semver ranges already declared, so this is a lockfile-only change.

20 advisories → 4.

Package	From	To
astro	5.16.3	5.18.2
vite	6.4.1	6.4.3
postcss	8.5.6	8.5.28
yaml	2.8.2	2.9.1
js-yaml	4.1.1	4.3.2
devalue	5.6.4	5.9.2
fast-xml-parser	5.4.1	5.11.1
nanoid	3.3.11	3.3.19

This clears the CRITICAL that was live on astro@5.16.3 (remote allowlist bypass via unanchored matchPathname wildcard) and the vite advisories, including the NTLMv2 hash disclosure that affected anyone running npm run dev on Windows.

Output verification

Built main first, snapshotted dist/, then built this branch and diffed the two — normalising content hashes and the per-build astro-island uid.

• 246 files, identical tree; 31 pages both builds
• 20 posts, identical set — nothing dropped or added
• The remotePattern build warning from astro is gone; only our own unused-import warning (ChevronUp, Trash2 in BlogFilter.jsx) remains

Two real output changes, both benign:

1. Typographic quotes now render correctly (14 pages). 5.16.3 emitted mismatched curly quotes — opening a quotation with a closing glyph:

5.16.3:  ”HVNC-” / “CLIENT_ID:HVNC-” / “IDENTIFIER_CHANNEL:“
5.18.2:  “HVNC-” / “CLIENT_ID:HVNC-” / “IDENTIFIER_CHANNEL:”

This is a fix, not a regression.

2. Two same-date posts swapped places (5 pages). Positions 16 and 17 in /blog/ traded:

16  cybersecurity-essentials  ->  pix-gateway-idor
17  pix-gateway-idor          ->  cybersecurity-essentials

Both carry pubDate: 2025-12-22. Five posts share that date, so their relative order is a tie the sort never breaks deterministically — the listing is ordered by pubDate alone. The upgrade just shuffled an already-arbitrary tie. Chronological order and the post set are unchanged.

Worth fixing separately: adding a stable secondary sort key (title or id) would pin the order of tied dates instead of letting it drift on every toolchain change.

What is NOT fixed

Four advisories remain; all need astro@7, a breaking major, and none are reachable here:

Severity	Package	Why it does not apply
CRITICAL	astro	XSS via define:vars and server-island encrypted params. define:vars appears nowhere in src/, and server islands need SSR — there is no output or adapter in astro.config.mjs, so the site builds as pure static
HIGH	sharp	libvips CVEs. Build-time only, over images we author ourselves
LOW	esbuild	Dev server arbitrary file read
LOW	@astrojs/tailwind	Inherited from astro

Astro 7 would also mean migrating off @astrojs/tailwind, which is deprecated there. Not worth it for advisories with no path into a static build — better done when the site needs astro 7 on its own merits.

🤖 Generated with Claude Code