Upgrade Astro to 7.4 and add basic security settings

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      npm:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]

.github/workflows/deploy.yml

@@ -17,11 +17,14 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    # npm ci and the build run third-party code; the deploy scopes stay with the deploy job.
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: npm
       - run: npm ci
       - run: npm run build

.github/workflows/pr-build.yml

@@ -0,0 +1,22 @@
+name: Build check
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npm run build

README.md

@@ -13,6 +13,8 @@ Public website for the [Interra Project](https://interra-project.org), built wit
 
 ## Develop
 
+Requires Node 22.23.4 or newer.
+
 ```bash
 npm install
 npm run dev      # local dev server

astro.config.mjs

@@ -2,6 +2,10 @@
 import { defineConfig } from 'astro/config';
 import sitemap from '@astrojs/sitemap';
 
+// CSS for Safari 14+ as well: Vite 8 targets Safari 16.4+ by default and rewrites
+// max-width media queries into range syntax, which older Safari ignores.
+const cssTarget = ['chrome87', 'edge88', 'firefox78', 'safari14'];
+
 // Public site served at the apex domain (CNAME -> interra-project.org).
 // No base path: the site lives at the domain root.
 export default defineConfig({
@@ -11,4 +15,7 @@ export default defineConfig({
   build: {
     format: 'directory',
   },
+  vite: {
+    build: { cssTarget },
+  },
 });