[aneesas]

Summary

Fixes the critical Dependabot alert for astro < 7.2.8: a libheif vulnerability in the Sharp image service that can lead to remote code execution when a malicious AVIF image is processed. Astro didn't release a 5.x fix, so this upgrades from 5.18.2 to 7.3.5. That also moves Sharp from 0.34.5 to 0.35.5, above the required 0.35.4. Most of the other open alerts are on the same packages, so this should close them as well.

The site doesn't use Astro's image optimization (<Image>, <Picture>, getImage), so the real risk was low. This removes the vulnerable code anyway.

Changes

Change	Why
astro ^5.2.0 → ^7.3.5, @astrojs/check → ^0.9.10	Security fix
Node 20 → 22 in Dockerfile and deploy.yml	Astro 7 requires Node ≥ 22.12
Add @astrojs/markdown-remark; remark plugins now go through processor: unified({...})	Astro 7's default Markdown processor no longer runs remark plugins
compressHTML: true	Astro 7's new default removes the whitespace between inline elements; this keeps Astro 5's behaviour
Remove url("owl.video.play.png")	The image never existed (it was already a 404), and the new build fails on it
Remove *display / *zoom IE hacks	The new CSS minifier (LightningCSS) rejects them; modern browsers ignore them anyway

Testing

• Built the site on main (Astro 5) and on this branch (Astro 7) in Docker: both produce 266 pages.
• Diffed every HTML page between the two builds. The only differences are:
  • One HTML comment is now kept in the output.
  • A few block tags have a leading space.
  • On /404 and /thanks, data-page-url now ends in .html instead of /. That attribute only drives nav highlighting, and neither page is in the nav.
• astro check reports the same 27 errors before and after. They come from existing table markup in a few .astro pages.

Local dev note: ./serve.sh bind-mounts the old node_modules from your machine, so run docker compose run --rm web npm ci once after pulling.

🤖 Generated with Claude Code